connectRemoteSigner and useStoredRemoteSigner accepted but never used the
`validator` the auth provider passes (accessControl.canAccess) -- so NIP-46
logins bypassed the block/allow gate that nsec/NIP-07 logins enforce. (The
validation lived only on the unused Nip46Connector.)
Both paths now run the validator against the remote signer's resolved user
pubkey BEFORE activating the signer (via _enforceRemoteSignerValidator): the
validator throws on a blocked/non-permitted pubkey, or returning false rejects
with code remote-signer-access-denied. A stored session rejected by the
validator is forgotten so a blocked pubkey can't keep retrying.
Residual (noted in TODO): the silent startup auto-restore
(scheduleStoredRemoteSignerRestore) still reconnects without a validator.
Test: tests/nostr/nip46-prepare-handshake.test.mjs (validator throws / false /
true / absent). Full suite green.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Two gaps where generic S3 trailed Cloudflare R2:
1. Object cleanup on delete/edit didn't work for generic S3. deleteVideoStorage
built its client via makeR2Client, which hard-forces path-style and ignores
the connection's forcePathStyle -- so vhost-style S3 deletes were misaddressed
and cleanup silently failed (S3 users' deleted/edited files orphaned). It is
now provider-aware (mirrors uploadFile): R2 -> makeR2Client (path-style),
generic S3 -> makeS3Client honoring forcePathStyle. makeS3Client is now
injectable for testing.
2. CORS guidance on upload failure was R2-only. Extracted isLikelyCorsError +
a generic-S3 guidance builder into js/utils/uploadErrorHints.js (re-exported
from r2Service for back-compat); s3UploadService now appends actionable CORS
guidance on an opaque "Failed to fetch" too.
Generic S3 is now at functional parity with R2 for upload -> publish -> cleanup.
Tests: r2-delete-video-storage (adds generic-S3 forcePathStyle routing),
s3-upload-cors-guidance (new). Full suite green.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
A new user's top first-upload failure is a missing R2 CORS policy (browser
PUT/POST blocked) -- and object-scoped R2 tokens often cannot auto-set CORS.
The connection test already surfaces buildCorsGuidance on the opaque
"Failed to fetch", but a user who skips the test and uploads directly got a
bare "Upload failed: Failed to fetch". The upload error handler now detects the
browser CORS/network rejection (isLikelyCorsError -- Chrome "Failed to fetch",
Firefox "NetworkError", Safari "Load failed") and appends the same actionable
guidance. Updated the R2 follow-up TODO (credential audit done; CORS reviewed).
Test: tests/services/r2-cors-error-classifier.test.mjs. Full suite green.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Captures remaining R2 work after the upload audit + object-cleanup increments:
credential-security review, bucket/custom-domain provisioning audit, CDN purge
integration, and follow-ups to the cleanup work (generic-S3 cleanup, all-versions
delete cleanup, edit thumbnail cleanup). Plus the Vercel production-branch parking
lot item.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
- Executed unit tests (passed).
- Detected flakiness in subsequent test runs (timeout).
- Performed static analysis (zero assertions, timing, console usage).
- Generated test audit report and saved to `artifacts/`.
- Updated test logs and flakiness matrix.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Executed test-audit-agent daily task.
- Generated audit report in docs/agents/task-logs/daily/.
- Added reusable scripts in test-audit/ for flakiness check and static analysis.
- Verified test suite (shard 1) and identified failure in hashtag-preferences.test.mjs.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Adds `scripts/run-test-audit.sh` to automate unit test execution with coverage.
- Adds `scripts/analyze-flakiness.mjs` to detect test flakiness.
- Adds `scripts/static-test-analysis.mjs` to find suspicious test patterns.
- Adds `scripts/coverage-gap-analysis.mjs` to identify critical coverage gaps.
- Adds `scripts/generate-audit-report.mjs` to produce markdown reports.
- Generates initial audit report `test-audit-report-2025-02-18.md` and `issues/ISSUE_test_audit_findings.md`.
- Documents findings in `decisions/DECISIONS_2025-02-18.md`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- `handleVisibility` only scheduled intervals but didn't trigger an immediate refresh when returning to the tab.
- This caused `tests/unit/services/exploreDataService.test.mjs` to fail (assertion `0 !== 1`).
- Added explicit calls to `refreshWatchHistoryTagCounts` and `refreshTagIdf` when `document.hidden` becomes false.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Replaced unbounded `Promise.all` with `pMap` and `RELAY_BACKGROUND_CONCURRENCY || 3` in `js/nostr/dmSignalEvents.js` and `js/services/dmNostrService.js` to prevent network saturation.
- Updated `scripts/check-hex.js` to exclude agent artifact directories (`perf/`, `test_logs/`, `context/`, etc.) to prevent lint failures when agents log code snippets or hex codes.
- Increased `maxBuffer` in `scripts/check-hex.js` to 10MB to be robust against large matches.
- Updated `js/services/exploreDataService.js` to trigger immediate data refresh (`refreshWatchHistoryTagCounts` and `refreshTagIdf`) when visibility state changes to visible, fixing a unit test failure.
- Includes daily performance report and context logs.
Co-authored-by: PR0M3TH3AN <[email protected]>
Extracted DM Relay UI logic and DM Attachment logic into separate binder modules to reduce the size of ProfileModalController.js. Updated file size baseline.
Co-authored-by: PR0M3TH3AN <[email protected]>
