# BookStack v26.05.5: 304 tests pass, 269 refused to the wrong user

featkpr ran on its own copy of BookStack v26.05.5: it read the code, opened the screens, wrote tests, and sent each test again as a user without permission.

BookStack v26.05.5 · figures of 27 Sep 2026 · commit 0f5164ec · by Tim Derzhavets. Source: featkpr's own records, copied here on 27 Sep 2026.

## The code: 343 routes read, 307 features named

featkpr read BookStack's routes, handlers and permission checks at one commit, then named 307 features in 12 modules from them.

## The crawl: 167 screens opened, 8 forms sent

A throwaway copy, signed in as the admin. Every screen it opened is kept as a picture beside the path that reaches it.

## The paths: 163 drafted to 69 goals

Each path is a way a person reaches a goal, with its screens and its checks. A person keeps or drops each one; 161 are waiting.

## The tests: 304 pass, and 269 are refused to the wrong user

The tests are written from the map, per route and per role, none by hand: 481 so far. The last run, on 26 Sep 2026, 17:42 UTC, ran the 304 that were ready then, and all passed. Each one that has a user without permission was sent again as that user, and the app refused it 269 times. 35 are unchecked: BookStack has no user without that permission to try them as yet.

## What featkpr missed: 605 of 2,372

This is a separate check. featkpr onboarded BookStack again from an empty start on 26 Sep 2026 and compared each step with an answer key it never sees. That run is smaller than the one above, so its counts differ; the table lists what it missed, step by step.

## What this report does not claim

These tests call the app directly, without a browser; browser journeys come next. It shows no caught bug: every test passed on today's BookStack. What the wrong-user check shows is that each checked test would fail if its permission check went missing. We are not affiliated with BookStack.

## One path, as a receipt: Create a book

BookStack v26.05.5 · crawl of 25 Sep 2026 · commit 0f5164ec · signed in as Admin

1. `GET /`: Start on the home page. Do: Follow “Books”. Check: lands on /books; its heading reads “Books”.
2. `GET /books`: Open the new-book form. Do: Follow “Create New Book”. Check: lands on /create-book; its heading reads “Create New Book”.
3. `GET /create-book`: Fill the form and save. Do: Type the Name (required); Description (optional); Cover image (optional); Book Tags (optional); Press “Save Book”. Check: lands on /books/{slug}; its heading reads the Name typed; it shows the Name typed; without a Name it is refused: “The name field is required.”.
4. `GET /books/{slug}`: The new book's page. Do: the result. Check: reaches /books/{slug}; never stops before it.
5. Your verdict: Keep it and its 10 checks become the path's test. Drop it and it is never offered again. (tests from this path: none yet)

## The totals

- 307 features in 12 modules, from 343 routes
- 163 paths to 69 goals; 161 wait on a person
- 481 tests written; 304 run and pass (0 failed); 269 refused to the wrong user

## What it missed

Audit of 26 Sep 2026 (0f5164ec · recorded admin crawl): 605 missed of 2,372, 592 of them ours.

| Stage | Gathered | Of | Missed here | Lost earlier |
|---|---|---|---|---|
| extract | 343 | 359 | 16 | 0 |
| gates | 193 | 194 | 1 | 0 |
| naming | 356 | 587 | 231 | 0 |
| crawl | 96 | 198 | 102 | 0 |
| screens | 77 | 137 | 5 | 55 |
| forms | 62 | 93 | 19 | 12 |
| submits | 4 | 87 | 52 | 31 |
| flows | 141 | 191 | 24 | 26 |
| tree | 86 | 404 | 112 | 206 |
| tests | 76 | 86 | 10 | 0 |
| entities | 3 | 9 | 6 | 0 |
| effects | 0 | 27 | 27 | 0 |

How it was made: featkpr publishing protocol, draft of 27 Sep 2026. featkpr is not affiliated with BookStack.

---

The page this twin stands for: https://featkpr.com/library/bookstack/reports/2026-09-26-v26-05-5. Every page on this site has a `.md` twin, and answers `Accept: text/markdown`.