peter
47d968eeea
Deep-review round 4, targeted at round 3's changes (f569b19c..e7f38396). Accounts - Switching, adding or signing out an account moved the tab's pin before the page unloaded, so the players' resume beacons fired on the way out under the NEW account: one account's playback position saved into the other. The pin is now handed to the next page (pinOnNextPage) and taken over at import; clearActiveAccount is gone. - Switching to a suspended account was refused but left it in the switcher, refused on every click; a deactivated one was not refused at all, and made the default it signed every account in the browser out on the next request. Every account _session_user would refuse — gone, deactivated, suspended, revoked — is refused and dropped from the list. Share page (/watch) - An IPv6 client is limited by its /64 (client_ip becomes client_key, for every limiter): keyed on the full address, one subscriber could rotate through endless identities. The comments now state what the per-link ceiling costs: guessing from five networks can keep a link shut for its window, and guesses already running when it fills are still checked. - The link is looked up before the limiter records the attempt, so made-up tokens no longer grow it by an entry each. Forms - Failing the same way twice is announced again: the sign-in, passphrase and setup errors are keyed on the attempt (a clear and a set in one handler left the alert node untouched). - The install wizard's own validation showed the generic error — it threw plain objects its catch did not read. It sets the step's message. Tests: a re-pin leaving the previous account's notices behind; the pin hand-over; switching to an ended account; the /64 viewer; made-up tokens; the repeated alerts. Each mutation-checked RED for its own reason.
92 lines
3.4 KiB
TypeScript
92 lines
3.4 KiB
TypeScript
// @vitest-environment jsdom
|
|
//
|
|
// A form's error is announced (role="alert"), and failing the same way again must be announced again. The
|
|
// clear and the set of a validation failure commit together, so the alert node used to stay untouched on
|
|
// the second attempt and a screen reader said nothing — a press that seemed to do nothing.
|
|
//
|
|
// i18n is mocked to a key-passthrough; the API and the E2EE module are stubbed so nothing reaches out.
|
|
import { afterEach, describe, expect, it, vi } from "vitest";
|
|
import { cleanup, fireEvent, render, screen } from "@testing-library/react";
|
|
import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
|
|
|
|
vi.mock("react-i18next", async (importOriginal) => {
|
|
const actual = await importOriginal<typeof import("react-i18next")>();
|
|
return {
|
|
...actual,
|
|
useTranslation: () => ({ t: (key: string) => key, i18n: { language: "en" } }),
|
|
};
|
|
});
|
|
|
|
vi.mock("../lib/api", async (importOriginal) => {
|
|
const actual = await importOriginal<typeof import("../lib/api")>();
|
|
return {
|
|
...actual,
|
|
api: {
|
|
...actual.api,
|
|
authConfig: () => Promise.resolve({ google_enabled: false }),
|
|
messageMyKey: () => Promise.resolve({ configured: true }),
|
|
me: () => Promise.resolve({ authenticated: false }),
|
|
setupInfo: () => Promise.resolve({ secrets_manageable: false }),
|
|
},
|
|
};
|
|
});
|
|
|
|
vi.mock("../lib/e2ee", () => ({ unlock: vi.fn(), setup: vi.fn(), clearDevice: vi.fn() }));
|
|
|
|
import KeyGate from "./KeyGate";
|
|
import SetupWizard from "./SetupWizard";
|
|
import Welcome from "./Welcome";
|
|
|
|
afterEach(() => {
|
|
cleanup();
|
|
window.history.replaceState(null, "", "/");
|
|
});
|
|
|
|
// Fails twice the same way; the second alert must be a new node carrying the same message.
|
|
async function failTwice(fail: () => void, message: string) {
|
|
fail();
|
|
const first = await screen.findByRole("alert");
|
|
expect(first.textContent).toBe(message);
|
|
fail();
|
|
const second = screen.getByRole("alert");
|
|
expect(second.textContent).toBe(message);
|
|
expect(second).not.toBe(first);
|
|
}
|
|
|
|
describe("a form failing the same way twice announces it twice", () => {
|
|
it("the message passphrase gate", async () => {
|
|
render(
|
|
<QueryClientProvider client={new QueryClient()}>
|
|
<KeyGate meId={1} />
|
|
</QueryClientProvider>,
|
|
);
|
|
const unlock = await screen.findByText("messages.unlock");
|
|
fireEvent.change(screen.getByPlaceholderText("messages.passphrase"), {
|
|
target: { value: "abc" },
|
|
});
|
|
await failTwice(() => fireEvent.click(unlock), "messages.passTooShort");
|
|
});
|
|
|
|
it("the sign-in card", async () => {
|
|
render(
|
|
<Welcome verify={{ outcome: null, email: null, resetPending: false, dismiss: () => {} }} />,
|
|
);
|
|
const email = await screen.findByPlaceholderText("welcome.auth.email");
|
|
fireEvent.change(email, { target: { value: "not-an-address" } });
|
|
await failTwice(() => fireEvent.submit(email.closest("form")!), "welcome.auth.invalidEmail");
|
|
});
|
|
|
|
it("the install wizard, with the step's own message rather than the generic one", async () => {
|
|
window.history.replaceState(null, "", "/?token=setup-token");
|
|
render(<SetupWizard />);
|
|
fireEvent.click(await screen.findByText("setup.nav.next")); // past the intro
|
|
fireEvent.change(await screen.findByPlaceholderText("setup.admin.email"), {
|
|
target: { value: "not-an-address" },
|
|
});
|
|
await failTwice(
|
|
() => fireEvent.click(screen.getByText("setup.nav.next")),
|
|
"setup.admin.invalidEmail",
|
|
);
|
|
});
|
|
});
|