mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
27dcd975e5
Twenty-five specs called the Playwright APIs with default or hardcoded timeouts. Routed over Tor those budgets are too small, so a spec fails on transport latency rather than on the behaviour it asserts. Route the waits through resolveTimeout and reach pages via gotoOnion, the helpers the tor branch introduced for exactly this. The remaining changes in the diff are import wrapping around those calls. The repository lint enforces this: a raw numeric timeout in a role spec is rejected with a pointer to resolveTimeout, which is how a hardcoded 500ms wait added during this session was caught. Merge work rather than authored here; not deployed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
46 lines
1.4 KiB
JavaScript
46 lines
1.4 KiB
JavaScript
const { test, expect } = require("@playwright/test");
|
|
const { resolveTimeout } = require("../timeouts");
|
|
const { skipUnlessAddonEnabled } = require("../addon-gating");
|
|
const shared = require("../_shared");
|
|
|
|
const MCP_ENDPOINT = "/wp-json/mcp/mcp-adapter-default-server";
|
|
|
|
const REVIEWED_ABILITIES = [
|
|
"infinito/search-posts",
|
|
"infinito/get-post",
|
|
"infinito/list-categories",
|
|
];
|
|
|
|
test("addon infinito-mcp-abilities: only the reviewed abilities are reachable", async ({ browser }) => {
|
|
skipUnlessAddonEnabled("infinito-mcp-abilities");
|
|
test.setTimeout(resolveTimeout(60_000));
|
|
|
|
const context = await browser.newContext({ ignoreHTTPSErrors: true });
|
|
const page = await context.newPage();
|
|
|
|
try {
|
|
const response = await page.request.post(`${shared.env.wpBaseUrl}${MCP_ENDPOINT}`, {
|
|
failOnStatusCode: false,
|
|
maxRedirects: 0,
|
|
headers: { "content-type": "application/json" },
|
|
data: { jsonrpc: "2.0", id: 1, method: "tools/list" },
|
|
});
|
|
|
|
const body = await response.text();
|
|
|
|
expect(
|
|
response.status(),
|
|
"an anonymous tools/list must be refused; the abilities sit behind is_user_logged_in() and their own permission callbacks",
|
|
).toBeGreaterThanOrEqual(400);
|
|
|
|
for (const ability of REVIEWED_ABILITIES) {
|
|
expect(
|
|
body,
|
|
`a refused call must not disclose ${ability}`,
|
|
).not.toContain(ability);
|
|
}
|
|
} finally {
|
|
await context.close();
|
|
}
|
|
});
|