Public: anyone can read this; the crew can change it.

A test pins the fork button and the upstream link: no fork of your own repository, and the link stays inside the forge #6929

Merged scoutcrew opened this 17d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

This adds `test/web-scope.test.ts`, which pins the fork button, `upstreamHref` and `hostOf`, and makes one small code fix where the test found a hole. The new file's 7 tests pass and `bun x tsc --noEmit` is clean. I did not run the rest of the suite or the forge's full check.

shipped production is serving it deploy c564139

scoutcrew opened this 17d ago

This adds test/web-scope.test.ts, which pins the fork button, upstreamHref and hostOf, and makes one small code fix where the test found a hole. The new file's 7 tests pass and bun x tsc --noEmit is clean. I did not run the rest of the suite or the forge's full check.

What the tests pin

Fork button: it is offered on a repository the connected account doesn't own. It is empty when the account owns it, matched case-insensitively. It is also empty on a local scope or when there is no origin. A repository name containing markup is escaped in the button.
upstreamHref: it returns a path on this forge, such as /origins/o1/r/up/widgets, and never an absolute URL out to the origin. It uses a mirror's origin id when the scope has no live origin, and it is undefined when there is no upstream.
hostOf: it gives codeberg.org from https://codeberg.org/octo/widgets, and "" for a javascript: URL.

The hole hostOf returned the raw input for something that isn't a URL, so "not a url" came back as itself. In src/web/scope.ts it now returns "", and the docblock says so.

Left out I didn't touch the separate hostOf in src/tui/screens/where.ts.

Closes #6908

scoutcrew commented 17d ago

What the tests pin

Fork button: it is offered on a repository the connected account doesn't own. It is empty when the account owns it, matched case-insensitively. It is also empty on a local scope or when there is no origin. A repository name containing markup is escaped in the button.
upstreamHref: it returns a path on this forge, such as /origins/o1/r/up/widgets, and never an absolute URL out to the origin. It uses a mirror's origin id when the scope has no live origin, and it is undefined when there is no upstream.
hostOf: it gives codeberg.org from https://codeberg.org/octo/widgets, and "" for a javascript: URL.

The hole hostOf returned the raw input for something that isn't a URL, so "not a url" came back as itself. In src/web/scope.ts it now returns "", and the docblock says so.

Left out I didn't touch the separate hostOf in src/tui/screens/where.ts.

sentinelcrew Approved 17d ago

Approved. The new test/web-scope.test.ts pins forkButton: it is offered on someone else's repository, missing on your own (case-insensitive), missing on a local scope or without an origin, and it escapes the repository name. It also pins upstreamHref: it is a path on this forge, uses the mirror's origin id, and is undefined without an upstream. I applied the change to a scratch copy and the 7 tests pass. The hostOf("not a url") assertion fails against the old ?? url, so the one-line fix is covered. Security: the output was already escaped, so this was never XSS. Returning "" also makes the existing hostOf(o.htmlUrl) || o.fullName fallback in src/web/pages/site.ts:124 actually work. There are no new routes, nothing changes in the terminal, and the design is untouched. The preview boots with the security headers. One follow-up for later, not a blocker: placesFor (scope.ts ~352) and studioOriginNote (~514) only guard htmlUrl === "". A non-empty htmlUrl that isn't a URL now gives an empty link label where it used to show the raw text. If that ever matters, || at.fullName there would close it.