mirrors/remark42
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Record that email is now measured, leaving Telegram as the inference

Browse Source 
#2214 turned its two TLS cases into tables over anonymous and email, so both
are exercised in a third-party frame with the reload and again under enforced
partitioning. Telegram is the only one of the three still resting on the
writer keying off X-JWT and not off the provider, with #2208 as the reason it
cannot be measured and go-pkgz/auth#316 as what would change that.
This commit is contained in:
Dmitry Verkhoturov
2026-08-24 01:09:05 +01:00
parent 864cde68c8
commit 8e16a7373c
1 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/2026-08-19-frontend-simplification.md
+10 -8
View File
@@ -68,14 +68,16 @@ against a browser configured to block third-party cookies. That second case need
`IgnoreDefaultArgs`, because Playwright's own `--disable-features` list switches partitioning off and
beats the flags passed through `Args`, which would leave the case asserting nothing.
Both of its TLS cases sign in anonymously, so the anonymous flow is the only one of the three
measured in a third-party frame. Email is exercised over http by `TestAuth_EmailSignsIn` and never
embedded; Telegram is not exercised anywhere and cannot be until #2208 makes the Telegram API base
URL configurable, since without that the widget cannot be pointed at a stub. The expectation that all
three behave alike is an inference and should be read as one: the client-side writer keys off `X-JWT`
on any auth response and not off the provider, so nothing in it distinguishes them. Worth stating
plainly, because a criterion naming flows the suite cannot reach is a milder version of the defect
this section was rewritten to remove.
Both of its TLS cases are table-driven over two flows, so anonymous and email are each measured in a
third-party frame with the reload, and each again under enforced partitioning, every subtest carrying
its own control cookie and its own partitioned-JWT guard in a fresh context so neither can pass
vacuously. Telegram is the one of the three still resting on inference. It is exercised nowhere and
cannot be until #2208 makes the Telegram API base URL configurable, because without that the stack
cannot answer as Telegram; `go-pkgz/auth` #316 is the change that would let the suite measure it. The
inference itself is that the client-side writer keys off `X-JWT` on any auth response and not off the
provider, so nothing in it distinguishes one flow from another. Worth naming which of the three is
inferred, because a criterion resting on flows the suite cannot reach is a milder version of the
defect this section was rewritten to remove.
`ALLOWED_HOSTS` sets the CSP `frame-ancestors` and `AUTH_SAME_SITE=none` lets the server's auth
cookies be set from any embedding domain. Those server-set cookies carry no `Partitioned`, so they