Every service in the suite spoke http, and the browser gates a whole class
of behaviour on the page protocol: Secure cookies, SameSite=None,
Partitioned, and any code reading location.protocol. None of it was
executed, which is how setAuthCookie came to decorate its cookies with
__Host- on https pages and survive for years.
A TLS pair joins the stack: remark42 with SSL_TYPE=static on 8443, and an
nginx serving a host page on its own name on 8444, both on a self-signed
certificate that e2e/tls/generate.sh makes and .gitignore keeps out. Every
context accepts it, and so does the readiness client, since those are the
only servers either talks to. The instance also runs with
AUTH_SEND_JWT_HEADER, which is what makes the widget write cookies of its
own: without it the client-side writer never runs on any https page here
and every assertion about the attributes it chooses is vacuous.
Three cases. Signing in across origins and then reloading, which is the one
the http cross-origin case cannot make: the widget holds its token in
memory for the life of a page, so signing in and posting says nothing about
persistence and only the reload asks whether the cookie was delivered,
stored under a name the backend reads and sent back from a third-party
frame. The cookies themselves, read out of the browser store while the
widget is embedded elsewhere, since a cookie the browser refused is absent
from that list entirely and one it kept but will not send is worse than
useless: every copy of both names has to be Secure and SameSite=None, at
least one has to be partitioned, and none may carry a __Host- prefix
nothing on either side reads. And the same reload under a browser that
blocks third-party cookies, which the widget's own partitioned pair is the
only reason to survive.
That last one needs a browser playwright does not offer: its default
arguments disable ThirdPartyStoragePartitioning outright, so a run
configured wrongly keeps every third-party cookie and the case would pass
while asserting nothing. IgnoreDefaultArgs drops that list and re-supplies
it without the one feature, and a control cookie set from inside the frame
has to be refused before anything else is read, so a playwright release
that changes the list fails as itself instead of going quietly vacuous.
All three pass against master. What TLS still cannot reach, the OAuth popup
above all, is written down in the README.
* Move the e2e suite to Go and playwright-go
The seven playwright tests in `frontend/e2e` become twenty in `e2e/`, a
separate Go module driving the same browsers through playwright-go. The
npm project, its lockfile entries, its prettier config and
`Dockerfile.e2e` go with it, leaving `frontend/` a single-member
workspace.
The suite covers posting with markdown, replying and the nesting that
implies, editing inside the deadline and the backend refusing one outside
it, deleting, voting with the optimistic score observed mid-flight and
rolled back on failure, changing the sort, collapse persistence across a
reload, dev, anonymous and email sign-in end to end, the profile iframe,
and the two scripts that render into the host page rather than the
widget's own frame.
The rendering tests run in chromium, firefox and webkit. The rest sign in,
sign-in needs the dev oauth2 provider, and reaching that by name from the
host is chromium-only, so they run there alone.
`compose-e2e-test.yml` runs remark42, a second instance with a short edit
window so that path does not need a five-minute test, and mailpit, which
catches the email verification message the suite reads back. Everything
binds to the loopback interface: the stack holds a known secret and an
admin shared id, and `go test` can start it unattended. The tests run on
the host rather than in a container.
Three settings there exist for the tests rather than for realism.
`REMARK_URL` uses a hostname because the dev oauth2 server binds whatever
host it reads out of it, and a loopback bind inside a container cannot be
published. `UPDATE_LIMIT` is raised because the default of 0.5/sec rejects
any test posting twice in a row. The suite also paces its own `/auth/`
calls, which are capped at 2/sec by a bare literal in `rest.go` rather
than by a setting.
Each test gets its own comment thread from a query string on the demo
page, so nothing has to reset the database between runs.
CI gains a vet and lint job for the module, since the build tag keeps it
out of a plain `go test ./...`, and uploads a browser trace for any test
that fails.
`e2e/README.md` carries the rest: how to run it, what the stack is for,
and the widget behaviour the assertions have to work around.
* Update golangci-lint to 2.13.1 in the backend workflow
The pin sat three minors behind what the linter installs locally, so CI
checked the backend with an older set of rules than anyone running it by
hand. 2.10.1 also fetches its config schema over the network on every
`config verify`, which is a failure mode with no bearing on the code.
Both targets are clean on 2.13.1, `backend/app` and the memory_store
example.
replace the Docker artifact build with GoReleaser config and a tag release workflow. Keep local artifact builds snapshot-only and clean generated frontend embed files after release runs.
Replace strings.Split(RemoteAddr, ":") with net.SplitHostPort for correct
IPv6 address extraction in vote deduplication and comment IP tracking.
Harden image proxy: add SSRF-safe transport blocking private/reserved IPs
at connection time with DNS rebinding protection, sanitize error messages
to prevent information leakage, add response size limit via io.LimitReader.
Fix shadowed error variables in BlockedUsers, SetTitle, and Delete methods.
Exclude gosec taint analysis false positives at linter config level.
Remove generic development documentation, make frontend
and backend pages more specific and self-sufficient,
as previously you had to read development and frontend
pages in order to understand how to properly develop
frontend.
by @akellbl4
* create infrastructure for site
* wip
* fix docker build and add readme
* add docker-compose as a build and a run method
* rename compose file yaml -> yml
* add `src` as volume for watching changes
* update configs
* update README
* add padding at the end of the pages
* move demo settings in config
* fetch latest release from github
* update docs navigation
- add sections
- redirect from root of the section to first doc
- nice styles for navigation
- add brand colors
* cache github data from first load
* add redirects and fix link to docs
* fix docs nav styles
* add installation page placeholder
* fix demo
* add 404
* add dark theme, add theme switcher, remove unused files
* fix dark theme on main page
* fix dark theme background
* fix node version
* change installation docs
* add note block
* minor fixes
* add code highlighting styles
* fixes
* fixes
* mobile navigation, fix code highlighting colors
* fix dev server
* fix fetching error
* fix path to edit
Co-authored-by: Pavel Mineev <pavel@mineev.me>
Co-authored-by: Dmitry Verkhoturov <paskal.07@gmail.com>
* support flags commands, move to cmd
* fix target name
* test for happy path importer
* add export cmd
* fix wrong import, lint warns
* increase test timeout
* add sellp to allow main test server to start
* implement all cmds
* handle backup/restore errors
* fix import status check, hide secret from logs
* backup cmd err tests
* randimize test port
* avoid dup code in Last controller
* add target to make all bin archives
* remove container in make
* add smiple scripts to simplify commands, update readme
* add docs on dockerless, enforce app user
* add restore info
* move last to lastCommentsScope const
* WIP: start mongo engine
* WIP: mongo accessor and admin
* integrate mongo store to main
* disable mongo tests by default, only in CI
* connection with constructor
* add mongo buffered writer
* buffered mongo writer
* fix nil responses on an empty list from mongo
* missing mongo index for scores
* cancelable store
* add gridfs implementation of avatar store
* fix race on mongo session copy
* gridfs avatars without tmp files
* move avatar store
* minor comments and refactoring for avatar store
* merged from current master
* simplify gridfs reader
* lint: fix minor warns
* test mongo against env defined url
* pass MONGO_REMARK_TEST to docker and travis
* set dockerfile env for mongo test url
* increase connect timeout in mongo tests
* pass MONGO_REMARK_TEST to drone build
* add MONGO_REMARK_TEST to branch stage of drone
* mass mongo test url via build_args_from_env
* populate mongo IP to docker build hosts
* test env
* pass mongo ip via .mongo
* remove .mongo temp from git
* add .mongo -> env to linter step
* allow more time to autoflush writer test
* default mongo tests to "mongo" if not in env
* merge fresh master into
* add test for mongo cleanup
* msg for a failed test
* lazy fix for failed test
* add an ability to skip all mongo tests
* add backend dev instructions
* remove unused code from mongo server
* move mongo testing to connection_test
* restore testing.go
* lint: minor warns for testing code
Dmitry VerkhoturovandGitHub
UmputunandGitHub
Pavel MineevandDmitry Verkhoturov
Vyrtsev Mikhail
konstantin krivlenia
Anatoly MilkovandUmputun
igoradamenko
Eugene