b601c062bd
Second round: the two regressions the first round introduced, the remaining
gaps it left, and the CI change that makes the iOS guarantees actually gate a
change rather than being asserted.
Squashed from 9 commits, original messages preserved below.
──────── docs(deploy): document the update path — `up -d` alone ships nothing
The README only ever described a fresh install. There was no update section
anywhere, and `--build` appeared nowhere in the docs.
That matters because `app` and `frontend` are `build:` services with no published
image tag, and Compose has no source-change detection: if an image by that name
exists it is reused. So the natural `git pull && docker compose up -d` reports
"Container app-1 Running", rebuilds nothing, and exits 0. A deploy that shipped
none of the new code is indistinguishable from a successful one — which is how
eleven merged fixes can sit in the repo and never reach the box.
Verified both halves against a real stack rather than asserting them: with a
source change staged, `up -d` left the image ID untouched; `up -d --build`
produced a new image ID and a healthy /health.
Adds an "Updating an existing deployment" section covering backup-before-migrate,
pull, rebuild, health check, and an image-ID comparison to prove a build actually
happened. Also spells out the rollback trap: migrations run on boot and are not
undone by checking out an older commit, so rolling back code without restoring
the snapshot leaves the schema ahead of the binary and the app refusing to start.
──────── fix(video): play the actual video, and answer Range requests
Every video in the app was unplayable. Two independent defects, either one
sufficient on its own, and nothing in the suite covered either — no test
anywhere played media or asserted a `<video>` src.
1. The lightbox handed `<video>` a JPEG.
`pickMediaUrl` is mime-agnostic, and compression only ever produces a THUMBNAIL
for a video (one `ffmpeg -vframes 1` frame) — no preview, no display. So in the
DEFAULT saver mode the element's src resolved to `/api/v1/upload/{id}/thumbnail`,
served as `image/jpeg` with `nosniff` so the browser can't even sniff its way
out. Chromium reports DEMUXER_ERROR_COULD_NOT_OPEN.
Fixed in the lightbox rather than in `pickMediaUrl`: FeedListCard shares that
helper and legitimately wants the thumbnail for its `<img>` poster, so a central
mime branch would break the feed. This mirrors the rule the diashow already
applies ("videos play the original file directly"). Added `preload="none"` so
saver-mode guests on cellular still fetch nothing until they press play — there
is no smaller video derivative to offer them — plus `playsinline`, without which
iOS hijacks playback into fullscreen.
2. `stream_media_file` ignored Range entirely.
It took no request headers, so it could not see `Range`; it always returned 200
with the whole body and never sent Accept-Ranges or Content-Range. iOS Safari
opens every `<video>` with a `Range: bytes=0-1` probe and abandons the load
without a 206 — so video failed on the app's primary platform even in `original`
mode, where the src was already correct.
Adds single-range support (`bytes=N-`, `bytes=N-M`, `bytes=-S`) with 206 +
Content-Range, 416 + `bytes */len` past EOF, and Accept-Ranges advertised on
every response. Anything it won't handle — multi-range, non-bytes units, garbage
— falls back to a full 200, which RFC 9110 explicitly permits and which is safer
than guessing. All four media routes share the helper, so seeking works
uniformly.
`get_original` now serves `inline` instead of `attachment`. An attachment
disposition is hostile to a `<video>` element, and this route is the only source
of playable video bytes; it also matches what the UI promises, since the action
is labelled "Original anzeigen" — view, not download. `no-store` is deliberately
kept so a takedown still revokes access promptly; ranges work fine under it, the
client just re-fetches.
Tests: 11 unit tests pin the parser (the iOS `bytes=0-1` probe, inclusive ends,
suffix ranges, clamping past EOF, 416 vs 200, malformed fallbacks). A new
03-feed/video-playback spec asserts the src is the original and not the
thumbnail, that the browser accepts the bytes as media (readyState > 0, no
MediaError), that no video bytes are delivered before play, and that Range
returns the correct 206 slices and a 416 past EOF — verified on both Chromium
and WebKit.
The "not downloaded before play" test asserts no *delivered body* rather than no
request: WebKit opens a connection for a preload="none" video and immediately
aborts it (GET, no Range, status 0, nothing transferred) while Chromium issues
nothing at all. The portable guarantee is that no response carrying bytes
completes.
──────── fix(auth): bind the role store to the identity, not to the tab
The role store I added in the moderation work is a module-level singleton seeded
ONCE at import. `goto()` is a client-side navigation, so leaving and re-joining in
the same tab re-imports no module and re-runs no onMount — the previous user's
role simply stayed resident. Nothing reset it: not join, recover, admin login,
"Event verlassen", `clearAuth`, nor the api.ts 401 auto-clear.
So a host who left, followed by a guest joining on the same phone, left that guest
with `isStaff === true` and a "🚫 Beitrag entfernen" action on other people's
photos. The backend 403s the delete, so this was a false affordance rather than a
privilege escalation — but `/feed` never fetched `/me/context`, so unlike every
other route it never self-corrected either. It survived until a hard reload.
The mirror case was equally broken and easier to overlook: a guest who recovered
into a host account got NO host affordances.
`clearAuth` already had a hook registry for exactly this shape of problem, with a
comment explaining it exists to avoid circular imports. Add the missing mirror,
`onSetAuth`, fired by both `setAuth` and `setAdminAuth` after the new token is
resident, and have the role store register on both sides: clear to null on
logout, re-seed from the new token on login. That also gives
`syncRoleFromToken` — dead code with zero callers since I introduced it — its
intended purpose.
Seeding from the claim fixes the reported bug, but the claim is frozen for the
token's 30-day life, so a promotion or demotion still wouldn't reach the feed.
`/feed` now calls the existing `refreshEventState()` on mount, which fetches
`/me/context` and applies both the authoritative role and the lock/release state
in one request. The feed is the one route gating a destructive action on the role,
so it should not be the only route running on a stale claim.
Tests: 04-host/role-identity-reset drives the real flows. The first asserts the
host DOES see the action before asserting the newcomer does not — a negative
assertion alone would pass against a build that shipped no moderation at all. The
second covers the mirror, promoting a guest server-side while their resident token
still claims `role: guest`, so a fix that only cleared the role would fail it.
──────── fix(compression): reclaim failed originals instead of leaking them
Round 1 stopped the compression worker deleting an upload's original on failure —
a transient ENOSPC or a codec panic must never destroy the only copy of a photo a
guest cannot retake. But it left `Upload::soft_delete`'s quota refund in place, so
the bytes stayed on disk while the uploader was charged nothing for them.
That is worse than it first looks. The row is soft-deleted, so the file is
invisible and unowned; a guest hitting a reproducible codec failure can accumulate
orphans indefinitely at zero personal cost. And `active_uploaders` counts only
users with non-deleted uploads, so dropping out of that count RAISES everyone's
per-user ceiling — the leak loosens the very quota meant to contain it.
Keep the refund: the uploader didn't cause the failure and shouldn't silently lose
quota to it. Bound the leak instead, with an hourly sweep alongside the existing
session cleanup in `spawn_periodic_tasks`, reclaiming failed originals older than
14 days — comfortably longer than any single event, so an operator investigating a
failed upload still has the file.
The selection predicate is the entire safety argument, so it is deliberately
narrow: `compression_status = 'failed'` AND soft-deleted AND past the window AND
`original_path <> ''`. That is exactly the state the give-up path leaves behind,
and it cannot reach a live upload, an owner-deleted one, or a failure still inside
its recovery window. `original_path` is cleared after a successful reclaim, which
makes the sweep idempotent — otherwise a row whose file is already gone is
re-selected on every tick forever. The row itself is kept as the audit trail.
Tests reproduce the selection verbatim (same pattern as upload_concurrency) and
assert it against five near-misses that must survive, both sides of the retention
boundary, and the idempotence property.
Also fixes two comments in export.rs still claiming "the compression worker
hard-deletes an original when its transcode fails" — no longer true, and the
defensive handling they justify is now justified by this sweep and by ordinary
deletes instead.
──────── fix(export): apply EXIF orientation in the keepsake too
Round 1 fixed EXIF orientation in the compression worker, which corrected the live
app — feed preview and diashow display. The export worker was missed, and it does
not reuse those derivatives: it re-decodes the originals itself with `image::open`,
which ignores the orientation tag, then re-encodes to JPEG, which drops the tag —
so the viewer has no way to recover it.
The damage was oddly shaped, which is exactly why it reads as a viewer bug:
Gallery.zip originals correct (byte-copied, EXIF intact)
Memories viewer grid thumbnails SIDEWAYS (always)
Memories viewer full image >5 MB SIDEWAYS (re-encoded at 2000px)
Memories viewer full image ≤5 MB correct (streamed byte-for-byte)
So in the keepsake people actually keep, every portrait photo in the grid was on
its side, and clicking through silently "fixed" small photos but not large ones.
Rather than paste the decoder dance a third time, extract `services::imaging::
decode_oriented` and route both workers through it, so there is exactly one way to
turn a file on disk into a DynamicImage. It carries a second invariant that had
also drifted: `image::open` applies NO decode limits, so the export path was
decoding arbitrary user-supplied images unbounded — the decompression-bomb cap
existed only in the compression worker. Both now come as a pair, which is the
point of having one function.
Not done: switching export to consume the existing `display` derivative. It would
fix orientation and drop a redundant full-resolution decode per photo, but it
would also replace the pristine ≤5 MB originals in the keepsake with 2048px
re-encodes — a real quality regression in the one artefact people keep forever.
Test uploads the round-1 fixture (40x20 landscape tagged Orientation=6), runs a
real export, pulls the thumbnail out of Memories.zip and asserts it came back
portrait — with a sanity check that the source really is stored landscape, so the
test can't pass against a pipeline that does nothing.
──────── fix(recover): cap name cycling, and stop bcrypt blocking the runtime
Round 1 gave /join a per-IP ceiling and left /recover with only its
`recover:{ip}:{name}` bucket. That key is right for the job it was written for —
stopping someone who knows a display name (they're listed on the feed) from
burning the victim's 3-strike PIN counter and locking them out on repeat. But the
name is ATTACKER-CHOSEN, so cycling names mints a fresh 5-attempt bucket every
time and the per-IP cost is unbounded.
What sits behind that limiter makes it worse than a normal flood: every call runs
a cost-12 bcrypt verify, including an UNCONDITIONAL throwaway verify for names
that don't exist — added deliberately to close a timing oracle. So an unknown name
is the single cheapest way to make the server do ~200ms of hashing.
Adds `recover_ip_rate_per_min` (default 30, migration 019), checked BEFORE the
per-name bucket so a name generator can't walk past it. 30/min is far above any
real recovery attempt while capping a flood. The per-name bucket is untouched and
remains the anti-guessing control.
The second half matters as much as the first: bcrypt was running inline on the
async runtime everywhere. At cost 12 that pins a tokio worker thread for ~200ms,
and there is only one per core — so a login flood stalled every other request on
the box, including the feed. There was no spawn_blocking anywhere in the auth
module, despite SECURITY-BACKLOG claiming bcrypt had been offloaded.
Route all of it through `verify_password` / `hash_password` on the blocking pool.
That covers /recover, /admin/login, the host PIN reset, and — the one most likely
to bite at a real event — the PIN hash minted on every single /join. Saturating
the blocking pool degrades logins; saturating the worker threads degrades
everything.
Tests: cycling distinct names from one IP now hits the ceiling with a Retry-After,
and — the assertion that keeps the fix honest — repeated wrong PINs against ONE
name are still throttled with the ceiling set generously high, so the ceiling
added protection rather than replacing it.
──────── ci(e2e): run WebKit, so the iOS guarantees actually gate a PR
The workflow installed only Chromium and ran chromium-desktop + chromium-mobile.
iOS Safari is the app's stated primary user — a wedding guest opening a QR link —
and WebKit is the only engine in the matrix that reproduces two of its behaviours:
- it enforces X-Frame-Options on the hidden download iframe, so a site-wide DENY
makes the keepsake download silently do nothing. Blink hands attachments to
the download manager before the frame check and never notices.
- it abandons a <video> load unless its Range probe gets a 206.
Both of those shipped. Adding 06-export to the webkit project in the round-1 fix
bought nothing on a PR, because CI never ran that project at all — the regression
test written specifically to catch the blocker only ever executed locally.
Runs 71 tests (67 pass, 4 skip on the documented IndexedDB-blob harness
limitation) in ~1.5 minutes locally, using the exact command added here.
──────── chore(backend): satisfy cargo fmt
`checks.yml` runs `cargo fmt --check`, and it has been failing since the round-1
audit fixes: I gated those on `cargo build` and `cargo clippy` but never ran fmt,
so three files drifted then and eight more this round. Pure formatting — no
behaviour change; clippy stays at zero and all 70 backend tests still pass.
Worth noting for next time: clippy passing is not evidence fmt does.
──────── chore: satisfy prettier in frontend and e2e
`checks.yml` runs `npm run format:check` for both projects and both were failing.
- frontend/src/lib/ui-store.ts is mine, unformatted since the round-1 upload-queue
badge fix — the same miss as the rustfmt one: I gated on svelte-check and eslint
but never on format:check.
- e2e/loadtest/* and e2e/shots.mjs have been unformatted since 7758270 and are
unrelated to the audit work. Fixed here because they block the same gate and the
fix is mechanical; no behaviour change in either project.
Still red and deliberately NOT fixed here: `npm run lint` in the frontend reports
`svelte/prefer-svelte-reactivity` on routes/diashow/+page.svelte:208 (a mutable
`Set` where the rule wants `SvelteSet`), pre-existing since 5009590. That one is a
real reactivity change in code I have no test coverage for, so it belongs in its
own change rather than smuggled into a formatting commit.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
EventSnap E2E Suite
Playwright-driven end-to-end tests for the EventSnap stack. The suite spins
up an isolated docker-compose stack on ports :3101 (Caddy → frontend +
backend) and :55432 (Postgres), and exercises the SvelteKit frontend
against a real Rust backend with rate limits and quotas disabled.
Phases 1, 2, and 3-mobile-gestures are landed:
- Phase 1 — happy-path coverage of every documented user journey, plus a smoke matrix across nine browser/UA profiles to catch engine-level divergences.
- Phase 2 — adversarial inputs (XSS, SQL-injection, JWT forgery, MIME spoofing, oversize, brute-force) and browser chaos (storage purge, offline/slow-3G, multi-tab, clock skew, no-JS, quota exhaustion).
- Phase 3 (gestures only) — touch-target audit, safe-area structural
check, long-press → ContextSheet, double-tap → like, viewport reflow,
plus
test.fixmestubs for planned gestures (lightbox swipe, swipe-down dismiss, pull-to-refresh).
Phase 3 real-device compat (Android emulator + Samsung Internet via
connectOverCDP, BrowserStack), visual regression, and a11y audits are
sketched in the Roadmap at the bottom.
Quickstart
cd e2e
npm install
npm run install:browsers # one-time: ~500 MB across chromium/firefox/webkit
# 1. Boot the test stack (rebuilds backend + frontend Docker images)
npm run stack:up
# 2. Wait ~20s for migrations + warmup, then run tests
npm run test:e2e # full Phase 1 suite on chromium-desktop
npm run test:e2e:smoke # cross-UA smoke matrix (~9 projects × 1 test)
npm run test:e2e:ui # interactive Playwright UI mode
# 3. After: tear the stack down (deletes volumes)
npm run stack:down
The CI workflow at .github/workflows/e2e.yml runs both jobs on every PR.
What's tested
Every spec covers a journey from docs/USER_JOURNEYS.md
or a security/chaos scenario. One folder per area:
| Folder | Phase | Journeys / Topic | Tests | Notes |
|---|---|---|---|---|
specs/01-auth/ |
1 | §1, §2, §3, §11, §15 | 13 | Join, recover, PIN lockout, admin login, leave event. |
specs/02-upload/ |
1 | §5, §6, §18 | 5 | Gallery picker, multi-file, rate-limit, admin toggle. |
specs/03-feed/ |
1 | §7, §8, §17 | 5 | Like/comment SSE, filter chips, SSE reconnect. |
specs/04-host/ |
1 | §9 | 5 | Event lock, ban/unban, role change. |
specs/05-admin/ |
1 | §11, §16 | 11 | Config validation, foundational auth guards, stats. |
specs/06-export/ |
1 | §12 | 3 | Status, release, download stub. |
specs/__smoke/ |
1 | (matrix) | 1 × 9 UAs | @smoke-tagged happy-path on every UA project. |
specs/07-adversarial/ |
2 | Input attacks, file upload boundaries, JWT forgery, brute-force, deep authorization, small DDoS | ~40 | See breakdown below. |
specs/08-browser-chaos/ |
2 | Storage purge, IndexedDB, offline/slow-3G, multi-tab, no-JS, clock skew, quota | ~20 | See breakdown below. |
specs/09-mobile/ |
3 | Touch-target audit, safe-area, long-press, double-tap, viewport reflow, fixme stubs | 23 | Runs only on chromium-mobile (Pixel 7 viewport). See below. |
Phase 2 — adversarial (specs/07-adversarial/)
xss-injection.spec.ts— 13 tests. Six XSS payloads × display-name path- four SQLi patterns + length/encoding edge cases (NUL byte, RTL override,
caption overflow). Asserts
window.__xssFirednever gets set and nodialogevent fires.
- four SQLi patterns + length/encoding edge cases (NUL byte, RTL override,
caption overflow). Asserts
ui-rendering.spec.ts— 2 tests. Belt-and-braces: even when a script- payload sits in localStorage as the user's display name, rendering through/accountkeeps it as text.file-upload-attacks.spec.ts— 9 tests. ELF body claimed as JPEG, oversize image vsmax_image_size_mb, zero-byte, missing file field, path-traversal filename, NUL filename,application/*declared category bypass, SVG-with-script.auth-tampering.spec.ts— 8 tests.alg:noneforging admin role, signature tamper, payload tamper with original signature, logged-out session reuse, header withoutBearer, missing Authorization, PIN brute-force lockout, admin password brute-force (documented finding — no lockout today, bcrypt cost is the only defense).authorization-deep.spec.ts— 6 tests. Cross-user comment delete, banned user across like/comment/feed-read, host→admin escalation attempts.ddos.spec.ts— 4 small-scale abuse tests. 20 parallel /join, 10 MB comment body, 10 concurrent SSE streams, malformed JSON.
Phase 2 — browser chaos (specs/08-browser-chaos/)
storage-purge.spec.ts— 5 tests.localStorage.clear()mid-session, cookies cleared (JWT in localStorage still works), sessionStorage cleared, admin force-relogin, PIN intentionally survives clearAuth.indexeddb.spec.ts— 2 tests. Drop all IDB databases mid-session; stub IDB to undefined before navigation.offline-network.spec.ts— 4 tests.setOffline(true)→ reconnect, slow-3G viapage.routedelay, intermittent 503s, 429 from server (no infinite retry storm).multi-tab.spec.ts— 3 tests. Same user two tabs, two users two contexts (storage isolated), logout in tab A doesn't sync to tab B (documented gap).environment.spec.ts— 5 tests. JS disabled, localStorage quota exhausted, hostile CSS hiding nav, clock skew ±1h / -2d.
Pending tests covering features that need a Node-side multipart upload helper
are marked test.fixme and will activate when that helper lands.
Browser & UA matrix
| Project | Engine | UA / Device | Why |
|---|---|---|---|
chromium-desktop |
Chromium | Desktop Chrome | Baseline. Full suite runs here. |
chromium-pixel7 |
Chromium | Pixel 7 device descriptor | Chrome Android. |
chromium-galaxy-s22 |
Chromium | Galaxy viewport + Samsung phone UA | Chrome on Samsung hardware. |
samsung-internet |
Chromium | Galaxy viewport + SamsungBrowser UA | Tier-A Samsung Internet baseline. |
edge-android |
Chromium | Pixel viewport + EdgA UA | Edge Mobile (Blink-based). |
chrome-ios |
Chromium | iPhone viewport + CriOS UA | Chrome iOS (actually WebKit, but UA differs). |
webkit-iphone |
WebKit | iPhone 14 Pro | Real iOS Safari engine. |
firefox-android |
Firefox | Pixel viewport + Firefox Android UA | Gecko engine. |
firefox-desktop |
Firefox | Desktop Firefox | FF-specific quirks. |
Only the @smoke happy-path runs across all projects (controlled by
grep in playwright.config.ts). The full Phase 1 suite is
chromium-desktop-only by default to keep CI under 15 min.
Samsung Internet — three escalation tiers
Samsung Internet ships on every Galaxy phone (~5% of mobile traffic in DE). It's Blink-based, so Tier-A catches ~90% of regressions. Real Samsung divergences (Smart Switch save-data mode, dark-mode injection, custom autoplay, in-browser ad blocking) are only reproducible at Tier B+:
- Tier A (this repo, free, in CI): Playwright Chromium with the
Samsung Internet user-agent + Galaxy viewport. See the
samsung-internetproject inplaywright.config.ts. - Tier B (free, manual, future): Android Studio emulator on Linux →
install Samsung Internet APK → enable
--remote-debugging-port=9222→chromium.connectOverCDP('http://localhost:9222'). Setup docs live indocs/samsung-emulator.md(to be written). - Tier C (paid, optional): BrowserStack or LambdaTest cloud devices. Real Galaxy S22/S23 hardware via Playwright's cloud integration.
Test isolation
Every test runs against a freshly truncated database:
global-setup.tswaits for/health, logs in admin, and disables every rate-limit and quota toggle viaPATCH /admin/config.- The auto-fixture
truncateinfixtures/test.tscallsPOST /api/v1/admin/__truncatebefore every test. - The truncate endpoint is only registered when the backend is started
with
EVENTSNAP_TEST_MODE=1(seebackend/src/main.rsandbackend/src/handlers/test_admin.rs). Production builds return 404.
Single-worker by design (workers: 1 in the config). Per-worker isolated
DBs are a Phase-2+ change.
Architecture
e2e/
├── docker-compose.test.yml # Isolated test stack: db :55432, caddy :3101
├── Caddyfile.test # Proxies /api/* /media/* /health to backend
├── playwright.config.ts # UA matrix + smoke grep
├── global-setup.ts # admin login, rate-limit disable
├── global-teardown.ts # (no-op; use `npm run stack:down`)
├── fixtures/
│ ├── api-client.ts # Typed wrapper over /api/v1/*
│ ├── db.ts # Direct Postgres escape hatch (locked-PIN, etc.)
│ ├── test.ts # Central test.extend (guest, host, signIn fixtures)
│ └── media/ # sample.jpg, sample.mp4, not-an-image.jpg
├── helpers/
│ ├── sse-listener.ts # Async SSE iterator with waitForEvent()
│ ├── storage-helpers.ts # localStorage/sessionStorage helpers
│ └── fake-media.ts # Camera permissions (Chromium only)
├── page-objects/
│ ├── join-page.ts # /join
│ ├── recover-page.ts # /recover
│ ├── admin-login-page.ts # /admin/login
│ ├── feed-page.ts # /feed + bottom nav
│ ├── upload-sheet.ts # UploadSheet.svelte + /upload
│ ├── lightbox.ts # LightboxModal.svelte
│ ├── account-page.ts # /account
│ ├── host-dashboard.ts # /host
│ ├── admin-dashboard.ts # /admin
│ └── export-page.ts # /export
└── specs/
├── __smoke/ # @smoke cross-UA matrix (1 spec)
├── 01-auth/
├── 02-upload/
├── 03-feed/
├── 04-host/
├── 05-admin/
└── 06-export/
Debugging a failure
npm run test:e2e:ui— interactive UI with time-travel and selector probe.npm run test:e2e:headed— watch the browser run live.npm run test:e2e:debug— Playwright inspector with breakpoints.npm run stack:logs— tail backend + Postgres logs during a failure.playwright-report/index.html— opens the HTML report (auto-generated on every run).- Trace files (
test-results/**/trace.zip) drag-and-drop intohttps://trace.playwright.dev.
Conventions
- One assertion per
expect. Bundling multiple expects in one statement loses the line-level failure context. - Wait on data, not time. Use
expect.pollfor DB checks; neverwaitForTimeoutin production specs. @smoketag on each suite's happiest path so the matrix run stays under 2 min.test.fixmefor features that need infrastructure not yet built (Node-side multipart upload helper, real video fixtures, etc.). Fixme tests don't fail the suite but show up in the report.- Page objects own selectors. Specs never use raw locators.
- German text in assertions is fine — it's not going to change frequently. When it does, the page object is the only file to update.
Roadmap
Phase 2 — Adversarial & browser chaos ✅ landed
See the What's tested table above and the per-file breakdown. Known findings surfaced (documented in tests, not silent failures):
/admin/loginhas no rate-limit or lockout — bcrypt cost is the only defense.localStorage'storage' event is not listened for, so logout in tab A doesn't synchronously sign out tab B (the next 401 from any API call clears it).- SVG uploads currently pass the magic-byte check (depends on
infer's detection coverage) — consider addingX-Content-Type-Options: nosniff- CSP on
/media/*if SVGs are ever expected as user content.
- CSP on
Phase 3 — Mobile gestures (specs/09-mobile/) ✅ landed
Runs only on the chromium-mobile project (Pixel 7 device descriptor with
hasTouch and isMobile). The chromium-desktop project explicitly
ignores this folder via testIgnore in playwright.config.ts.
touch-targets.spec.ts— 4 tests. Audits ≥ 44×44 px on bottom nav, FAB, join submit, admin-login submit, PIN-modal buttons. Usesexpect.softso a single failure surfaces the actual bounding-box dimensions instead of stopping the suite.safe-area.spec.ts— 4 tests. Assertsenv(safe-area-inset-bottom)is present in the inline style of every bottom-anchored UI element (bottom nav, UploadSheet, ContextSheet), and that the nav stays flush with the viewport bottom on a no-notch emulated device.gestures-longpress.spec.ts— 3 tests. A 600 ms hold on a FeedListCard opens the ContextSheet; a 200 ms tap does not; the click-suppression logic prevents the lightbox from also opening at pointer-up. Driven viapage.mouse.down/upbecause thelongpressaction listens for pointer events (mouse/touch/pen unified).gestures-doubletap.spec.ts— 2 tests. Double-tap on a feed card image button records a like; double-tap inside the lightbox triggers the heart-burst animation and records a like. Assertions read the like count back via/api/v1/feedso they don't couple to specific badge markup.viewport-reflow.spec.ts— 5 tests. Portrait, landscape, narrow (320×568), phablet (480×1024) — each asserts the bottom nav is visible, the FAB stays roughly centered, and there's no horizontal overflow on<html>. Plus a rotation test that confirms auth survives a viewport resize.planned-gestures.spec.ts— 5test.fixmestubs documenting the contracts for gestures from journey §17 that aren't shipped yet (lightbox swipe L/R, swipe-down to dismiss UploadSheet, pull-to-refresh, long-press on a comment). Fliptest.fixmetotestwhen wiring each gesture.
Driving gestures: the helpers/touch.ts module
longPress(page, locator, durationMs)— holds the pointer down for the duration. Default 600 ms beats the action's 500 ms threshold.doubleTap(page, locator)— twomouse.down/uppairs within thedoubletapaction's 300 ms window.swipe(page, from, to, steps)— gradual mouse-driven move (used by the fixme stubs once swipe gestures land).inlineStyle(locator)/computedStyle(locator, prop)— read rawstyleattributes (whereenv(...)strings live) and computed values.
Phase 3 — Real-device compat & visual / a11y (not landed)
- Long-press own/other post, swipe lightbox L/R, swipe-down dismiss, pull-to-refresh, double-tap like.
- Safe-area inset visual diff on iPhone notch.
- Touch-target ≥ 44 px audit.
- Tier B Samsung Internet via
connectOverCDPon Android Studio emulator. - Tier C BrowserStack integration (paid, optional).
@axe-core/playwrightaccessibility audits.- Visual regression with screenshot diffs.
Out of scope (handed to other tools)
- Load testing → k6 / Vegeta.
- API contract testing → backend
cargo testintegration tests. - Static asset auditing → Lighthouse CI.