Answer prose round 1: 0 🔴, 5 🟡 (0 misread); shorten the return-target comment, state why /settings is public, drop the test restatements

2026-10-31 09:10:57 +01:00
parent 8d1e8be6fc
commit 943520566e
3 changed files with 9 additions and 13 deletions
@@ -242,8 +242,6 @@ test("return_to: a deep link while logged out returns to that page after login",

 test("settings: an anonymous visit signs in first, then lands on the settings page", async ({ page }) => {
  test.setTimeout(90_000);
-  // /settings is public (recovery lands there with a Kratos session but no app JWT), so Kratos' 401
-  // for an anonymous settings flow must send the visitor to sign in, not to the 500 page.
  await page.goto("/settings");
  await expect(page).toHaveURL(/\/login(\?|$)/);
  await page.fill('input[name="identifier"]', ADMIN_EMAIL);