dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

e2e: accept Plex's session-less hand-off to app.plex.tv

Browse Source 
The full-suite re-run after the reset fix came back "1 flaky": 12-crawl reached
plex.franksdank.cloud, the guard cleared, and Plex Web — signed out in the
qa-e2e profile — handed the browser to its own hosted sign-in surface, so the
hostname never settled on the vhost (60 s poll, Expected plex.franksdank.cloud /
Received app.plex.tv). settleThroughGuard now takes a HANDOFFS landing list per
vhost; only plex.franksdank.cloud gets one, every other host still has to land on
its own vhost, and the guard assertions (Anubis cleared, no authentik uidField,
status < 500) are unchanged. Worklog and E2E gotcha 6 carry both symptoms: the
ERR_ABORTED reset and the hand-off.
This commit is contained in:
Frank
2026-10-17 22:49:35 -07:00
parent d2587e1d29
commit fc099d9b3c
3 changed files with 80 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serverAppConfigs-docs/Architecture/E2E Suite.md
+11 -7
View File
@@ -82,10 +82,14 @@ real IdP credentials.
5. **Solve-once cookie.** Since Anubis v1.27.0 + `COOKIE_DOMAIN` (see
[[Anubis]]), one PoW per fresh context covers every guarded vhost — crawl
and SSO specs complete in ~0.5 s per vhost instead of a PoW each.
6. **Apps navigate too.** `12-crawl` returns to the homepage between links, and
Plex Web (signed out, so it shows its own *"would like to sign in to your
Plex account"* iframe) keeps redirecting the top frame — Chromium cancels our
`goto("/")` with `net::ERR_ABORTED`, which used to abort the whole crawl
(once as a 420 s timeout, once at 5 s on the same link). `backHome()` re-issues
the navigation; the app itself was already judged, so the abort is the app's
behaviour, not a guard-chain failure.
6. **Apps navigate too — and may leave.** `12-crawl` returns to the homepage
between links, and Plex Web (signed out in the `qa-e2e` profile) runs its own
sign-in flow: it redirects the top frame, so Chromium cancelled our
`goto("/")` with `net::ERR_ABORTED` (once as a 420 s timeout, once at 5 s on
the same link), and the same redirect then lands the browser on
`app.plex.tv` — Plex's hosted surface for a session-less client — which broke
the `hostname == target` law. Two narrow answers: `backHome()` re-issues the
navigation on that one error class, and the landing check takes an explicit
hand-off list (`HANDOFFS`) instead of a single host. The guard contract is
untouched: challenge cleared, no authentik `uidField`, status < 500, and every
host NOT in the list still has to land on its own vhost.