32dfe6874a
The e2e suite had never been run during this audit. It failed 9 of 256; seven of those predated the audit's changes, established by building a stack from a clean HEAD worktree and running the same specs against it rather than guessing. Most were stale assertions rather than product defects: - quota.spec solved for a target limit using the observed uploader count, but the divisor is max(active, estimated_guest_count, 1) and that config seeds at 100 — so every limit it aimed for came out 100x small and every "within quota" upload 413'd. - rate-limit-shared-nat destructured `ticket` from a 429 body and fetched with `ticket=undefined`, turning the 429 under test into an unrelated 401. It also faked a release with no archive on disk, so the mint's pre-check 404'd and the per-day limiter was never reached; it now does a real release and asserts 200 rather than "not 429". - ddos allowed only [200,429] from ten concurrent streams, so it failed on the very defence it exercises: four tickets per session survive and the rest correctly 401. Now asserts exactly four, which a tightened cap or an inverted eviction order would catch. - auth-tampering asserted a throttled IP is refused EVEN with the correct password. That contract was deliberately removed — it let any phone on the venue NAT lock the operator out of their own admin panel, with a circular escape hatch. Inverted, plus a new check that a success does not refill an attacker's bucket. - moderation-ui assumed a ban leaves a comment "stuck on screen"; `list_for_upload` filters banned authors, so it is hidden from everyone including the host. Now pins the pair that matters — the ban hides it, and the host's permanent removal survives an unban — and the UI leg it used to own is restored as a separate test on a reachable comment. The export specs mint with `?kind=` now that a download ticket is bound to one archive, and four of them assert the mint's 404 rather than the download's: with the kind always known, the pre-check refuses up front instead of after charging a daily download for an archive that cannot be served. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
55 lines
2.3 KiB
TypeScript
55 lines
2.3 KiB
TypeScript
/**
|
|
* Critical a11y fix — bottom sheets on /account (data-mode warning and
|
|
* leave-confirm) now respond to Escape via the focusTrap action. They were
|
|
* previously click-only, blocking keyboard / switch-control users.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
|
|
test.describe('Mobile a11y — sheets dismiss on Escape', () => {
|
|
test('data-mode warning sheet closes on Escape', async ({ page, guest, signIn }) => {
|
|
const g = await guest('SheetEsc');
|
|
await signIn(page, g);
|
|
await page.goto('/account');
|
|
|
|
// /account is server-rendered, so its controls exist and look clickable BEFORE Svelte
|
|
// hydrates their handlers. The data-mode options are custom `div[role=radio]` (no native
|
|
// input fallback), so a pre-hydration click does nothing and the sheet never opens (a
|
|
// reproduced ~1% flake). The profile name/expiry are filled in onMount (post-hydration);
|
|
// waiting for the real display name is a reliable "the page is interactive now" barrier.
|
|
await expect(page.getByText(g.displayName)).toBeVisible();
|
|
|
|
// Click the "Original" radio in the Datennutzung section to open the warning sheet.
|
|
// The radio's accessible name is its title + description ("Original Lädt die
|
|
// Originaldateien…"), so anchor on the start, not the end.
|
|
const originalRadio = page.getByRole('radio', { name: /^Original/i });
|
|
await originalRadio.click();
|
|
|
|
const sheet = page.locator('[role="dialog"][aria-labelledby="data-mode-title"]');
|
|
await expect(sheet).toBeVisible();
|
|
|
|
await page.keyboard.press('Escape');
|
|
await expect(sheet).not.toBeVisible({ timeout: 2_000 });
|
|
});
|
|
|
|
test('leave-confirm sheet (built on ConfirmSheet) closes on Escape', async ({
|
|
page,
|
|
guest,
|
|
signIn,
|
|
}) => {
|
|
const g = await guest('LeaveEsc');
|
|
await signIn(page, g);
|
|
await page.goto('/account');
|
|
|
|
// Wait for /account to hydrate before tapping the (server-rendered) leave button, so the
|
|
// click reaches a live handler. See the test above.
|
|
await expect(page.getByText(g.displayName)).toBeVisible();
|
|
|
|
await page.getByTestId('account-logout').click();
|
|
const sheet = page.getByTestId('confirm-sheet');
|
|
await expect(sheet).toBeVisible();
|
|
|
|
await page.keyboard.press('Escape');
|
|
await expect(sheet).not.toBeVisible({ timeout: 2_000 });
|
|
});
|
|
});
|