Skip to content

test(mobile): check posterless video previews renew the relay assertion - #9144

Merged
brow merged 1 commit into
mainfrom
tomb/mobile-video-preview-renewal-test
Nov 6, 2026
Merged

brow merged 1 commit into
mainfrom
tomb/mobile-video-preview-renewal-test

Conversation

@brow

@brow brow commented Nov 5, 2026

Copy link
Copy Markdown
Collaborator

Follow-up to #9134, which made posterless video previews and voice notes renew an expired relay assertion before handing headers to the native player. The voice-note path got a test there, but nothing failed if the video preview went back to the cached-only headers.

This extends the expired-assertion journey in native_media_headers_test with one step: the real videoPreviewFrameLoaderProvider loads a relay video through a fake native video player, which records the headers it is created with. The player must receive both the media Authorization proof and the renewed Nostr-Federated-Identity.

Validation

  • Added tests: the video-preview step above. Switching the loader back to the synchronous cached headers fails it.
  • flutter analyze is clean and the full mobile suite passes (4508 tests).
  • Test-only change, so no app run.

🤖 Generated with Claude Code

@brow

brow commented Nov 5, 2026

Copy link
Copy Markdown
Collaborator Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 5, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-05T22:24:45.549037Z d80cc6c Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: d80cc6ccbc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@brow
brow marked this pull request as ready for review November 5, 2026 22:22
@brow
brow requested a review from a team as a code owner November 5, 2026 22:22
@github-actions github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 5, 2026
@github-actions

github-actions Bot commented Nov 5, 2026

Copy link
Copy Markdown

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

  • Exact PR diff: 47be2e2d3f2a438b3a5fd7df0c710b81d8c0d87e...d80cc6ccbc0f180ced016f5f0e06e6dc702d4a17
  • Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.


Review Summary

Overall Risk: NONE

The PR adds a mobile regression test for refreshed authentication headers on posterless video previews. No concrete security, correctness, or reliability issues were found in the authorized changes.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

  • Review used read-only source inspection. Tests and builds were not executed, as instructed.

Generated by Codex Security Review |
Requested by: @brow |
Workflow run

@wesbillman wesbillman left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Carl, an automated reviewer, commenting via Wes's GitHub account.

No blockers. Reviewed at d80cc6cc.

The new step drives the real videoPreviewFrameLoaderProvider through _loadVideoPreviewFrame into a fake platform player, so it pins the #9134 behavior where it matters: the native player's creation headers. Reverting the provider to nativeMediaHeadersProvider drops Nostr-Federated-Identity and fails the .single[...] assertion, as described. The fake fails at videoEventsFor, which exercises the loader's catch-and-dispose path, and the platform instance is restored in teardown. Folding it into the existing expired-assertion journey instead of adding a new test is the right shape.

Validation: Mobile Checks and Android CI pass on this head. No local run; the change is test-only and CI covers it.

@brow
brow merged commit fc85b0d into main Nov 6, 2026
60 checks passed
@brow
brow deleted the tomb/mobile-video-preview-renewal-test branch November 6, 2026 00:51
tellaho added a commit that referenced this pull request Nov 6, 2026
* origin/main: (54 commits)
  release(mobile): push candidate tags as the operator, not the App (#9084)
  test(mobile): check posterless video previews renew the relay assertion (#9144)
  feat(relay): log WebSocket EVENT writes on the access target (#9154)
  perf(db): plan multi-value #d reads with their values (#9131)
  fix(mobile): confirm before starting a Huddle from the header (#9155)
  feat(cli): send NIP-FI evidence via credential chain and Buzz desktop (#8999)
  fix(mobile): find verified people who have no profile (#9086)
  feat(protocol): define compact membership discovery (BUZZ-615) (#9117)
  perf(db): hydrate search hits with exact event timestamps (#9126)
  perf(db): prune post-commit push enqueue by signed event timestamp (#9128)
  perf(db): use exact event timestamps for transactional deletion (#9130)
  perf(redis): index mesh ready records and share one Redis connection (#9113)
  fix(mobile): delay iOS message actions until a deliberate hold (#9049)
  feat(cli): user status expiry and status read (#8777)
  feat(cli): send a thread message to the channel (#8778)
  feat(relay): add kind 30180 custom emoji entry (#8783)
  feat(cli): read-only unread state (NIP-RS) (#8789)
  feat(cli): report a message to relay moderators (#8829)
  buzz-db: read explicit #h sets one channel at a time (#9110)
  feat(cli): list huddles and their participants (#8830)
  ...

Signed-off-by: Taylor Ho <[email protected]>
tellaho added a commit that referenced this pull request Nov 6, 2026
#9138 removed videoPreviewFrameLoaderProvider (posterless videos now show a static placeholder and start no native player until tapped), and #9144 then added a native_media_headers_test step that reads it, so main's mobile analyze fails. With no preview player left, the step has nothing to guard; revert it.

Co-authored-by: Princess Donut <0366ccd5ee09c2779a9d6bd6683daa17c16a508a51f6a7e7314018dab8fdc49b@feedback.communities.buzz.xyz>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Taylor Ho <[email protected]>
brow added a commit that referenced this pull request Nov 6, 2026
…oading (#9164)

Fixes red main. #9144 added a step to
the expired-assertion journey in `native_media_headers_test` that loads
a posterless video preview through `videoPreviewFrameLoaderProvider`.
#9138 merged around the same time and
replaced native first-frame loading with a static placeholder, removing
that provider, so `flutter analyze` now fails on main with `Undefined
name 'videoPreviewFrameLoaderProvider'`.

Posterless previews no longer fetch anything natively, so the step has
nothing left to guard. This deletes it along with its fake video player,
restoring the test file to its state before #9144.

### Validation

- `just mobile-check` and `just mobile-test` pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: Tom Brow <[email protected]>
Co-authored-by: Tom Brow <[email protected]>

This branch was previously deployed

1 inactive deployment
codex-review — d80cc6cc Deployed Nov 5, 2026 by brow via Run Codex Security Review #13126
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

codex-security-review-current The posted Codex security review matches its recorded range.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants