[\s\S]*?<\/details>/, ' ')
+ .replace(/<[^>]+>/g, ' ');
+ for (const word of ['keypair', 'key pair', 'plaintext', 'ML-KEM', 'ML-DSA', 'AES-256', 'fingerprint', 'vault mode', 'blob']) {
+ assert.ok(!new RegExp(word, 'i').test(flowText),
+ `steps 1 and 2 still say "${word}" to the reader; that belongs in the How this works panel, not in the path a sender walks`);
+ }
+ // And the fingerprint step is named after the thing the sender does.
+ assert.match(PS_HTML, /Compare this code together<\/div>/,
+ 'the verify card must be named for the action, not for the data structure');
+ assert.match(PS_HTML, /3 · Compare<\/span>/,
+ 'the stepper must name the same step the same way');
+});
+
+// ── 11. Which failures are worth a line in the console ──────────────────────
+// The page reports the unplanned case through failureText, which is the shared
+// reporter from js/error-message.js. "No key for this session" is not that
+// case: a signed-out browser gets 401 or 403 and a self-host that never built
+// the endpoint gets 404, and the banner is the whole answer to both. Reporting
+// them would put a console error on every signed-out visit, and
+// tests/product-heartbeat.test.mjs reads that console: it caught exactly this
+// and went red on "account key: HTTP 404". A 500 is a different thing and does
+// get reported. Verified by sabotage in both directions: report the expected
+// half and the 404 case goes red; stop reporting the 500 and the 500 case does.
+test('a missing session key is not a console error, and a broken endpoint is', async () => {
+ for (const status of [401, 403, 404]) {
+ const quiet = await loadPage({ keyResponses: [{ status, body: {} }] });
+ assert.equal(quiet.getElementById('ps-key-error').classList.contains('is-shown'), true,
+ `a ${status} must still raise the banner: the sender has to know why there is no key`);
+ assert.deepEqual(quiet.consoleErrors, [],
+ `a ${status} is the ordinary "no key here" answer and may not write to the console of every signed-out visit`);
+ }
+
+ const broken = await loadPage({ keyResponses: [{ status: 500, body: {} }] });
+ assert.equal(broken.getElementById('ps-key-error').classList.contains('is-shown'), true);
+ assert.ok(broken.consoleErrors.some((line) => /\[paramant\] account key/.test(line)),
+ 'a 500 is unplanned, and its detail belongs in the console through the one reporter');
+
+ // A 200 that carries no key is the non-revealable account, which is planned
+ // as well: the reveal route says so in as many words.
+ const noKey = await loadPage({ keyResponses: [{ status: 200, body: { api_key: null, revealable: false } }] });
+ assert.equal(noKey.getElementById('ps-key-error').classList.contains('is-shown'), true);
+ assert.deepEqual(noKey.consoleErrors, [],
+ 'an account whose key is not revealable is a documented state, not a fault to report');
+});
diff --git a/tests/site-claims.test.mjs b/tests/site-claims.test.mjs
index ead08113..ca90df1d 100644
--- a/tests/site-claims.test.mjs
+++ b/tests/site-claims.test.mjs
@@ -1453,8 +1453,19 @@ test('the CT-log hash named on /privacy and /dpa is the one ct-hash.js computes'
// 28 ── The browser-storage list. It named ps_free_uses "to enforce the 10/day
// limit client-side" and pm_docs_key; neither string exists anywhere in the
// repository, and the limit it described is 10 a month, not a day. Meanwhile the
-// key the site really does write, an API key, was not on the list at all.
-// Verified by sabotage: deleting any one entry fails this by key name.
+// key the site really did write, an API key, was not on the list at all.
+//
+// That API key is now the other half of the same problem. The page also said
+// paramant_api_key was "removed when you sign out" and nothing removed it, and
+// ParaSend has since stopped writing it altogether: /parashare reads
+// GET /api/user/account/key on every load and keeps the key in memory only. So
+// the inventory harvests what the frontend READS OR WRITES, and a key it only
+// ever DELETES (legacy cleanup of what an older build stored) is asserted to be
+// OFF the list rather than on it. Naming a key the site no longer keeps is the
+// same untruth as omitting one it does.
+// Verified by sabotage in both directions: deleting any one entry fails
+// this by key name; putting localStorage.setItem('paramant_api_key', …) back
+// into frontend/js/parashare.page.js fails it by the ParaSend assertion below.
test('the browser storage /privacy lists is the storage the frontend writes', () => {
const files = [];
(function walk(dir, prefix) {
@@ -1465,21 +1476,35 @@ test('the browser storage /privacy lists is the storage the frontend writes', ()
})(path.join(ROOT, 'frontend'), '');
assert.ok(files.length > 20, `the frontend walk found only ${files.length} files; the check would be vacuous`);
- const keys = new Set();
- for (const f of files) {
- const src = stripJsComments(read(`frontend/${f}`));
- for (const m of src.matchAll(/localStorage\.(?:get|set|remove)Item\(\s*['"`]([^'"`]+)/g)) keys.add(m[1]);
+ // Three shapes of key, harvested twice: once for the verbs that mean the
+ // browser is holding something (get/set), once for the verb that means the
+ // browser is being emptied (remove).
+ const harvest = (src, verbs, into) => {
+ for (const m of src.matchAll(new RegExp(`localStorage\\.(?:${verbs})Item\\(\\s*['"\`]([^'"\`]+)`, 'g'))) into.add(m[1]);
// A key held in a constant, and a key built by a helper: both are used here.
- for (const m of src.matchAll(/localStorage\.(?:get|set|remove)Item\(\s*([A-Za-z_$][\w$]*)\s*[,)]/g)) {
+ for (const m of src.matchAll(new RegExp(`localStorage\\.(?:${verbs})Item\\(\\s*([A-Za-z_$][\\w$]*)\\s*[,)]`, 'g'))) {
const c = new RegExp(`(?:const|let|var)\\s+${m[1]}\\s*=\\s*['"\`]([^'"\`]+)`).exec(src);
- if (c) keys.add(c[1]);
+ if (c) into.add(c[1]);
}
- for (const m of src.matchAll(/localStorage\.(?:get|set|remove)Item\(\s*([A-Za-z_$][\w$]*)\(/g)) {
+ for (const m of src.matchAll(new RegExp(`localStorage\\.(?:${verbs})Item\\(\\s*([A-Za-z_$][\\w$]*)\\(`, 'g'))) {
const fn = new RegExp(`function\\s+${m[1]}\\s*\\([^)]*\\)\\s*\\{\\s*return\\s+['"\`]([^'"\`]+)`).exec(src);
- if (fn) keys.add(fn[1]);
+ if (fn) into.add(fn[1]);
}
+ };
+ const keys = new Set();
+ const cleared = new Set();
+ for (const f of files) {
+ const src = stripJsComments(read(`frontend/${f}`));
+ harvest(src, 'get|set', keys);
+ harvest(src, 'remove', cleared);
}
- assert.ok(keys.size >= 5, `only ${keys.size} storage keys resolved; the check would be vacuous`);
+ assert.ok(keys.size >= 4, `only ${keys.size} storage keys resolved; the check would be vacuous`);
+
+ // The ParaSend pin. Send in the signed-in navigation used to die on a key the
+ // sender had typed by hand, because localStorage was a second source of truth
+ // next to the session. There is one source now, and it is not this store.
+ assert.ok(!keys.has('paramant_api_key'),
+ 'a frontend file reads or writes paramant_api_key again. ParaSend takes the account key from GET /api/user/account/key on every load and keeps it in memory; /privacy no longer lists this key, so putting it back in localStorage makes that page untrue.');
const priv = visible(page('privacy'));
const list = priv.slice(priv.indexOf('Local storage in your browser
'), priv.indexOf('', priv.indexOf('Local storage in your browser
')));
@@ -1491,6 +1516,9 @@ test('the browser storage /privacy lists is the storage the frontend writes', ()
for (const n of named) {
if (![...keys].some((k) => k === n || k.startsWith(n))) problems.push(`privacy: the storage list names "${n}" and no frontend file writes it`);
}
+ for (const k of [...cleared].filter((c) => !keys.has(c)).sort()) {
+ if (named.some((n) => k === n || k.startsWith(n))) problems.push(`privacy: the storage list names "${k}" and the frontend only ever deletes it, which is not storage the browser keeps`);
+ }
assert.deepEqual(problems, [], `\n ${problems.join('\n ')}\n`);
});
diff --git a/tests/ui-truthfulness.test.mjs b/tests/ui-truthfulness.test.mjs
index f66422d3..1d3fa9bf 100644
--- a/tests/ui-truthfulness.test.mjs
+++ b/tests/ui-truthfulness.test.mjs
@@ -1848,3 +1848,56 @@ console.log('ui-truthfulness: the rules page is Our rules on /rules, with /parar
})();
console.log('ui-truthfulness: the appearance switch says only what theme.js and app-2026.css do');
+
+// ── /parashare says up front that this is a live handshake ──────────────────
+// A buyer reached step 2 before finding out that the other person has to be at
+// their screen right now. The stepper said "2 . Share", the card said "Waiting
+// for receiver", and by then he had already picked a file and made a link. That
+// is not a copy problem on step 2; it is a fact about the product that belongs
+// above step 1, in the words someone would use out loud.
+//
+// The sentence is pinned to the flow rather than to itself. It claims two
+// things: that the receiver has to be online while you send, and that the two
+// of you confirm a short code together. Both are properties of
+// parashare.page.js, so both are read back from it here. Verified by sabotage:
+// drop the sentence, or let confirmFingerprint run without receiverPubs, or
+// let createSession reach step-encrypting without going through the waiting
+// step, and this block goes red.
+(() => {
+ const parashare = read('frontend/parashare.html');
+ const psJs = read('frontend/js/parashare.page.js');
+
+ assert.match(parashare, /The person you send to has to be online while you send; you confirm a short code together\./,
+ '/parashare must say above step 1 that the receiver has to be there; a sender should not discover a live handshake on step 2');
+ // Above step 1 means above it, not somewhere on the page: the sentence has to
+ // sit before the step-1 guide inside #step-setup.
+ const setupAt = parashare.indexOf('id="step-setup"');
+ const noteAt = parashare.indexOf('The person you send to has to be online');
+ const guideAt = parashare.indexOf('Step 1 of 5');
+ assert.ok(setupAt > 0 && noteAt > setupAt && noteAt < guideAt,
+ 'the sentence must stand inside #step-setup and above the step-1 guide, which is where a sender reads before choosing a file');
+
+ // Claim 1: sending really does wait for the other person. createSession goes
+ // to the waiting step and opens the socket, and nothing else advances.
+ assert.match(psJs, /showStep\('step-waiting'\);\s*\n\s*connectWebSocket\(\);/,
+ 'createSession must hand over to the waiting step: that wait is what the sentence promises');
+ assert.equal((psJs.match(/showStep\('step-encrypting'\)/g) || []).length, 1,
+ 'more than one path now reaches the encrypt step; the promise that the receiver has to be online is only true while confirmFingerprint is the single door');
+ const confirm = psJs.slice(psJs.indexOf('async function confirmFingerprint()'));
+ const guardAt = confirm.indexOf('if (!receiverPubs) return;');
+ const encryptAt = confirm.indexOf('showStep(\'step-encrypting\')');
+ assert.ok(guardAt >= 0,
+ 'confirmFingerprint no longer refuses to run without a receiver; the sentence above step 1 promises the receiver has to be there');
+ assert.ok(encryptAt > guardAt,
+ 'the encrypt step must sit behind the receiverPubs guard, so a sender cannot send to nobody');
+
+ // Claim 2: there really is a short code, and both sides work it out.
+ assert.match(psJs, /async function genFingerprint\(/,
+ 'the short code the sentence promises is genFingerprint; without it the sentence describes nothing');
+ assert.match(parashare, /Compare this code together/,
+ 'the card where the two of you compare must be named after what it asks you to do');
+ assert.match(read('frontend/js/ontvang.page.js'), /genFingerprint|fp-display/,
+ 'the receiver side must compute a code too, otherwise "together" is one-sided');
+})();
+
+console.log('ui-truthfulness: /parashare says the receiver has to be online, and the flow really waits for them');