amadan

oficina / calendar Public

Home consumer: connect 01166fc, sign-out chain, "All apps"

Calendar pinned home/connect at 5b8d841 (2026-09-10), before the
in-app sign-out chain, the signed-in /signin shortcut and
Credentials.Directory. Bump to 01166fc so, in Home mode:

- POST /signout 307s on to {issuer}/signout and the id.* session ends;
- /signin for a signed-in person returns to return_to with no exchange;
- HOME_DIRECTORY_ORIGIN reaches the app, and the account menu shows
  "All apps" linking to the directory. No directory, no link.

The three tests in home_consumer_test.go configure Home from the
environment, as production does, and all three failed first on the
old pin; they pass now. The existing router test expects the chain.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Paul Campbell pushed by paul@keymail.dev 465eb4efdbb02eace93cc8c23d4e1b12c36ed219 parent 25974c6
8 files changed, +107 −6
  • go.mod +1 −1
  • go.sum +2 −2
  • internal/calendar/app.go +1 −0
  • internal/calendar/handlers.go +6 −2
  • internal/calendar/home_consumer_test.go +88 −0
  • internal/calendar/home_router_test.go +3 −1
  • internal/calendar/render.go +5 −0
  • internal/calendar/templates/layout.html +1 −0

CI failed — run details

CI log 
=== vet ===
go vet ./...
=== fmt ===
=== test ===
go test ./...
?   	amadan.net/oficina/calendar/cmd/calendar	[no test files]
ok  	amadan.net/oficina/calendar/internal/calendar	6.213s
?   	amadan.net/oficina/calendar/internal/calendar/icons	[no test files]
?   	amadan.net/oficina/calendar/internal/calendar/seal	[no test files]
--- FAIL: TestPublicBookingPostRegistersItsHoldAndMail (0.07s)
    schedule_delivery_test.go:83: public booking did not register scheduled work: got 2026-09-30 20:58:52 +0000 UTC, expected 2026-09-30 22:23:52 +0100 IST
2026/09/30 21:53:53 INFO migrate applied="[sessions/0001_init auth/0001_init auth/0002_sessions_backfill calendar/0001_create_people calendar/0002_alter_people calendar/0003_alter_reminders calendar/0004_create_attendees calendar/0005_alter_people calendar/0006_alter_reminder_queues]" skipped=0 adopted=false
2026/09/30 21:53:53 ERROR calendar: scheduled work registration failed stage=schedule.register err="calendar: this platform does not support safe scheduled work; update the platform before starting Calendar"
FAIL
FAIL	amadan.net/oficina/calendar/internal/calendartest	7.238s
ok  	amadan.net/oficina/calendar/internal/guardstest	0.159s
?   	amadan.net/oficina/calendar/scripts/writeestilo	[no test files]
FAIL
make: *** [Makefile:85: test] Error 1

amadan: step test failed: exit status 2

amadan: job failed at step test — its output is above, not at the tail of this log
diff --git a/go.mod b/go.mod
index 5188792..da777bc 100644
--- a/go.mod
+++ b/go.mod
@@ -5,7 +5,7 @@ go 1.25.0
toolchain go1.26.5
require (
- amadan.net/oficina/home/connect v0.0.0-20260910000424-5b8d8410775f
+ amadan.net/oficina/home/connect v0.0.0-20260923190447-01166fcfc0a9
amadan.net/oficina/home/handoff v0.0.0-20260908102137-481d2d57f489
amadan.net/rastrillo/rastrillo v0.26.1-0.20260908075707-29e4491631bd
github.com/carlosframework/rastrillo v0.23.0
diff --git a/go.sum b/go.sum
index 1b25fc6..2f15ceb 100644
--- a/go.sum
+++ b/go.sum
@@ -1,7 +1,7 @@
amadan.net/oficina/estilo.git v0.0.0-20260929231226-cce11010ece0 h1:Qww+xGIYJaj+6TIX4Knr71ghxeYJjtgFm6WukX6NkGg=
amadan.net/oficina/estilo.git v0.0.0-20260929231226-cce11010ece0/go.mod h1:4u0jNBtIdMLOsJyrScfqoEuYDJF7BBM3qM9YWbzt6aw=
-amadan.net/oficina/home/connect v0.0.0-20260910000424-5b8d8410775f h1:lkw3tjzHfZxe74pNfo+tGDz4mkZLg+D6R+FTkmsym6M=
-amadan.net/oficina/home/connect v0.0.0-20260910000424-5b8d8410775f/go.mod h1:YroavXe43Wietec+po8mtSk4a9Bir2h31Q3iAf4MWxI=
+amadan.net/oficina/home/connect v0.0.0-20260923190447-01166fcfc0a9 h1:K/PaOVdQqRMwifPD6ipiwLeGR5nbFSxm9FxjrDJlZcg=
+amadan.net/oficina/home/connect v0.0.0-20260923190447-01166fcfc0a9/go.mod h1:YroavXe43Wietec+po8mtSk4a9Bir2h31Q3iAf4MWxI=
amadan.net/oficina/home/handoff v0.0.0-20260908102137-481d2d57f489 h1:RPKtyry/71i06o8L+gjAaUyexbmG56kO1YPs601URAM=
amadan.net/oficina/home/handoff v0.0.0-20260908102137-481d2d57f489/go.mod h1:YISpzFJ+iMgrM0rUL032OSzsAQbP4/nozvXLCCOcn1k=
amadan.net/rastrillo/native/server v0.0.0-20260923173546-2a5d07b2c8d3 h1:5EFx7BLJj/+G/rt8bTmeyMWVfF5s5Sns7ajTvX4w/I8=
diff --git a/internal/calendar/app.go b/internal/calendar/app.go
index 9a5d607..6b34cd7 100644
--- a/internal/calendar/app.go
+++ b/internal/calendar/app.go
@@ -163,6 +163,7 @@ func New(cfg Config) (*App, error) {
return nil, err
}
h.homeEnabled = true
+ h.directory = homeSettings.Directory
}
// Native wiring comes before the scheduler starts, so a native
// failure leaves no timer goroutine behind to leak.
diff --git a/internal/calendar/handlers.go b/internal/calendar/handlers.go
index 6d56c2e..96e9fcd 100644
--- a/internal/calendar/handlers.go
+++ b/internal/calendar/handlers.go
@@ -12,8 +12,12 @@ import (
type handlers struct {
scheduled *scheduledWork
homeEnabled bool
- store *Store
- logger *slog.Logger
+ // directory is the hub directory origin (HOME_DIRECTORY_ORIGIN) that
+ // the account menu's "All apps" links to. Set only in Home mode;
+ // empty means no link.
+ directory string
+ store *Store
+ logger *slog.Logger
// origin is this instance's external origin. Handlers read it to
// decide Secure cookie attributes and to build the absolute URLs a
diff --git a/internal/calendar/home_consumer_test.go b/internal/calendar/home_consumer_test.go
new file mode 100644
index 0000000..4051a50
--- /dev/null
+++ b/internal/calendar/home_consumer_test.go
@@ -0,0 +1,88 @@
+package calendar
+
+import (
+ "bytes"
+ "encoding/base64"
+ "encoding/json"
+ "io"
+ "log/slog"
+ "net/http"
+ "path/filepath"
+ "strings"
+ "testing"
+
+ "amadan.net/oficina/home/connect"
+ assertioncrypto "amadan.net/rastrillo/rastrillo/crypto"
+)
+
+const homeTestDirectory = "https://directory.example.test"
+
+// newHomeConsumerFixture configures Home the way production does: from the
+// environment, through connect.CredentialsFromEnv, so HOME_DIRECTORY_ORIGIN
+// (unprefixed, the name Home itself reads) is read exactly as it is live.
+func newHomeConsumerFixture(t *testing.T, directory string) *homeRouterFixture {
+ t.Helper()
+ key, err := assertioncrypto.Generate()
+ if err != nil {
+ t.Fatal(err)
+ }
+ manifest, _ := json.Marshal(map[string]string{"key": base64.StdEncoding.EncodeToString(key.SignPub())})
+ t.Setenv("CALENDAR_HOME_ISSUER", homeTestIssuer)
+ t.Setenv("CALENDAR_HOME_CONSUMER_ID", "calendar-test")
+ t.Setenv("CALENDAR_HOME_KEYS_BASE64", base64.StdEncoding.EncodeToString(manifest))
+ t.Setenv("CALENDAR_HOME_DEK_BASE64", base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{7}, 32)))
+ t.Setenv("HOME_DIRECTORY_ORIGIN", directory)
+ a, err := New(Config{DBPath: filepath.Join(t.TempDir(), "calendar.db"), Env: "development", Origin: homeTestOrigin, AllowedAddresses: "alice@example.test", Logger: slog.New(slog.NewTextHandler(io.Discard, nil)), Home: connect.CredentialsFromEnv("CALENDAR")})
+ if err != nil {
+ t.Fatal(err)
+ }
+ t.Cleanup(func() { a.Close() })
+ return &homeRouterFixture{a, key, map[string]*http.Cookie{}}
+}
+
+// Sign out in Calendar ends the id.* session too: the app session ends and
+// the same POST is handed on (307) to {issuer}/signout, which returns the
+// browser to /signed-out. Without it the next "Sign in" passed silently
+// through the live id.* session (spec shared-chrome §9.5).
+func TestHomeSignoutChainsToIssuer(t *testing.T) {
+ f := newHomeConsumerFixture(t, "")
+ f.local(t)
+ w := f.do("POST", "/signout", "")
+ if w.Code != http.StatusTemporaryRedirect || w.Header().Get("Location") != homeTestIssuer+"/signout" {
+ t.Fatalf("POST /signout: status %d Location %q, want 307 to %s/signout", w.Code, w.Header().Get("Location"), homeTestIssuer)
+ }
+ if got := w.Header().Get("Referrer-Policy"); got != "strict-origin-when-cross-origin" {
+ t.Fatalf("Referrer-Policy %q: id.* admits the null-Origin hop by Referer", got)
+ }
+ if f.cookies[f.app.home.sessions.CookieName()] != nil {
+ t.Fatal("sign-out kept the Calendar session cookie")
+ }
+}
+
+// A signed-in person who follows a "Sign in" link goes straight to where
+// they were headed, with no second exchange.
+func TestHomeSigninWhenSignedInReturnsToPage(t *testing.T) {
+ f := newHomeConsumerFixture(t, "")
+ f.local(t)
+ if got := homeRedirect(t, f.do("GET", "/signin?return_to=%2Fday%2F2026-09-10", "")); got != "/day/2026-09-10" {
+ t.Fatalf("signed-in /signin went to %q, want /day/2026-09-10", got)
+ }
+}
+
+// "All apps" goes to the hub directory, from HOME_DIRECTORY_ORIGIN, and is
+// absent when no directory is configured.
+func TestAllAppsLinksToDirectory(t *testing.T) {
+ link := `href="` + homeTestDirectory + `/"`
+ f := newHomeConsumerFixture(t, homeTestDirectory)
+ f.local(t)
+ body := f.do("GET", "/day/2026-09-10", "").Body.String()
+ if !strings.Contains(body, link) || !strings.Contains(body, ">All apps<") {
+ t.Fatalf("signed-in page has no All apps link to %s/", homeTestDirectory)
+ }
+
+ bare := newHomeConsumerFixture(t, "")
+ bare.local(t)
+ if body := bare.do("GET", "/day/2026-09-10", "").Body.String(); strings.Contains(body, "All apps") {
+ t.Fatal("All apps shown with no directory configured")
+ }
+}
diff --git a/internal/calendar/home_router_test.go b/internal/calendar/home_router_test.go
index a18ab48..0535b80 100644
--- a/internal/calendar/home_router_test.go
+++ b/internal/calendar/home_router_test.go
@@ -145,7 +145,9 @@ func TestHomeRouterRetainsExistingCalendarIdentity(t *testing.T) {
t.Fatal("proof replaced session")
}
homeRedirect(t, f.do("POST", "/account/home/confirm", ""))
- homeRedirect(t, f.do("POST", "/signout", ""))
+ if w := f.do("POST", "/signout", ""); w.Code != http.StatusTemporaryRedirect || w.Header().Get("Location") != homeTestIssuer+"/signout" {
+ t.Fatal("sign-out did not chain to the issuer", w.Code, w.Header().Get("Location"))
+ }
start = homeRedirect(t, f.do("GET", "/signin", ""))
target := homeRedirect(t, f.exchange(t, start, "opaque-home-alice"))
if target != "/" {
diff --git a/internal/calendar/render.go b/internal/calendar/render.go
index 66b3418..01d84e4 100644
--- a/internal/calendar/render.go
+++ b/internal/calendar/render.go
@@ -130,6 +130,10 @@ type PageData struct {
SignedIn bool
Address string
+ // Directory is the hub directory origin "All apps" links to, or
+ // empty for no link (standalone, or no HOME_DIRECTORY_ORIGIN).
+ Directory string
+
// QuickPane is the quick-add box's first paint. It is on the SHELL
// rather than on each page's own data because the box is in the
// shell: a page that forgot to build one would render an empty
@@ -147,6 +151,7 @@ func (h *handlers) page(r *http.Request, title string, data any) PageData {
pd := PageData{
Title: title,
HomeEnabled: h.homeEnabled,
+ Directory: h.directory,
ThemeAttr: themeAttr(mode),
Mode: mode,
Path: r.URL.Path,
diff --git a/internal/calendar/templates/layout.html b/internal/calendar/templates/layout.html
index 9ee2e14..54e72e7 100644
--- a/internal/calendar/templates/layout.html
+++ b/internal/calendar/templates/layout.html
@@ -125,6 +125,7 @@
{{if .SignedIn}}
<p rst-menu-group><a href="/settings">Settings</a></p>
+{{if .Directory}}<p rst-menu-group><a href="{{.Directory}}/">All apps</a></p>{{end}}
{{if .HomeEnabled}}<p rst-menu-group><a href="/account/home">Connect Home account</a></p>{{end}}
<p rst-menu-group><a href="/import">Import a calendar</a></p>
<form rst-menu-group method="post" action="/signout">