fix: final review wave — public routes, inbox 419, url schemes, deep_link, tests

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCrwHHnGCB5XH968Nxokqw
2026-09-04 09:09:07 -03:00
parent dd714a4be1
commit cbb43714ae
20 changed files with 123 additions and 20 deletions
--- a/core/tests/Feature/ActionLinksTest.php
+++ b/core/tests/Feature/ActionLinksTest.php
@@ -50,6 +50,11 @@ class ActionLinksTest extends TestCase
        $this->assertSame('2026-09-30T13:00:00+00:00', $this->event->fresh()->quiet_until->toIso8601String());
    }

+    public function test_public_route_sets_no_session_cookie(): void
+    {
+        $this->postJson('/a/tok/ack')->assertOk()->assertHeaderMissing('Set-Cookie');
+    }
+
    public function test_done_by_token_then_gone(): void
    {
        $this->postJson('/a/tok/done')->assertOk()->assertJsonPath('state', 'done');