Public: anyone can read this; the crew can change it.
A signed-out reader of the toolbar page is offered sign-in that brings them back to it #4101
Check · Review · Land · Live done — Landed and live in production.
scout/forge:scout/4090-a-signed-out-reader-of-the-toolbar-page → main 2 commits fork 1 thread · 1 unresolved
2 files
changed +60
−1
src/web/studio/toolbar.ts +2 −1
| @@ -115,10 +115,11 @@ export async function toolbarPage(ctx: Ctx): Promise<Response> { | ||
| 115 | 115 | const home = btn("Home", { href: "/", variant: "ghost" }); |
| 116 | 116 | const rendering = performance.now(); |
| 117 | 117 | if (!user) { |
| 118 | const next = encodeURIComponent(toolbarPath(base, where.env, address)); | |
| 118 | 119 | const response = page({ |
| 119 | 120 | ctx, |
| 120 | 121 | title: `${repo.name} · forge`, |
| 121 | body: html`<div class="narrow-wide">${pageHead(here)}${liveNote}<div class="form-actions">${home}</div></div>`, | |
| 122 | body: html`<div class="narrow-wide">${pageHead(here)}${liveNote}<div class="form-actions">${btn("Sign in to comment", { href: `/signin?next=${next}`, variant: "primary" })}${home}</div></div>`, | |
| 122 | 123 | }); |
| 123 | 124 | notePhase(request, "render", performance.now() - rendering); |
| 124 | 125 | return response; |
test/toolbar-signed-out.test.ts added +58
| @@ -0,0 +1,58 @@ | ||
| 1 | /** A signed-out reader of the toolbar page is offered sign-in that returns to it (#4090). */ | |
| 2 | import { afterAll, beforeAll, expect, test } from "bun:test"; | |
| 3 | import { mkdtempSync, rmSync } from "node:fs"; | |
| 4 | import { tmpdir } from "node:os"; | |
| 5 | import { join } from "node:path"; | |
| 6 | import { newApp } from "../src/actions/apps.ts"; | |
| 7 | import { createApp, type App } from "../src/app.ts"; | |
| 8 | import { createUser } from "../src/core/users.ts"; | |
| 9 | import { serve, type Servers } from "../src/http/server.ts"; | |
| 10 | import { safeNext } from "../src/web/pages/site.ts"; | |
| 11 | import { proveAll } from "./helpers/verified.ts"; | |
| 12 | import { quietLogs } from "./helpers/globals.ts"; | |
| 13 | ||
| 14 | quietLogs(); | |
| 15 | ||
| 16 | let root = ""; | |
| 17 | let app: App; | |
| 18 | let servers: Servers; | |
| 19 | ||
| 20 | beforeAll(async () => { | |
| 21 | root = mkdtempSync(join(tmpdir(), "forge-toolbar-out-")); | |
| 22 | app = createApp({ dataDir: root, port: 0, forgeRepo: "alice/forge" }); | |
| 23 | const u = await createUser(app.db, { | |
| 24 | origin: "seed", | |
| 25 | trusted: true, | |
| 26 | username: "alice", | |
| 27 | email: "[email protected]", | |
| 28 | password: "a-good-passphrase", | |
| 29 | adminIfFirst: true, | |
| 30 | }); | |
| 31 | if (!u.ok) throw new Error(u.error); | |
| 32 | proveAll(app); | |
| 33 | const made = await newApp(app, { id: u.value.id, username: "alice" } as never, { name: "forge", description: "x", visibility: "public" }); | |
| 34 | if (!made.ok) throw new Error(made.error); | |
| 35 | servers = await serve(app); | |
| 36 | }); | |
| 37 | afterAll(() => { | |
| 38 | servers.stop(); | |
| 39 | app.close(); | |
| 40 | rmSync(root, { recursive: true, force: true }); | |
| 41 | }); | |
| 42 | ||
| 43 | test("signed out, the page offers sign-in that returns to it", async () => { | |
| 44 | const res = await fetch(`${servers.url}/alice/forge/toolbar?env=production&page=${encodeURIComponent("https://x.test/a")}`); | |
| 45 | expect(res.status).toBe(200); | |
| 46 | const body = await res.text(); | |
| 47 | const next = encodeURIComponent(`/alice/forge/toolbar?env=production&page=${encodeURIComponent("https://x.test/a")}`); | |
| 48 | expect(body).toContain("Sign in to comment"); | |
| 49 | expect(body).toContain(`href="/signin?next=${next}"`); | |
| 50 | expect(body).toContain(">Home<"); | |
| 51 | expect(safeNext(decodeURIComponent(next))).toBe(decodeURIComponent(next)); | |
| 52 | }); | |
| 53 | ||
| 54 | test("a crafted next to another host is refused", () => { | |
| 55 | expect(safeNext("//evil.example/x")).toBeUndefined(); | |
| 56 | expect(safeNext("https://evil.example/")).toBeUndefined(); | |
| 57 | expect(safeNext("/\\evil.example")).toBeUndefined(); | |
| 58 | }); |
new above
offline