Files
VoxVera/e2e
thePR0M3TH3ANandClaude Opus 4.8 29ed45533d Add localized Safety & privacy page + static link-preview meta
New standalone /safety page (safety.html / safety.js), localized across
all 14 languages, in plain language: what VoxVera protects, what it does
NOT (relays see your IP; the anonymous key is stored unencrypted; a short
PIN won't stop a targeted attacker; published events are public and
permanent; nsec-paste risk; reports are public; the host/relays still see
requests), and operational tips (Tor/VPN, disposable keys, signer apps).
Linked from the editor and the board. Aimed at the activist audience the
aesthetic invites — being honest about limits matters more than features.

Also adds static site-wide Open Graph / Twitter-card meta to the home,
board, and safety pages so a shared voxvera.org link renders a real
title/description instead of nothing. Per-flyer previews remain a
deliberate non-goal: the naddr lives in the URL fragment (invisible to
servers) and per-flyer meta would require server-side rendering, which is
out of scope for a purely static site.

i18n guard extended to SAFETY_UI (keys + equal bullet-list lengths per
language). New cross-engine test covers the page's sections, localization,
RTL, and the editor/board links. Full suite 354 passing.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-06-11 14:53:48 -04:00
..

Cross-browser end-to-end tests

Playwright smoke tests that exercise the static client on every major browser engine and on mobile emulations, so a change that works in Chrome can be confirmed to work in Firefox and Safari (WebKit) too.

Coverage

Projects are defined in ../playwright.config.js:

Project Engine Notes
chromium-desktop Chromium Chrome / Brave / Edge
firefox-desktop Gecko Firefox
webkit-desktop WebKit Safari on macOS
chrome-android Chromium Pixel 5 emulation (touch, mobile UA)
safari-ios WebKit iPhone 13 emulation — proxy for iOS Safari
firefox-mobileviewport Gecko Mobile viewport only (Playwright Firefox has no touch/isMobile emulation)

WebKit is the engine behind Safari and every iOS browser, so the WebKit projects are our stand-in for the Apple ecosystem without a Mac in the loop. They are not a perfect substitute for real Safari/iOS (notably print dialog behavior and clipboard gesture rules), so a real-device pass is still worth doing before a release.

The specs in flyer.spec.js check the genuinely engine-sensitive surfaces:

  • default flyer renders with no uncaught JS / console errors
  • @media print hides the app chrome and keeps the flyer (a print-media screenshot of the sheet is attached per engine for visual diffing)
  • anonymous key generation works (the WebCrypto path)
  • the legacy /nostr/ redirect preserves the query string and #hash
  • an event-lookup URL shows the localized loading state, never the default flyer
  • the bulletin board is gated behind a Nostr connection: the gate shows when no identity is connected, connecting (stubbed window.nostr) reveals the table and the connected npub, disconnecting returns to the gate, and a remembered connection auto-restores on revisit
  • the board's alternative connect methods: pasting an nsec derives the pubkey, reveals the board, leaves no secret in the DOM or storage, and restores on reload from the pubkey alone; an invalid nsec errors without connecting; and "Create a new key" reveals the npub/nsec, stores the device key, then connects
  • flyer management: editor and board delete publish a tombstone + a NIP-09 deletion (the board/viewer then hide it); a NIP-07 publish builds the naddr from the signer even before the pubkey loads; the board's Block hides an author locally, persists, and clears; own-flyer rows show Edit/Re-broadcast/ Delete while others show Block
  • the editor's publishing identity: defaults to anonymous; connecting NIP-07 (stubbed) signs/publishes under the extension key; importing an nsec signs for the session without persisting the secret; an invalid nsec errors; a remembered nsec is PIN-encrypted at rest (the stored blob never contains the plaintext secret), locks on reload, rejects a wrong PIN, and unlocks with the right one; "Forget" clears the stored identity back to anonymous
  • the board's web-of-trust filter (stubbed relays): a connected viewer sees only flyers from authors in their NIP-02 follow graph, "Show all" opts out to the full set, and a viewer with no follow list is seeded from the curator's follows

Running

npm install
npx playwright install            # download Chromium, Firefox, WebKit
npm run test:e2e                  # all projects
npx playwright test --project=firefox-desktop   # one engine
npm run report                    # open the HTML report (with print screenshots)

Playwright starts and stops the static server itself (python3 -m http.server), so you do not need a server running first.

Linux: WebKit system dependency

On a fresh Linux box WebKit needs extra system libraries. If the WebKit projects fail to launch, install them once:

sudo npx playwright install-deps   # or: sudo apt-get install -y libavif16

The Chromium and Firefox projects run without this step.