mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
c94193c51c
PDS 0.4.0 (@atproto/pds 0.4.0-beta.7) signs the service-auth JWT it
attaches to proxied app.bsky.* calls with iss, aud and exp only
(createServiceJwt in dist/index.js of the image). The AppView requires
the lxm claim and rejects every such call with 401
BadJwtLexiconMethod, so social-app shows errorMessageView on Following
and Notifications. 0.4.66 passes the called method as lxm into every
service JWT it signs and sends every proxied call through the
SSRF-guarded proxy agent.
0.4.66 also replaces the whole-handle limit of 0.4.0 (30 characters
for the entire handle) with a limit of 18 on the part in front of the
service domain, so kc-administrator.<domain> passes for any domain
length, including kc-administrator.infinito.nexus (31).
- meta/services.yml: pin ghcr.io/bluesky-social/pds to 0.4.66.
- vars/main.yml: the public AppView URL is always https. Onion-primary
deployments took the protocol from the local TLS setting and sent the
service JWT to api.bsky.app over plain http. services.view.enabled is
evaluated as a bool.
- templates/env.j2: drop PDS_ADMIN_EMAIL, which neither 0.4.0 nor
0.4.66 reads. PDS_CONTACT_EMAIL_ADDRESS stays unset on purpose:
describeServer would publish the administrator's address.
- Administration.md: the account database only migrates forward; a
rollback restores the bluesky_pds_data backup together with the old
pin.
- Playwright: the broker login moves into _shared.js and waits for a
landing outside /oauth2/, because the bare base URL also matches the
intermediate /oauth2/callback hop. New scenarios check that the PDS
proxies getTimeline and listNotifications to the AppView with a JWT
it accepts, for the broker session (OIDC) and for a native session
(oauth2 disabled), and that social-app renders Following and
Notifications without errorMessageView or lxm page errors. The
rendering scenario is clearnet only: social-app boots only after
loading its age-assurance config from public.api.bsky.app.
Merge note for feature/store-i18n: 19b491b014 raises the pin to 0.4.21
and renames the contact-mail line to PDS_CONTACT_EMAIL_ADDRESS. Resolve
the pin to 0.4.66 (0.4.21 still signs without lxm, and the account
database cannot migrate back) and keep the line deleted. Take the union
of both sides in _shared.js and playwright.spec.js.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
59 lines
2.6 KiB
JavaScript
59 lines
2.6 KiB
JavaScript
const { test, expect } = require("@playwright/test");
|
|
const { isOnionTarget, resolveTimeout } = require("./timeouts");
|
|
const { gotoOnion } = require("./personas");
|
|
const {
|
|
brokerAccessJwt,
|
|
collectAppViewResponses,
|
|
expectNoFailures,
|
|
expectNoLxmRejections,
|
|
reachFollowingFeed,
|
|
readPreferences,
|
|
restorePreferences,
|
|
waitForResponseTo,
|
|
} = require("./_appview");
|
|
|
|
exports.register = function (shared) {
|
|
test("OIDC: social-app renders Following and Notifications without errorMessageView or lxm page errors", async ({ page }) => {
|
|
shared.skipUnlessServiceEnabled("sso");
|
|
test.skip(
|
|
isOnionTarget(),
|
|
"social-app only boots after loading its age-assurance config from public.api.bsky.app, which a Tor-routed test browser cannot reliably reach",
|
|
);
|
|
test.setTimeout(resolveTimeout(900_000));
|
|
|
|
const pageErrors = [];
|
|
page.on("pageerror", (err) => pageErrors.push(err.message));
|
|
const seen = collectAppViewResponses(page);
|
|
const { pdsBaseUrl } = shared.env;
|
|
|
|
await shared.loginThroughBroker(page);
|
|
const accessJwt = await brokerAccessJwt(page);
|
|
const preferences = await readPreferences(page.request, pdsBaseUrl, accessJwt);
|
|
try {
|
|
await waitForResponseTo(seen, "app.bsky.notification.listNotifications");
|
|
await expectNoLxmRejections(seen, pageErrors);
|
|
|
|
await reachFollowingFeed(page);
|
|
await waitForResponseTo(seen, "app.bsky.feed.getTimeline");
|
|
await expectNoFailures(seen, "app.bsky.feed.getTimeline");
|
|
const following = page.getByTestId("followingFeedPage");
|
|
await expect(following.locator('[data-testid^="feedItem-by-"]').or(following.getByTestId("errorMessageView")).first()).toBeVisible({
|
|
timeout: resolveTimeout(60_000),
|
|
});
|
|
await expect(following.getByTestId("errorMessageView"), "Following must render without an errorMessageView").toHaveCount(0);
|
|
|
|
const notificationsFrom = seen.length;
|
|
await gotoOnion(page, `${shared.env.baseUrl}/notifications`);
|
|
const notifications = page.getByTestId("notificationsScreen");
|
|
await expect(notifications).toBeVisible({ timeout: resolveTimeout(60_000) });
|
|
await waitForResponseTo(seen, "app.bsky.notification.listNotifications", notificationsFrom);
|
|
await expectNoFailures(seen, "app.bsky.notification.listNotifications");
|
|
await expect(notifications.getByTestId("errorMessageView"), "Notifications must render without an errorMessageView").toHaveCount(0);
|
|
|
|
await expectNoLxmRejections(seen, pageErrors);
|
|
} finally {
|
|
await restorePreferences(page.request, pdsBaseUrl, accessJwt, preferences);
|
|
}
|
|
});
|
|
};
|