5 Commits

Include renames

Author	SHA1	Message	Date
sneak	42f6b23244	Test that logging out needs the form's CSRF token (part of #256) ... A GET /logout, or a POST /logout without the CSRF token, must end no login session; the generator page must carry a logout form with the token; and after a logout from that form, a login opens the generator page while a cookie copied before it is refused, also after a restart. Model: opus-5-5	2026-10-15 18:15:46 +00:00
sneak	8efc87bc8d	Test a logout after a restart and one that cannot be saved (part of #256) ... The new server test logs in and out on pixa built as pixad builds it, starts pixa again on the same state directory, and checks that a cookie copied before the logout is refused, which fails if pixad keeps logouts in memory only. The new handler test closes the database so the logout cannot be saved, and checks for 500, no session cookie set, and the session still valid. Model: opus-5-5	2026-10-15 18:15:46 +00:00
sneak	0df7b0d8c2	Test that logging out ends a copied login session (part of #256) ... A copy of the session cookie taken before /logout must be refused after it, a login after it must work, and both must still hold for a session manager made again on the same database, as after a restart. A logout from a request without a session cookie must end no session. These fail until the fix: the session tests do not compile yet. Model: opus-5-5	2026-10-15 18:15:46 +00:00
clawbot	708a9bec20	Test that a URL made on the generator page with a ttl expires (closes #199) ... A new handler test makes a URL on the generator page with a ttl of one second, checks that /v1/e/ serves it at once, waits two seconds and checks that it then answers 410. The expiry is kept in whole seconds, so two seconds is the longest a one-second ttl can take to pass. Test only. Model: opus-5-5	2026-10-04 22:42:03 +02:00
clawbot	233a9c05ad	Test logging in, logging out, the URL generator and /v1/e/ tokens (closes #77) ... New handler tests in internal/handlers, with no network: GET / shows the login form without a session; a wrong key shows it again with an error and sets no session cookie; the right key answers 303 with a session cookie marked Secure, HttpOnly and SameSite=Strict, with which GET / shows the generator page; GET /logout empties the cookie with Max-Age=0; POST /generate without a session answers 303 to /; /v1/e/ serves a valid token's image, answers 410 for an expired token and 400 for one changed, cut short or made with another signing key; a URL made on the generator page is served by /v1/e/. No code changes. Model: opus-5-5	2026-10-04 19:24:39 +02:00