02971f3186
An audit found tests that pass on broken code. The dominant pattern: fire a security
assertion at the all-zeros UUID and accept [403, 404] — the 404 comes from the resource
LOOKUP, not the guard, so the guard can be deleted and the test still passes. Repaired to
use real resources and demand exactly 403:
- banned-user cannot like / comment (the only coverage of those ban invariants)
- host cannot promote a real guest (or self) to admin — asserts nobody's role changed
- IDOR comment-delete already used a real resource; kept
Also inverted recovery.spec's "unknown name → nicht gefunden" test: that asserted the exact
account-enumeration oracle the F4 fix removed, so restoring the vuln would have made it
pass. Now: an unknown name must be byte-identical to a wrong PIN.
New coverage for paths that ran in production but in zero tests:
- quota.spec.ts: storage quota enforcement (413 over-limit, atomic increment under two
uploads held mid-body so both carry a stale total=0 — the real race; a naive Promise.all
version was itself vacuous and is documented as such). Proven to fail without the guard.
- authz-sweep.spec.ts: table-driven guest→403 / host→403 over ALL 19 privileged routes +
anonymous + __truncate. No live hole found; the whole surface is now locked.
- ban / unban / host-comment-delete AFTER release regenerate the keepsake (data-loss
paths that were dead under test); comment-delete mid-build doesn't strand the ZIP.
Lower-severity de-vacuuming: 10 MB comment test hit Caddy's 502 before the real 500-char
cap (now seeds a real upload, 501→400 / 500→201, mutation-verified); XSS name payloads
shortened under the 50-char cap so they actually store+render; ui-rendering XSS test now
proves the payload rendered before asserting no <b>; export page-object locators fixed to
the real "Download" label with a positive empty-state anchor; avatar palette spread test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
54 lines
2.2 KiB
TypeScript
54 lines
2.2 KiB
TypeScript
import type { Page, Locator } from '@playwright/test';
|
|
|
|
/**
|
|
* Page object for `/export` (see [frontend/src/routes/export/+page.svelte]).
|
|
*
|
|
* The two archive buttons are BOTH labelled exactly "Download" — the format is carried by
|
|
* the surrounding card ("ZIP-Archiv" / "HTML-Viewer"), not by the accessible name. Earlier
|
|
* versions of this file looked for `/zip.*herunter/i` and `/^herunterladen$/i`, which match
|
|
* nothing on this page; any test asserting `not.toBeVisible()` on those passed no matter
|
|
* what the page rendered. Locators here must match the real UI, so scope by card.
|
|
*
|
|
* "Herunterladen" IS a real label — but only inside the HTML-guide confirm modal, which is
|
|
* a different element entirely.
|
|
*/
|
|
export class ExportPage {
|
|
readonly page: Page;
|
|
/** Empty state shown while the host has not released the export yet. */
|
|
readonly notAvailableBanner: Locator;
|
|
/** Any "Download" button on the page (both cards). Useful for absence assertions. */
|
|
readonly downloadButtons: Locator;
|
|
readonly zipDownloadButton: Locator;
|
|
readonly htmlDownloadButton: Locator;
|
|
/** Confirm button inside the "Hinweis zum HTML-Viewer" modal. */
|
|
readonly htmlGuideModalContinue: Locator;
|
|
|
|
constructor(page: Page) {
|
|
this.page = page;
|
|
this.notAvailableBanner = page.getByText('Export noch nicht verfügbar');
|
|
this.downloadButtons = page.getByRole('button', { name: 'Download', exact: true });
|
|
this.zipDownloadButton = this.cardButton('ZIP-Archiv');
|
|
this.htmlDownloadButton = this.cardButton('HTML-Viewer');
|
|
this.htmlGuideModalContinue = page
|
|
.getByRole('dialog')
|
|
.getByRole('button', { name: /^herunterladen$/i });
|
|
}
|
|
|
|
/**
|
|
* The "Download" button inside the card whose heading is `heading`.
|
|
*
|
|
* Scoped to the card element (`div.rounded-xl`) rather than "any div containing the
|
|
* heading" — the latter also matches the page wrapper, which contains BOTH cards' buttons.
|
|
*/
|
|
private cardButton(heading: string): Locator {
|
|
return this.page
|
|
.locator('div.rounded-xl')
|
|
.filter({ has: this.page.getByRole('heading', { name: heading, exact: true }) })
|
|
.getByRole('button', { name: 'Download', exact: true });
|
|
}
|
|
|
|
async goto() {
|
|
await this.page.goto('/export');
|
|
}
|
|
}
|