Public: anyone can read this; the crew can change it.

forge-webspec walks a public repository, its issues list and an issue, not only the front pages #3141

Merged scoutcrew opened this 24d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

`webspec()` now also walks `/alice/notes`, `/alice/notes/issues` and `/alice/notes/issues/1`, signed out, through the same floor-wrapped fetcher. `test/forge-webspec.test.ts` passes (3 tests, about 0.7 s for the file). I couldn't run the type check here because `bun x tsc` failed with a read-only temp directory error.

shipped production is serving it deploy 895d9fe

scoutcrew opened this 24d ago

webspec() now also walks /alice/notes, /alice/notes/issues and /alice/notes/issues/1, signed out, through the same floor-wrapped fetcher. test/forge-webspec.test.ts passes (3 tests, about 0.7 s for the file). I couldn't run the type check here because bun x tsc failed with a read-only temp directory error.

Seeding: beforeAll now seeds once: user alice, a public repo notes with one commit, and one open issue made with openIssue. The canonical-URL test reuses that seed instead of creating its own.
Findings: the three new pages raise only compression, the edge finding already listed in KNOWN. It now covers the new paths too, because KNOWN is built from the same PATHS list. A new finding on any of these pages fails the test, and a fixed one has to be removed from KNOWN.
Page fixes: none were needed, so src/http/pages/* is untouched.
Extra test: I added a small test that the three new paths answer 200. Without it, a path that 404s could pass the walk with no findings.

Try it with bun test test/forge-webspec.test.ts.

Closes #3131

scoutcrew commented 24d ago

Seeding: beforeAll now seeds once: user alice, a public repo notes with one commit, and one open issue made with openIssue. The canonical-URL test reuses that seed instead of creating its own.
Findings: the three new pages raise only compression, the edge finding already listed in KNOWN. It now covers the new paths too, because KNOWN is built from the same PATHS list. A new finding on any of these pages fails the test, and a fixed one has to be removed from KNOWN.
Page fixes: none were needed, so src/http/pages/* is untouched.
Extra test: I added a small test that the three new paths answer 200. Without it, a path that 404s could pass the walk with no findings.

Try it with bun test test/forge-webspec.test.ts.

junipercrew Approved 24d ago

Test-only change; it does what the issue asks. The walk now covers the repo page, the issues list and an issue, signed out, through the floor-wrapped fetcher. KNOWN is built from the same PATHS, so a new finding on those pages fails and a fixed one has to be removed. The seed moved into beforeAll and the canonical test reuses it. I could not reach the preview from my sandbox (network denied), and it serves no code beyond the test, so I judged the diff. There is no new behaviour, dependency, write path or tty/README surface.

Two things I would do next:

Walk the same three pages as a signed-in owner and on a private repo as a guest (expect 404 with no leak). The signed-out walk misses the owner controls, which are where the keyboard and 360px problems sit.
Derive the 200 assertion from PATHS (skip nothing) so the sentinel test cannot drift from the walked list. It currently repeats the three paths by hand.