path: root/packages/meshbay-hub/tests/test_transport_contracts.py

"""
Two wire contracts in transport.js that fail quietly when broken.

Neither can be reached from Python, and `QE/deploy/e2e.py` is a second
implementation of the client rather than a test of this one, so these read the
source. That is weak evidence in general, and the right kind here: both defects
below produce a plausible screen rather than an error.

  - History paged forward from the oldest message, so a group with more than
    200 of them opened on its first screen and the recent conversation could
    not be reached. Nothing threw; the wrong messages were simply shown.
  - A reply that is not routed falls through to "resolve the oldest pending
    request". Adding a ping made that dangerous: a pong handed to a waiting
    history request satisfies it with a message that has no `messages` field,
    and the conversation renders empty.
"""

import re
from pathlib import Path

import pytest

STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static"
TRANSPORT = STATIC / "transport.js"
APP = STATIC / "app.js"
# Chat's history paging/scroll-anchoring logic and GroupPage's own connect()
# effect moved out of app.js in the group-page refactor.
CHAT_APP = STATIC / "chat-app.js"
GROUP_PAGE = STATIC / "group-page.js"
CREATE_GROUP = STATIC / "create-group-page.js"
SPLIT_FILES = [APP, GROUP_PAGE, CHAT_APP, STATIC / "files-app.js",
              STATIC / "video-player.js", STATIC / "video-app.js",
              STATIC / "music-app.js", STATIC / "music-player.js",
              STATIC / "photos-app.js", STATIC / "pager.js",
              STATIC / "group-settings.js",
              # Same reason as test_hook_ordering's STATIC_FILES: these are
              # reached through the registry, so leaving one out here means it
              # is simply never checked.
              STATIC / "settings-ui.js", STATIC / "folder-tree.js",
              STATIC / "chat-app-settings.js",
              STATIC / "video-app-settings.js",
              STATIC / "music-app-settings.js",
              STATIC / "photos-app-settings.js",
              STATIC / "helloworld-app.js",
              STATIC / "helloworld-app-settings.js",
              STATIC / "menu.js", STATIC / "playlist-menu.js",
              STATIC / "auth-page.js", STATIC / "explore-page.js",
              CREATE_GROUP]

pytestmark = pytest.mark.skipif(
    not TRANSPORT.exists(), reason="the SPA sources are not available")


@pytest.fixture(scope="module")
def transport():
    return TRANSPORT.read_text()


@pytest.fixture(scope="module")
def app():
    return APP.read_text()


@pytest.fixture(scope="module")
def chat():
    return CHAT_APP.read_text()


@pytest.fixture(scope="module")
def group_page():
    return GROUP_PAGE.read_text()


@pytest.fixture(scope="module")
def create_group():
    return CREATE_GROUP.read_text()


def test_chat_history_pages_backwards(transport):
    body = transport[transport.index("async fetchChatHistory"):]
    body = body[:body.index("\n  }")]
    assert "before" in body, "the request must carry a backward cursor"
    assert "since" not in body, (
        "`since` pages forward from the oldest message — that was the bug")


def test_chat_history_reports_whether_more_exists(transport):
    body = transport[transport.index("async fetchChatHistory"):]
    body = body[:body.index("\n  }")]
    assert "has_more" in body, (
        "without it the 'load older' control cannot know when to stop offering")


def test_the_browser_asks_for_the_newest_page_first(chat):
    """A group opens on the newest messages, not the oldest."""
    assert "fetchChatHistory({ limit: CHAT_PAGE })" in chat
    assert re.search(r"const CHAT_PAGE\s*=\s*100", chat)
    assert re.search(r"const CHAT_OLDER_PAGE\s*=\s*50", chat)


def test_older_pages_are_requested_with_a_cursor_not_an_offset(chat):
    assert "before: messages[0].id" in chat, (
        "paging by offset repeats or skips messages when one arrives mid-scroll")


def test_pong_is_routed_by_its_echoed_token(transport):
    """Not left to the oldest-pending fallback, which would empty a chat."""
    assert "if (msg.type === 'pong')" in transport
    routing = transport[transport.index("if (msg.type === 'pong')"):]
    routing = routing[:routing.index("const oldest")]
    assert "handler._key === key" in routing
    assert "return;" in routing, (
        "a pong for a timed-out probe must stop here, not fall through")


def test_ping_requests_are_keyed(transport):
    assert "`ping:${obj.token}`" in transport, (
        "an unkeyed ping cannot be matched to its pong")


def test_ping_can_time_out_sooner_than_a_transfer(transport):
    """30 s is right for a chunk and useless for a liveness probe."""
    assert "_sendAndWait(obj, timeoutMs = 30000)" in transport
    body = transport[transport.index("  async ping("):]
    body = body[:body.index("\n  }")]
    assert "timeoutMs" in body


def test_scroll_position_is_anchored_when_older_messages_are_prepended(chat):
    """Everything above the viewport grows, so scrollTop alone is not enough."""
    assert "scrollHeight - list.scrollTop" in chat, "the anchor is measured from the bottom"
    assert "list.scrollTop = list.scrollHeight - anchorRef.current" in chat
    assert "useLayoutEffect" in chat, (
        "correcting after paint shows the jump it is meant to prevent")


def test_the_view_only_follows_new_messages_when_already_at_the_bottom(chat):
    assert "if (atBottomRef.current) list.scrollTop = list.scrollHeight" in chat, (
        "scrolling unconditionally fights someone reading back through history")


def test_every_authorize_admin_op_call_is_registered_in_admin_op_types(transport):
    """
    Found live (docs/MESHBAY_DESIGN.md §9.9's photo_roots): `setPhotoRoots` called
    `_authorizeAdminOp(msg, 'photo_roots', ...)` like every other admin op,
    but `photo_roots` was never added to `ADMIN_OP_TYPES` — so its initial
    request was never keyed `admin:photo_roots`, the node's `admin_challenge`
    reply matched no pending request (_dispatch's own keyed block, which
    `return`s unconditionally whether or not it found a match), and the
    request sat until its 30 s timeout with no error and no admin prompt.
    `ADMIN_OP_TYPES`'s own comment already narrates this exact bug once,
    for `audio_root`/`apps_enabled` — this pins it so a third op cannot
    reintroduce it silently.
    """
    set_body = transport[transport.index("const ADMIN_OP_TYPES = new Set(["):]
    set_body = set_body[:set_body.index("]);")]
    registered = set(re.findall(r"'([a-z_]+)'", set_body))

    called = set(re.findall(r"_authorizeAdminOp\(\s*\w+,\s*'([a-z_]+)'", transport))
    assert called, "the extraction pattern itself found nothing — check it against transport.js"
    missing = called - registered
    assert not missing, (
        f"{sorted(missing)} call _authorizeAdminOp but are missing from ADMIN_OP_TYPES — "
        "their admin_challenge will silently time out instead of ever reaching the user")


def test_the_bottom_is_reached_by_scrollTop_not_a_sentinel(chat):
    """scrollIntoView on a zero-height marker stops short of the true bottom.

    The list has padding and a flex gap below the last bubble, so aligning an
    empty div to the viewport bottom left the bar a few pixels from the end —
    visible on opening a group and again after sending a message.
    """
    # The call, not the word: a comment explaining why it is gone should not
    # be able to fail this.
    assert ".scrollIntoView(" not in chat
    assert "list.scrollTo({ top: list.scrollHeight" in chat, (
        "jumping to the latest should also land on the real bottom")


def test_messages_are_keyed_by_id_not_index(chat):
    """Index keys plus prepending makes Preact reuse the wrong bubbles."""
    assert "key=${m.id}" in chat
    assert "key=${i}" not in chat.split("function ChatPanel")[1].split("\n}")[0]


def test_presence_has_three_states_and_a_label_for_each(app):
    for state in ("online", "offline", "unknown"):
        assert f"presence-{state}" in (STATIC / "style.css").read_text()
    assert "t('presence.' + state)" in app, (
        "red and green are the pair colour-blind readers cannot separate, so "
        "the dot needs a title and an aria-label, not just a colour")


def _string(source: str, key: str) -> str:
    """One locale entry's text, whether it is written on one line or spliced
    across several with `+`."""
    start = source.index(f"'{key}':") + len(f"'{key}':")
    end = source.index("\n  '", start)
    return source[start:end]


def test_a_refusal_from_the_node_counts_as_present(group_page):
    """The node answering "no" proves it is up; only silence proves nothing."""
    assert "err.reason ? 'online' : 'offline'" in group_page


# ── The create-group form ─────────────────────────────────────────────────────

def test_the_form_asks_one_question_not_two(create_group):
    """
    Visibility and admission were separate selectors that could only ever be set
    together, and the form knew it — picking Public reached over and set the
    policy. Two of the four combinations were impossible: the API refused
    public+invite with a 422, and private+open is a directory listing nobody can
    find, joining being through the node rather than a link.

    So there is one selector. "Open" is what makes a group listed, and the
    request derives the rest.
    """
    form = create_group[create_group.index("function CreateGroupFormSimple"):]
    form = form[:form.index("\n}\n")]

    assert "setVisibility(" not in form, "the visibility selector is back"
    assert "t('create_group.join_policy')" in form
    assert "joinPolicy === 'open' ? 'public' : 'private'" in form, (
        "the request must derive visibility rather than leave it unset")


def test_the_form_says_what_each_choice_means_for_finding_the_group(app):
    """Dropping the visibility box removes the words "public" and "private"
    from the page. If the descriptions do not say it, nothing does — and
    somebody publishes a group without meaning to."""
    en = (STATIC / "locales" / "en.js").read_text(encoding="utf-8")
    invite = _string(en, "create_group.invite_desc")
    open_ = _string(en, "create_group.open_desc")
    assert "not listed" in invite.lower()
    assert "listed" in open_.lower() and "anyone" in open_.lower()


def test_the_strings_the_visibility_box_used_are_gone(app):
    """A key nobody reads is a key that rots, and ten locales carry each one."""
    for locale in (STATIC / "locales").glob("*.js"):
        text = locale.read_text(encoding="utf-8")
        for key in ("create_group.visibility", "create_group.private",
                    "create_group.public_is_open", "create_group.public_desc"):
            assert f"'{key}'" not in text, f"{locale.name} still carries {key}"


def test_the_form_starts_on_a_combination_the_api_accepts(create_group):
    form = create_group[create_group.index("function CreateGroupFormSimple"):]
    assert "useState('invite')" in form[:form.index("return html")]


# ── Dead references in the SPA ────────────────────────────────────────────────

def test_no_setter_survives_the_state_it_belonged_to():
    """A removed useState leaves its setter behind, and nothing complains.

    `setActionsOpen` outlived `actionsOpen` when the Actions dropdown became a
    row of buttons, and shipped: every action in the Files panel threw
    ReferenceError on click. No Python test could see it and e2e.py does not
    drive the SPA, so the shape is checked here instead.

    A grep for the state name does not find it — `setActionsOpen` does not
    contain `actionsOpen`, the capital breaks the match. That is exactly how it
    got through.

    Checked per file rather than on one concatenated blob: the group-page
    refactor split what used to be one app.js into several, and a setter
    defined in one (e.g. `setAuth`, imported from hub-client.js) must not be
    mistaken for covering an orphan call of the same name in another. Lifting
    state to the shared shell and passing its setter down as a prop is the
    same idea one level lower — `FilesPanel`'s `setEntries` is real, just
    declared in group-page.js's own `useState` rather than here — so a setter
    named in a component's own destructured props is treated as defined too.
    """
    import re
    for path in SPLIT_FILES:
        app = path.read_text()
        declared = set(re.findall(r"const \[\s*\w+\s*,\s*(set\w+)\s*\]\s*=\s*useState", app))
        # Names brought in from another module are defined, just not here.
        imported = set()
        for names in re.findall(r"import\s*\{([^}]*)\}\s*from", app):
            imported.update(n.strip().split(" as ")[-1].strip() for n in names.split(","))
        # A bare call only: `downloads.setMode(...)` and `view.setUint32(...)`
        # belong to their object, not to this component.
        called = set(re.findall(r"(?<![.\w])(set[A-Z]\w*)\s*\(", app))
        builtin = {"setTimeout", "setInterval"}
        # A `setX` that is a plain function of this module is not an orphan
        # setter: `setAuth` writes the session to localStorage and has no
        # `useState` behind it by design. Without this the rule reports every
        # such helper, and a rule that cries wolf is one someone eventually
        # silences.
        defined = set(re.findall(r"^(?:async\s+)?function\s+(set[A-Z]\w*)\s*\(", app, re.M))
        defined |= set(re.findall(r"^\s*const\s+(set[A-Z]\w*)\s*=", app, re.M))
        # A setter named in a `function Component({ ..., setX, ... })` prop
        # list is handed down from wherever it is really declared.
        for params in re.findall(r"^function [A-Z]\w*\(\{([^}]*)\}", app, re.M):
            defined.update(re.findall(r"\b(set[A-Z]\w*)\b", params))

        orphans = sorted(called - declared - imported - builtin - defined)
        assert not orphans, (
            f"{path.name}: setter(s) called with no useState behind them: "
            f"{orphans} — each one is a ReferenceError the moment that code "
            "path runs")


# ── Parallel uploads ──────────────────────────────────────────────────────────

def test_an_upload_refusal_names_the_upload_it_is_about(transport):
    """Reported 2026-08-16: a second upload started in parallel killed both.

    An error used to carry nothing identifying, so the client could not tell
    whose it was and failed every upload in flight — one name the node disliked
    took the other file with it.

    The node named the *file* until MNP 2.0 and names the `upload_id` now: the
    filename moved inside the seal, and echoing it in clear so the two sides
    could match on it would give back precisely what sealing the upload is for.
    The property is unchanged — one refusal, one failed upload.
    """
    body = transport[transport.index("if (msg.type === 'error' && this._uploaders.size)"):]
    body = body[:body.index("\n    if (msg.type === 'chat_msg'")]
    assert "this._uploaders.has(msg.upload_id)" in body, (
        "a named refusal must reach one uploader, not all of them")
    assert "if (!msg.upload_id)" in body, (
        "an unnamed error from an older node must still stop everything — "
        "guessing which upload it belongs to would be worse")


def test_uploads_are_tracked_per_upload(transport):
    """Acks interleave when two files are in flight."""
    assert "this._uploaders = new Map()" in transport
    assert "this._uploaders.set(uploadId" in transport
    # The "already being uploaded" guard is keyed by folder and name, as the
    # node's own upload state is: a dropped folder can hold two files of one name.
    assert "const inFlightKey = `${dir || ''}/${file.name}`;" in transport
    assert "this._inFlightUploads.has(inFlightKey)" in transport
    # And its error still speaks in the filename the caller would recognise.
    assert "`${file.name} is already being uploaded`" in transport


def test_the_upload_itself_is_sealed(transport):
    """
    MNP 2.0. The filename, the destination and the bytes go inside the seal
    together — sealing the content and announcing the name beside it would be
    theatre — and only what the node routes on stays outside.
    """
    start = transport.index("  async uploadFile(file,")
    body = transport[start:transport.index("\n  /** Create a directory", start)]
    assert "sealGroup(" in body and "'file_upload'" in body, (
        "the upload must be sealed under the group key")
    assert "openGroup(" in body and "'file_upload_ack'" in body, (
        "the ack carries the stored name and must be opened, not read")
    # The messages the node actually receives: everything between each
    # `this._send({` and its close. Read on their own, because the same field
    # names appear a few lines above inside `msgpack_encode({...})`, which is
    # the sealed half.
    #
    # Every one of them, not the first: `uploadFile` sends a probe chunk before
    # the file ("where am I?", UPLOAD_PROBE_INDEX) and it names the file too, so
    # a check that stopped at the first message would have moved off the one it
    # was written for the day the second appeared.
    sends = []
    rest = body
    while "this._send({" in rest:
        rest = rest[rest.index("this._send({"):]
        sends.append(rest[:rest.index("});")])
        rest = rest[len("this._send({"):]
    assert len(sends) >= 2, "the probe and the chunks are both sent from here"
    for sent in sends:
        assert "filename" not in sent, "the filename is on the message in clear"
        assert "data" not in sent, "the bytes are on the message in clear"
        assert "dir" not in sent and "root" not in sent, (
            "the destination is on the message in clear")
        assert "...sealed," in sent or "...probeSealed," in sent, (
            "the message must carry the sealed pair")
    # And no branch that sends anything else: an upload is sealed or it is not
    # sent. A fallback here is a fallback the node would have to keep opening.
    assert "filename: file.name" not in body.replace(
        "msgpack_encode({ filename: file.name", ""), (
        "a filename reaches the message outside the seal")


# ── MNP 1.0: the sealed handshake ack ────────────────────────────────────────
#
# The index half is measured for real in `test_index_seal_client.py`. The ack is
# opened inside `connect()`, three messages into a WebRTC negotiation, so these
# read the source — and the ordering they pin is the whole security argument, not
# an implementation detail.

def _handshake_block(transport: str) -> str:
    start = transport.index("if (reply.type === 'handshake_challenge') {")
    return transport[start:transport.index("      return ack;", start)]


def test_the_ack_is_verified_before_it_is_decrypted(transport):
    """
    Verify, then decrypt. Opening the payload first would mean acting on data
    from a peer we have not yet authenticated — which is the exact shape of C3,
    where `node_pk` was never checked and a peer that had hijacked signaling
    could serve a forged index and a forged `is_node_admin`.
    """
    block = _handshake_block(transport)
    proof = block.index("Node failed to prove GEK possession")
    signature = block.index("Node signature invalid")
    pinned = block.index("_checkNodePin(")
    opened = block.index("openGroup(")
    assert proof < opened, "the payload is opened before the GEK proof is checked"
    assert signature < opened, "the payload is opened before the signature is checked"
    assert pinned < opened, "the payload is opened before the node is pinned"


def test_an_ack_that_does_not_open_refuses_the_connection(transport):
    """
    Never a default. An `enabled_apps` that failed to open would otherwise reach
    the client's documented fallback — show every registered app — which is a
    confident wrong answer, indistinguishable from an operator's real choice.
    """
    block = _handshake_block(transport)
    opened = block[block.index("let config;"):block.index("return ack;")
                   if "return ack;" in block else len(block)]
    assert "throw new Error(" in opened, "a failed decrypt is swallowed"
    assert "handshake_ack" in opened, "the failure does not name the message"
    for fallback in ("|| {}", "?? {}", "catch { }", "config = {}"):
        assert fallback not in opened, (
            f"the ack falls back to {fallback} instead of refusing")


def test_the_handshake_declares_a_version_range(transport):
    """
    L2: `v` used to be written by everyone and read by nobody, so a mismatch
    surfaced as a missing field rather than a refusal. Both halves of the range
    ride the handshake, and the node's half is checked before anything below it
    in `connect()` runs.
    """
    block = transport[transport.index("type: 'handshake',"):]
    block = block[:block.index("});")]
    assert "v: MNP_V," in block and "v_min: MNP_V_MIN," in block

    challenge = _handshake_block(transport)
    assert challenge.index("_checkNodeVersion(") < challenge.index("openGroup("), (
        "the node's version is checked after its messages are relied on")


def test_the_index_is_never_reported_from_a_failed_decrypt(transport):
    """
    The consumer callbacks may only be reached from inside the opened path — a
    `catch` that called `_onIndexSync` with an empty message would show "this
    group has no files", which is a state a real group can be in.
    """
    body = transport[transport.index("async _applyIndexMessage("):]
    body = body[:body.index("\n  /**", 1)]
    assert "openGroup(" in body
    assert "catch" not in body, (
        "_applyIndexMessage swallows its own failure instead of letting "
        "_queueIndexMessage end the session")


# ── One node refusing must not take a group down (2026-09-11) ────────────────
#
# `/v1/groups/{id}/nodes` returns every node registered for the group, in hub
# registration order. GroupPage took `nodesData.nodes[0]` and stopped there, so
# a node that could not serve the group — refusing the handshake with "Group
# not hosted on this node" — made the group unopenable while the node that
# *did* host it sat second in the same list.
#
# These strip comments first. The lesson this repeats otherwise is the CSP read
# out of the comment above the meta tag, and the packaging unit whose test
# matched the comment explaining why `User=` was absent: a source-level check
# that can match prose is not a check.

def _code_only(src: str) -> str:
    """Source with // and /* */ comments removed. Crude, and enough here: no
    string literal in these files carries a comment marker."""
    src = re.sub(r"/\*.*?\*/", "", src, flags=re.S)
    return re.sub(r"^\s*//.*$", "", src, flags=re.M)


def test_the_group_page_tries_every_node_the_hub_offers(group_page):
    code = _code_only(group_page)
    assert "for (const n of nodesData.nodes)" in code, (
        "the connect effect must walk the list, not index into it")
    assert "nodesData.nodes[0]" not in code, (
        "taking the head and stopping is the defect — one wrongly registered "
        "node captured the whole group's traffic")


def test_a_not_hosted_refusal_moves_on_to_the_next_node(group_page):
    code = _code_only(group_page)
    body = code[code.index("for (const n of nodesData.nodes)"):]
    body = body[:body.index("if (!transport)")]
    assert "not_hosted" in body, (
        "without the code, a refusal this browser cannot act on is "
        "indistinguishable from one it must stop for")
    assert "throw e" in body, (
        "a refusal naming a state of this browser — a pairing code, a "
        "passphrase, a device — is the same from every node and must stop here")


def test_the_last_refusal_is_what_the_reader_is_told(group_page):
    code = _code_only(group_page)
    assert "if (!transport) throw (lastErr" in code, (
        "exhausting the list must report why, not fall through silently")


def test_the_refusal_the_loop_keys_on_has_a_message(transport):
    """A code the page routes on, with nothing to show, is a blank error."""
    refusals = transport[transport.index("const HANDSHAKE_REFUSALS"):]
    refusals = refusals[:refusals.index("};")]
    assert "not_hosted:" in refusals


# Search had the same `nodes[0]` twice — once to read a group's index, once for
# the pooled connection its thumbnails and playback use — and was not part of
# the fix above, so a group with a second, working node counted as unreachable
# there while it opened fine from the sidebar.

SEARCH_PAGE = STATIC / "search-page.js"


def test_search_tries_every_node_the_hub_offers():
    code = _code_only(SEARCH_PAGE.read_text(encoding="utf-8"))
    assert "nodes[0]" not in code, "Search takes the head of the node list again"
    walk = code[code.index("for (const n of nodesData.nodes)"):]
    walk = walk[:walk.index("throw (lastErr")]
    assert "not_hosted" in walk and "throw e" in walk, (
        "the walk must stop for a refusal about this browser and move on "
        "for one about this node")


def test_search_connects_in_one_place():
    """Two call sites with their own connect is how one of them kept `nodes[0]`,
    and how the sweep and the warm-up each negotiated the same group: every
    connection goes through the pool, and only the pool calls `connectToGroup`."""
    code = _code_only(SEARCH_PAGE.read_text(encoding="utf-8"))
    assert code.count("transport.connect(") == 1
    # The definition, and the pool's one call.
    assert code.count("connectToGroup(") == 2
    pool = code[code.index("async _doConnect("):code.index("_evict() {")]
    index = code[code.index("async function fetchGroupIndex("):
                 code.index("async function fetchAllIndexes(")]
    assert "connectToGroup(" in pool
    assert "pool.connect(" in index and "connectToGroup(" not in index


# node:start only links an unlinked node key to the hub account when it is
# given credentials to link it with (main.js's linkNodeKeyAndAwaitRunning on
# Windows, the equivalent inline block on Linux -- both gate on `opts.token`).
# create-group-page.js's own startNode() passes {hubUrl, username, token};
# the Node page's Start button, reachable independently of that wizard,
# passed none. Reproduced live 2026-09-14 on a fresh non-service Windows
# install signed in to the real hub: Start on a node that had never been
# linked (the ordinary state for anyone who has not gone through Create
# Group yet) polled for up to 105s and failed with "could not link" --
# cross-platform, since both mains share this same frontend call.
NODE_PAGE = STATIC / "node-page.js"


@pytest.fixture(scope="module")
def node_page():
    return NODE_PAGE.read_text(encoding="utf-8")


def test_node_page_start_button_can_link_an_unlinked_node(node_page):
    fn = node_page[node_page.index("function NodeServicePanel("):]
    fn = fn[:fn.index("\nfunction ") if "\nfunction " in fn else len(fn)]
    start_call = fn[fn.index("act('start'"):]
    start_call = start_call[:start_call.index(")}>")]
    assert "hubUrl" in start_call and "HUB" in start_call, (
        "the Start button must pass hubUrl (HUB) through to node:start, or "
        "an unlinked node can never link on Start alone")
    assert "username" in start_call and "token" in start_call, (
        "the Start button must pass username and token through to "
        "node:start -- linkNodeKeyAndAwaitRunning needs both to PUT the key")

    assert "import { HUB" in node_page or "import {HUB" in node_page, (
        "HUB must come from hub-client.js, the one file allowed to decide "
        "where the hub is"
    )


def test_node_page_receives_the_session_it_hands_to_start():
    """app.js is what actually has to hand token/username down; a fixed
    node-page.js reading them off undefined props is the same bug moved up
    one file."""
    app_src = APP.read_text(encoding="utf-8")
    marker = "route === '/node' && platform.capabilities.nodeAdmin"
    route = app_src[app_src.index(marker):]
    route = route[:route.index(";")]
    assert "LazyNodePage" in route
    assert "token=" in route and "username=" in route, (
        "app.js renders the Node page without the session NodeServicePanel "
        "now expects, so its Start button's opts are undefined again")