test(e2e): cover drafts, candidate profiles, and the avatar gate - #110
Open
douglance wants to merge 1 commit into
Open
test(e2e): cover drafts, candidate profiles, and the avatar gate#110douglance wants to merge 1 commit into
douglance wants to merge 1 commit into
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
douglance
force-pushed
the
siwe/remaining-specs
branch
from
August 19, 2026 21:02
b5e55ab to
6735d2d
Compare
douglance
force-pushed
the
siwe/remaining-specs
branch
from
August 20, 2026 16:45
6735d2d to
8f4ec5e
Compare
fionnachan
force-pushed
the
siwe/remaining-specs
branch
from
August 20, 2026 16:55
8f4ec5e to
b443f1a
Compare
douglance
force-pushed
the
siwe/remaining-specs
branch
from
August 24, 2026 16:26
b443f1a to
fbfa731
Compare
Adds the remaining SIWE e2e coverage. Every new spec replays a saved
session via signedInPage(), so the suite still spends exactly five nonces
per run regardless of how many tests it grows.
Running these found four real defects, all fixed here:
- POST /api/drafts/shared/:slug/submitted is behind requireSession. The
UI offered the form to anonymous readers and the code comments claimed
the route was unauthenticated. It requires a session but not
authorship, so the form is now gated on being signed in and says so —
the `second` wallet, which did not write the draft, records the
submission in the spec.
- Editing, publishing and deleting all require status `draft` (409
not_editable otherwise), because a share link has to keep resolving to
what reviewers were shown. DraftList offered Delete on published and
submitted drafts, where it could only ever 409. A submitted draft now
offers none of the three, and the spec asserts that.
- /elections was unreachable. next.config.mjs permanently redirects it
to /security-council for old bookmarks, so the new page never
rendered. Moved to /profile/candidate, beside the other owned
surfaces. Adding it to the Security Council tab bar was the
alternative, but that component's active-tab logic is a two-tab
binary that a third entry would have forced me to rewrite.
- e2e/.auth/*.json were tracked in git. They are listed in .gitignore,
but that has no effect on already-committed files, so live session
cookies were repository content and every run dirtied the tree.
The 429 avatar branch is deliberately left uncovered: reaching it means
exhausting the real limiter with a key that is a delegate, which would
leave that key limited for the rest of the run and make the result
order-dependent.
The proposal description is located by MDEditor's own
`.w-md-editor-text-input` class rather than a data-testid, because
ITextAreaProps rejects extra attributes and CreateProposalForm already
depends on sibling library classes.
Verified: lint clean, tsc clean, 1262 unit tests, and three consecutive
full e2e runs at 19 passed / 1 skipped with no reset between them.
douglance
force-pushed
the
siwe/remaining-specs
branch
from
August 27, 2026 18:08
fbfa731 to
aa96cb2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the remaining SIWE e2e coverage. Every new spec replays a saved session via
signedInPage(), so the suite still spends exactly five nonces per run regardless of how many tests it grows.Running these found four real defects, all fixed here
1.
POST /api/drafts/shared/:slug/submittedis behindrequireSession. The UI offered the form to anonymous readers and the code comments claimed the route was unauthenticated. It requires a session but not authorship, so the form is now gated on being signed in and says so — thesecondwallet, which did not write the draft, records the submission in the spec.2. Editing, publishing and deleting all require status
draft(409not_editableotherwise), because a share link has to keep resolving to what reviewers were shown.DraftListoffered Delete on published and submitted drafts, where it could only ever 409. A submitted draft now offers none of the three, and the spec asserts that.3.
/electionswas unreachable.next.config.mjspermanently redirects it to/security-councilfor old bookmarks, so the new page returned 308 and never rendered. Moved to/profile/candidate, beside the other owned surfaces. Adding it to the Security Council tab bar was the alternative, but that component's active-tab logic is a two-tab binary that a third entry would have forced me to rewrite.4.
e2e/.auth/*.jsonwere tracked in git. They are listed in.gitignore, but that has no effect on already-committed files, so live session cookies were repository content and every run dirtied the tree. Untracked here, and the misleading "Gitignored" comment corrected.What is deliberately not covered
The 429 avatar branch. Reaching it means exhausting the real limiter with a key that is a delegate, which would leave that key limited for the rest of the run and make the result order-dependent. It stays covered by the indexer's own unit tests.
Locator note
The proposal description is located by MDEditor's own
.w-md-editor-text-inputclass rather than adata-testid, becauseITextAreaPropsrejects extra attributes andCreateProposalFormalready depends on sibling library classes in its tooltipMutationObserver. No production code was bent to suit the test.Verified: lint clean, tsc clean, 1262 unit tests, and three consecutive full e2e runs at 19 passed / 1 skipped with no database reset between them.