From 8e16a7373c51ea833f2bfa5672d816755270c6a7 Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Sun, 23 Aug 2026 14:28:41 +0100 Subject: [PATCH] Record that email is now measured, leaving Telegram as the inference #2214 turned its two TLS cases into tables over anonymous and email, so both are exercised in a third-party frame with the reload and again under enforced partitioning. Telegram is the only one of the three still resting on the writer keying off X-JWT and not off the provider, with #2208 as the reason it cannot be measured and go-pkgz/auth#316 as what would change that. --- .../2026-08-19-frontend-simplification.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/docs/plans/2026-08-19-frontend-simplification.md b/docs/plans/2026-08-19-frontend-simplification.md index a9290443..763d8343 100644 --- a/docs/plans/2026-08-19-frontend-simplification.md +++ b/docs/plans/2026-08-19-frontend-simplification.md @@ -68,14 +68,16 @@ against a browser configured to block third-party cookies. That second case need `IgnoreDefaultArgs`, because Playwright's own `--disable-features` list switches partitioning off and beats the flags passed through `Args`, which would leave the case asserting nothing. -Both of its TLS cases sign in anonymously, so the anonymous flow is the only one of the three -measured in a third-party frame. Email is exercised over http by `TestAuth_EmailSignsIn` and never -embedded; Telegram is not exercised anywhere and cannot be until #2208 makes the Telegram API base -URL configurable, since without that the widget cannot be pointed at a stub. The expectation that all -three behave alike is an inference and should be read as one: the client-side writer keys off `X-JWT` -on any auth response and not off the provider, so nothing in it distinguishes them. Worth stating -plainly, because a criterion naming flows the suite cannot reach is a milder version of the defect -this section was rewritten to remove. +Both of its TLS cases are table-driven over two flows, so anonymous and email are each measured in a +third-party frame with the reload, and each again under enforced partitioning, every subtest carrying +its own control cookie and its own partitioned-JWT guard in a fresh context so neither can pass +vacuously. Telegram is the one of the three still resting on inference. It is exercised nowhere and +cannot be until #2208 makes the Telegram API base URL configurable, because without that the stack +cannot answer as Telegram; `go-pkgz/auth` #316 is the change that would let the suite measure it. The +inference itself is that the client-side writer keys off `X-JWT` on any auth response and not off the +provider, so nothing in it distinguishes one flow from another. Worth naming which of the three is +inferred, because a criterion resting on flows the suite cannot reach is a milder version of the +defect this section was rewritten to remove. `ALLOWED_HOSTS` sets the CSP `frame-ancestors` and `AUTH_SAME_SITE=none` lets the server's auth cookies be set from any embedding domain. Those server-set cookies carry no `Partitioned`, so they