Replaces Promise.any with raceOrdered utility to respect decryptor preference order while maintaining parallel execution.
Adds regression test for order preference.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Refactor `tests/utils/linkPreviewSettings.test.mjs` to be self-contained and remove dependency on `jsdom` (via `test-setup.mjs`).
- Add comprehensive test cases for `getLinkPreviewSettings`, `setLinkPreviewAutoFetch`, `allowLinkPreviewDomain`, `isLinkPreviewDomainAllowed`, and `subscribeToLinkPreviewSettings`.
- Add robustness checks for missing `localStorage` (simulated) and invalid inputs.
- Polyfill `EventTarget` and `CustomEvent` (as fallback) to ensure tests run reliably in environments where `jsdom` is unavailable.
This addresses the gap in testing coverage for `js/utils/linkPreviewSettings.js` while ensuring test stability.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Replaced `innerHTML` usage in `Drawing.prototype.draw` (table fallback) with `document.createElement`, `appendChild`, etc.
- Replaced `innerHTML` usage in `Drawing.prototype.clear` with `removeChild` loop.
- Added `tests/qrcode_table_fallback.test.mjs` to verify the table generation logic in a simulated environment (JSDOM) without Canvas support.
- Updated `package.json` to include `jsdom` in `devDependencies` (if it wasn't already there and committed, though I verified it is present after install).
This change eliminates the potential for HTML injection vulnerabilities in the QR code generation library.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Replaces unsafe innerHTML usage with document.createElement and appendChild in the table drawing fallback.
- Adds a unit test `tests/qrcode_table_fallback.test.mjs` to verify the table generation logic using JSDOM.
- Addresses a potential security vulnerability where HTML injection could occur (though unlikely in this specific context, it is best practice).
- Updates package.json to include jsdom in devDependencies (if not already present).
Co-authored-by: PR0M3TH3AN <[email protected]>
- Create `tests/static-modal-accessibility.test.mjs` to test `prepareStaticModal`, `openStaticModal`, and `closeStaticModal`.
- Tests cover element resolution, DOM state updates (classes, attributes), and edge cases (missing elements, null targets).
- Use `jsdom` to mock the browser environment.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Created `tests/video-menu-renderers.test.mjs` to test `js/ui/components/videoMenuRenderers.js`.
- Implemented comprehensive test coverage for `createVideoMoreMenuPanel`, `createVideoShareMenuPanel`, `createChannelProfileMenuPanel`, and `createVideoSettingsMenuPanel`.
- Tests use `jsdom` to simulate DOM element creation and verify structure, classes, and dataset attributes.
- Ensured dependencies (`jsdom`) are installed.
- Verified tests pass with `npm run test:unit`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced the local `extractDTagValue` function in `js/ui/components/DeleteModal.js` with the shared `getDTagValueFromTags` utility from `js/nostr/nip71.js` to reduce code duplication and improve maintainability.
Added `tests/ui/components/DeleteModal.test.mjs` with manual DOM mocks to verify the refactor and ensure no regressions.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced the local `extractDTagValue` function in `js/ui/components/DeleteModal.js` with the shared `getDTagValueFromTags` utility from `js/nostr/nip71.js` (exported via `js/nostr/index.js`).
Added a new unit test `tests/ui/components/DeleteModal.test.mjs` to verify the d-tag extraction logic and ensure the refactor is correct and safe. This test uses `jsdom` to mock the necessary DOM environment.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added comprehensive tests for default settings, storage parsing, and error handling.
- Covered `setLinkPreviewAutoFetch` and `allowLinkPreviewDomain` (including normalization and silent mode).
- Verified `isLinkPreviewDomainAllowed` and event subscriptions.
- Mocked `window.dispatchEvent`, `addEventListener`, and `CustomEvent` locally as they are missing from test helpers.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Removed duplicated `extractDTagValue` method from `js/ui/components/RevertModal.js`
- Imported and used `getDTagValueFromTags` from `js/nostr/nip71.js`
- Added unit tests for `getDTagValueFromTags` in `tests/nostr/nip71-d-tag.test.mjs`
This reduces code duplication and ensures consistent d-tag extraction logic.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced the duplicated `extractDTagValue` method in `RevertModal.js` with the standard `getDTagValueFromTags` utility from `js/nostr/nip71.js`.
Verified by adding a new unit test suite `tests/nostr/nip71-d-tag.test.mjs` ensuring the utility covers all edge cases.
This improves code health by reducing duplication and centralizing NIP-71 logic.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced `pMap` with `Promise.all` in `publishRecords` to remove concurrency limit for faster syncing of multiple month records.
Measured ~50% improvement in mock benchmark (200ms -> 100ms for 10 items with concurrency 5 vs unbounded).
Note: The task description described the existing code as a sequential `for` loop, but the actual file used `pMap` with concurrency 5. This change optimizes it further by removing the concurrency limit as requested.
Co-authored-by: PR0M3TH3AN <[email protected]>
This commit mitigates a reverse tabnabbing vulnerability by ensuring
that the external link in the embed player opens with proper
security attributes.
Co-authored-by: PR0M3TH3AN <[email protected]>
This commit replaces the duplicated d-tag extraction logic in `extractDTagValue` method of `js/app.js` with the standard utility function `getDTagValueFromTags` from `js/nostr/nip71.js`. This improves code reuse and maintainability.
The fallback logic for `extractDTagValue` now delegates to `getDTagValueFromTags` if `similarContentController` is not present, ensuring consistent behavior.
Verified with unit tests and linting.
Co-authored-by: PR0M3TH3AN <[email protected]>
This commit addresses a security vulnerability in `views/channel-profile.html` where an external link with `target="_blank"` was missing `rel="noopener noreferrer"`. This could allow the target page to manipulate the `window.opener` object (reverse tabnabbing).
Changes:
- Added `rel="noopener noreferrer"` to the `#channelWebsite` anchor tag.
Verification:
- Confirmed the attribute is present using a Playwright verification script.
- Confirmed no visual regressions.
- Ran linting checks (passed).
- Ran unit tests (pre-existing unrelated failures in NIP compliance noted).
Co-authored-by: PR0M3TH3AN <[email protected]>
Executed the weekly-synthesis-agent as per the scheduler flow.
Generated `ai/reports/weekly-20260225.md` summarizing the week's activity.
Created scheduler log `docs/agents/task-logs/weekly/2026-02-25_13-34-49_weekly-synthesis-agent_completed.md`.
Co-authored-by: PR0M3TH3AN <[email protected]>
