From 557d2e55b5e226947b470fd8d69ebbc4e6b96c69 Mon Sep 17 00:00:00 2001 From: Jonathon Leight Date: Thu, 30 Jul 2026 08:46:19 -0400 Subject: [PATCH] Fix page headings --- internal/auth/templates/account.html | 18 +- internal/auth/templates/login.html | 2 +- internal/auth/templates/signup.html | 2 +- internal/core/heading_structure_test.go | 189 ++++++++++++++++++ internal/core/templates/add_repeater.html | 12 +- internal/core/templates/admin.html | 10 +- internal/core/templates/admin_catalog.html | 4 +- .../core/templates/admin_user_history.html | 4 +- .../templates/admin_user_permissions.html | 2 +- internal/core/templates/admin_users.html | 2 +- internal/core/templates/analytics.html | 14 +- internal/core/templates/command_log.html | 2 +- internal/core/templates/config_edit.html | 6 +- .../core/templates/config_profile_edit.html | 2 +- .../core/templates/config_regions_edit.html | 2 +- internal/core/templates/console.html | 8 +- internal/core/templates/dashboard.html | 8 +- internal/core/templates/delete_repeater.html | 4 +- internal/core/templates/edit_repeater.html | 2 +- internal/core/templates/invite.html | 2 +- internal/core/templates/join_org.html | 2 +- internal/core/templates/my_orgs.html | 2 +- internal/core/templates/new_org.html | 2 +- internal/core/templates/org.html | 8 +- internal/core/templates/org_edit_links.html | 2 +- internal/core/templates/org_edit_profile.html | 2 +- internal/core/templates/org_members.html | 4 +- internal/core/templates/person_access.html | 2 +- internal/core/templates/proxy_test.html | 10 +- internal/core/templates/repeater.html | 10 +- internal/core/templates/repeater_added.html | 6 +- internal/core/templates/repeater_docs.html | 8 +- .../core/templates/repeater_maintenance.html | 2 +- internal/core/templates/repeaters.html | 4 +- internal/core/templates/share.html | 6 +- internal/core/templates/share_invite_new.html | 2 +- internal/core/templates/share_org_limits.html | 4 +- internal/marketing/templates/docs.html | 16 +- internal/marketing/templates/landing.html | 12 +- internal/marketing/templates/orgs.html | 2 +- .../marketing/templates/repeater_public.html | 14 +- internal/marketing/templates/user_public.html | 6 +- internal/web/security_test.go | 57 ++++++ internal/web/templates/base.html | 2 +- internal/web/templates/command_grid.html | 2 +- internal/web/templates/error.html | 15 +- internal/web/templates/org_config.html | 8 +- internal/web/templates/org_public.html | 8 +- internal/web/templates/org_repeaters.html | 4 +- internal/web/templates/org_tabs.html | 2 +- internal/web/templates/repeater_tabs.html | 2 +- 51 files changed, 389 insertions(+), 132 deletions(-) create mode 100644 internal/core/heading_structure_test.go diff --git a/internal/auth/templates/account.html b/internal/auth/templates/account.html index 3ba56d2..677198e 100644 --- a/internal/auth/templates/account.html +++ b/internal/auth/templates/account.html @@ -3,7 +3,7 @@
Your account
-

Account settings

+

Account settings

{{end}} @@ -12,7 +12,7 @@ {{if .OK}}
{{.OK}}
{{end}}
-

Username

+

Username

Your username is your unique handle (3–32 chars: letters, digits, _ . -). You can change it once every 30 days. When you do, your old username is reserved for 90 days before anyone else can take it.

@@ -36,7 +36,7 @@
-

Display name

+

Display name

Your display name is what other people see — on shares and in organizations. It can be anything, and it isn't tied to sign-in.

@@ -54,7 +54,7 @@
-

Time zone

+

Time zone

Dates and times across MeshTender are shown in this time zone (and in your browser's locale format). Leave it on Auto-detect to use whatever zone your browser reports.

@@ -82,7 +82,7 @@
-

Public profile

+

Public profile

These appear on your public page at {{.RootURL}}/u/{{.User.Username}}, which anyone can view. Leave a field blank to keep it off your page.

@@ -108,7 +108,7 @@
-

Links (public)

+

Links (public)

Ways to reach or find you — social media, a website, or your MeshCore public key (shown as a QR code). Mark one non-MeshCore link as your primary contact so people know the best way to reach you.

@@ -174,7 +174,7 @@
-

Passkeys

+

Passkeys

Passkeys let you sign in with your device's fingerprint, face, or PIN — no password to remember or leak.

{{if .PKErr}}
{{.PKErr}}
{{end}} @@ -217,7 +217,7 @@
-

Password

+

Password

{{if .HasPassword}}

Change the password you use as a fallback to passkeys.

@@ -264,7 +264,7 @@
-
Rename passkey
+

Rename passkey

diff --git a/internal/auth/templates/login.html b/internal/auth/templates/login.html index 7e4525a..f301e3a 100644 --- a/internal/auth/templates/login.html +++ b/internal/auth/templates/login.html @@ -2,7 +2,7 @@ {{define "content"}}
-

Sign in to your account

+

Sign in to your account

{{if .Error}}
{{.Error}}
{{end}} diff --git a/internal/auth/templates/signup.html b/internal/auth/templates/signup.html index 7a8df6d..7842cd9 100644 --- a/internal/auth/templates/signup.html +++ b/internal/auth/templates/signup.html @@ -2,7 +2,7 @@ {{define "content"}}
-

Create your account

+

Create your account

{{if .Error}}
{{.Error}}
{{end}}

No email required. Passkeys are the easiest, most secure option — your device unlocks the account with a fingerprint, face, or PIN.

diff --git a/internal/core/heading_structure_test.go b/internal/core/heading_structure_test.go new file mode 100644 index 0000000..4c9b7cd --- /dev/null +++ b/internal/core/heading_structure_test.go @@ -0,0 +1,189 @@ +package core + +import ( + "fmt" + "io" + "net/http" + "net/http/cookiejar" + "regexp" + "strconv" + "strings" + "testing" + + "github.com/jleight/meshtender/internal/store" +) + +var headingRe = regexp.MustCompile(`(?i) naming the page, and no level is skipped on the +// way down (an h1 followed by an h3 leaves a hole in the outline that screen-reader +// users navigating by level fall through). +func checkHeadingOutline(t *testing.T, label, html string) { + t.Helper() + + var levels []int + for _, m := range headingRe.FindAllStringSubmatch(html, -1) { + n, err := strconv.Atoi(m[1]) + if err != nil { + t.Fatalf("%s: unparseable heading %q", label, m[0]) + } + levels = append(levels, n) + } + if len(levels) == 0 { + t.Errorf("%s: page has no headings at all", label) + return + } + + h1s := 0 + for _, l := range levels { + if l == 1 { + h1s++ + } + } + switch { + case h1s == 0: + t.Errorf("%s: no

— the page has no top-level heading (outline starts at h%d)", + label, levels[0]) + case h1s > 1: + t.Errorf("%s: %d

elements — exactly one should name the page; sequence: %s", + label, h1s, seq(levels)) + } + if levels[0] != 1 { + t.Errorf("%s: outline starts at h%d, not h1 (sequence: %s)", label, levels[0], seq(levels)) + } + for i := 1; i < len(levels); i++ { + if levels[i] > levels[i-1]+1 { + t.Errorf("%s: heading level jumps h%d → h%d (skips h%d); sequence: %s", + label, levels[i-1], levels[i], levels[i-1]+1, seq(levels)) + break // one report per page is enough to act on + } + } +} + +func seq(levels []int) string { + parts := make([]string, len(levels)) + for i, l := range levels { + parts[i] = fmt.Sprintf("h%d", l) + } + return strings.Join(parts, " ") +} + +// TestPageHeadingOutlines walks a representative page from every layout and header +// source — the default base header, the repeater-tabs header, the org-tabs header, +// the auth layout (which has no page header, so the card title carries it), the +// public root layout, and the branded error page — and checks each one's heading +// outline. +// +// Regression for audit findings A1 (28 pages had no

; page titles were +//

) and A2 (the landing page ran h1 → h3 → h2, skipping a +// level and then jumping backwards). +func TestPageHeadingOutlines(t *testing.T) { + t.Parallel() + st, ctx, ts, h := splitServer(t) + + jar, err := cookiejar.New(nil) + if err != nil { + t.Fatalf("cookiejar: %v", err) + } + user := seedSession(t, ts, st, ctx, jar, "headinguser") + cookies := jar.Cookies(mustURL(t, ts.URL)) + + rep, err := st.CreateRepeater(ctx, &store.Repeater{ + OwnerID: user.ID, Name: "Heading Test Relay", PublicKeyHex: strings.Repeat("e", 64), + RadioFreqHz: 1, RadioBwHz: 1, RadioSF: 11, RadioCR: 5, + }) + if err != nil { + t.Fatalf("create repeater: %v", err) + } + org, err := st.CreateOrg(ctx, "Heading Test Org", user.ID) + if err != nil { + t.Fatalf("create org: %v", err) + } + + pages := []struct { + label, host, path string + anon bool // fetch without the session cookie + }{ + // Root (public) host — the landing page is A2's subject. + {"root landing", h.root, "/", false}, + {"root org directory", h.root, "/orgs", false}, + {"root docs", h.root, "/docs", false}, + {"root public org page", h.root, "/orgs/" + org.Slug, false}, + {"root 404 (error page)", h.root, "/no-such-page", false}, + // Auth host — authbase has no page header, so the card title is the heading. + {"auth login", h.auth, "/login", true}, + {"auth signup", h.auth, "/signup", true}, + // App host — covers base's own header, repeater-tabs and org-tabs headers. + {"app dashboard", h.app, "/", false}, + {"app repeater list", h.app, "/repeaters", false}, + {"app repeater overview", h.app, "/repeaters/" + rep.PublicID, false}, + {"app repeater sharing", h.app, "/repeaters/" + rep.PublicID + "/share", false}, + {"app my orgs", h.app, "/orgs", false}, + {"app org member view", h.app, "/orgs/" + org.Slug, false}, + {"app 404 (error page)", h.app, "/no-such-page", false}, + } + + for _, p := range pages { + send := cookies + if p.anon { + send = nil + } + resp := do(t, ts, p.host, p.path, send...) + body, err := io.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + t.Fatalf("%s: read body: %v", p.label, err) + } + // A redirect would mean the fixture didn't grant access; the outline of a + // redirect body is meaningless, so surface it rather than silently passing. + if resp.StatusCode >= 300 && resp.StatusCode < 400 { + t.Fatalf("%s: unexpected %d redirect to %q — fixture problem", + p.label, resp.StatusCode, resp.Header.Get("Location")) + } + checkHeadingOutline(t, p.label, string(body)) + } +} + +// TestModalFragmentHeadings covers the htmx modal fragments separately: they're +// swapped into an already-rendered page, so their heading has to fit under that +// page's outline (h1 page → h2 dialog title) rather than restart it. +func TestModalFragmentHeadings(t *testing.T) { + t.Parallel() + st, ctx, ts, h := splitServer(t) + + jar, err := cookiejar.New(nil) + if err != nil { + t.Fatalf("cookiejar: %v", err) + } + user := seedSession(t, ts, st, ctx, jar, "modaluser") + cookies := jar.Cookies(mustURL(t, ts.URL)) + rep, err := st.CreateRepeater(ctx, &store.Repeater{ + OwnerID: user.ID, Name: "Modal Test Relay", PublicKeyHex: strings.Repeat("f", 64), + RadioFreqHz: 1, RadioBwHz: 1, RadioSF: 11, RadioCR: 5, + }) + if err != nil { + t.Fatalf("create repeater: %v", err) + } + + // The invite modal is the representative fragment; all modal titles share the + // same convention. + resp := do(t, ts, h.app, "/repeaters/"+rep.PublicID+"/share/link/new", cookies...) + body, err := io.ReadAll(resp.Body) + resp.Body.Close() + if err != nil { + t.Fatalf("read body: %v", err) + } + if resp.StatusCode != http.StatusOK { + t.Fatalf("invite modal fragment = %d, want 200", resp.StatusCode) + } + + found := headingRe.FindAllStringSubmatch(string(body), -1) + if len(found) == 0 { + t.Fatal("invite modal fragment has no heading — the dialog has nothing to label it") + } + if got := found[0][1]; got != "2" { + t.Errorf("modal title is h%s, want h2 (it sits under the page's h1; an h5 there "+ + "would skip three levels)", got) + } +} diff --git a/internal/core/templates/add_repeater.html b/internal/core/templates/add_repeater.html index 59719c3..0262ae0 100644 --- a/internal/core/templates/add_repeater.html +++ b/internal/core/templates/add_repeater.html @@ -1,7 +1,7 @@ {{define "title"}}Add a repeater · MeshTender{{end}} {{define "header"}}
-

Add a repeater

+

Add a repeater

{{end}} {{define "content"}} @@ -27,7 +27,7 @@
-

{{template "icon-antenna" "me-1"}}Add a repeater that's already on the network

+

{{template "icon-antenna" "me-1"}}Add a repeater that's already on the network

Register a repeater that's already configured and on the mesh, then control it remotely through a KISS modem over the air. You'll grant MeshTender admin yourself first. This is the usual choice.

@@ -38,7 +38,7 @@
-

{{template "icon-plug" "me-1"}}Set up a brand-new repeater

+

{{template "icon-plug" "me-1"}}Set up a brand-new repeater

Connect a freshly-flashed repeater over USB serial and let MeshTender generate and run the whole setup — identity, radio, region, name, and the admin grant — straight down the wire. Best for a repeater that isn't on the network yet.

@@ -64,7 +64,7 @@
{{template "icon-alert" "alert-icon"}}
-

This grants full admin control to MeshTender

+

This grants full admin control to MeshTender

  • This grants admin to MeshTender itself — not to other MeshTender users. Letting specific people operate the repeater is a separate step you control later @@ -84,7 +84,7 @@
    {{template "icon-map-pin" "alert-icon"}}
    -

    MeshTender will read the repeater's location

    +

    MeshTender will read the repeater's location

    When you confirm this repeater — or use “Fetch location” later — MeshTender reads its coordinates by running get lat / get lon through your modem, on its own behalf @@ -251,7 +251,7 @@ {{/* Review + run */}}