From 530c8f40fe32700b6e8ba688b9ed9f2964c97d5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Tue, 15 Sep 2026 14:39:09 +0200 Subject: [PATCH] test: allowlist the consent journey's origin-only goto The MCP consent journey navigates to /api/version only to give the page an origin, then registers the OAuth client with the page's own fetch. That evaluate reads no DOM, the same shape as the allowlisted vaccination seed, and the consent page after it is gated on the Allow button. --- src/__tests__/e2e-measurement-gating-guard.test.ts | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/__tests__/e2e-measurement-gating-guard.test.ts b/src/__tests__/e2e-measurement-gating-guard.test.ts index 407cc7728..79a749806 100644 --- a/src/__tests__/e2e-measurement-gating-guard.test.ts +++ b/src/__tests__/e2e-measurement-gating-guard.test.ts @@ -39,6 +39,11 @@ const ALLOWLIST: ReadonlyArray<{ file: string; test: string; why: string }> = [ test: "the list and the capture form carry no serious accessibility violations", why: "The evaluate after the goto reads no DOM: it issues the seed POST from the page's own origin so the row is written over the browser's socket rather than the runner's shared keep-alive agent, which handed POSTs to sockets the server had already closed. The scan that follows is gated on the reloaded list.", }, + { + file: "mcp-oauth-consent-redirect.spec.ts", + test: "Allow lands on the client's callback with a code", + why: "The evaluate after the goto reads no DOM: the goto only gives the page an origin, and the evaluate registers the OAuth client from it so the POST travels over the browser's socket rather than the runner's shared keep-alive agent. The consent page that follows is gated on the Allow button being visible.", + }, { file: "ipad-viewport.spec.ts", test: "no horizontal overflow and full-width content on",