Guests who open a manage address get the sign-in page instead of the management forms, and signed-in accounts no longer see sign-in controls on the account and connect pages.
- commit
- b3c9d323fea3d2a34872d90f214d36f659560318
- parent
- 8cd48a5d2f4af29a00e46afcbfebd51f9af70a49
- author
- Dami <dami.etoile@gmail.com>
| M | internal/ | 2 | +- |
| M | internal/ | 4 | ++-- |
| M | internal/ | 8 | +++++--- |
| M | internal/ | 18 | +++++++++++++++++- |
| M | internal/ | 5 | ++++- |
| M | internal/ | 6 | ++++++ |
| M | internal/ | 2 | +- |
@@ -72,7 +72,7 @@ func TestBrowseRoutesUseObjectContractsAndRenderData(t *testing.T) {
7272 7373 func TestConnectPublishesGRASPAndDeliveryKinds(t *testing.T) {7474 b := &fakeBackend{policy: policy.Defaults(strings.Repeat("a", 64))}75- app, err := New(b, Options{})75+ app, err := New(b, Options{Actor: func(*http.Request) (string, error) { return b.policy.Owner, nil }})7676 if err != nil {7777 t.Fatal(err)7878 }@@ -116,9 +116,9 @@
116116 <label>Blossom server URLs, one per line <textarea name="lines"></textarea></label>117117 <button>Publish server list</button>118118 </publish-list>119-<h3>Sign in</h3>119+{{if not .Actor}}<h3>Sign in</h3>120120 {{template "signerControls" .}}121-</section>121+{{end}}</section>122122 {{end}}123123 124124 {{define "data"}}<section>@@ -18,11 +18,13 @@
1818 1919 {{define "signin"}}<section>2020 <h1>{{if .Actor}}Your account{{else}}Sign in{{end}}</h1>21+{{if .Notice}}<p role="status">{{.Notice}}</p>{{end}}2122 {{if .Actor}}<p>Signed in as {{template "nostrKey" .Actor}}.</p>22-<p><a href="/manage/people">Manage relay</a> | <a href="/tools">Browser tools</a></p>23+<p><a href="/manage/people">Manage relay</a> | <a href="/tools">Browser tools</a> | <a href="/inbox">Inbox</a></p>24+<p>Use the sign out control in the footer to end this session.</p>2325 {{else}}<p>Use a browser extension, or connect Amber on your phone. The relay never sees a private key.</p>24-{{end}}{{template "signerControls" .}}25-</section>26+{{template "signerControls" .}}27+{{end}}</section>2628 {{end}}2729 2830 {{define "signerControls"}}<p><button id="session-login" type="button">Sign in with connected signer</button></p>@@ -27,7 +27,7 @@ func (b *siteBackend) Query(_ context.Context, method string, params []json.RawM
2727 2828 func TestShellRendersRailPanelAndPrompt(t *testing.T) {2929 backend := &fakeBackend{policy: policy.Defaults(strings.Repeat("a", 64))}30- app, err := New(backend, Options{})30+ app, err := New(backend, Options{Actor: func(*http.Request) (string, error) { return backend.policy.Owner, nil }})3131 if err != nil {3232 t.Fatal(err)3333 }@@ -156,3 +156,19 @@ func TestFilePagePreviewsImages(t *testing.T) {
156156 t.Fatalf("no image preview: %s", body)157157 }158158 }159+160+func TestGuestsSeeSignInInsteadOfManagementPages(t *testing.T) {161+ backend := &fakeBackend{policy: policy.Defaults(strings.Repeat("a", 64))}162+ app, err := New(backend, Options{Actor: func(*http.Request) (string, error) { return "", nil }})163+ if err != nil {164+ t.Fatal(err)165+ }166+ for _, path := range []string{"/manage/people", "/manage/owner", "/manage/status", "/manage/data"} {167+ recorder := httptest.NewRecorder()168+ app.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, path, nil))169+ body := recorder.Body.String()170+ if recorder.Code != http.StatusOK || !strings.Contains(body, "Sign in to manage this relay.") || strings.Contains(body, `<rpc-form method="setmember"`) || strings.Contains(body, `id="rail"><div id="railbox"><header><span><a href="/">`) {171+ t.Fatalf("%s exposed management content to a guest: %d %s", path, recorder.Code, body[:min(600, len(body))])172+ }173+ }174+}@@ -23,9 +23,12 @@ func TestSignInNavigationAndAccount(t *testing.T) {
2323 if actor != "" && (!strings.Contains(body, `title="`+actor+`"`) || strings.Count(body, `id="session-logout"`) != 1) {2424 t.Fatalf("%s missing account or unique sign-out control", path)2525 }26- if path == "/signin" && (!strings.Contains(body, `id="nostrconnect"`) || strings.Contains(body, `method="setconnections"`)) {26+ if path == "/signin" && actor == "" && (!strings.Contains(body, `id="nostrconnect"`) || strings.Contains(body, `method="setconnections"`)) {2727 t.Fatal("sign-in page must show signer controls without connection settings")2828 }29+ if actor != "" && strings.Contains(body, `id="nostrconnect"`) {30+ t.Fatalf("%s shows signer controls to a signed-in account", path)31+ }2932 }3033 }3134 }@@ -631,6 +631,12 @@ func (a *App) render(writer http.ResponseWriter, request *http.Request, data Pag
631631 }632632 data.Path = strings.TrimPrefix(request.URL.Path, data.Base)633633 a.privatePageData(&data, request, actor)634+ if !data.Private && data.Actor == "" && railKind(data.Tab) == "manage" && data.Tab != "tools" {635+ // Management pages are for signed-in people only. Guests see the636+ // sign-in page at the same address and come back after signing in.637+ data.Tab, data.Notice = "signin", "Sign in to manage this relay."638+ data.Event, data.Feed, data.Error = nil, nil, ""639+ }634640 writer.Header().Set("Cache-Control", "private, no-store")635641 writer.Header().Set("content-type", "text/html; charset=utf-8")636642 var rendered bytes.Buffer@@ -221,7 +221,7 @@ func TestRPCUsesVerifiedActorAndBackendContract(t *testing.T) {
221221 222222 func TestSignerBundleAndDedicatedJourneysArePresent(t *testing.T) {223223 backend := &fakeBackend{policy: policy.Defaults(strings.Repeat("a", 64))}224- app, err := New(backend, Options{Actor: func(*http.Request) (string, error) { return backend.policy.Owner, nil }})224+ app, err := New(backend, Options{Actor: func(*http.Request) (string, error) { return "", nil }})225225 if err != nil {226226 t.Fatal(err)227227 }