featkpr Private demo

Library / BookStack / report

BookStack v26.05.5: 304 tests pass, 269 refused to the wrong user

featkpr ran on its own copy of BookStack v26.05.5: it read the code, opened the screens, wrote tests, and sent each test again as a user without permission.

BookStack v26.05.5 · figures of 27 Sep 2026 · commit 0f5164ec · by Tim Derzhavets

  1. code read 343routes
  2. features named 307features
  3. screens crawled 167screens
  4. paths drafted 163paths
  5. tests run 304pass
  6. wrong-user check 269refused to the wrong user
featkpr's Runs screen for BookStack: every test in the last run, with the wrong-user check for eachRuns, in featkpr: every test, what it sent, what came back

One journey it drafted: create a book, screen by screen

Create a book

a goal featkpr drafted, from HomeBookStack v26.05.5 · crawl of 25 Sep 2026 · commit 0f5164ec · signed in as Admin
GET /

Start on the home page

  • Follow “Books”
  • lands on /books
  • its heading reads “Books”
screen captured by the crawl
GET /books

Open the new-book form

  • Follow “Create New Book”
  • lands on /create-book
  • its heading reads “Create New Book”
screen captured by the crawl
GET /create-book

Fill the form and save

  • Type the Namerequired
  • Descriptionoptional
  • Cover imageoptional
  • Book Tagsoptional
  • Press “Save Book”
  • lands on /books/{slug}
  • its heading reads the Name typed
  • it shows the Name typed
  • without a Name it is refused: The name field is required.
form filled and sent by the crawl
GET /books/{slug}

The new book's page

  • reaches /books/{slug}
  • never stops before it
a book's page, captured by the crawl
your verdict

Waiting on a person

Keep it and its 10 checks become the path's test. Drop it and it is never offered again.

tests from this path: none yet
4 screens7 actions, 3 optional10 checks1 refusal0 tests yet1 decision waiting

Every word on the receipt is what featkpr stored for this path. Nothing was written for this page.

The code: 343 routes read, 307 features named

featkpr read BookStack’s routes, handlers and permission checks at one commit, then named 307 features in 12 modules from them.

The crawl: 167 screens opened, 8 forms sent

A throwaway copy, signed in as the admin. Every screen it opened is kept as a picture beside the path that reaches it.

The paths: 163 drafted to 69 goals

Each path is a way a person reaches a goal, with its screens and its checks. A person keeps or drops each one; 161 are waiting.

The tests: 304 pass, and 269 are refused to the wrong user

The tests are written from the map, per route and per role, none by hand: 481 so far. The last run, on 26 Sep 2026, 17:42 UTC, ran the 304 that were ready then, and all passed. Each one that has a user without permission was sent again as that user, and the app refused it 269 times. 35 are unchecked: BookStack has no user without that permission to try them as yet.

What featkpr missed: 605 of 2,372

This is a separate check. featkpr onboarded BookStack again from an empty start on 26 Sep 2026 and compared each step with an answer key it never sees. That run is smaller than the one above, so its counts differ; the table lists what it missed, step by step.

What this report does not claim

These tests call the app directly, without a browser; browser journeys come next. It shows no caught bug: every test passed on today’s BookStack. What the wrong-user check shows is that each checked test would fail if its permission check went missing. We are not affiliated with BookStack.

One test, word for word

  1. sign in
  2. open the shelf
  3. send the new book
as an Editorallowed to create bookspassed302, on to the shelf
as a readercan read, can't createrefused, as it should besent back to the home page
One test, run twice: it passes for the Editor and is refused to the reader.BookStack · a recorded run of 26 Sep 2026 (a fixture, not the production run) · Entities · POST /shelves/{shelfSlug}/create-book

The totals

307features named from the code, in 12 modulesfrom 343 routes read at the commit
see the Features screensee the Features screen
163paths drafted to 69 goals, each a receipt like the one aboveone crawl · 167 screens · 8 forms sent
see every path from Homesee every path from Home
481tests written from the map so farper route, per role · none written by hand
see the Runs screensee the Runs screen
304ran in the last run, and all passedrun of 26 Sep 2026, 17:42 UTC · 0 failed
see the verdictsee the verdict
269refused when sent again as a user without permissionwith permission · passes→without · refused35 unchecked: no user without that permission to try them as yet
161journeys wait for a person to keep or drop themnothing is tested from a journey until it is kept

● a fact featkpr holds · ○ waiting on a person · copied from featkpr's own records on 27 Sep 2026

What it missed, step by step

BookStack · audit of 26 Sep 2026 · 0f5164ec · recorded admin crawl · 605 missed of 2,372, 592 of them ours

Routesagainst the route list 343 of 35916 missed here
Permission checkshandlers and middleware 193 of 1941 missed here
Features namedagainst what the routes cite 356 of 587231 missed here
Pages reachedevery GET route 96 of 198102 missed here
Screens capturedevery GET route 77 of 1375 missed here · 55 lost earlier
Forms foundthe templates' forms 62 of 9319 missed here · 12 lost earlier
Forms sentgoals behind a button 4 of 8752 missed here · 31 lost earlier
Flowsentry to target, per role 141 of 19124 missed here · 26 lost earlier
Scenario leaveswhat each gate owes 86 of 404112 missed here · 206 lost earlier
Tests writtenone per stored leaf 76 of 8610 missed here
Seeded recordsthe target's own constants 3 of 96 missed here
Effects seenmail, downloads, off-host calls 0 of 2727 missed here

gatheredmissed, each with the stage that lost it and why

How this report was made

featkpr publishing protocol, draft of 27 Sep 2026. featkpr ran on our own copy of BookStack v26.05.5, never on anyone else's server, with users we seeded ourselves. Anything that passed as the wrong user is triaged by a person before it is published; a suspected bug goes to the maintainers privately first.

featkpr is not affiliated with BookStack. Ask for a correction or a removal at /removal.

See this run live, on a call

Tim walks you through BookStack in featkpr and answers your questions first.

Ask for a private demo