36fe59caa5
Follows the perf + security + user-flow work with a role/persona audit (guest, host, admin, projector) and fixes across three review rounds. Highlights: HIGH - Ban now replays on reconnect. A ban isn't a soft-delete, and the `user-hidden` SSE has no replay, so a client that missed it (esp. the unattended diashow) kept cycling a banned user's slides. New `uploads_hidden_at` (migration 013) + `hidden_user_ids` in /feed/delta; feed + diashow evict those users. Applied even on a truncated delta. MEDIUM - Locked-upload data loss: a photo staged offline during a lock/release was purged as a terminal 4xx and lost when the host reopened. New reversible `uploads_locked` error code; the queue keeps the blob and auto-resumes on the `event-opened` SSE. - Reopen after release now warns (ConfirmSheet) that it revokes the published keepsake. - Host "forgotten-PIN" badge updates live (`pin-reset-requested` was broadcast but never in KNOWN_EVENTS / subscribed); host page also refetches on `pin-reset` so a two-host race can't hand out a conflicting PIN. - Ban modal copy fixed (read-only ban, not "session ended"); Degradieren/Sperren/Entsperren hidden on peer-host rows for non-admins (they always 403'd). - Host dashboard shows live keepsake generation progress / ready state + link to /export. - Admin JWT moved to sessionStorage (§11.1) to bound exposure on shared devices. Export generation guard (H1 from the prior round, hardened): per-(event,type) `release_seq` (migration 012) with seq-guarded claim/finalize/mark_failed/update_progress, per-generation temp/final paths, download follows `file_path`, prune only strictly-older generations. LOW: diashow coalesces upload-processed (avoids self-rate-limit); event-closed reconciles galleryReleased; /recover gains a forgot-PIN request + drops a stale cached PIN on 401; delta `>=` tie-break + 429 retry; misc copy/labels. Adds e2e: ban-replay, upload-lock-code, and rewrites export-reopen-rerelease with a data-completeness test. Reconciles USER_JOURNEYS §9/§11. Verified: cargo build clean, 40 unit tests, svelte-check 0 errors, 33 frontend unit tests, 155 e2e passing on chromium-desktop. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
55 lines
2.3 KiB
TypeScript
55 lines
2.3 KiB
TypeScript
/**
|
|
* Regression guard — a locked/released event rejects uploads with the DISTINCT error code
|
|
* `uploads_locked` (not the generic `forbidden`), so the offline upload queue can tell this
|
|
* REVERSIBLE 403 apart from a permanent one (banned / quota). On `uploads_locked` the client
|
|
* KEEPS the queued blob and retries when the host reopens; a permanent 403 purges it. Before
|
|
* this, a photo staged during a lock was purged and lost the moment the host reopened.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
import { uploadRaw } from '../../helpers/upload-client';
|
|
import { readFileSync } from 'node:fs';
|
|
import { join } from 'node:path';
|
|
|
|
const SAMPLE = () => readFileSync(join(process.cwd(), 'fixtures', 'media', 'sample.jpg'));
|
|
|
|
test.describe('Upload — locked event uses a distinct, reversible 403 (audit fix)', () => {
|
|
test('closed event → 403 uploads_locked; reopen → upload succeeds', async ({ host, api }) => {
|
|
// Close the event: uploads are locked for everyone.
|
|
await api.closeEvent(host.jwt);
|
|
|
|
const locked = await uploadRaw(host.jwt, SAMPLE(), {
|
|
filename: 'during-lock.jpg',
|
|
contentType: 'image/jpeg',
|
|
});
|
|
expect(locked.status).toBe(403);
|
|
const lockedBody = await locked.json();
|
|
// The distinct code is what tells the client to KEEP the blob (reversible), not purge it.
|
|
expect(lockedBody.error).toBe('uploads_locked');
|
|
|
|
// Reopen → the same upload now goes through (the queued blob would have survived).
|
|
await api.openEvent(host.jwt);
|
|
const ok = await uploadRaw(host.jwt, SAMPLE(), {
|
|
filename: 'after-reopen.jpg',
|
|
contentType: 'image/jpeg',
|
|
});
|
|
expect(ok.status, 'upload succeeds once the host reopens').toBeLessThan(300);
|
|
});
|
|
|
|
test('released gallery → 403 uploads_locked (also reversible via reopen)', async ({ host }) => {
|
|
const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
|
|
const rel = await fetch(`${BASE}/api/v1/host/gallery/release`, {
|
|
method: 'POST',
|
|
headers: { Authorization: `Bearer ${host.jwt}` },
|
|
});
|
|
expect(rel.status).toBe(204);
|
|
|
|
const rejected = await uploadRaw(host.jwt, SAMPLE(), {
|
|
filename: 'after-release.jpg',
|
|
contentType: 'image/jpeg',
|
|
});
|
|
expect(rejected.status).toBe(403);
|
|
const body = await rejected.json();
|
|
expect(body.error).toBe('uploads_locked');
|
|
});
|
|
});
|