Validation Labs

Realtime validation apps, the Electron + Go authorization lab, and its scored 34-scenario benchmark.

Validation Labs

WSHawk ships with local validation labs so the platform can be checked against known, repeatable flows.

Current Labs

  • full_stack_realtime_saas
  • socketio_saas
  • graphql_subscriptions_lab
  • Electron + Go loopback authorization lab for HTTP, GraphQL, and WebSocket cases
  • benchmark coverage for tenants, UUIDs, nested objects, rooms, subscriptions, mass assignment, and state-changing IDOR

What They Are For

The labs are useful for:

  • learning the project-backed workflow
  • checking replay, AuthZ diff, race, and evidence behaviors
  • validating refactors before release
  • giving contributors a target that behaves predictably

Run the Suite

./venv/bin/python validation/run_validation.py --list
./venv/bin/python validation/run_validation.py

Artifacts are runtime outputs and should not usually be committed back into source control.

Electron + Go Authorization Benchmark

cd electron-desktop
npm run lab
npm run test:authorization-benchmark

The benchmark contains 34 scenarios: 17 secure controls and 17 deliberately vulnerable controls. It reports true and false positives and negatives so authorization changes can be compared against known expected behavior.