fix(web): allow Google consent form redirects #108

Merged

eleith merged 1 commits from fix/google-consent-csp into main 2026-10-30 18:22:03 +00:00

Conversation 0 Commits 1 Files Changed 3

+9 -1

eleith-gitea-agent Bot commented 2026-10-30 15:40:00 +00:00

Copy link

Copy source

Summary

• Allow exactly https://accounts.google.com alongside self in CSP form-action, so Chromium can follow the admin Google-calendar Connect form's consent redirect.
• Leave other CSP directives, CSRF, authentication and OAuth handlers unchanged. No dependency, database, configuration-schema or UI changes.
• Add one assertion to the existing security-header case for the exact delivered directive. Existing consent redirect/nonce and signed-out refusal cases remain unchanged. No new test cases, files or harness.
• Include a normal web patch changeset. This is follow-up PR one after #107; watcher shutdown cleanup is separate and not started.

Validation

• Final independent code/security and readability reviews passed.
• Formatting, ESLint and web type checks passed (0 errors/warnings).
• 23 focused provider/state-cookie unit tests passed.
• Four targeted Playwright cases passed with one worker and no retries: signed-out refusal, consent redirect/nonce, delivered security headers, and booking-page hydration under CSP.
• Negative control: the same header assertion fails against the original self-only policy and passes with the narrow allowance. These runs use isolated production builds.
• Full suite remains for PR CI. This is HTTP-policy coverage, not a completed browser/Google OAuth round trip.

Test scope and limits

Browser interception experiments were discarded rather than adding more test machinery. Playwright does not route redirected requests through the destination handler; one exploratory attempt reached Google's invalid-client page with dummy fixture values, without real credentials or code exchange. An offline relay alternative also proved unsuitable. None of that scaffolding remains: the permanent consent API test still disables redirect following, and the new assertion checks the actual CSP header served by When. No successful live Google-account authorization is claimed.

No watcher/lifecycle work, release, version bump, deployment or merge action is included. Owner will land this PR before the second follow-up starts.

## Summary - Allow exactly https://accounts.google.com alongside self in CSP form-action, so Chromium can follow the admin Google-calendar Connect form's consent redirect. - Leave other CSP directives, CSRF, authentication and OAuth handlers unchanged. No dependency, database, configuration-schema or UI changes. - Add one assertion to the existing security-header case for the exact delivered directive. Existing consent redirect/nonce and signed-out refusal cases remain unchanged. No new test cases, files or harness. - Include a normal web patch changeset. This is follow-up PR one after #107; watcher shutdown cleanup is separate and not started. ## Validation - Final independent code/security and readability reviews passed. - Formatting, ESLint and web type checks passed (0 errors/warnings). - 23 focused provider/state-cookie unit tests passed. - Four targeted Playwright cases passed with one worker and no retries: signed-out refusal, consent redirect/nonce, delivered security headers, and booking-page hydration under CSP. - Negative control: the same header assertion fails against the original self-only policy and passes with the narrow allowance. These runs use isolated production builds. - Full suite remains for PR CI. This is HTTP-policy coverage, not a completed browser/Google OAuth round trip. ## Test scope and limits Browser interception experiments were discarded rather than adding more test machinery. Playwright does not route redirected requests through the destination handler; one exploratory attempt reached Google's invalid-client page with dummy fixture values, without real credentials or code exchange. An offline relay alternative also proved unsuitable. None of that scaffolding remains: the permanent consent API test still disables redirect following, and the new assertion checks the actual CSP header served by When. No successful live Google-account authorization is claimed. No watcher/lifecycle work, release, version bump, deployment or merge action is included. Owner will land this PR before the second follow-up starts.

eleith-gitea-agent Bot added 1 commit 2026-10-30 15:40:00 +00:00

fix(web): allow Google consent form redirects ... d60f89c9e2

Permit only accounts.google.com alongside self in form-action. Assert the exact delivered policy in the existing security-header case; retain existing consent redirect and nonce tests unchanged without adding browser interception infrastructure.

eleith merged commit d60f89c9e2 into main 2026-10-30 18:22:03 +00:00

eleith deleted branch fix/google-consent-csp 2026-10-30 18:22:03 +00:00

eleith-gitea-agent Bot referenced this pull request 2026-10-30 18:43:26 +00:00

fix(web): stop config watcher on native shutdown #109

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

blocked

Waiting on a prerequisite before work can proceed

bug

Something is not working

enhancement

New feature

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

eleith-gitea-agent Bot eleith (eleith)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eleith/when#108