Audit pass with the threats that actually apply to a self-hosted, account-less app: getting the Ollama key throttled or banned, and someone grinding the app down. Per-route windows already existed; these are the missing layers. - lib/model-guard.ts: every route that spends a model call now takes a slot — 60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight per IP, 6 in total — and the slot is released when the call finishes, on errors and on client disconnects. Over the concurrency cap answers 429 kind=busy, not a punishment. Slots are taken after every cheap rejection so a malformed request cannot hold one (found by the new suite: early 400s were leaking slots). - Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL in an images field made Ollama fetch an arbitrary address on our behalf. - Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored. - The rate-limit identity is the LAST x-forwarded-for hop. Reading the first let a client spoof its own IP and dodge every per-IP limit. - Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder devices cap at PUSH_MAX_SUBSCRIPTIONS (50). - Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a referrer policy and a Permissions-Policy without camera/mic/geo/payment. New tests/security-test.mjs (13 checks, registered in run-all) proves each guard against a slow stub Ollama with deliberately tiny limits. README: security notes + rate-limit tables updated. Version 0.1.3, SW -> v51. |
||
|---|---|---|
| .. | ||
| bubble-perf.mjs | ||
| bubbles-test.mjs | ||
| chat-test.mjs | ||
| freeze-loading-test.mjs | ||
| i18n-test.mjs | ||
| lib.mjs | ||
| mobile-test.mjs | ||
| model-compare.mjs | ||
| native-test.mjs | ||
| phase1-test.mjs | ||
| phase2-test.mjs | ||
| phase3-test.mjs | ||
| README.md | ||
| regression.mjs | ||
| review-test.mjs | ||
| run-all.mjs | ||
| security-test.mjs | ||
| wizard-test.mjs | ||
Browser suites
End-to-end checks for Freezmo, driven by Playwright against a running
production build. Everything lives in this repo (nothing in /tmp), so a
reboot cannot wipe the harness.
Requirements
- The app is running on
http://127.0.0.1:3207(systemctl --user start freezmo). - A Chromium build. The suites auto-detect the newest Playwright Chromium in
~/.cache/ms-playwright/; override withCHROME=/path/to/chrome. npm install(dev deps:playwright-core,axe-core).
Running
npm run build && systemctl --user restart freezmo # fresh build first
npm run test:e2e # every suite, in order
npm run test:e2e -- phase1 # only suites whose name contains "phase1"
Each suite prints PASS/FAIL lines and exits non-zero on failure; the runner
prints a per-suite summary at the end.
Suites
| Suite | Covers |
|---|---|
regression.mjs |
Library, deck card + menu, study feed to results, homework entry, desktop shell + settings/health panel. |
bubbles-test.mjs |
Ice-scene bubbles: stacking/layout contract, keyframes only transform+opacity, rise/sway/scale/fade phases, per-breakpoint counts (5/3/2), phone pacing, reduced motion, tab-hidden parking. |
mobile-test.mjs |
Five-tab bar at 360/390 × EN/CS × dark/light × reduced motion (labels, targets, no hamburger/drawer), the library ⋯ sheet (Import JSON / New folder), the settings sheet (touch targets, key flow, drag-to-close, backdrop), axe contrast audits. |
wizard-test.mjs |
Deck 3-step flow and homework flow, flat action bar, in-page mode switch, the loading lock, abort-on-leave. |
native-test.mjs |
Manifest/PWA head, offline banner + disabled generate, share target GET + POST, Back-gesture layers, undo toast, tab re-tap, haptics, draft restore. |
i18n-test.mjs |
EN/CS dictionary parity, locale switch, Czech desktop shell, Czech phone tab labels and plurals. |
freeze-loading-test.mjs |
The generation loading screen appears immediately, hides the action bar, Cancel returns with the notice. |
review-test.mjs |
Smart Review loading feedback under a stalled request, the session end-to-end, mistakes, and the health-probe cache. |
phase1-test.mjs |
Backup export/import, persistence row, nudge, encrypted sync (enable/join/push/delete + API validation), usage-limit handling (client + a stub Ollama). |
phase2-test.mjs |
Answer history + SRS from a real study run, review/mistakes, stats, exam mode, push reminders hidden without VAPID and validated with it. |
phase3-test.mjs |
Check my work (API + phone/desktop UI), follow-ups, guide step explain, turn-into-a-study-deck. |
chat-test.mjs |
Chat: streaming API (validation, allowlist, context travel, history window, thinking separation, usage-limit mapping), attachment extraction, entry points, streaming/stop, markdown + KaTeX, model/scope pickers, edit/regenerate, offline, reduced motion, plus history (IDB persistence, reload, rename/search/delete/undo, scope+model memory), assistant actions, the export payload and a two-device sync round-trip. |
Extra instances
phase1, phase2 and phase3 start their own next start instance with a
stub Ollama (or VAPID keys) on a spare port (3208/3209). Each suite checks the
port is free first and kills the whole process group on exit, so ports do not
leak between suites. Scratch data for the VAPID test lives in tests/.tmp/
(gitignored).
Diagnostics (not part of the run)
node tests/bubble-perf.mjs [label] measures the ice-scene frame cost with a
CDP performance trace (rAF frame timing, long tasks, main-thread busy time,
style recalcs) on a 4× throttled phone profile and a 2× desktop profile. It
always exits 0; the numbers are for tuning the bubble count/speed.