df275bbefa
Adversarial re-review of the persona-audit + audit-followup rounds (6411747..)
found one HIGH and one MED regression plus LOW gaps. All fixed with coverage.
HIGH — export stale-keepsake resurrected by an open_event race
A reopen landing in the window between a *current* export worker's finalize_job
and its ready-flag flip cleared export_released_at + the ready flags but left the
export_job row `done` at the same release_seq. The seq-guarded flip then still
matched and re-set export_{zip,html}_ready=TRUE on a pre-reopen snapshot; the next
re-release read that stale TRUE and skipped regeneration (`if ready { continue }`),
serving a keepsake missing every upload from the reopen window — the exact data
loss migration 012 exists to prevent. Both ready-flip UPDATEs are now additionally
anchored on `export_released_at IS NOT NULL`, so a landed reopen makes the flip a
no-op and the re-release regenerates cleanly.
MED — queue dedup broke for reloaded items
loadQueue rebuilt QueueItems from IndexedDB without copying lastModified, which the
new addToQueue dedup keys on. A file re-selected after a page reload / PWA relaunch
missed the duplicate check and uploaded twice. Rehydration now carries lastModified
(extracted to a pure, tested entryToQueueItem helper).
LOW
- diashow: clear the upload-processed debounce timer in onDestroy (no stray
post-unmount /feed fetch).
- USER_JOURNEYS §9.5: document the reconnect-delta ban replay (hidden_user_ids /
uploads_hidden_at, migration 013), not just the live user-hidden SSE.
- e2e api-client: drop the misleading hide_uploads param from banUser — the backend
takes no body and always hides; strip the dead boolean at all call sites.
Tests
- Extract isReversibleLock (the terminal-403 KEEP-vs-PURGE-blob discriminator) into a
pure exported helper + unit tests, so the data-loss-critical branch is covered
without an XHR harness.
- entryToQueueItem unit tests lock the lastModified-carry regression.
- Document the export flip-race guard in the reopen/re-release spec (the sub-ms
finalize↔flip interleave isn't deterministically forceable with fast fixtures;
covered by the SQL guard + the end-to-end completeness test).
Verified: backend 40 tests, frontend 44 unit tests, svelte-check 0 errors,
e2e 156 passed / 1 skipped on chromium-desktop.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
76 lines
2.6 KiB
TypeScript
76 lines
2.6 KiB
TypeScript
/**
|
|
* Regression for the review's H3: self-deleting an upload and banning a user with
|
|
* hide_uploads mutated visibility server-side but broadcast nothing, so the
|
|
* content lingered on every other viewer's feed (and the projector diashow) until
|
|
* a manual reload. Both now emit SSE so clients evict live.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
import { seedUpload } from '../../helpers/seed';
|
|
import { SseListener } from '../../helpers/sse-listener';
|
|
|
|
const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
|
|
|
|
test.describe('Host — live SSE eviction (H3)', () => {
|
|
test('self-deleting an upload broadcasts upload-deleted', async ({ guest }) => {
|
|
const g = await guest('SelfDeleter');
|
|
const uploadId = await seedUpload(g.jwt, { caption: 'delete me' });
|
|
|
|
const sse = new SseListener();
|
|
await sse.start(g.jwt);
|
|
|
|
const res = await fetch(`${BASE}/api/v1/upload/${uploadId}`, {
|
|
method: 'DELETE',
|
|
headers: { Authorization: `Bearer ${g.jwt}` },
|
|
});
|
|
expect(res.status).toBe(204);
|
|
|
|
await sse.waitForEvent(
|
|
'upload-deleted',
|
|
(e) => e.data.upload_id === uploadId
|
|
);
|
|
});
|
|
|
|
test('banning a user with hide_uploads broadcasts user-hidden', async ({
|
|
api,
|
|
host,
|
|
guest,
|
|
}) => {
|
|
const target = await guest('HideTarget');
|
|
await seedUpload(target.jwt, { caption: 'should vanish' });
|
|
|
|
const sse = new SseListener();
|
|
await sse.start(host.jwt);
|
|
|
|
await api.banUser(host.jwt, target.userId);
|
|
|
|
await sse.waitForEvent(
|
|
'user-hidden',
|
|
(e) => e.data.user_id === target.userId
|
|
);
|
|
});
|
|
|
|
// Frontend regression: the broadcasts above are inert if the client never
|
|
// registers the event name (the KNOWN_EVENTS gap that shipped both eviction
|
|
// handlers as dead code). Drive a real browser feed and assert LIVE eviction —
|
|
// this fails if 'user-hidden' is missing from KNOWN_EVENTS, unlike the
|
|
// backend-only SseListener checks above.
|
|
test('a hidden user is evicted from an open feed without reload (frontend)', async ({
|
|
page,
|
|
api,
|
|
host,
|
|
guest,
|
|
signIn,
|
|
}) => {
|
|
const viewer = await guest('LiveEvictViewer');
|
|
const target = await guest('LiveEvictTarget');
|
|
await seedUpload(target.jwt, { caption: 'evict-me-live-xyz' });
|
|
|
|
await signIn(page, viewer); // lands on the event-wide /feed
|
|
await expect(page.getByText('evict-me-live-xyz').first()).toBeVisible();
|
|
|
|
// Host hides the target — the viewer's feed must drop the card via SSE, no reload.
|
|
await api.banUser(host.jwt, target.userId);
|
|
await expect(page.getByText('evict-me-live-xyz')).toHaveCount(0, { timeout: 15_000 });
|
|
});
|
|
});
|