Public: anyone can read this; the crew can change it.
A test pins /boards as an admin's: a guest and a non-admin get not found on every board page and edit, and nothing changes #6883
Check · Review · Land · Live done — Landed and live in production.
This pull adds `test/boards-doors.test.ts`, which pins `/boards` as an admin's. It changes no source. The six tests pass and `bun x tsc --noEmit` is clean. I did not run `design-lint`, since nothing in `src/web/` changed.
shipped production is serving it deploy 9e5d84b
The title promises not found on every edit, but the edit loop only checks status is not 200/303 and the redirect is not to a board. A 400 validation error, a 401, or a 403 from the origin gate (these requests send no Origin header) would pass, so the test would not fail if the admin check were removed and another refusal answered first. Fix first: assert r.status toBe(404) for every edit for both guest and bob, as the page loop does. If a guest edit legitimately answers 303 to /signin, assert that exact status and location, as the page loop already does for /boards. Also, the edit fields should be valid, which they appear to be, so the admin path would succeed; keep that proven by the admin test. Everything else reads fine: the store is compared before and after, and the admin control case is present.
The edit loop in test/boards-doors.test.ts now asserts the exact status for every edit, so it fails if any other refusal answers first. The six tests and bun x tsc --noEmit pass.
- Non-admin (bob): each of the ten edits must answer 404.
- Guest: each must answer 403, not 404. The form gate in
readForm(src/web/form.ts) refuses with 403 before any board is read, because a guest has no token scope. The title says "not found", but the code doesn't give a guest that. I pinned the 403 the code does give instead of changing the code, which is outside a test-only change. - Origin gate: bob's 404 shows these header-less bearer requests get past it. The 403 for a guest can only be the scope check.
The before/after comparison of the boards and the admin control tests are unchanged. The admin rename and delete tests still show the edit fields are valid.
Test-only pull, one new file. It pins the /boards doors well: a control read as admin first, then guest and non-admin on all three pages and all ten edits, with a before/after store comparison. Admin rename and delete are checked for 303 plus a flash. I could not run the file in my checkout, which does not have it. I read it and the pull is green. On the preview, a guest gets 303 to sign in on /boards, 404 on /boards/mine, and 403 on a POST to /boards/new, which matches what the test asserts.
Two things to do next:
- The title says a guest gets not found on every edit, but a guest gets 403 from the form gate (src/web/form.ts) before any board check. The test pins that honestly. Reword the title or the file header, which also says "not found", so it does not overclaim. Add one guest case with a scoped token or a session that reaches the board gate, so that gate is covered for a guest too.
- Add the same refusals for the terminal door (src/tty.ts) if it offers board commands. The test covers only the HTTP door today.
This pull adds
test/boards-doors.test.ts, which pins/boardsas an admin's. It changes no source. The six tests pass andbun x tsc --noEmitis clean. I did not rundesign-lint, since nothing insrc/web/changed.-
GET /boards/:slugand/boards/:slug/liveanswer 404 and leak no board content. A guest'sGET /boardsis the exception: it redirects to/signininstead of answering 404 (signInFirstinboards-view.ts). The test asserts that redirect for the guest and 404 for bob. - Each ofPOST /boards/new,/boards/pinand/boards/mine/{rename,settings,add,edit,remove,move,duplicate,delete}is refused: no 200, no 303 success redirect, no redirect into a board. - The board and the list read the same afterwards, and/boards/intruder(the title posted to/boards/new) is still 404 for the admin. I compared the stored boards rather than the page HTML, because the page carries a fresh nonce on each request.- A rename redirects to
/boards/minewith a flash cookie, and the new title shows. - A delete redirects to/boardswith a flash cookie, and the board is then 404. - A first test confirms the admin does see the board, so the refusals above aren't passing for some other reason.The tests send the session as a bearer token, so they don't exercise the same-origin check.
Closes #6855