[cristim]

Summary

Repairs the pre-existing test failures that make a pristine checkout of feat/multicloud-web-frontend red, so every open PR stops inheriting an UNSTABLE base. Fixed in one focused commit; CSRF logic and CSRF/login security behavior are untouched.

Closes #993.

Fixes

1. internal/server TestAuthServiceAdapter_ValidateCSRFToken (base flake, was red)

Root cause: createMockAuthService built the service via auth.NewService without a CSRFKey, so NewService generated a random ephemeral key on every run. The test then asserted that the literal "csrf-token" validates, but ValidateCSRFToken recomputes the expected token as HMAC-SHA256(csrfKey, rawSessionToken), which a random key can never make equal to a fixed literal. It only ever "passed" if an ambient CSRFKey happened to derive that value, which a clean checkout never has.

Fix (test-side, hermetic): pin a deterministic key via a new exported auth.TestCSRFKey() and assert the real derived token via a new auth.DeriveTestCSRFToken() (which reuses the production deriveCSRFToken, no crypto duplication). The actual CSRF validation logic is unchanged; the test now exercises the real end-to-end path deterministically.

2. frontend utils.test.ts formatDate / getDateParts (base flake, was red outside UTC)

Root cause (genuine code bug, not just a test-env assumption): a date-only string like "2024-03-15" is parsed by new Date() as UTC midnight, then toLocaleDateString / getDate() shifts it into the browser's local timezone, so any user west of UTC saw the previous day ("Mar 14") for dates the backend means as plain calendar days (purchase scheduled_date, reservation end_date, etc.). The test only passed in a UTC runner.

Fix (code-side, root cause): parse bare "YYYY-MM-DD" as local midnight via a new parseDateInput helper, with round-trip validation so out-of-range digits ("2024-13-45") still reject as invalid instead of silently rolling over. Full timestamps (...T..:..Z) and Date objects are left untouched (formatDateTime / formatRelativeTime keep their time-of-day behavior). Added timezone-invariance regression tests; the full frontend suite (2510 tests, 74 suites) passes in UTC, America/Los_Angeles, Asia/Tokyo, and America/New_York.

3. internal/auth TestLogin_WithMFA_NoSecret (#993 - already resolved on base)

#993 no longer reproduces on the current base: service.go already routes every login-failure branch (unknown email, store error, inactive/locked account, wrong password, MFA-secret anomaly) through the single genericLoginError constant "Check your email address and password and try again". Unknown-email and wrong-password therefore return a byte-identical message, preserving the anti-enumeration property the test guards. Both subcases pass. A previously-merged PR fixed it; this PR closes the issue alongside the remaining base-CI repairs.

Verification

• go build ./... — success
• go test ./internal/auth/... ./internal/server/... — 909 passed
• npx tsc --noEmit (frontend) — clean
• jest full frontend suite — 2510 passed / 1 skipped across UTC, LA, Tokyo, NY timezones
• Each previously-failing test confirmed red on pristine base before the fix and green after.

[cristim]

@coderabbitai review

[coderabbitai]

Warning

Review limit reached

@cristim, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 40 minutes and 17 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 67589be1-02e1-4f66-a9ac-0bbeed09e365

📥 Commits

Reviewing files that changed from the base of the PR and between c7448ca and ecdd1bd.

📒 Files selected for processing (4)

• frontend/src/__tests__/utils.test.ts
• frontend/src/utils.ts
• internal/auth/test_helpers.go
• internal/server/adapter_test.go

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/base-ci-flakes

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.