mirror of
https://github.com/block/buzz.git
synced 2026-10-27 04:30:52 +00:00
## Summary - Supersedes #1913 with a KLIPY-hosted URL implementation. - Adds KLIPY GIF search and trending results to desktop message and forum composers. - Keeps selected GIFs hosted by KLIPY; Buzz stores only the external URL and media metadata (no imeta tag, since relays only accept hash-backed local `/media/` entries). - Aligns the Emoji/GIF picker with Buzz's standard segmented control, theme surfaces, and motion behavior. ## Relay-to-provider boundary - The relay proxies KLIPY search/share so the `BUZZ_KLIPY_API_KEY` never reaches the desktop; the key stays server-side behind a redacted `Debug` impl. - The dedicated GIF `reqwest` client sets `redirect::Policy::none()`. Because the API key rides in the request path, following a provider `3xx` could replay a key-bearing URL to an attacker-chosen host (an SSRF/key-disclosure primitive). With redirects disabled, a `3xx` returns as a non-success status that the handlers map to a generic `502`; the `Location` target is never read or forwarded. - Admission reuses the established NIP-98, membership, replay, and per-pubkey rate-limit gates, with an upstream response-size cap and allowlisting so KLIPY error bodies never cross the relay boundary. ## Accessibility - Under `prefers-reduced-motion: reduce`, the picker grid renders a static provider poster (a normalized `jpg` asset) instead of the animated preview, or a named static placeholder when no poster is available. It reacts to preference changes while mounted. `no-preference` keeps the animated preview. - Selected GIFs carry their title through `ImetaMedia`'s `displayLabel`, so the composer thumbnail, preview dialog, editor, lightbox, and remove control all derive one non-empty accessible name instead of an empty `Attachment ` label. Ordinary hashed uploads keep their existing hash-derived names. --------- Signed-off-by: kenny lopez <klopez4212@gmail.com> Signed-off-by: Kenny Lopez <klopez4212@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz> Signed-off-by: Hayt <9e1c23a3fd83f61da34420e4e88ff1b16e45cafcc0cd9019eb07d4ecfa8ca9b0@buzz.block.builderlab.xyz> Co-authored-by: Princess Donut <b238ea756dee4d98afa5883fc7f1de61eeabe65bf700e3a5a5a80db5e42e2c2b@buzz.block.builderlab.xyz> Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz> Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: Hayt <9e1c23a3fd83f61da34420e4e88ff1b16e45cafcc0cd9019eb07d4ecfa8ca9b0@buzz.block.builderlab.xyz>
378 lines
12 KiB
TypeScript
378 lines
12 KiB
TypeScript
import { expect, test } from "@playwright/test";
|
|
import type { Page } from "@playwright/test";
|
|
|
|
import { installMockBridge, TEST_IDENTITIES } from "../helpers/bridge";
|
|
|
|
const IMAGE_SHA = "c".repeat(64);
|
|
const IMAGE_URL = "http://127.0.0.1:4173/buzz.svg";
|
|
const IMAGE_DESCRIPTOR = {
|
|
url: IMAGE_URL,
|
|
sha256: IMAGE_SHA,
|
|
size: 646,
|
|
type: "image/svg+xml",
|
|
uploaded: Math.floor(Date.now() / 1000),
|
|
thumb: IMAGE_URL,
|
|
dim: "64x64",
|
|
filename: "buzz.svg",
|
|
};
|
|
const GENERAL_CHANNEL_ID = "9a1657ac-f7aa-5db0-b632-d8bbeb6dfb50";
|
|
|
|
type MockFeedItem = {
|
|
id: string;
|
|
kind: number;
|
|
pubkey: string;
|
|
content: string;
|
|
created_at: number;
|
|
channel_id: string | null;
|
|
channel_name: string;
|
|
tags: string[][];
|
|
category: "mention" | "needs_action" | "activity" | "agent_activity";
|
|
};
|
|
|
|
type MockFeedWindow = Window &
|
|
typeof globalThis & {
|
|
__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__?: (item: MockFeedItem) => MockFeedItem;
|
|
};
|
|
|
|
async function installSpoilerBridge(
|
|
page: Page,
|
|
mock: Parameters<typeof installMockBridge>[1] = {},
|
|
) {
|
|
await installMockBridge(page, {
|
|
...mock,
|
|
uploadDescriptors: [IMAGE_DESCRIPTOR],
|
|
});
|
|
}
|
|
|
|
test("no-selection spoiler applies to every composer paragraph", async ({
|
|
page,
|
|
}) => {
|
|
await installSpoilerBridge(page);
|
|
await page.context().grantPermissions(["clipboard-read", "clipboard-write"], {
|
|
origin: "http://127.0.0.1:4173",
|
|
});
|
|
|
|
await page.goto("/");
|
|
await page.getByTestId("channel-general").click();
|
|
await expect(page.getByTestId("chat-title")).toHaveText("general");
|
|
|
|
const input = page.getByTestId("message-input");
|
|
const paragraphs = [
|
|
"First hidden paragraph",
|
|
"Second hidden paragraph",
|
|
"Third hidden paragraph",
|
|
];
|
|
|
|
await page.evaluate(
|
|
(text) => navigator.clipboard.writeText(text),
|
|
paragraphs.join("\n\n"),
|
|
);
|
|
await input.click();
|
|
await page.keyboard.press("ControlOrMeta+V");
|
|
await expect(input.locator("p")).toHaveCount(paragraphs.length);
|
|
|
|
await page.getByRole("button", { name: "Toggle formatting" }).click();
|
|
await page.getByRole("button", { name: "Spoiler", exact: true }).click();
|
|
|
|
await expect
|
|
.poll(() =>
|
|
input.evaluate(() =>
|
|
Array.from(
|
|
document.querySelectorAll(
|
|
'[data-testid="message-input"] .buzz-spoiler[data-spoiler]',
|
|
),
|
|
(node) => node.textContent,
|
|
),
|
|
),
|
|
)
|
|
.toEqual(paragraphs);
|
|
});
|
|
|
|
test("image attachments can be marked and sent as hidden spoilers", async ({
|
|
page,
|
|
}) => {
|
|
await installSpoilerBridge(page);
|
|
await page.goto("/");
|
|
await page.getByTestId("channel-general").click();
|
|
await expect(page.getByTestId("chat-title")).toHaveText("general");
|
|
|
|
await page.getByRole("button", { name: "Attach file" }).click();
|
|
|
|
const composer = page.getByTestId("message-composer");
|
|
await expect(
|
|
composer.getByRole("button", { name: "Attachment cccc", exact: true }),
|
|
).toBeVisible();
|
|
|
|
// Media spoilers are toggled per-attachment from the lightbox.
|
|
await composer.getByTestId("composer-media-attachment").hover();
|
|
await page.getByTestId("composer-attachment-annotate").click();
|
|
await page.getByTestId("composer-attachment-spoiler").click();
|
|
await page.keyboard.press("Escape");
|
|
await expect(composer.locator("[data-composer-media-spoiler]")).toBeVisible();
|
|
|
|
await page.getByTestId("send-message").click();
|
|
|
|
const lastMessage = page.getByTestId("message-row").last();
|
|
const spoilerBlock = lastMessage.locator(".buzz-spoiler--block");
|
|
await expect(spoilerBlock).toBeVisible();
|
|
await expect(spoilerBlock).toHaveAttribute("data-revealed", "false");
|
|
await expect(spoilerBlock.locator("[data-block-media] img")).toHaveAttribute(
|
|
"src",
|
|
IMAGE_URL,
|
|
);
|
|
|
|
await spoilerBlock.click();
|
|
await expect(spoilerBlock).toHaveAttribute("data-revealed", "true");
|
|
await expect(page.getByRole("dialog", { name: "image" })).toHaveCount(0);
|
|
});
|
|
|
|
test("text spoiler stays usable while attachment upload is pending", async ({
|
|
page,
|
|
}) => {
|
|
await installSpoilerBridge(page, { uploadDelayMs: 1_000 });
|
|
await page.goto("/");
|
|
await page.getByTestId("channel-general").click();
|
|
await expect(page.getByTestId("chat-title")).toHaveText("general");
|
|
|
|
const input = page.getByTestId("message-input");
|
|
await input.click();
|
|
await page.keyboard.type("pending secret");
|
|
|
|
// Kick off the (delayed) upload first — the attach button lives in the
|
|
// passive toolbar, which is replaced while formatting is expanded.
|
|
await page.getByRole("button", { name: "Attach file" }).click();
|
|
|
|
await page.getByRole("button", { name: "Toggle formatting" }).click();
|
|
const spoilerButton = page.getByRole("button", {
|
|
name: "Spoiler",
|
|
exact: true,
|
|
});
|
|
|
|
// Text spoilers are independent of media uploads, so the button stays
|
|
// enabled and works while the upload is still in flight.
|
|
await expect(spoilerButton).toBeEnabled();
|
|
await spoilerButton.click();
|
|
await expect(input.locator(".buzz-spoiler[data-spoiler]")).toContainText(
|
|
"pending secret",
|
|
);
|
|
|
|
await expect(
|
|
page
|
|
.getByTestId("message-composer")
|
|
.getByRole("button", { name: "Attachment cccc", exact: true }),
|
|
).toBeVisible();
|
|
});
|
|
|
|
test("hidden spoiler links reveal without opening on the first click", async ({
|
|
page,
|
|
}) => {
|
|
await installSpoilerBridge(page);
|
|
await page.goto("/");
|
|
await page.getByTestId("channel-general").click();
|
|
await expect(page.getByTestId("chat-title")).toHaveText("general");
|
|
|
|
const input = page.getByTestId("message-input");
|
|
await input.click();
|
|
await page.keyboard.type("||[secret](https://example.com)||");
|
|
await page.getByTestId("send-message").click();
|
|
|
|
const lastMessage = page.getByTestId("message-row").last();
|
|
const spoiler = lastMessage.locator(".buzz-spoiler").first();
|
|
await expect(spoiler).toHaveAttribute("data-revealed", "false");
|
|
|
|
// The freshly sent row can still be settling layout; a forced click
|
|
// computed from a pre-shift bounding box lands on the wrong element
|
|
// (force skips Playwright's stability check). Wait until the link's
|
|
// position is identical across two animation frames before clicking.
|
|
const secretLink = spoiler.getByRole("link", { name: "secret" });
|
|
await secretLink.evaluate(
|
|
(el) =>
|
|
new Promise<void>((resolve) => {
|
|
let last = -1;
|
|
const tick = () =>
|
|
requestAnimationFrame(() => {
|
|
const { y } = el.getBoundingClientRect();
|
|
if (y === last) resolve();
|
|
else {
|
|
last = y;
|
|
tick();
|
|
}
|
|
});
|
|
tick();
|
|
}),
|
|
);
|
|
|
|
const popupPromise = page
|
|
.waitForEvent("popup", { timeout: 500 })
|
|
.catch(() => null);
|
|
await secretLink.click({ force: true });
|
|
|
|
const popup = await popupPromise;
|
|
await popup?.close();
|
|
expect(popup).toBeNull();
|
|
await expect(spoiler).toHaveAttribute("data-revealed", "true");
|
|
});
|
|
|
|
test("hidden spoilers stay masked on hover and focus until reveal", async ({
|
|
page,
|
|
}) => {
|
|
await installSpoilerBridge(page);
|
|
await page.goto("/");
|
|
await page.getByTestId("channel-general").click();
|
|
await expect(page.getByTestId("chat-title")).toHaveText("general");
|
|
|
|
const input = page.getByTestId("message-input");
|
|
await input.click();
|
|
await page.keyboard.type("||secret hover focus note||");
|
|
await page.getByTestId("send-message").click();
|
|
|
|
const lastMessage = page.getByTestId("message-row").last();
|
|
const spoiler = lastMessage.locator(".buzz-spoiler").first();
|
|
const content = spoiler.locator(".buzz-spoiler__content");
|
|
const particles = spoiler.locator(".buzz-spoiler__particles");
|
|
|
|
await expect(spoiler).toHaveAttribute("data-revealed", "false");
|
|
await expect(content).toHaveCSS("opacity", "0");
|
|
await expect(particles).toHaveCSS("opacity", "1");
|
|
|
|
await spoiler.hover();
|
|
await expect(spoiler).toHaveAttribute("data-revealed", "false");
|
|
await expect(content).toHaveCSS("opacity", "0");
|
|
await expect(particles).toHaveCSS("opacity", "1");
|
|
|
|
await page.mouse.move(0, 0);
|
|
await spoiler.focus();
|
|
await expect(spoiler).toBeFocused();
|
|
await expect(spoiler).toHaveAttribute("data-revealed", "false");
|
|
await expect(content).toHaveCSS("opacity", "0");
|
|
await expect(particles).toHaveCSS("opacity", "1");
|
|
|
|
await page.keyboard.press("Enter");
|
|
await expect(spoiler).toHaveAttribute("data-revealed", "true");
|
|
await expect(content).toHaveCSS("opacity", "1");
|
|
await expect(particles).toHaveCSS("opacity", "0");
|
|
});
|
|
|
|
test("masked link inside a hidden spoiler does not leak its URL until revealed", async ({
|
|
page,
|
|
}) => {
|
|
const SECRET_URL = "https://private.example/leak-path";
|
|
await installSpoilerBridge(page);
|
|
await page.goto("/");
|
|
await page.getByTestId("channel-general").click();
|
|
await expect(page.getByTestId("chat-title")).toHaveText("general");
|
|
|
|
const input = page.getByTestId("message-input");
|
|
await input.click();
|
|
await page.keyboard.type(`||[secret](${SECRET_URL})||`);
|
|
await page.getByTestId("send-message").click();
|
|
|
|
const lastMessage = page.getByTestId("message-row").last();
|
|
const spoiler = lastMessage.locator(".buzz-spoiler").first();
|
|
await expect(spoiler).toHaveAttribute("data-revealed", "false");
|
|
|
|
const secretLink = spoiler.getByRole("link", { name: "secret" });
|
|
|
|
// Neither hovering nor focusing the still-hidden link may open the URL
|
|
// tooltip — that would leak the destination before the spoiler is revealed.
|
|
await secretLink.hover({ force: true });
|
|
await page.waitForTimeout(500); // exceed the tooltip open delay
|
|
await expect(page.getByRole("tooltip")).toHaveCount(0);
|
|
|
|
await page.mouse.move(0, 0);
|
|
await secretLink.focus();
|
|
await page.waitForTimeout(500);
|
|
await expect(page.getByRole("tooltip")).toHaveCount(0);
|
|
await expect(page.getByText(SECRET_URL)).toHaveCount(0);
|
|
await secretLink.blur();
|
|
|
|
// Reveal the spoiler (first click reveals; it must not open the link).
|
|
await page.mouse.move(0, 0);
|
|
await secretLink.evaluate(
|
|
(el) =>
|
|
new Promise<void>((resolve) => {
|
|
let last = -1;
|
|
const tick = () =>
|
|
requestAnimationFrame(() => {
|
|
const { y } = el.getBoundingClientRect();
|
|
if (y === last) resolve();
|
|
else {
|
|
last = y;
|
|
tick();
|
|
}
|
|
});
|
|
tick();
|
|
}),
|
|
);
|
|
await secretLink.click({ force: true });
|
|
await expect(spoiler).toHaveAttribute("data-revealed", "true");
|
|
|
|
// Now revealed, hovering the link reveals the URL tooltip as normal.
|
|
await secretLink.hover();
|
|
await expect(page.getByRole("tooltip")).toContainText(SECRET_URL);
|
|
});
|
|
|
|
test("non-interactive inbox preview spoilers let row clicks pass through", async ({
|
|
page,
|
|
}) => {
|
|
await installSpoilerBridge(page);
|
|
await page.goto("/");
|
|
await expect(page.getByTestId("home-inbox-list")).toBeVisible();
|
|
await page.waitForFunction(
|
|
() =>
|
|
typeof (window as MockFeedWindow).__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__ ===
|
|
"function",
|
|
);
|
|
|
|
await page.evaluate(
|
|
({ channelId, createdAt, currentPubkey, senderPubkey }) => {
|
|
const pushFeedItem = (window as MockFeedWindow)
|
|
.__BUZZ_E2E_PUSH_MOCK_FEED_ITEM__;
|
|
if (!pushFeedItem) {
|
|
throw new Error("Mock feed injection helper is not installed.");
|
|
}
|
|
|
|
pushFeedItem({
|
|
id: "mock-feed-spoiler-preview",
|
|
kind: 9,
|
|
pubkey: senderPubkey,
|
|
content: "Preview contains ||hidden launch note|| for review.",
|
|
created_at: createdAt,
|
|
channel_id: channelId,
|
|
channel_name: "general",
|
|
tags: [
|
|
["e", channelId],
|
|
["p", currentPubkey],
|
|
],
|
|
category: "mention",
|
|
});
|
|
},
|
|
{
|
|
channelId: GENERAL_CHANNEL_ID,
|
|
createdAt: Math.floor(Date.now() / 1000),
|
|
currentPubkey: TEST_IDENTITIES.tyler.pubkey,
|
|
senderPubkey: TEST_IDENTITIES.alice.pubkey,
|
|
},
|
|
);
|
|
|
|
const item = page.getByTestId("home-inbox-item-mock-feed-spoiler-preview");
|
|
await expect(item).toContainText("Preview contains");
|
|
|
|
const spoiler = item.locator(".buzz-spoiler").first();
|
|
await expect(spoiler).toBeVisible();
|
|
await expect(spoiler).not.toHaveAttribute("role", "button");
|
|
await expect(spoiler).not.toHaveAttribute("tabindex", "0");
|
|
await expect(spoiler).toHaveCSS("pointer-events", "none");
|
|
|
|
const box = await spoiler.boundingBox();
|
|
expect(box).not.toBeNull();
|
|
if (!box) {
|
|
throw new Error("Expected inbox preview spoiler to have a bounding box.");
|
|
}
|
|
|
|
await page.mouse.click(box.x + box.width / 2, box.y + box.height / 2);
|
|
await expect(page.getByTestId("home-inbox-detail")).toContainText(
|
|
"Preview contains",
|
|
);
|
|
});
|