From ead51b9fa0e7f5a40b6f2f16297a9f620ba59832 Mon Sep 17 00:00:00 2001 From: marc Date: Fri, 21 Aug 2026 19:24:45 +0200 Subject: [PATCH] Hold down the place the picture is looked for MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The suite proved a picture was drawn somewhere on the page. Where it belongs is the account button at the top of the sidebar — the person icon's place — so that is what the check now names. Co-Authored-By: Claude Opus 5 --- e2e/oidc.mjs | 7 +++++++ readme.md | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/e2e/oidc.mjs b/e2e/oidc.mjs index 2603993..f37cf39 100644 --- a/e2e/oidc.mjs +++ b/e2e/oidc.mjs @@ -101,6 +101,13 @@ try { check(created?.signsInWithProvider === true, "and has no password of its own"); check(created?.linkedToProvider === true, "and is marked as belonging to the provider"); + /* The picture belongs where the person icon was: in the account button at the + top of the sidebar. That is the place it is looked for. */ + check( + (await page.locator('[title="Account"] [data-avatar]').count()) === 1, + "the account button in the sidebar wears the picture instead of the person icon" + ); + /* ── what the two people involved see ── * The one signing in: no password tab, because there is no password behind * it. The administrator: which accounts these are, without asking anybody. */ diff --git a/readme.md b/readme.md index fe9bab7..68236eb 100644 --- a/readme.md +++ b/readme.md @@ -593,7 +593,7 @@ docker compose -f docker-compose.dev.yml up -d --build # must be running | Suite | Checks | What it holds down | | --- | --- | --- | | `admin` | 15 | no sign-up anywhere; `/api/admin/*` refused for non-admins even when called directly | -| `oidc` | 39 | the whole redirect journey against a provider that signs real tokens — and the four ways it must fail: a refusal, a replayed ticket, a token signed with an unpublished key, a token addressed to another client | +| `oidc` | 40 | the whole redirect journey against a provider that signs real tokens — and the four ways it must fail: a refusal, a replayed ticket, a token signed with an unpublished key, a token addressed to another client | | `editor` | 40 | tables and their right-click menu, task lists, note links, backlinks — and that each survives a reload | | `search-attachments` | 12 | body-only matches, ranking, umlauts; images as blob URLs, not inline bytes | | `history` | 10 | a large deletion is snapshotted, restoring works, restoring is itself undoable |