mrambossekandClaude Opus 5
40e76c52ca
Enrolling a device that cannot reach the admin UI meant transcribing a 200-character link with a base64 pin in it — the step the link format exists to avoid, and the one where a pin wrong by one character fails later as an inscrutable TLS error. Rendered as inline SVG rather than a PNG data: URI, because the page's CSP is default-src 'none' and means it: a data: image would need img-src opened, markup needs nothing. One path rather than a rect per module, since a link this long encodes to about 60x60 and two thousand elements is a lot of DOM for a picture of a square. It is generated from the same validated value as the href, so a rejected link produces neither. This relaxes the stdlib-only rule, deliberately and recorded in CLAUDE.md. The rule bought one self-contained binary with no supply chain to audit, which one small pure-Go package barely dents; F-Droid never applied to the server, only the app ships there. A correct QR encoder is ~500 lines of Reed-Solomon that nobody should be hand-writing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
25 lines
748 B
Go
25 lines
748 B
Go
package adminui
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestQrSVGEncodesAnEnrolmentLink(t *testing.T) {
|
|
link := "echolot://enroll?v=1&u=https%3A%2F%2Ffmr.echo-lot.app&p=pin-sha256%3AzRV9qkiLnRexAeh4RrSfJzbPWO%2BU%2F2Oj2%2FNVM%2FKfXlg%3D&t=20e6ccaa2a028dc0aab16442c258d1b8eadb5794682905fe"
|
|
out := string(qrSVG(link))
|
|
if !strings.HasPrefix(out, "<svg") || !strings.Contains(out, "<path d=\"M") {
|
|
t.Fatalf("expected an svg with a path, got %.80q", out)
|
|
}
|
|
// A quiet zone is part of the symbol; without it scanners cannot find its edges.
|
|
if !strings.Contains(out, `fill="#fff"`) {
|
|
t.Error("no light background rendered")
|
|
}
|
|
}
|
|
|
|
func TestQrSVGEmptyForNoLink(t *testing.T) {
|
|
if qrSVG("") != "" {
|
|
t.Error("no link should render no code")
|
|
}
|
|
}
|