oficina / calendar Public

Review: the door says "Sign in"; credits send strict-origin

- The sign-in door's button reads "Sign in" (Paul, 2026-10-01), not
  "Email me a link". TestSignInPageIsTheDoor now pins the button.
- /help/open-source shows the account menu, so it sends
  Referrer-Policy: strict-origin, not no-referrer (spec §9.5): Home's
  sign-out chain refuses a POST with no origin. No path is ever sent.

Both tests failed before the change (Fable 5.1 review of #17, P2 and P3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Paul Campbell pushed by paul@keymail.dev 2 weeks ago 56f1c4717bba45488fba780e02b5af9d41a33500 parent 5faf837

4 files changed, +11 −5

internal/calendar/credits.go +3 −1
internal/calendar/credits_test.go +5 −2
internal/calendar/signin.go +1 −1
internal/calendartest/signin_door_test.go +2 −1

diff --git a/internal/calendar/credits.go b/internal/calendar/credits.go

index 60999fd..3c12d63 100644

--- a/internal/calendar/credits.go

+++ b/internal/calendar/credits.go

@@ -28,7 +28,9 @@ func (h *handlers) credits(w http.ResponseWriter, r *http.Request) {

w.Header().Set("Content-Type", "text/html; charset=utf-8")

w.Header().Set("Cache-Control", "no-store")

- w.Header().Set("Referrer-Policy", "no-referrer")

+ // strict-origin (spec §9.5): this page shows the account menu, and Home's

+ // sign-out chain needs an origin; no path or query is ever sent.

+ w.Header().Set("Referrer-Policy", "strict-origin")

render(w, "credits", h.page(r, "Open source", credits.PageData{Title: "Open source", MissingNoticeLabel: "No notice file is included in this release.", Components: embeddedCredits.Components}))

}

diff --git a/internal/calendar/credits_test.go b/internal/calendar/credits_test.go

index ba2a304..f7b78cf 100644

--- a/internal/calendar/credits_test.go

+++ b/internal/calendar/credits_test.go

@@ -18,8 +18,11 @@ func TestCreditsArePublicAndContainDependencyNotices(t *testing.T) {

if response.Code != http.StatusOK || response.Header().Get("Location") != "" || len(response.Result().Cookies()) != 0 {

t.Fatal("credits required authentication", response.Code)

}

- if response.Header().Get("Cache-Control") != "no-store" || response.Header().Get("Referrer-Policy") != "no-referrer" {

- t.Fatal("credits shell may retain account context")

+ if response.Header().Get("Cache-Control") != "no-store" || response.Header().Get("Referrer-Policy") != "strict-origin" {

+ // strict-origin, not no-referrer (shared-chrome spec §9.5): the page

+ // shows the account menu, and Home's sign-out chain refuses a POST

+ // with no Origin/Referer. strict-origin still never sends a path.

+ t.Fatal("credits must send Referrer-Policy: strict-origin, got", response.Header().Get("Referrer-Policy"))

}

for _, wanted := range []string{"No notice file is included in this release.", "estilo-credits", "Open source", "Lucide and Feather", "gorm.io/gorm", "gormlite/LICENSE", "/static/credits.css"} {

if !strings.Contains(response.Body.String(), wanted) {

diff --git a/internal/calendar/signin.go b/internal/calendar/signin.go

index 5645d76..c34437c 100644

--- a/internal/calendar/signin.go

+++ b/internal/calendar/signin.go

@@ -39,7 +39,7 @@ func (h *handlers) signin(w http.ResponseWriter, r *http.Request) {

Action: "/signin",

AddressLabel: "Email address",

Help: "We email you a link. There is no password to forget.",

- Submit: "Email me a link",

+ Submit: "Sign in", // Paul, 2026-10-01

OpenSource: &chrome.Link{Href: "/help/open-source", Label: "Open source"},

}

switch q.Get("err") {

diff --git a/internal/calendartest/signin_door_test.go b/internal/calendartest/signin_door_test.go

index b61861c..4186933 100644

--- a/internal/calendartest/signin_door_test.go

+++ b/internal/calendartest/signin_door_test.go

@@ -26,7 +26,8 @@ func TestSignInPageIsTheDoor(t *testing.T) {

"<span>Calendar</span>",

`<form rst-form estilo-signin-form method="post" action="/signin"`,

`name="address"`,

- "Email me a link",

+ // Paul, 2026-10-01: the door's button says "Sign in".

+ `<button rst-btn="primary" type="submit">Sign in</button>`,

"We email you a link. There is no password to forget.",

} {

if !strings.Contains(body, want) {