From 43aeb5c1416f3162ab07ffffbfeee4ed5434afb9 Mon Sep 17 00:00:00 2001 From: Dotta Date: Tue, 27 Oct 2026 16:00:38 -0500 Subject: [PATCH] test(evals): accept concealed expired-session reads with full sign-in proof --- .../runner-e2e/chat-catalog-domains/identity-sign-in.test.ts | 4 ++-- tests/runner-e2e/chat-catalog-domains/identity-sign-in.ts | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/runner-e2e/chat-catalog-domains/identity-sign-in.test.ts b/tests/runner-e2e/chat-catalog-domains/identity-sign-in.test.ts index c54a73493fb..8c6002aca7a 100644 --- a/tests/runner-e2e/chat-catalog-domains/identity-sign-in.test.ts +++ b/tests/runner-e2e/chat-catalog-domains/identity-sign-in.test.ts @@ -6,9 +6,9 @@ function valid() { return { personId: "alex", returnedPersonId: "alex", companyI nonmemberCompanyStatus: 403, nonmemberConversationStatus: 404, nonmemberBrowserBlocked: true, beforeCommentIds: [], afterCommentIds: [], runIds: [] }; } describe("real sign-in boundary acceptance", () => { - it("accepts complete real auth+same-resource+audience evidence", () => { expect(gradeSignInBoundary(valid()).passed).toBe(true); }); + it.each([401, 404])("accepts complete real auth+same-resource+audience evidence with production denial %s", expiredReadStatus => { expect(gradeSignInBoundary({ ...valid(), expiredReadStatus }).passed).toBe(true); }); it.each([ - { expiredReadStatus: 200 }, { returnedPersonId: "riley" }, { returnedConversationId: "new-conversation" }, + { expiredReadStatus: 200 }, { expiredReadStatus: 403 }, { expiredReadStatus: 500 }, { returnedPersonId: "riley" }, { returnedConversationId: "new-conversation" }, { safeReturnPath: "https://other.test/steal" }, { nonmemberConversationStatus: 200 }, { nonmemberBrowserBlocked: false }, { runIds: ["accidental-run"] }, { afterCommentIds: ["sent-expired-intent"] }, { restoredComposerVisible: false }, ])("rejects incomplete or wrong boundary proof %j", change => { expect(gradeSignInBoundary({ ...valid(), ...change }).passed).toBe(false); }); diff --git a/tests/runner-e2e/chat-catalog-domains/identity-sign-in.ts b/tests/runner-e2e/chat-catalog-domains/identity-sign-in.ts index 86b2e93581f..c01f7bbf52a 100644 --- a/tests/runner-e2e/chat-catalog-domains/identity-sign-in.ts +++ b/tests/runner-e2e/chat-catalog-domains/identity-sign-in.ts @@ -20,7 +20,7 @@ interface SignInEvidence { export function gradeSignInBoundary(value: unknown) { const c = checks(); const o = value as SignInEvidence | undefined; c.add("real-invalidated-human-session", !!o && !!o.personId && o.personId !== "local-board" && o.beforeComposerVisible - && o.expiredReadStatus === 401 && o.expiredComposerAbsent, "A previously usable real human session is revoked by the server; the expired browser cannot read or compose in its conversation."); + && [401, 404].includes(o.expiredReadStatus) && o.expiredComposerAbsent, "A previously usable real human session is revoked by the server; the expired browser cannot read or compose in its conversation."); c.add("configured-safe-sign-in-return", !!o && o.configuredSignInVisible && typeof o.safeReturnPath === "string" && o.safeReturnPath === o.intendedReturnPath && o.safeReturnPath.startsWith("/") && !o.safeReturnPath.startsWith("//") && o.returnedPersonId === o.personId && o.returnedConversationId === o.conversationId && o.restoredComposerVisible,