Ship the grounding snippets checked at start - #41
Merged
Merged
Conversation
Contributor
Author
|
Waiting for #40 to be merged without conflicts, then I'll mark this ready for review. |
Contributor
Author
|
The The fix is |
Contributor
Go ahead. |
ColtenOuO
force-pushed
the
fix-grounding-start-snapshot
branch
from
September 14, 2026 20:13
17fbd8d to
57bd1e5
Compare
Contributor
Author
|
Fixed the implementation according to the review on #40. |
ColtenOuO
marked this pull request as ready for review
September 15, 2026 06:39
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
jserv
reviewed
Sep 15, 2026
jserv
reviewed
Sep 15, 2026
The start handler read which snippets were checked before the sign-in round trip, but looked their text up in the extracted lists after it. A JD picked while a gated start was waiting on /api/login replaced those lists, so the stored indexes pointed into the new file and the packet carried snippets the candidate never checked. The lists are now copied alongside the selection, the way the rest of the form is read.
Copying the extracted lists before the sign-in round trip kept the indices and the text together, but still assembled the packet after it, and a start the packet was always going to refuse spent a login first. The packet is now built with the rest of the form, and only stored once the sign-in has answered.
Building the packet before the sign-in round trip also snapshotted consent, so a candidate who cleared grounding or unchecked consent while the login was pending still had the pre-click snippets stored. Consent is now read again when the packet is stored, and a withdrawn consent stores nothing, which is what clearing did on main. The existing snapshot test unchecked a box Clear had already unchecked, so it never exercised that path. It now re-checks consent before the login resolves, and a separate test pins that withdrawing consent alone leaves no grounding in session storage.
ColtenOuO
force-pushed
the
fix-grounding-start-snapshot
branch
from
September 15, 2026 14:26
2fd628c to
813b146
Compare
Contributor
|
Thank @ColtenOuO for contributing! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to the review on #40. On a lobby that requires sign-in, the start handler read the checked snippet indexes before
/api/loginbut looked up their text after it. A JD picked during that wait replaced the lists, so the packet sent snippets the candidate never checked. This predates #39 and #40.Changes
web/app.js: copy the three grounding lists next toselectedbefore the sign-in await, and build the packet from that copy.tests/browser/lobby.test.js: hold/api/login, load a second JD during the hold, and assert the stored packet still has the first JD's snippet. Fails onmain(shipsMust know SQL), passes with the fix.Summary by cubic
Builds the grounding packet when Start is pressed, before the sign-in round trip, so a JD chosen during login cannot replace the snippets the candidate checked. Previously, the handler looked up snippet text after login and could store the wrong selections; it now stores the packet only after sign-in succeeds, rechecks consent at that point, and rejects invalid starts before signing in.
Written for commit 813b146. Summary will update on new commits.