137c4ee8a1
The keepsake download navigates a hidden, same-origin iframe (deliberately: a top-level navigation to a 404/429 would unload the PWA). Caddy stamped a site-wide `X-Frame-Options: DENY` that also covered the proxied `/api/*`. Blink hands a `Content-Disposition: attachment` response to the download manager at the network layer, so Chromium never noticed. WebKit enforces XFO on the frame navigation first and aborts the load — so on iOS Safari, the app's primary platform, tapping Download did nothing at all, silently. Carve the two export endpoints out to SAMEORIGIN, which still blocks cross-origin framing. Implemented as two disjoint matchers rather than an override: Caddy applies the FIRST `header` directive outermost, so it wins on write and a later, more specific `header` is silently ignored (verified against the running test stack). Also close the test gap that let this ship: - `06-export` ran on chromium-desktop only; add it to `webkit-iphone`, the only engine that enforces XFO on the download frame. - No test in the suite ever clicked a download button — every archive assertion used Node `fetch`, which has no frame and no XFO enforcement. Add a spec that clicks it and awaits a real `download` event. Verified falsifiable: with the blanket DENY reinstated it fails and reports the WebKit refusal as the cause. - Fix `ExportPage`'s card-scoped locators, which matched nothing: the cards carry `class="card p-5"` (a Tailwind `@apply` component class), never the `rounded-xl` the page object looked for. This had left the "shows enabled download buttons" test red on main. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
32 lines
1.3 KiB
Caddyfile
32 lines
1.3 KiB
Caddyfile
# Caddyfile used only by the E2E test stack. Listens on the in-container :3101
|
|
# (mapped to host :3101) and proxies API + media to the backend, everything else
|
|
# to the SvelteKit frontend container — same layout as production but stripped
|
|
# of HTTPS/Let's Encrypt.
|
|
|
|
:3101 {
|
|
# Mirror prod: exclude the SSE stream from compression so buffering doesn't
|
|
# delay real-time events (and so the test stack exercises the real behavior).
|
|
@compressible not path /api/v1/stream
|
|
encode @compressible zstd gzip
|
|
|
|
# Mirror prod's security headers (minus HSTS, which is HTTPS-only).
|
|
header {
|
|
X-Content-Type-Options "nosniff"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
}
|
|
|
|
# Mirror prod's export carve-out: the keepsake download targets a hidden
|
|
# same-origin iframe, and WebKit enforces XFO before Content-Disposition.
|
|
# Two disjoint matchers, not an override — see the comment in ../Caddyfile.
|
|
@framable path /api/v1/export/zip /api/v1/export/html
|
|
@not_framable not path /api/v1/export/zip /api/v1/export/html
|
|
header @framable X-Frame-Options "SAMEORIGIN"
|
|
header @not_framable X-Frame-Options "DENY"
|
|
|
|
reverse_proxy /api/* app:3000
|
|
reverse_proxy /media/* app:3000
|
|
reverse_proxy /health app:3000
|
|
|
|
reverse_proxy frontend:3001
|
|
}
|