use hash instead of path for key

use docker-compose

.github/workflows/test.yml

@@ -0,0 +1,18 @@
+name: test
+
+on:
+  workflow_dispatch:
+  push:
+
+jobs:
+  text:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Install
+        run: |
+          docker-compose build
+          npm ci
+      - name: Test
+        run: npm run test:run

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.0] - 2021-05-16
+
+### Security
+
+- Using hash `#` instead of path
+
 ## [1.0.11] - 2021-05-08
 
 ### Added

client/src/lib/views/Create.svelte

@@ -50,7 +50,8 @@
 				password: password,
 				id: response.id,
 			}
-		} catch {
+		} catch (e) {
+			console.error(e)
 			error = 'could not create note.'
 		} finally {
 			loading = false
@@ -67,8 +68,9 @@
 		type="text"
 		readonly
 		label="share link"
-		value="{window.location.origin}/note/{result.id}/{result.password}"
+		value="{window.location.origin}/note/{result.id}#{result.password}"
 		copy
+		data-testid="note-share-link"
 	/>
 	<br />
 	<p>
@@ -84,11 +86,16 @@
 {:else}
 	<form on:submit|preventDefault={submit}>
 		<fieldset disabled={loading}>
-			<TextArea label="note" bind:value={note.contents} placeholder="..." />
+			<TextArea
+				label="note"
+				bind:value={note.contents}
+				placeholder="..."
+				data-testid="input-note"
+			/>
 
 			<div class="bottom">
 				<Switch label="advanced" bind:value={advanced} />
-				<Button type="submit">create</Button>
+				<Button type="submit" data-testid="button-create">create</Button>
 			</div>
 
 			{#if error}

client/src/routes/note/[id].svelte

@@ -16,8 +16,8 @@
 	import Button from '$lib/ui/Button.svelte'
 
 	export let id: string
-	export let password: string
 
+	let password: string
 	let note: NotePublic | null = null
 	let exists = false
 
@@ -28,6 +28,8 @@
 		try {
 			loading = true
 			error = null
+			password = window.location.hash.slice(1)
+			console.log(password)
 			await info(id)
 			exists = true
 		} catch {
@@ -55,10 +57,12 @@
 
 {#if !loading}
 	{#if !exists}
-		<p class="error-text">note was not found or was already deleted.</p>
+		<p class="error-text" data-testid="note-not-found">
+			note was not found or was already deleted.
+		</p>
 	{:else if note && !error}
 		<p class="error-text">you will not get the chance to see the note again.</p>
-		<div class="note">
+		<div class="note" data-testid="note-result">
 			{note.contents}
 		</div>
 		<br />
@@ -67,7 +71,7 @@
 		<form on:submit|preventDefault={show}>
 			<fieldset>
 				<p>click below to show and delete the note if the counter has reached it's limit</p>
-				<Button type="submit">show note</Button>
+				<Button type="submit" data-testid="button-show">show note</Button>
 				{#if error}
 					<br />
 					<p class="error-text">

cypress.json

@@ -0,0 +1,5 @@
+{
+  "fixturesFolder": false,
+  "pluginsFile": false,
+  "supportFile": false
+}

cypress/.gitignore

@@ -0,0 +1,2 @@
+screenshots
+videos

cypress/integration/main.spec.js

@@ -0,0 +1,41 @@
+function createNote(options = {}) {
+  Object.assign(options, {
+    text: `Revaluation battle selfish derive suicide revaluation society love superiority salvation spirit virtues revaluation. Aversion sexuality play burying mountains intentions battle reason strong burying war insofar inexpedient war. Fearful intentions selfish madness suicide.`,
+  })
+  cy.visit('http://localhost:5000')
+  const text = options.text
+  cy.get('[data-testid=input-note]').type(text)
+  cy.get('[data-testid=button-create]').click()
+  cy.wait(500)
+  return cy
+    .get('[data-testid=note-share-link]')
+    .invoke('val')
+    .then((link) => {
+      return [link, text]
+    })
+}
+
+describe('Basics', () => {
+  it('Share note', () => {
+    createNote().then(([link, text]) => {
+      cy.visit(link)
+      cy.get('[data-testid=button-show]').click()
+      cy.wait(250)
+      cy.get('[data-testid=note-result]').should('have.text', text)
+    })
+  })
+
+  it('Check destroyed', () => {
+    createNote().then(([link, text]) => {
+      // Check the first time
+      cy.visit(link)
+      cy.get('[data-testid=button-show]').click()
+      cy.wait(250)
+      cy.get('[data-testid=note-result]').should('have.text', text)
+
+      // Should not exists anymore
+      cy.visit(link)
+      cy.get('[data-testid=note-not-found]').should('exist')
+    })
+  })
+})

docker-compose.yml

@@ -15,4 +15,4 @@ services:
     depends_on:
       - memcached
     ports:
-      - 80:5000
+      - 5000:5000

package.json

@@ -3,9 +3,14 @@
     "dev:docker": "docker-compose up memcached",
     "dev:backend": "cargo watch -x 'run --bin cryptgeon'",
     "dev:front": "npm --prefix client run dev",
-    "dev": "run-p dev:*"
+    "dev": "run-p dev:*",
+    "test:server": "docker-compose up --build",
+    "test:cypress": "cypress run --headless",
+    "test:run": "start-server-and-test test:server http://localhost:5000 test:cypress"
   },
   "devDependencies": {
-    "npm-run-all": "^4.1.5"
+    "cypress": "^7.2.0",
+    "npm-run-all": "^4.1.5",
+    "start-server-and-test": "^1.12.1"
   }
 }