Sekai/hado
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: final review wave — public routes, inbox 419, url schemes, deep_link, tests

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCrwHHnGCB5XH968Nxokqw
This commit is contained in:
nikita.hohlov
2026-09-04 09:09:07 -03:00
parent dd714a4be1
commit cbb43714ae
20 changed files with 123 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
core/tests/Feature/InboxPageTest.php
View File

@@ -80,6 +80,13 @@ class InboxPageTest extends TestCase
$this->assertStringContainsString('НОВОЕ СОБЫТИЕ', $html);
$this->assertStringContainsString('/inbox.js', $html);
$this->assertStringContainsString('csrf-token', $html);
// инлайн-ошибка карточки и обработка 419 в клиентском скрипте
$this->assertStringContainsString('card-err', $html);
$this->assertStringContainsString('419', file_get_contents(public_path('inbox.js')));
// Запланировано — витрина, без действий «Помню»/«Сделано»
$this->assertStringContainsString('>Помню<', $html);
$scheduledSection = substr($html, (int) strpos($html, '予定'));
$this->assertStringNotContainsString('>Помню<', $scheduledSection);
}
public function test_counter_hidden_when_zero(): void
@@ -106,12 +113,20 @@ class InboxPageTest extends TestCase
'after_due' => AfterDue::Keep, 'payload' => ['title' => 'Протокольная ссылка', 'deep_link' => '//evil.com/x'],
'state' => EventState::Today, 'quiet_until' => CarbonImmutable::parse('2000-01-01Z'),
]);
Event::create([
'source_id' => $source->id, 'user_id' => $user->id, 'source_ref' => 'r', 'topic' => 'c',
'due_mode' => DueMode::Local, 'due_date' => '2026-09-04', 'due_time' => '24:00:00', 'fire_on' => '2026-09-04',
'after_due' => AfterDue::Keep, 'payload' => ['title' => 'Обратный слэш', 'deep_link' => '/\evil.com'],
'state' => EventState::Today, 'quiet_until' => CarbonImmutable::parse('2000-01-01Z'),
]);
$html = $this->get('/', ['X-Remote-User' => 'nikita'])->assertOk()->getContent();
$this->assertStringNotContainsString('href="javascript:', $html);
$this->assertStringNotContainsString('href="//evil', $html);
$this->assertStringNotContainsString('href="/\\', $html);
$this->assertStringContainsString('Опасное событие', $html);
$this->assertStringContainsString('Протокольная ссылка', $html);
$this->assertStringContainsString('Обратный слэш', $html);
}
}