fix: review round 4 — an account switch unloads as the old account, a share link's lockout costs five networks

Deep-review round 4, targeted at round 3's changes (f569b19c..e7f38396). Accounts - Switching, adding or signing out an account moved the tab's pin before the page unloaded, so the players' resume beacons fired on the way out under the NEW account: one account's playback position saved into the other. The pin is now handed to the next page (pinOnNextPage) and taken over at import; clearActiveAccount is gone. - Switching to a suspended account was refused but left it in the switcher, refused on every click; a deactivated one was not refused at all, and made the default it signed every account in the browser out on the next request. Every account _session_user would refuse — gone, deactivated, suspended, revoked — is refused and dropped from the list. Share page (/watch) - An IPv6 client is limited by its /64 (client_ip becomes client_key, for every limiter): keyed on the full address, one subscriber could rotate through endless identities. The comments now state what the per-link ceiling costs: guessing from five networks can keep a link shut for its window, and guesses already running when it fills are still checked. - The link is looked up before the limiter records the attempt, so made-up tokens no longer grow it by an entry each. Forms - Failing the same way twice is announced again: the sign-in, passphrase and setup errors are keyed on the attempt (a clear and a set in one handler left the alert node untouched). - The install wizard's own validation showed the generic error — it threw plain objects its catch did not read. It sets the step's message. Tests: a re-pin leaving the previous account's notices behind; the pin hand-over; switching to an ended account; the /64 viewer; made-up tokens; the repeated alerts. Each mutation-checked RED for its own reason.
2026-09-15 02:53:22 +02:00
parent e7f38396a2
commit 47d968eeea
18 changed files with 316 additions and 76 deletions
@@ -0,0 +1,91 @@
+// @vitest-environment jsdom
+//
+// A form's error is announced (role="alert"), and failing the same way again must be announced again. The
+// clear and the set of a validation failure commit together, so the alert node used to stay untouched on
+// the second attempt and a screen reader said nothing — a press that seemed to do nothing.
+//
+// i18n is mocked to a key-passthrough; the API and the E2EE module are stubbed so nothing reaches out.
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { cleanup, fireEvent, render, screen } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return {
+    ...actual,
+    useTranslation: () => ({ t: (key: string) => key, i18n: { language: "en" } }),
+  };
+});
+
+vi.mock("../lib/api", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../lib/api")>();
+  return {
+    ...actual,
+    api: {
+      ...actual.api,
+      authConfig: () => Promise.resolve({ google_enabled: false }),
+      messageMyKey: () => Promise.resolve({ configured: true }),
+      me: () => Promise.resolve({ authenticated: false }),
+      setupInfo: () => Promise.resolve({ secrets_manageable: false }),
+    },
+  };
+});
+
+vi.mock("../lib/e2ee", () => ({ unlock: vi.fn(), setup: vi.fn(), clearDevice: vi.fn() }));
+
+import KeyGate from "./KeyGate";
+import SetupWizard from "./SetupWizard";
+import Welcome from "./Welcome";
+
+afterEach(() => {
+  cleanup();
+  window.history.replaceState(null, "", "/");
+});
+
+// Fails twice the same way; the second alert must be a new node carrying the same message.
+async function failTwice(fail: () => void, message: string) {
+  fail();
+  const first = await screen.findByRole("alert");
+  expect(first.textContent).toBe(message);
+  fail();
+  const second = screen.getByRole("alert");
+  expect(second.textContent).toBe(message);
+  expect(second).not.toBe(first);
+}
+
+describe("a form failing the same way twice announces it twice", () => {
+  it("the message passphrase gate", async () => {
+    render(
+      <QueryClientProvider client={new QueryClient()}>
+        <KeyGate meId={1} />
+      </QueryClientProvider>,
+    );
+    const unlock = await screen.findByText("messages.unlock");
+    fireEvent.change(screen.getByPlaceholderText("messages.passphrase"), {
+      target: { value: "abc" },
+    });
+    await failTwice(() => fireEvent.click(unlock), "messages.passTooShort");
+  });
+
+  it("the sign-in card", async () => {
+    render(
+      <Welcome verify={{ outcome: null, email: null, resetPending: false, dismiss: () => {} }} />,
+    );
+    const email = await screen.findByPlaceholderText("welcome.auth.email");
+    fireEvent.change(email, { target: { value: "not-an-address" } });
+    await failTwice(() => fireEvent.submit(email.closest("form")!), "welcome.auth.invalidEmail");
+  });
+
+  it("the install wizard, with the step's own message rather than the generic one", async () => {
+    window.history.replaceState(null, "", "/?token=setup-token");
+    render(<SetupWizard />);
+    fireEvent.click(await screen.findByText("setup.nav.next")); // past the intro
+    fireEvent.change(await screen.findByPlaceholderText("setup.admin.email"), {
+      target: { value: "not-an-address" },
+    });
+    await failTwice(
+      () => fireEvent.click(screen.getByText("setup.nav.next")),
+      "setup.admin.invalidEmail",
+    );
+  });
+});