From 5e0592381a01e734b72ecad4615db42d6c6cc4df Mon Sep 17 00:00:00 2001 From: Frank Date: Tue, 3 Nov 2026 00:55:02 -0800 Subject: [PATCH] test(e2e): audit the guard chain over abs.franksdank.cloud The guard spec's GUARDED list is the lockstep with the Caddyfile; abs joins it with the app's own SSO-button label as the leak marker - a string the Audiobookshelf login renders and the IdP gate never prints. --- tests/e2e/specs/14-guard.spec.ts | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/tests/e2e/specs/14-guard.spec.ts b/tests/e2e/specs/14-guard.spec.ts index 4856bcf..7d1fe57 100644 --- a/tests/e2e/specs/14-guard.spec.ts +++ b/tests/e2e/specs/14-guard.spec.ts @@ -15,9 +15,12 @@ const BASE = "https://www.franksdank.cloud"; // Every vhost that Caddy routes through anubis:8923 (see dankclaw/Caddyfile). // Keep this list in lockstep with the Caddyfile: a new guarded vhost must be // added here or the guard-chain audit is incomplete. -const GUARDED = ["www", "search", "romm", "files", "seerr", "grafana", "prometheus", "loki", "notebook"]; +const GUARDED = ["www", "search", "romm", "files", "seerr", "grafana", "prometheus", "loki", "notebook", "abs"]; -// Markers that prove app content leaked past the guard to an anonymous user. +// Markers that prove app content leaked past the guard to an anonymous user. Each +// marker must be a string the APP renders that the gate itself could never print — +// for abs that is the Audiobookshelf login's own SSO button label (the app's OIDC +// door), which authentik's gate never renders because it IS the IdP. const LEAK_MARKERS: Record = { "search.franksdank.cloud": ["SearXNG preferences"], "romm.franksdank.cloud": ["RomM"], @@ -26,6 +29,7 @@ const LEAK_MARKERS: Record = { "grafana.franksdank.cloud": ["Dashboards"], "prometheus.franksdank.cloud": ["Expression Browser", "Graph"], "notebook.franksdank.cloud": ["Open Notebook"], + "abs.franksdank.cloud": ["Sign in with Authentik"], }; test("homepage root (/) is guarded for unauthenticated users", async ({ page }) => {