fix: timing-safe key comparison and network-error state in liveview

Use hmac.compare_digest() to prevent timing-based key enumeration. Distinguish network failures from invalid-key errors in the frontend.
2026-03-28 15:30:09 +01:00
parent 210304394e
commit 5897be70c2
3 changed files with 8 additions and 5 deletions
@@ -88,12 +88,12 @@ describe('LiveView (non-standalone)', () => {
    })
  })

-  it('shows invalid-key error for unexpected API errors', async () => {
+  it('shows network-error for non-response errors (offline, CORS, 500)', async () => {
    setSearch('?key=anything')
    vi.mocked(liveviewApi.load).mockRejectedValue(new Error('network'))
    render(<LiveView />)
    await waitFor(() => {
-      expect(screen.getByText(/Invalid or expired/)).toBeDefined()
+      expect(screen.getByText(/Could not reach the server/)).toBeDefined()
    })
  })