From 7b594d662f6d8aba28a1cb25bdbe3dbc08762c4e Mon Sep 17 00:00:00 2001
From: Juan Castro <jfcastro9208@gmail.com>
Date: Mon, 2 Nov 2026 09:59:00 -0500
Subject: [PATCH] test(puter-js): reach the push sync in the boot sign-in e2e

The push page now has the user's opt-in and cached user from an earlier
load, starts its sync before boot's own requests come back, and gets a
rejected token from the push routes, so the spec covers the key request
that must not open a sign-in.
---
 .../tests/e2e/fixtures/boot-reauth.html       | 18 +++----
 .../tests/e2e/specs/bootReauth.spec.js        | 48 ++++++++++++++++++-
 2 files changed, 56 insertions(+), 10 deletions(-)

diff --git a/src/puter-js/tests/e2e/fixtures/boot-reauth.html b/src/puter-js/tests/e2e/fixtures/boot-reauth.html
index d2e7578ec..242d38a43 100644
--- a/src/puter-js/tests/e2e/fixtures/boot-reauth.html
+++ b/src/puter-js/tests/e2e/fixtures/boot-reauth.html
@@ -25,6 +25,13 @@
         window.PUTER_API_ORIGIN = 'http://api.puter.localhost:4100';
     </script>
     <script src="/dist/puter.dev.js"></script>
+    <script>
+        // With ?push, a user known from an earlier load keeps push current.
+        if (new URLSearchParams(location.search).has('push')) {
+            puter.whoami = { uuid: 'boot-reauth-user' };
+            puter.notifications.onPush('boot', () => {}, { onError: () => {} });
+        }
+    </script>
     <script>
         const statusEl = document.getElementById('status');
 
@@ -34,16 +41,9 @@
             document.getElementById('kv-get').disabled = false;
         }
 
-        // With ?push, the page keeps a push subscription current from load on.
-        const keepsPush = new URLSearchParams(location.search).has('push');
         function waitForPuter() {
-            if (window.puter && puter.kv) {
-                if (keepsPush)
-                    puter.notifications.onPush('boot', () => {}, {
-                        onError: () => {},
-                    });
-                ready();
-            } else setTimeout(waitForPuter, 50);
+            if (window.puter && puter.kv) ready();
+            else setTimeout(waitForPuter, 50);
         }
         waitForPuter();
 
diff --git a/src/puter-js/tests/e2e/specs/bootReauth.spec.js b/src/puter-js/tests/e2e/specs/bootReauth.spec.js
index 441ff8769..2061f48b4 100644
--- a/src/puter-js/tests/e2e/specs/bootReauth.spec.js
+++ b/src/puter-js/tests/e2e/specs/bootReauth.spec.js
@@ -70,8 +70,53 @@ test.describe('a stale token does not raise sign-in UI at load', () => {
     }) => {
         const popups = [];
         page.on('popup', (p) => popups.push(p.url()));
+        const fixtureOrigin = new URL(FIXTURE).origin;
         await context.grantPermissions(['notifications'], {
-            origin: new URL(FIXTURE).origin,
+            origin: fixtureOrigin,
+        });
+        // The opt-in the fixture's user recorded when they turned push on.
+        await page.addInitScript(() => {
+            const open = indexedDB.open('puter-push', 1);
+            open.onupgradeneeded = () => {
+                open.result.createObjectStore('handlers');
+                open.result.createObjectStore('clicks');
+            };
+            open.onsuccess = () => {
+                const tx = open.result.transaction('handlers', 'readwrite');
+                tx.objectStore('handlers').put(
+                    true,
+                    'puter:opt-in:boot-reauth-user',
+                );
+                tx.oncomplete = () => open.result.close();
+            };
+        });
+        // The push routes answer the stale token as Puter's API does.
+        let keyRequests = 0;
+        const cors = {
+            'Access-Control-Allow-Origin': fixtureOrigin,
+            'Access-Control-Allow-Credentials': 'true',
+            'Access-Control-Allow-Headers': '*',
+            'Access-Control-Allow-Methods': 'GET, POST, DELETE',
+        };
+        await page.route('**/push/web/**', (route) => {
+            if (route.request().method() === 'OPTIONS')
+                return route.fulfill({ status: 204, headers: cors });
+            keyRequests++;
+            return route.fulfill({
+                status: 401,
+                headers: cors,
+                contentType: 'application/json',
+                body: JSON.stringify({
+                    code: 'token_auth_failed',
+                    message: 'Authentication failed',
+                }),
+            });
+        });
+
+        // Boot's own 401s come later, so the sync starts while signed in.
+        await page.route(/\/(whoami|rao)(\?|$)/, async (route) => {
+            await new Promise((resolve) => setTimeout(resolve, 1000));
+            await route.continue();
         });
 
         await seedStaleToken(page, 'puter.auth.token.v2');
@@ -82,6 +127,7 @@ test.describe('a stale token does not raise sign-in UI at load', () => {
         });
         await page.waitForTimeout(2000);
 
+        expect(keyRequests).toBeGreaterThan(0);
         expect(popups).toEqual([]);
         await expect(page.locator('puter-dialog')).toHaveCount(0);
     });