amadan
Measure the sweep's reach instead of reasoning about it
The comment said three ceremony endpoints "still do not run here". I wrote that from reasoning, not measurement, which is the exact habit this project keeps paying for — so I measured it. The count holds: twenty of twenty-three targets reach their handler and run it to completion, and the three that do not are the ones named. But "do not run" is wrong in a way worth fixing. They DO run; they refuse with a 403 before doing anything, because they want a pending half-session rather than a session. A CSP header set before that refusal would still be observable; one set after would not. Also states plainly why the two CSP tests both exist: the runtime sweep covers what it can reach, and the source guard covers those three, anything they set before refusing, and any route added later.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 file changed,
+12
−5
internal/home/noscript_test.go+12 −5
CI passed — run details
Intent
Attributed to this commit: 44.5 g CO₂e (5461804 tokens). This is an attribution, not a measurement — usage counted from this commit's own marker forward to the next one on step2/seal-and-secrets, never backward from it. A turn that produced more than one commit books all of its tokens to the last one, and a concurrent session on this branch can add to the same figure. Some of it was priced using the shared default rate, because no model-specific factor row exists yet for at least one model involved. The Carbon view has the repo total, which is never derived from this attribution.
diff --git a/internal/home/noscript_test.go b/internal/home/noscript_test.go| index f246893..84264f9 100644 |
| --- a/internal/home/noscript_test.go |
| +++ b/internal/home/noscript_test.go |
| @@ -261,11 +261,18 @@ func TestServedCSPAllowsNoInlineScript(t *testing.T) { |
| // are the ones ruling 21 lets load script and therefore the |
| // tempting place to widen a CSP. |
| // |
| - // So: a fresh session cookie as well. Three ceremony endpoints |
| - // (signin/begin, signin/finish, signin/recovery) need a pending |
| - // half-session rather than a session and still do not run here; |
| - // TestNoHandlerSetsItsOwnCSP covers those by reading source, which |
| - // is why both tests exist. |
| + // So: a fresh session cookie as well. Measured after that change, |
| + // twenty of the twenty-three targets reach their handler and run it |
| + // to completion. The three that do not are the ceremony endpoints — |
| + // signin/begin, signin/finish, signin/recovery — which want a |
| + // pending half-session rather than a session, and refuse with a 403 |
| + // before doing anything. Precisely: they DO run, they just return |
| + // early, so a header set after that point would not be observed |
| + // here. |
| + // |
| + // That is why TestNoHandlerSetsItsOwnCSP exists alongside this one: |
| + // it reads source, so it covers those three, anything they might set |
| + // before refusing, and any route added later. |
| type target struct{ method, path string } |
| var targets []target |
| if err := chi.Walk(routes, func(method string, route string, _ http.Handler, _ ...func(http.Handler) http.Handler) error { |