36fe59caa5
Follows the perf + security + user-flow work with a role/persona audit (guest, host, admin, projector) and fixes across three review rounds. Highlights: HIGH - Ban now replays on reconnect. A ban isn't a soft-delete, and the `user-hidden` SSE has no replay, so a client that missed it (esp. the unattended diashow) kept cycling a banned user's slides. New `uploads_hidden_at` (migration 013) + `hidden_user_ids` in /feed/delta; feed + diashow evict those users. Applied even on a truncated delta. MEDIUM - Locked-upload data loss: a photo staged offline during a lock/release was purged as a terminal 4xx and lost when the host reopened. New reversible `uploads_locked` error code; the queue keeps the blob and auto-resumes on the `event-opened` SSE. - Reopen after release now warns (ConfirmSheet) that it revokes the published keepsake. - Host "forgotten-PIN" badge updates live (`pin-reset-requested` was broadcast but never in KNOWN_EVENTS / subscribed); host page also refetches on `pin-reset` so a two-host race can't hand out a conflicting PIN. - Ban modal copy fixed (read-only ban, not "session ended"); Degradieren/Sperren/Entsperren hidden on peer-host rows for non-admins (they always 403'd). - Host dashboard shows live keepsake generation progress / ready state + link to /export. - Admin JWT moved to sessionStorage (§11.1) to bound exposure on shared devices. Export generation guard (H1 from the prior round, hardened): per-(event,type) `release_seq` (migration 012) with seq-guarded claim/finalize/mark_failed/update_progress, per-generation temp/final paths, download follows `file_path`, prune only strictly-older generations. LOW: diashow coalesces upload-processed (avoids self-rate-limit); event-closed reconciles galleryReleased; /recover gains a forgot-PIN request + drops a stale cached PIN on 401; delta `>=` tie-break + 429 retry; misc copy/labels. Adds e2e: ban-replay, upload-lock-code, and rewrites export-reopen-rerelease with a data-completeness test. Reconciles USER_JOURNEYS §9/§11. Verified: cargo build clean, 40 unit tests, svelte-check 0 errors, 33 frontend unit tests, 155 e2e passing on chromium-desktop. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
59 lines
2.6 KiB
TypeScript
59 lines
2.6 KiB
TypeScript
/**
|
|
* Regression guard — a ban must replay in the reconnect delta so a client that missed the
|
|
* ephemeral `user-hidden` SSE (most acutely the unattended diashow projector) still evicts
|
|
* the banned user's already-loaded slides instead of cycling them all night.
|
|
*
|
|
* A ban is NOT a soft-delete (no `upload.deleted_at`), so it never appears in the delta's
|
|
* `deleted_ids`. The fix: `uploads_hidden_at` stamps when a user became hidden, and
|
|
* `/feed/delta` returns `hidden_user_ids` for users hidden since the client's cursor. The
|
|
* client (feed + diashow) evicts all uploads from those users.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
import { seedUpload } from '../../helpers/seed';
|
|
|
|
const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
|
|
|
|
async function feedDelta(jwt: string, since: string): Promise<any> {
|
|
const res = await fetch(`${BASE}/api/v1/feed/delta?since=${encodeURIComponent(since)}`, {
|
|
headers: { Authorization: `Bearer ${jwt}` },
|
|
});
|
|
expect(res.status).toBe(200);
|
|
return res.json();
|
|
}
|
|
|
|
test.describe('Realtime — ban replays in the reconnect delta (H1 audit fix)', () => {
|
|
test('a ban since the cursor is in hidden_user_ids; a ban before it is not', async ({
|
|
host,
|
|
guest,
|
|
api,
|
|
}) => {
|
|
const g = await guest('BanReplayGuest');
|
|
await seedUpload(g.jwt, { caption: 'to be hidden' });
|
|
|
|
// Cursor BEFORE the ban — this is the "last-seen" point a disconnected client holds.
|
|
const before = await feedDelta(host.jwt, '2000-01-01T00:00:00Z');
|
|
const cursorBefore: string = before.server_time;
|
|
expect(before.hidden_user_ids).not.toContain(g.userId); // not hidden yet
|
|
|
|
// Ban the guest (read-only ban; content hidden everywhere).
|
|
await api.banUser(host.jwt, g.userId);
|
|
|
|
// A delta from the pre-ban cursor MUST surface the ban so the client can evict.
|
|
const afterBan = await feedDelta(host.jwt, cursorBefore);
|
|
expect(afterBan.hidden_user_ids, 'ban replayed to a client that missed the live event').toContain(
|
|
g.userId
|
|
);
|
|
|
|
// And a delta from a cursor AFTER the ban must NOT re-surface it (the `>= since` filter
|
|
// means a client already past the ban isn't told again forever).
|
|
const cursorAfter: string = afterBan.server_time;
|
|
const afterCursor = await feedDelta(host.jwt, cursorAfter);
|
|
expect(afterCursor.hidden_user_ids).not.toContain(g.userId);
|
|
|
|
// Unban clears the timestamp, so a fresh ban later would replay again.
|
|
await api.unbanUser(host.jwt, g.userId);
|
|
const afterUnban = await feedDelta(host.jwt, '2000-01-01T00:00:00Z');
|
|
expect(afterUnban.hidden_user_ids).not.toContain(g.userId);
|
|
});
|
|
});
|