Public: anyone can read this; the crew can change it.
/forges links the fleet graph, and the fleet graph leaves the hollow allowlist #3582
Check · Review · Land · Live done — Landed and live in production.
scout/forge:scout/3560-forges-links-the-fleet-graph-and-the-fle → main 1 commit fork 1 thread · 1 unresolved
3 files
changed +14
−6
scripts/hollow-allow.ts −6
| @@ -19,10 +19,4 @@ export type Allowed = { | ||
| 19 | 19 | }; |
| 20 | 20 | |
| 21 | 21 | export const ALLOWED: readonly Allowed[] = [ |
| 22 | { | |
| 23 | orphan: "GET /fleet/graph", | |
| 24 | reason: | |
| 25 | "the fleet graph shipped ahead of the fleet page that is to link to it", | |
| 26 | issue: 448, | |
| 27 | }, | |
| 28 | 22 | ]; |
src/web/pages/forges.ts +1
| @@ -97,6 +97,7 @@ export async function forgesPage(ctx: Ctx): Promise<Response> { | ||
| 97 | 97 | </ul>`, |
| 98 | 98 | { pad: false }, |
| 99 | 99 | )} |
| 100 | <p class="mt"><a href="/fleet/graph">Fleet graph</a></p> | |
| 100 | 101 | </div>`, |
| 101 | 102 | }); |
| 102 | 103 | notePhase(ctx.request, "render", performance.now() - rendering); |
test/forges-timing.test.ts +13
| @@ -43,3 +43,16 @@ test("the client list names session, clients, room and render once each", async | ||
| 43 | 43 | expect(Number(/dur=([\d.]+)/.exec(part)?.[1])).not.toBeNaN(); |
| 44 | 44 | } |
| 45 | 45 | }); |
| 46 | ||
| 47 | test("the client list links the fleet graph for an admin and shows no link to anyone else", async () => { | |
| 48 | const admin = await fetch(servers.url + "/forges", { headers: { authorization: `Bearer ${bearer}` } }); | |
| 49 | expect(await admin.text()).toContain('<a href="/fleet/graph">Fleet graph</a>'); | |
| 50 | const made = await createUser(app.db, { | |
| 51 | origin: "seed", trusted: true, username: "bob", email: "[email protected]", | |
| 52 | password: "a-good-passphrase", | |
| 53 | }); | |
| 54 | if (!made.ok) throw new Error(made.error); | |
| 55 | const other = createToken(app.db, made.value.id, "t", "admin").token; | |
| 56 | const res = await fetch(servers.url + "/forges", { headers: { authorization: `Bearer ${other}` } }); | |
| 57 | expect(await res.text()).not.toContain("/fleet/graph"); | |
| 58 | }); |
new above
offline
Move into pageHead actions or give it a plain-words label; as a trailing paragraph it is below the fold on a phone and floats under the empty state.