amadan
Test: every page that shows Sign out sends strict-origin (Astra P3 on #22)
Fails on origin/main (credits and Share meeting were no-referrer); passes here. The native hand-off pages keep no-referrer and show no Sign out.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+30
−0
internal/callstest/chrome_test.go+30 −0
CI passed — run details
CI log
=== vet === go vet ./... === fmt === === test === go test ./... ok amadan.net/oficina/calls/callscore (cached) ? amadan.net/oficina/calls/cmd/calls [no test files] ok amadan.net/oficina/calls/internal/calls 1.601s ok amadan.net/oficina/calls/internal/calls/apns (cached) ok amadan.net/oficina/calls/internal/calls/hub (cached) ? amadan.net/oficina/calls/internal/calls/icons [no test files] ok amadan.net/oficina/calls/internal/calls/relay (cached) ok amadan.net/oficina/calls/internal/calls/seal (cached) ok amadan.net/oficina/calls/internal/callstest 8.756s ? amadan.net/oficina/calls/protocol [no test files] ? amadan.net/oficina/calls/scripts/writeestilo [no test files] === migration-check === go run amadan.net/rastrillo/rastrillo/cmd/rastrillo migration check rastrillo migration check: models and migrations agree === race === CGO_ENABLED=1 go test -race ./internal/... ok amadan.net/oficina/calls/internal/calls 10.196s ok amadan.net/oficina/calls/internal/calls/apns (cached) ok amadan.net/oficina/calls/internal/calls/hub (cached) ? amadan.net/oficina/calls/internal/calls/icons [no test files] ok amadan.net/oficina/calls/internal/calls/relay (cached) ok amadan.net/oficina/calls/internal/calls/seal (cached) ok amadan.net/oficina/calls/internal/callstest 29.296s
diff --git a/internal/callstest/chrome_test.go b/internal/callstest/chrome_test.go| index ee754b6..d54c50b 100644 |
| --- a/internal/callstest/chrome_test.go |
| +++ b/internal/callstest/chrome_test.go |
| @@ -418,3 +418,33 @@ func TestEstilosChromeUsesTokensCallsDefines(t *testing.T) { |
| } |
| } |
| } |
| + |
| +// Spec §9.5, and Astra's P3 on meet #22: a page that shows Sign out sends |
| +// Referrer-Policy strict-origin, never no-referrer — in Home mode the |
| +// chained sign-out is admitted by id.* on the Referer's origin, and |
| +// no-referrer strands it on "Finish signing out". Open source and Share |
| +// meeting show the account menu, so they are strict-origin; the native |
| +// hand-off pages keep no-referrer and so show no Sign out at all. |
| +func TestPagesWithSignOutSendStrictOrigin(t *testing.T) { |
| + x, sqid, _ := memberWithMeeting(t) |
| + c := x.browser(t) |
| + c.signIn("paul@example.com") |
| + for name, rec := range map[string]*httptest.ResponseRecorder{ |
| + "Open source": c.getNav("/help/open-source"), |
| + "Share meeting": c.post("/m/"+sqid+"/share", nil), |
| + } { |
| + if !strings.Contains(rec.Body.String(), ">Sign out<") { |
| + t.Errorf("%s: no Sign out, so this check proves nothing", name) |
| + } |
| + if got := rec.Header().Get("Referrer-Policy"); got != "strict-origin" { |
| + t.Errorf("%s shows Sign out with Referrer-Policy %q, want strict-origin", name, got) |
| + } |
| + } |
| + // Any page with Sign out and no-referrer is the bug, wherever it is. |
| + for _, path := range []string{"/", "/settings", "/m/" + sqid + "/join", "/meetings/" + sqid + "/settings", "/no/such/page"} { |
| + rec := c.getNav(path) |
| + if strings.Contains(rec.Body.String(), ">Sign out<") && rec.Header().Get("Referrer-Policy") == "no-referrer" { |
| + t.Errorf("GET %s shows Sign out under no-referrer", path) |
| + } |
| + } |
| +} |