fix1 tokens

tests/share_url_test.mjs

@@ -0,0 +1,67 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+globalThis.location = { origin: "https://pad.example" };
+
+const source = await readFile(new URL("../static/js/url-state.js", import.meta.url), "utf8");
+const moduleUrl = `data:text/javascript;base64,${Buffer.from(source).toString("base64")}`;
+const { editorResourceUrl, withShareToken } = await import(moduleUrl);
+
+function parsed(path) {
+  return new URL(path, "https://pad.example");
+}
+
+test("workspace share token is preserved when opening a note", () => {
+  const url = parsed(editorResourceUrl("/w/private/n/first", {
+    shareToken: "share-token-123",
+    view: "split",
+    mode: "markdown",
+  }));
+
+  assert.equal(url.pathname, "/w/private/n/first");
+  assert.equal(url.searchParams.get("share"), "share-token-123");
+  assert.equal(url.searchParams.get("view"), "split");
+  assert.equal(url.searchParams.get("mode"), "markdown");
+});
+
+test("share token is preserved when returning to the workspace", () => {
+  const url = parsed(withShareToken("/w/private", "share-token-123"));
+
+  assert.equal(url.pathname, "/w/private");
+  assert.equal(url.searchParams.get("share"), "share-token-123");
+});
+
+test("existing query and hash survive share-aware navigation", () => {
+  const url = parsed(editorResourceUrl("/w/private/n/first?mode=text#section", {
+    shareToken: "new-token",
+    view: "preview",
+    mode: "markdown",
+  }));
+
+  assert.equal(url.searchParams.get("share"), "new-token");
+  assert.equal(url.searchParams.get("view"), "preview");
+  assert.equal(url.searchParams.get("mode"), "markdown");
+  assert.equal(url.hash, "#section");
+});
+
+test("ordinary workspace navigation does not gain or retain a share token", () => {
+  const url = parsed(editorResourceUrl("/w/public/n/first?share=stale-token", {
+    view: "split",
+    mode: "markdown",
+  }));
+
+  assert.equal(url.searchParams.has("share"), false);
+});
+
+
+test("share-aware helpers reject external application URLs", () => {
+  assert.equal(withShareToken("https://example.com/steal", "secret"), "/");
+});
+
+
+test("share-aware helpers accept same-origin absolute URLs", () => {
+  const url = parsed(withShareToken("https://pad.example/w/private", "share-token-123"));
+  assert.equal(url.pathname, "/w/private");
+  assert.equal(url.searchParams.get("share"), "share-token-123");
+});