fix(ui): document viewer back button returns to the page you came from (chat or sources)
This commit is contained in:
@@ -98,12 +98,13 @@ def test_on_topic_question_streams_grounded_answer(
|
||||
|
||||
# Grounded: a kubernetes.md source chip renders under the bubble
|
||||
# (top-N docs can add more chips; the question's doc must be among them).
|
||||
# Phase 10: chips open the document viewer in a new tab (encoded URL).
|
||||
# Phase 10: chips open the document viewer in a new tab (encoded URL);
|
||||
# phase 13 appends back=/ so the viewer's back button returns to chat.
|
||||
chip = page.locator(".msg.brain .source-chip", has_text="kubernetes.md")
|
||||
expect(chip).to_have_count(1)
|
||||
expect(chip.first).to_contain_text("kubernetes.md")
|
||||
expect(chip.first).to_have_attribute(
|
||||
"href", "/document.html?source=docs&path=homelab%2Fkubernetes.md"
|
||||
"href", "/document.html?source=docs&path=homelab%2Fkubernetes.md&back=%2F"
|
||||
)
|
||||
expect(chip.first).to_have_attribute("target", "_blank")
|
||||
expect(chip.first).to_have_attribute("rel", "noopener")
|
||||
|
||||
@@ -0,0 +1,206 @@
|
||||
"""Phase 13 E2E (Playwright): the viewer's back button returns to the
|
||||
page the document was opened from.
|
||||
|
||||
Story: ``.agent/user_stories/document-back-navigation.md``
|
||||
Run in isolation (DB must be up: ``podman compose up -d db``):
|
||||
|
||||
uv run pytest tests/e2e/test_document_back_navigation.py -v --no-cov
|
||||
|
||||
Both entry points (chat source chips, Sources table links) open the viewer
|
||||
in a NEW tab, where there is no browser history — so the return target is
|
||||
carried in the viewer URL: chat chips append ``&back=%2F`` (resolves to
|
||||
"Chat"), Sources links omit the param (the viewer's default
|
||||
``/sources.html`` applies → "Sources"). The viewer only honors
|
||||
same-origin relative ``back`` values; everything else falls back to
|
||||
``/sources.html``.
|
||||
|
||||
Test → story mapping (Playwright Mapping Rule):
|
||||
1. ``test_back_from_chat_returns_to_chat`` — question → source chip →
|
||||
new tab with ``&back=%2F`` → back link href ``/`` labeled "Chat" →
|
||||
click → the chat page.
|
||||
2. ``test_back_from_sources_returns_to_sources`` — Sources table link →
|
||||
new tab without a ``back`` param → back link href ``/sources.html``
|
||||
labeled "Sources" → click → the Sources page.
|
||||
3. ``test_malicious_back_param_is_rejected`` — absolute,
|
||||
protocol-relative, and ``javascript:`` ``back`` values all fall back
|
||||
to ``/sources.html`` (labeled "Sources", navigable).
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import asyncio
|
||||
import re
|
||||
from pathlib import Path
|
||||
from threading import Thread
|
||||
from typing import Any
|
||||
|
||||
from playwright.sync_api import Page, expect
|
||||
from sqlalchemy import text
|
||||
|
||||
from app.config import Settings
|
||||
from app.db import SessionLocal
|
||||
from app.rag.importer import ImportSummary, import_sources
|
||||
from app.rag.llm import LLMClient
|
||||
|
||||
REPO = Path(__file__).resolve().parents[2]
|
||||
FIXTURES = REPO / "tests" / "fixtures" / "docs"
|
||||
QUESTION = "How is my Kubernetes cluster set up?"
|
||||
# Seeded fixture doc (source=docs) shared by every test in this file.
|
||||
DOC_SOURCE = "docs"
|
||||
DOC_PATH = "homelab%2Fkubernetes.md"
|
||||
DOC_TITLE = "Kubernetes Homelab Cluster"
|
||||
|
||||
|
||||
async def _import_fixtures(mock_port: int) -> ImportSummary:
|
||||
kwargs: dict[str, Any] = {"_env_file": None, "llm_base_url": f"http://127.0.0.1:{mock_port}/v1"}
|
||||
settings = Settings(**kwargs) # pyright: ignore[reportCallIssue]
|
||||
return await import_sources([FIXTURES], LLMClient(settings))
|
||||
|
||||
|
||||
def _run_in_thread(coro: Any) -> Any:
|
||||
"""Run a coroutine on a worker thread.
|
||||
|
||||
Playwright's sync API keeps an asyncio loop running on the test thread,
|
||||
so ``asyncio.run`` cannot be called directly from a test body.
|
||||
"""
|
||||
box: dict[str, Any] = {}
|
||||
|
||||
def runner() -> None:
|
||||
try:
|
||||
box["value"] = asyncio.run(coro)
|
||||
except BaseException as e: # noqa: BLE001 — re-raised on the test thread
|
||||
box["error"] = e
|
||||
|
||||
t = Thread(target=runner)
|
||||
t.start()
|
||||
t.join()
|
||||
if "error" in box:
|
||||
raise box["error"]
|
||||
return box["value"]
|
||||
|
||||
|
||||
def _reset_db(mock_port: int, seed: bool) -> ImportSummary | None:
|
||||
"""Truncate the KB (and query log), then optionally re-import fixtures."""
|
||||
with SessionLocal() as db:
|
||||
db.execute(text("TRUNCATE chunks, documents, query_log"))
|
||||
db.commit()
|
||||
if not seed:
|
||||
return None
|
||||
return _run_in_thread(_import_fixtures(mock_port))
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 1. Chat source chip → viewer with back=/ → back returns to the chat
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def test_back_from_chat_returns_to_chat(
|
||||
page: Page, app_url: str, mock_llm: int, db_ready: None
|
||||
) -> None:
|
||||
_reset_db(mock_llm, seed=True)
|
||||
page.set_default_timeout(30_000)
|
||||
page.goto(app_url)
|
||||
|
||||
page.fill("#message-input", QUESTION)
|
||||
page.click("#send-btn")
|
||||
|
||||
chip = page.locator(".msg.brain .source-chip", has_text="kubernetes.md")
|
||||
expect(chip).to_have_count(1, timeout=30_000)
|
||||
# Chat chips carry back=/ (encoded %2F) so the viewer knows where home is.
|
||||
expect(chip.first).to_have_attribute(
|
||||
"href", f"/document.html?source={DOC_SOURCE}&path={DOC_PATH}&back=%2F"
|
||||
)
|
||||
|
||||
with page.expect_popup() as popup_info:
|
||||
chip.first.click()
|
||||
viewer = popup_info.value
|
||||
expect(viewer).to_have_url(
|
||||
re.compile(
|
||||
re.escape(f"{app_url}/document.html?source={DOC_SOURCE}&path={DOC_PATH}&back=%2F")
|
||||
)
|
||||
)
|
||||
# The cited document actually rendered (this is the viewer, not an error).
|
||||
expect(viewer.locator("#doc-title")).to_have_text(DOC_TITLE)
|
||||
# Back link resolved to the chat page, labeled "Chat".
|
||||
back = viewer.locator("#doc-back")
|
||||
expect(back).to_have_attribute("href", "/")
|
||||
expect(back).to_have_text("Chat")
|
||||
|
||||
# Click: deterministic anchor navigation back to the chat page.
|
||||
back.click()
|
||||
expect(viewer).to_have_url(f"{app_url}/")
|
||||
expect(viewer.locator("#composer")).to_be_visible()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 2. Sources table link → viewer without back param → back returns to Sources
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def test_back_from_sources_returns_to_sources(
|
||||
page: Page, app_url: str, mock_llm: int, db_ready: None
|
||||
) -> None:
|
||||
_reset_db(mock_llm, seed=True)
|
||||
page.goto(f"{app_url}/sources.html")
|
||||
|
||||
row = page.locator("#docs-tbody tr", has_text="kubernetes.md")
|
||||
expect(row).to_have_count(1)
|
||||
link = row.locator("td:nth-child(2) a.doc-link")
|
||||
expect(link).to_have_count(1)
|
||||
# Sources links carry NO back param — the viewer's default target
|
||||
# (/sources.html) applies.
|
||||
expect(link).to_have_attribute(
|
||||
"href", f"/document.html?source={DOC_SOURCE}&path={DOC_PATH}"
|
||||
)
|
||||
|
||||
with page.expect_popup() as popup_info:
|
||||
link.click()
|
||||
viewer = popup_info.value
|
||||
assert "back=" not in viewer.url, f"unexpected back param: {viewer.url}"
|
||||
expect(viewer.locator("#doc-title")).to_have_text(DOC_TITLE)
|
||||
# Back link kept the default target, labeled "Sources".
|
||||
back = viewer.locator("#doc-back")
|
||||
expect(back).to_have_attribute("href", "/sources.html")
|
||||
expect(back).to_have_text("Sources")
|
||||
|
||||
back.click()
|
||||
expect(viewer).to_have_url(f"{app_url}/sources.html")
|
||||
expect(viewer.locator("#docs-table")).to_be_visible()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 3. Hostile back values (absolute, protocol-relative, pseudo-protocol)
|
||||
# are all rejected in favor of the same-origin default
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def test_malicious_back_param_is_rejected(
|
||||
page: Page, app_url: str, mock_llm: int, db_ready: None
|
||||
) -> None:
|
||||
_reset_db(mock_llm, seed=True)
|
||||
errors: list[str] = []
|
||||
dialogs: list[str] = []
|
||||
page.on("pageerror", lambda e: errors.append(str(e)))
|
||||
|
||||
def _catch_dialog(d) -> None: # a fired dialog == executed script
|
||||
dialogs.append(d.message)
|
||||
d.dismiss()
|
||||
|
||||
page.on("dialog", _catch_dialog)
|
||||
|
||||
viewer_base = f"{app_url}/document.html?source={DOC_SOURCE}&path={DOC_PATH}"
|
||||
# Anything that is not a same-origin relative URL must be rejected:
|
||||
# an absolute https URL, a protocol-relative URL, and a javascript:
|
||||
# pseudo-protocol.
|
||||
for evil in ("https%3A%2F%2Fevil.com", "%2F%2Fevil.com", "javascript%3Aalert(1)"):
|
||||
page.goto(f"{viewer_base}&back={evil}")
|
||||
expect(page.locator("#doc-title")).to_have_text(DOC_TITLE)
|
||||
back = page.locator("#doc-back")
|
||||
expect(back).to_have_attribute("href", "/sources.html")
|
||||
expect(back).to_have_text("Sources")
|
||||
|
||||
# And the fallback is really navigable: clicking lands on Sources.
|
||||
page.click("#doc-back")
|
||||
expect(page).to_have_url(f"{app_url}/sources.html")
|
||||
|
||||
assert dialogs == [], f"dialog fired — a back param escaped validation: {dialogs}"
|
||||
assert errors == [], f"console crashes: {errors}"
|
||||
@@ -99,10 +99,11 @@ def test_source_chip_opens_document(
|
||||
|
||||
chip = page.locator(".msg.brain .source-chip", has_text="kubernetes.md")
|
||||
expect(chip).to_have_count(1, timeout=30_000)
|
||||
# New-tab contract: same-origin viewer URL, both query values encoded
|
||||
# (the path's slashes come out as %2F — exactly why encoding matters).
|
||||
# New-tab contract: same-origin viewer URL, all query values encoded
|
||||
# (the path's slashes come out as %2F — exactly why encoding matters),
|
||||
# plus back=/ (phase 13) so the viewer's back button returns to chat.
|
||||
expect(chip.first).to_have_attribute(
|
||||
"href", "/document.html?source=docs&path=homelab%2Fkubernetes.md"
|
||||
"href", "/document.html?source=docs&path=homelab%2Fkubernetes.md&back=%2F"
|
||||
)
|
||||
expect(chip.first).to_have_attribute("target", "_blank")
|
||||
expect(chip.first).to_have_attribute("rel", "noopener")
|
||||
@@ -112,7 +113,9 @@ def test_source_chip_opens_document(
|
||||
viewer = popup_info.value
|
||||
expect(viewer).to_have_url(
|
||||
re.compile(
|
||||
re.escape(f"{app_url}/document.html?source=docs&path=homelab%2Fkubernetes.md")
|
||||
re.escape(
|
||||
f"{app_url}/document.html?source=docs&path=homelab%2Fkubernetes.md&back=%2F"
|
||||
)
|
||||
)
|
||||
)
|
||||
expect(viewer.locator("#doc-title")).to_have_text("Kubernetes Homelab Cluster")
|
||||
|
||||
Reference in New Issue
Block a user