Merge pull request 'Enable same-origin microphone access for voice capture' (#934) from timmy/933-same-origin-microphone into main

Merge PR #934: enable same-origin microphone access

frontend/voice-issue-capture.js

@@ -62,7 +62,15 @@ function createVoiceIssueCapture({
       elements.start.hidden = false;
       elements.stop.hidden = true;
     };
-    recognition.start();
+    try {
+      recognition.start();
+    } catch (_) {
+      recognition = null;
+      elements.start.hidden = false;
+      elements.stop.hidden = true;
+      elements.status.textContent = 'Voice capture could not start. Your draft and transcript are unchanged.';
+      return;
+    }
     elements.start.hidden = true;
     elements.stop.hidden = false;
     elements.status.textContent = 'Listening… Tap stop when you are finished.';

src/main.py

@@ -1364,7 +1364,7 @@ async def enforce_browser_security_boundary(request: Request, call_next):
     response.headers["X-Content-Type-Options"] = "nosniff"
     response.headers["Referrer-Policy"] = "no-referrer"
     response.headers["Permissions-Policy"] = (
-        "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
+        "camera=(), microphone=(self), geolocation=(), payment=(), usb=()"
     )
     response.headers["X-Frame-Options"] = "DENY"
     if dashboard_auth.mode() == dashboard_auth.OPERATOR_MODE:

tests/test_security_headers.py

@@ -14,7 +14,10 @@ REQUIRED_HEADERS = {
 def assert_browser_security_boundary(response: httpx.Response) -> None:
     for name, value in REQUIRED_HEADERS.items():
         assert response.headers[name] == value
-    assert "camera=()" in response.headers["permissions-policy"]
+    permissions_policy = response.headers["permissions-policy"]
+    assert "camera=()" in permissions_policy
+    assert "microphone=(self)" in permissions_policy
+    assert "microphone=()" not in permissions_policy
     policy = response.headers["content-security-policy"]
     assert "default-src 'self'" in policy
     assert "script-src 'self'" in policy

tests/test_voice_issue_capture.py

@@ -296,6 +296,43 @@ process.stdout.write(JSON.stringify({{
     }
 
 
+def test_recognition_start_rejection_restores_controls_and_preserves_draft():
+    script = f"""
+const {{createVoiceIssueCapture}} = require({json.dumps(str(VOICE_CAPTURE))});
+class Element {{
+  constructor() {{ this.hidden=false; this.value=''; this.textContent=''; this.listeners={{}}; }}
+  addEventListener(name, callback) {{ this.listeners[name]=callback; }}
+  click() {{ this.listeners.click?.({{currentTarget:this}}); }} dispatchEvent() {{}}
+}}
+class Recognition {{
+  start() {{ throw new Error('microphone blocked by browser policy'); }}
+  stop() {{}} abort() {{}}
+}}
+const elements=Object.fromEntries(
+  ['root','start','stop','review','transcript','append','replace','status','title','body'].map(key=>[key,new Element()])
+);
+elements.title.value='Existing title';
+elements.body.value='Existing note';
+elements.transcript.value='Recovered transcript.';
+elements.start.hidden=false; elements.stop.hidden=true;
+createVoiceIssueCapture({{Recognition,elements}});
+elements.start.click();
+process.stdout.write(JSON.stringify({{
+  startHidden:elements.start.hidden, stopHidden:elements.stop.hidden,
+  status:elements.status.textContent, title:elements.title.value,
+  body:elements.body.value, transcript:elements.transcript.value
+}}));
+"""
+    assert run_node(script) == {
+        "startHidden": False,
+        "stopHidden": True,
+        "status": "Voice capture could not start. Your draft and transcript are unchanged.",
+        "title": "Existing title",
+        "body": "Existing note",
+        "transcript": "Recovered transcript.",
+    }
+
+
 def test_stop_error_and_sheet_close_release_recognition_without_losing_transcript():
     script = f"""
 const {{createVoiceIssueCapture}} = require({json.dumps(str(VOICE_CAPTURE))});