Repository navigation
test(verify): send the cookie transport header and cover the request guards - #345
Merged
Merged
Conversation
…guards The adapter actor now sends x-seamless-auth-transport: cookie, as the official client does, so body-less unsafe requests pass the content-type gate adapters add in v0.23. New request guard cases assert that a cross-site unsafe request answers 403 and leaves the session alone, and that a body-less form POST to /auth/recovery-codes without the header answers 415. The 415 case is a pending contract: it skips unless SEAMLESS_VERIFY_CONTRACTS names it, because the Go, Python and Rust adapters run these specs from main unpinned. The matrix reporter no longer counts a skipped case as a failure. Refs fells-code/seamless-auth-api#558
This was referenced Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The adapter conformance suite sends
x-seamless-auth-transport: cookieon cookie transport requests, as@seamless-auth/clientnow does (fells-code/seamless-auth-js PR alongside this one), and gains cases for the request guards from the v0.21 security review (fells-code/seamless-auth-api#558).Changes
newAdapterActorsends the header on every request. Bearer specs override it per request. All four adapters treat onlybeareras bearer, socookiechanges nothing for adapters that have not shipped the gate.verify/harness/adapter/requestGuards.spec.ts:POST /auth/recovery-codesandDELETE /auth/logoutanswer 403cross_site_request_blocked, and the session survives. Already true on every adapter's main, so this case is not gated.POST /auth/recovery-codeswithout the header answers 415unsupported_media_type, and the same request with the header then answers 201.verify/harness/lib/pendingContracts.ts). It runs only whenSEAMLESS_VERIFY_CONTRACTSnamescontent-type-gate(orall). Each adapter sets that in its conformance job once it releases the gate, and the entry is removed once all four have. This matters because the Go, Python and Rust jobs check out this repo's default branch unpinned.SameSite=None, so the suite cannot exercise Lax or Strict.CONFORMANCE.mdsays so; each adapter's unit tests cover those.Checks
Harness
tsc --noEmitclean, build passes, vitest 1718 passed, 4 skipped. The 415 case was confirmed to skip by default and to run with the variable set. The fullseamless verifyrun against the Docker stack was not done locally; CI runs it.