The e2e suite had never been run during this audit. It failed 9 of 256; seven of those
predated the audit's changes, established by building a stack from a clean HEAD worktree
and running the same specs against it rather than guessing.
Most were stale assertions rather than product defects:
- quota.spec solved for a target limit using the observed uploader count, but the divisor is
max(active, estimated_guest_count, 1) and that config seeds at 100 — so every limit it
aimed for came out 100x small and every "within quota" upload 413'd.
- rate-limit-shared-nat destructured `ticket` from a 429 body and fetched with
`ticket=undefined`, turning the 429 under test into an unrelated 401. It also faked a
release with no archive on disk, so the mint's pre-check 404'd and the per-day limiter was
never reached; it now does a real release and asserts 200 rather than "not 429".
- ddos allowed only [200,429] from ten concurrent streams, so it failed on the very defence
it exercises: four tickets per session survive and the rest correctly 401. Now asserts
exactly four, which a tightened cap or an inverted eviction order would catch.
- auth-tampering asserted a throttled IP is refused EVEN with the correct password. That
contract was deliberately removed — it let any phone on the venue NAT lock the operator
out of their own admin panel, with a circular escape hatch. Inverted, plus a new check
that a success does not refill an attacker's bucket.
- moderation-ui assumed a ban leaves a comment "stuck on screen"; `list_for_upload` filters
banned authors, so it is hidden from everyone including the host. Now pins the pair that
matters — the ban hides it, and the host's permanent removal survives an unban — and the
UI leg it used to own is restored as a separate test on a reachable comment.
The export specs mint with `?kind=` now that a download ticket is bound to one archive, and
four of them assert the mint's 404 rather than the download's: with the kind always known,
the pre-check refuses up front instead of after charging a daily download for an archive
that cannot be served.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Three distinct load-induced flakes in the mobile suite, all root-caused from real traces:
1. gestures-longpress "quick tap": longPress() drove page.mouse.down + Node-side
waitForTimeout(200) + page.mouse.up — three CDP round-trips. Under load the browser saw
the pointerup >500ms after pointerdown, firing the app's real long-press so the
ContextSheet opened on a quick tap. New quickTap() helper dispatches pointerdown/up
entirely in-browser on one clock, so the earlier-due pointerup always cancels the 500ms
timer first — immune to CDP latency.
2/3. upload-cancel-confirm and sheet-escape interacted with server-rendered controls before
Svelte hydrated them (caption fill lost -> cancel() navigates to /feed; custom role=radio
/ leave-button click no-ops). Wait for a post-hydration readiness signal (composer
auto-focus / real profile name) before the first interaction — the same barrier the
passing feed-based specs already have. (These are now belt-and-suspenders given ssr=false,
but keep the specs robust regardless of render mode.)
Verified: mobile 22/22, and 0/50 full-mobile runs under load (was ~3/95 pre-fix).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).
Rules keep the ones that catch real TEST bugs and drop the noise:
- no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
- no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
`api` arg, an unused JPEG_MAGIC import), all removed.
- no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
a page.evaluate() return.
- no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.
Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.
Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The running test container had been built from an older tree; rebuilding it to
pick up current app code surfaced several tests that predated shipped
security/UX features:
- file-upload-attacks / rate-limit: assert the magic-byte rejection wording and
upload a real decodable JPEG (a zero-buffer is now rejected at the boundary).
- ddos: open SSE via the single-use /stream/ticket flow, not the dead ?token=.
- recover-page / join: the PIN field auto-submits on the 4th digit, so don't
race an explicit submit click against the ensuing navigation.
- gestures-doubletap / sheet-escape: target the lightbox by aria-labelledby and
anchor the radio accessible-name match at the start (gated dialog semantics).
playwright.config: camera/mic/clipboard are Chromium-only permissions (they threw
"Unknown permission: camera" on firefox/webkit and failed the test at context
creation); grant them per-Chromium-project. firefox-android drops the
unsupported isMobile flag.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
