fix: preserve shared screenshots through sign-in (Closes #741)

tests/test_dashboard_auth.py

@@ -891,6 +891,40 @@ async def test_anonymous_app_shortcut_preserves_only_a_known_launch_action(acces
     assert invalid.headers["location"] == "login"
 
 
+@pytest.mark.anyio
+async def test_anonymous_shared_screenshot_preserves_bounded_sign_in_continuation(access_control):
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="https://test") as client:
+        valid = await client.get(
+            "/",
+            params={
+                "launch": "new",
+                "shared": "image",
+                "title": "Broken checkout",
+                "text": "Steps to reproduce",
+            },
+        )
+        wrong_launch = await client.get(
+            "/", params={"launch": "agenda", "shared": "image"}
+        )
+        wrong_marker = await client.get(
+            "/", params={"launch": "new", "shared": "document"}
+        )
+        duplicate_marker = await client.get(
+            "/?launch=new&shared=image&shared=image"
+        )
+
+    assert valid.status_code == 303
+    assert parse_qs(urlsplit(valid.headers["location"]).query) == {
+        "continue": [
+            "./?title=Broken+checkout&text=Steps+to+reproduce&launch=new&shared=image"
+        ]
+    }
+    assert wrong_launch.headers["location"] == "login"
+    assert wrong_marker.headers["location"] == "login"
+    assert duplicate_marker.headers["location"] == "login"
+
+
 @pytest.mark.anyio
 async def test_oversized_share_target_is_not_carried_through_login(access_control):
     transport = httpx.ASGITransport(app=main.app)

tests/test_login_frontend.py

@@ -370,6 +370,44 @@ setTimeout(() => process.stdout.write(JSON.stringify({{
     }
 
 
+def test_login_continues_only_bounded_shared_screenshot_capture():
+    harness = f"""
+const createLoginController = require({json.dumps(str(LOGIN_JS))});
+async function destination(continuation) {{
+  let replaced = null;
+  const controller = createLoginController({{
+    form: {{ reset: () => {{}} }}, status: {{ textContent: '' }}, button: {{ disabled: false }},
+    fetchImpl: async () => new Response('{{}}', {{ status: 200 }}),
+    location: {{ replace: value => replaced = value }}, continuation,
+  }});
+  await controller.submit('operator-token');
+  return replaced;
+}}
+(async () => {{
+  process.stdout.write(JSON.stringify({{
+    valid: await destination('./?title=Broken&launch=new&shared=image'),
+    wrongLaunch: await destination('./?launch=agenda&shared=image'),
+    missingLaunch: await destination('./?shared=image'),
+    wrongMarker: await destination('./?launch=new&shared=document'),
+    duplicateMarker: await destination('./?launch=new&shared=image&shared=image'),
+    launchWithoutMarker: await destination('./?launch=new'),
+  }}));
+}})().catch(error => {{ console.error(error); process.exit(1); }});
+"""
+    result = subprocess.run(
+        ["node", "-e", harness], text=True, capture_output=True, check=True
+    )
+
+    assert json.loads(result.stdout) == {
+        "valid": "./?title=Broken&launch=new&shared=image",
+        "wrongLaunch": "./",
+        "missingLaunch": "./",
+        "wrongMarker": "./",
+        "duplicateMarker": "./",
+        "launchWithoutMarker": "./?launch=new",
+    }
+
+
 @pytest.mark.anyio
 async def test_login_page_loads_rate_limit_controller():
     html = await login()