1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
"""
A signed-in person is never shown the sign-in form.
Found live on meshbay.org (2026-09-14): a browser already signed in as one
account opened on `#/login` — a hash left in the address bar, restored with the
session — and the router drew the login form, prefilled by the browser with
another account's name and passphrase, under a navigation bar and a sidebar
that already showed the first account and its Administration entry. The router
tested the route before it tested for a user.
Source-level, as the other routing guards here are: the SPA has no component
test harness, and the whole defect is the order of two conditions.
"""
import re
from pathlib import Path
import pytest
STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static"
APP = STATIC / "app.js"
pytestmark = pytest.mark.skipif(not APP.exists(), reason="SPA sources unavailable")
@pytest.fixture(scope="module")
def app_body() -> str:
source = APP.read_text(encoding="utf-8")
start = source.index("\nfunction App() {")
return source[start:source.index("\n}\n", start)]
def _branch_rendering(body: str, page: str) -> str:
"""The `else if (...)` condition of the branch that renders `page`."""
at = body.index(f"<${{{page}}}")
head = body.rindex("} else if (", 0, at)
return body[head:body.index("{\n", head)]
def test_the_login_and_register_forms_need_no_one_signed_in(app_body):
cond = _branch_rendering(app_body, "RegisterPage")
assert "!user" in cond, (
f"the sign-in/sign-up branch renders whoever is signed in: {cond!r}")
assert re.search(r"onAuthForm\s*&&\s*!user", cond)
def test_the_reset_flow_is_not_cut_off_when_it_signs_in(app_body):
"""ResetPasswordPage calls onLogin, then shows progress and a result. Gating
it on `!user` would unmount it the moment it signs the person in."""
cond = _branch_rendering(app_body, "ResetPasswordPage")
assert "route === '/reset'" in cond
assert not re.search(r"route === '/reset'\s*&&\s*!user", cond)
def test_a_signed_in_person_on_the_form_is_sent_home_without_a_history_entry(app_body):
assert "const onAuthForm = route === '/login' || route === '/register';" in app_body
effect = app_body[app_body.index("if (user && onAuthForm)"):]
effect = effect[:effect.index("\n")]
# `replace`, whichever the destination: home, or the invitation that sent
# them to sign in (invite-link.js). Assigning the hash would leave the form
# one Back away.
assert "window.location.replace(" in effect and "'#/'" in effect, (
"Back must not lead to the form again")
assert "window.location.hash" not in effect
|