3 Commits

Include renames

Author	SHA1	Message	Date
sneak	e5d9f64d83	Test that logging out ends a copied login session (part of #256) ... A copy of the session cookie taken before /logout must be refused after it, a login after it must work, and both must still hold for a session manager made again on the same database, as after a restart. A logout from a request without a session cookie must end no session. These fail until the fix: the session tests do not compile yet. Model: opus-5-5	2026-10-15 02:51:01 +00:00
clawbot	708a9bec20	Test that a URL made on the generator page with a ttl expires (closes #199) ... A new handler test makes a URL on the generator page with a ttl of one second, checks that /v1/e/ serves it at once, waits two seconds and checks that it then answers 410. The expiry is kept in whole seconds, so two seconds is the longest a one-second ttl can take to pass. Test only. Model: opus-5-5	2026-10-04 22:42:03 +02:00
clawbot	233a9c05ad	Test logging in, logging out, the URL generator and /v1/e/ tokens (closes #77) ... New handler tests in internal/handlers, with no network: GET / shows the login form without a session; a wrong key shows it again with an error and sets no session cookie; the right key answers 303 with a session cookie marked Secure, HttpOnly and SameSite=Strict, with which GET / shows the generator page; GET /logout empties the cookie with Max-Age=0; POST /generate without a session answers 303 to /; /v1/e/ serves a valid token's image, answers 410 for an expired token and 400 for one changed, cut short or made with another signing key; a URL made on the generator page is served by /v1/e/. No code changes. Model: opus-5-5	2026-10-04 19:24:39 +02:00