feat(runner): the authed share round-trip, against the real backend (DEV-2203) - #186
Open
danielzytohoc wants to merge 4 commits into
Open
feat(runner): the authed share round-trip, against the real backend (DEV-2203)#186danielzytohoc wants to merge 4 commits into
danielzytohoc wants to merge 4 commits into
Conversation
…DEV-2203) create → build → view → revoke, no stubs: the one test that exercises the builder, R2 and D1 end to end. Everything else about sharing is proved with stubbed APIs (authed-actions) or read-only against a fixture (share-view); nothing walked the write path a deploy could break. Gated on E2E_BROKER_TOKEN — the worker re-validates every bearer against the broker and requires @handsontable.com, deliberately, so the token is a secret someone refreshes by hand when they want the run. The spec asserts the signed-in top bar before acting, so an expired token reads as 'token expired', not a dead Share button. One BuilderSandbox boot and one D1 row per run; the revoke in finally is both the cleanup and the last assertion (a revoked share answers 410).
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
added 2 commits
August 17, 2026 08:34
…#186) getByLabel(/client link/i) matched both the field and its 'Copy Public client link' button; strict mode threw before demoId was set, so the finally never revoked and the minted production share stayed live. The id now comes from the POST /api/demos response the moment it exists — no locator can stand between the mint and the cleanup — and the dialog read narrows to the textbox role, asserting it names the same demo.
danielzytohoc
changed the base branch from
feat/DEV-2203-engine-and-docs-frameworks
to
feat/DEV-2203-style-panel-e2e
August 17, 2026 06:35
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 189429c. Configure here.
A visible Fork button proves auth, not content: the workspace starts as an empty placeholder and fills asynchronously — and can refill when /api/versions swaps in latest. Sharing in that window posts empty files and burns the whole 300s dialog budget on a doomed build. The test now waits for /package.json to exist in the files map first.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sixth in the DEV-2203 series. Stacked on #184.
What
e2e/share-create-live.spec.ts— one test, the full authed write path with no stubs: real broker token → Share → realPOST /api/demos(BuilderSandbox build, 300 s budget) →/d/:id/renders for an anonymous client →DELETEinfinally→ 410. The revoke is both cleanup and the final assertion, and rows are soft-deleted, so the worst-case leak is one revoked row.Gate:
E2E_BASE_URLandE2E_BROKER_TOKEN(a freshsessionStorage.hot_tokenfrom a signed-in session — documented in AGENTS.md). Broker tokens expire and cannot be minted programmatically; the sustainable machine-auth story is a follow-up ticket, and until then this runs on demand from the e2e-live dispatch, never on a schedule.Verification
Skip behavior verified (skips without the env pair; asserts the signed-in top bar before acting so an expired token reads as "token expired"). The live path needs a real token — @dan: one manual run with your session token before wiring it into e2e-live would be the proof.
Cost: one BuilderSandbox boot (pool of 3) + one D1 row per run.
Note
Low Risk
Test-only and documentation changes; no production auth, API, or share logic is modified.
Overview
Adds
e2e/share-create-live.spec.ts, the only test that runs the full authed share path against a deployed worker with no stubs: inject a real broker token, wait for the starter workspace, Share → realPOST /api/demos(up to ~300s build), open/d/:id/as an anonymous client, thenDELETEinfinallyand assert 410 on the public URL. Demo id is taken from the mint response (not fragile dialog locators), addressing prior strict-mode / orphan-share issues noted in the spec.The spec self-skips without
E2E_BASE_URLandE2E_BROKER_TOKEN(manualsessionStorage.hot_tokenrefresh).runner/AGENTS.mddocuments that gate, workflow behavior when the token is expired, and briefly documents the existingE2E_AI=1live LLM checks.Reviewed by Cursor Bugbot for commit 2fcf416. Bugbot is set up for automated code reviews on this repo. Configure here.