Dmitry VerkhoturovandGitHub
4793c1cd2c
* Assert what the image endpoints promise rather than the compressor's output Three tests pinned the exact bytes or the exact length of an encoded image, so they fail on any toolchain whose deflate or png encoder emits something different. CI pins go 1.25 and passes; go 1.27 fails all three, while the images themselves are perfectly valid. TestRest_QR now decodes both the golden file and the response and compares the pixels, which is the same assertion about the qr code and none about the encoder. The two resize cases assert the decoded image fits the box resize was given and touches one of its sides, which is what fitting to a box means and what the function actually promises. Resolves #2200. * Fill the instance URL into the embedded frontend at serve time The widget falls back to a compiled-in URL whenever a page omits `remark_config.host`. The bundler cannot know that URL, so it emits `{% REMARK_URL %}` and each distribution substitutes it: the docker image rewrites the files under its web root at container start, and the release binary, which serves the build embedded in itself, had nothing doing it. `prepare-release-assets.sh` filled the marker with `http://127.0.0.1:8080` before the embed instead, so every copy of the binary shipped pointing at the visitor's own loopback address, and on an https site the request is blocked as mixed content besides. It has been that way since v1.11.0, the first release to embed the frontend, and the earlier binaries embedded none, so the tarball has never served a correctly addressed widget. The placeholder now survives into the embedded copy and the file server fills it with the configured `REMARK_URL` as it serves, which is what the docker image already does to its own copy. The image no longer bakes the loopback address into its embedded copy either, so the fallback it keeps for a missing web root is correct rather than misleading. Substituted in html, js and mjs, the same set `docker-init.sh` rewrites, and the served size is the substituted one so a response is neither truncated nor left hanging. Nothing exercised the marker the frontend build emits wherever the instance url belongs. Every page in the suite sets `remark_config.host` from its own origin, so the compiled-in fallback is never read, and a distribution that stopped substituting would keep the suite green. Two tests. The first reads the served bundles and pages back and asserts the marker is gone from each and that what replaced it is this instance. The second covers what the substitution is for: the widget document carries no host of its own, since `iframe.html` builds its config from a query string the parent never puts one in, so everything it requests is addressed with the compiled-in url. It asserts the widget renders and that the config request went to this instance. The demo pages cannot show the second. Their loader builds the bundle's own script url from `remark_config.host`, so a page without one never gets as far as loading the widget. Verified by disabling both substitution paths, the serve-time one and the docker image's, and rebuilding: both tests fail. Editing the files on disk is not enough, since the file server substitutes as it serves. The served body now depends on remarkURL, but cacheControl builds its etag from version and path only. An operator who notices the widget is addressed to the wrong host, corrects REMARK_URL and restarts the same binary gets 304 on revalidation, so the client keeps a bundle pointing at the old host. Cache-Control is no-cache, so it revalidates every time and never ages out of that state either. That is the exact situation this substitution exists to fix, so the validator has to carry the url.
84 lines
3.3 KiB
Go
84 lines
3.3 KiB
Go
//go:build e2e
|
|
|
|
package e2e
|
|
|
|
import (
|
|
"fmt"
|
|
neturl "net/url"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/mxschmitt/playwright-go"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// remarkURLPlaceholder is what the frontend build emits wherever the instance url belongs. The
|
|
// bundler cannot know that url, so every distribution fills the marker in: the docker image
|
|
// rewrites its web root at container start, the binary substitutes as it serves.
|
|
const remarkURLPlaceholder = "{% REMARK_URL %}"
|
|
|
|
// TestAssets_InstanceURLIsFilledIn covers the substitution, which nothing else here exercises.
|
|
// The demo pages set remark_config.host from location.origin themselves, so the compiled-in
|
|
// fallback is never read and the marker could survive into a release without a test noticing.
|
|
func TestAssets_InstanceURLIsFilledIn(t *testing.T) {
|
|
page := newPage(t)
|
|
|
|
pauseForAuthLimit()
|
|
_, err := page.Goto(baseURL + "/web/")
|
|
require.NoError(t, err)
|
|
|
|
// every file type the distributions rewrite, not only the one the widget happens to load
|
|
for _, name := range []string{"embed.mjs", "counter.mjs", "last-comments.mjs", "index.html"} {
|
|
status, body := pageFetch(t, page, "GET", baseURL+"/web/"+name, nil)
|
|
require.Equal(t, 200, status, name)
|
|
assert.NotContains(t, body, remarkURLPlaceholder, "%s still carries the marker", name)
|
|
}
|
|
|
|
// and the value that replaced it is this instance, not some other host. only the bundles
|
|
// carry it; index.html sets the host from the page's own origin
|
|
status, body := pageFetch(t, page, "GET", baseURL+"/web/embed.mjs", nil)
|
|
require.Equal(t, 200, status)
|
|
assert.Contains(t, body, baseURL, "embed.mjs should fall back to this instance")
|
|
}
|
|
|
|
// TestAssets_WidgetRunsOnTheCompiledInURL is the behavior the substitution exists for.
|
|
//
|
|
// The widget document carries no host: iframe.html builds remark_config out of its own query
|
|
// string, and the parent never passes one, so everything the bundle requests is addressed with
|
|
// the url the build was substituted with. A marker left in place leaves the widget asking for
|
|
// `{% REMARK_URL %}/api/v1/config` and rendering nothing.
|
|
//
|
|
// The demo pages cannot show this. Their loader builds the bundle's own script url from
|
|
// remark_config.host, so a page without one never gets as far as loading the widget.
|
|
func TestAssets_WidgetRunsOnTheCompiledInURL(t *testing.T) {
|
|
page := newPage(t)
|
|
|
|
var configURL string
|
|
page.OnRequest(func(r playwright.Request) {
|
|
if configURL == "" && strings.Contains(r.URL(), "/api/v1/config") {
|
|
configURL = r.URL()
|
|
}
|
|
})
|
|
|
|
pauseForAuthLimit()
|
|
_, err := page.Goto(fmt.Sprintf("%s/web/iframe.html?site_id=remark&url=%s",
|
|
baseURL, neturl.QueryEscape(threadURL(t))))
|
|
require.NoError(t, err)
|
|
|
|
// the document really had no host of its own, or the fallback was never reached
|
|
host, err := page.Evaluate(`() => window.remark_config && window.remark_config.host`)
|
|
require.NoError(t, err)
|
|
require.Nil(t, host, "the widget document should carry no host")
|
|
|
|
// it rendered, so the url it was addressing resolved
|
|
waitVisible(t, page.Locator(commentFormSel).First())
|
|
|
|
eventually(t, waitTimeout, "the widget never asked for its config", func() bool {
|
|
return configURL != ""
|
|
})
|
|
assert.True(t, strings.HasPrefix(configURL, baseURL),
|
|
"the widget addressed %q rather than this instance", configURL)
|
|
assert.NotContains(t, configURL, remarkURLPlaceholder)
|
|
}
|