@jrpool/kilotest 48.0.0 → 49.0.0

package/web/hideReportForm/index.ts

@@ -11,13 +11,14 @@ import path from 'node:path';
 
 // FUNCTIONS
 
-// Returns a form for hiding a report.
-export const answer = async (_: any, search: string) => {
+// Returns a form for hiding a report. A GET request never processes a submission,
+// regardless of its query string; only a POST request (the form's own submission) does.
+export const answer = async (_: any, search: string, method: string) => {
   const searchParams = new URLSearchParams(search);
   const authCode = searchParams?.get('authCode');
   const jobName = searchParams?.get('report');
-  // If the form has been displayed by itself after a submission and a report is to be hidden:
-  if (jobName) {
+  // If the form has been submitted and a report is to be hidden:
+  if (method === 'POST' && jobName) {
     // If the authorization code is valid:
     if (authCode === process.env.AUTH_CODE) {
       const fileName = `${jobName}.json`;
@@ -36,10 +37,12 @@ export const answer = async (_: any, search: string) => {
     }
     // Otherwise, i.e. if the authorization code is invalid:
     else {
-      // Report the error.
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
       return {
         status: 'error',
-        message: 'Invalid authorization code'
+        message: 'Invalid request'
       }
     }
   }

package/web/listTopIssues/index.ts

@@ -79,7 +79,7 @@ const getIssuesSummary = async () => {
       // Report this.
       console.log(`ERROR: Annotations obsolete for issue ${issueID}; reannotate`);
       // Notify a manager.
-      sendAlert('Annotations obsolete', `Annotations for issue ${issueID} obsolete; reannotate.`);
+      sendAlert('Kilotest: Annotations obsolete', `Annotations for issue ${issueID} obsolete; reannotate.`);
     }
   });
   // For each summarized issue:

package/web/manage/index.html

@@ -23,9 +23,10 @@
         <li><a href="/rewindReportsForm.html">Delete latest superseding reports</a></li>
         <li><a href="/expungeReportsForm.html">Delete sole reports</a></li>
         <li><a href="/hideReportForm.html">Classify a report as experimental</a></li>
-        <li><a href="/unhideReportForm.html">Declassify a report as experimental</a></li>
+        <li><a href="/showHiddenReportsForm.html">View the list of experimental reports</a></li>
         <li><a href="/ai0BalanceForm.html">Record the current balance of AI service 0</a></li>
         <li><a href="/renewWCAGForm.html">Renew the map of WCAG numeric to text identifiers</a></li>
+        <li><a href="/metrics.html">View usage metrics</a></li>
       </ul>
     </main>
   </body>

package/web/metrics/index.html

@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html lang="en-US">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="publisher" content="Jonathan Robert Pool">
+    <meta name="creator" content="Jonathan Robert Pool">
+    <meta name="keywords" content="report,accessibility,a11y">
+    <title>Usage metrics | Kilotest</title>
+    <link rel="icon" href="/favicon.ico">
+    <link rel="stylesheet" href="/style.css">
+  </head>
+  <body>
+    <main>
+      <h1><a href="/">Kilotest</a>: Usage metrics</h1>
+      __body__
+    </main>
+  </body>
+</html>

package/web/metrics/index.ts

@@ -0,0 +1,126 @@
+/*
+  index.ts
+  Serves usage metrics for the maintainer: web page views, MCP tool calls, and API
+  operation calls, each broken down by name, recorded since a given date and time.
+*/
+
+// IMPORTS
+
+import {
+  clearMetrics, getDateTimeString, getExclusionCookieValue, getMetrics, metricsExclusionCookieName, populateTemplate
+} from '../../util.ts';
+
+// FUNCTIONS
+
+// Returns an HTML table of the counts in a metrics category, sorted by descending count.
+const getCategoryTable = (counts: Record<string, number>): string => {
+  const margin = ' '.repeat(6);
+  const names = Object.keys(counts).sort((a, b) => counts[b]! - counts[a]!);
+  if (!names.length) {
+    return `${margin}<p>None yet.</p>`;
+  }
+  const rows = names.map(name => `${margin}    <tr><td>${name}</td><td>${counts[name]}</td></tr>`);
+  return [
+    `${margin}<table class="allBorder">`,
+    `${margin}  <thead>`,
+    `${margin}    <tr><th>Name</th><th>Count</th></tr>`,
+    `${margin}  </thead>`,
+    `${margin}  <tbody>`,
+    ...rows,
+    `${margin}  </tbody>`,
+    `${margin}</table>`
+  ].join('\n');
+};
+// Returns an HTML table of manager-page activity, sorted by descending failure count,
+// since repeated failures are the signal of suspected abuse most worth surfacing first.
+const getManagerActivityTable = (activity: Record<string, {ok: number; error: number}>): string => {
+  const margin = ' '.repeat(6);
+  const names = Object.keys(activity).sort((a, b) => activity[b]!.error - activity[a]!.error);
+  if (!names.length) {
+    return `${margin}<p>None yet.</p>`;
+  }
+  const rows = names.map(name => {
+    const {ok, error} = activity[name]!;
+    return `${margin}    <tr><td>${name}</td><td>${ok}</td><td>${error}</td></tr>`;
+  });
+  return [
+    `${margin}<table class="allBorder">`,
+    `${margin}  <thead>`,
+    `${margin}    <tr><th>Name</th><th>Successful</th><th>Failed</th></tr>`,
+    `${margin}  </thead>`,
+    `${margin}  <tbody>`,
+    ...rows,
+    `${margin}  </tbody>`,
+    `${margin}</table>`
+  ].join('\n');
+};
+// Returns a page reporting usage metrics, or, if the form has not been submitted (a POST
+// request) yet, a form requesting an authorization code. A GET request, regardless of its
+// query string, never processes a submission, so the action cannot be triggered by GET.
+export const answer = async (_: any, search: string, method: string) => {
+  const searchParams = new URLSearchParams(search);
+  const authCode = searchParams?.get('authCode');
+  let query: Record<string, string>;
+  // If the form has been submitted:
+  if (method === 'POST') {
+    // If the authorization code is invalid:
+    if (authCode !== process.env.AUTH_CODE) {
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
+      return {
+        status: 'error',
+        message: 'Invalid request'
+      };
+    }
+    // If clearing the counts was requested:
+    const clearCounts = searchParams.has('clearCounts');
+    const metrics = clearCounts ? await clearMetrics() : await getMetrics();
+    query = {
+      body: [
+        ...(clearCounts ? ['<p>Counts cleared.</p>'] : []),
+        `<p>Counts recorded since ${getDateTimeString(metrics.since)}.</p>`,
+        '<h2>Web page views</h2>',
+        getCategoryTable(metrics.pageViews),
+        '<h2>MCP tool calls</h2>',
+        getCategoryTable(metrics.mcpToolCalls),
+        '<h2>API operation calls</h2>',
+        getCategoryTable(metrics.apiOperations),
+        '<h2>Manager page activity</h2>',
+        '<p>Manager-only pages (linked from <a href="/manage.html">management</a>), excluded from the web page views above. A high failed count for a page may indicate a suspected attack, such as repeated guessing of the authorization code.</p>',
+        getManagerActivityTable(metrics.managerActivity)
+      ].join('\n')
+    };
+  }
+  // Otherwise, i.e. if the form has not been submitted yet:
+  else {
+    query = {
+      body: [
+        '<form action="/metrics.html" method="post">',
+        '  <p><label>',
+        '    Authorization code: <input size="3" minlength="3" maxlength="3" name="authCode" required>',
+        '  </label></p>',
+        '  <p><label><input type="checkbox" name="clearCounts"> Clear counts</label></p>',
+        '  <p><button type="submit">Submit</button></p>',
+        '</form>'
+      ].join('\n')
+    };
+  }
+  // Get the populated template.
+  const answerPage = await populateTemplate(import.meta.dirname, query);
+  // Return the populated page. Submitting a valid authCode also sets a cookie that
+  // excludes this browser's future page views and API calls from usage metrics, on the
+  // premise that a maintainer who has just proven their identity here is very likely the
+  // same person about to manually browse and test the rest of Kilotest.
+  return {
+    status: 'ok',
+    answerPage,
+    ...(method === 'POST' && {
+      setCookie: {
+        name: metricsExclusionCookieName,
+        value: getExclusionCookieValue(),
+        maxAgeSeconds: 30 * 24 * 60 * 60
+      }
+    })
+  };
+};

package/web/metrics/metrics.test.ts

@@ -0,0 +1,211 @@
+/*
+  metrics.test.ts
+  Unit tests for web/metrics/index.ts.
+*/
+
+// IMPORTS
+
+import {test, before, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import {parse} from 'node-html-parser';
+import {answer} from './index.ts';
+import {getJSON, metricsPath} from '../../util.ts';
+
+// SETUP AND TEARDOWN
+
+const savedAuthCode = process.env.AUTH_CODE;
+const savedDBDir = process.env.DB_DIR;
+import {fixtureDBDir} from '../../test/dbFixture.ts';
+
+before(() => {
+  process.env.AUTH_CODE = 'test-auth-code';
+  process.env.DB_DIR = fixtureDBDir;
+});
+
+after(() => {
+  if (savedAuthCode !== undefined) {
+    process.env.AUTH_CODE = savedAuthCode;
+  }
+  if (savedDBDir !== undefined) {
+    process.env.DB_DIR = savedDBDir;
+  }
+});
+
+// TESTS
+
+test('metrics returns an error for an invalid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=wrong', 'POST');
+  assert.equal(result.status, 'error');
+  assert.equal(result.message, 'Invalid request');
+});
+
+test('metrics displays a form requesting an auth code on a GET request', async () => {
+  const result: any = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  const html = parse(result.answerPage);
+  const input = html.querySelector('input[name="authCode"]');
+  assert.ok(input);
+  assert.equal(html.querySelectorAll('table').length, 0);
+});
+
+test('metrics displays a clearCounts checkbox in the initial form', async () => {
+  const result: any = await answer(null, '', 'GET');
+  const html = parse(result.answerPage);
+  const checkbox = html.querySelector('input[name="clearCounts"]');
+  assert.ok(checkbox);
+  assert.equal(checkbox.getAttribute('type'), 'checkbox');
+});
+
+test('metrics submits its form as a POST', async () => {
+  const result: any = await answer(null, '', 'GET');
+  const html = parse(result.answerPage);
+  const form = html.querySelector('form');
+  assert.equal(form?.getAttribute('method'), 'post');
+});
+
+test('metrics ignores a valid authCode query string on a GET request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code', 'GET');
+  assert.equal(result.status, 'ok');
+  const html = parse(result.answerPage);
+  // The form (not the counts) should still be shown, since only POST submits.
+  assert.ok(html.querySelector('input[name="authCode"]'));
+  assert.equal(html.querySelectorAll('table').length, 0);
+});
+
+test('metrics ignores clearCounts on a GET request, even with a valid authCode', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {tutorialWeb: 9},
+    mcpToolCalls: {},
+    apiOperations: {},
+    managerActivity: {}
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code&clearCounts=on', 'GET');
+  assert.ok(!result.answerPage.includes('Counts cleared.'));
+  const metrics = JSON.parse(await fs.readFile(metricsPath(), 'utf8'));
+  // The counts should NOT have been cleared by a mere GET request.
+  assert.equal(metrics.pageViews.tutorialWeb, 9);
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics reports no counts yet when the metrics file does not exist', async () => {
+  await fs.rm(metricsPath(), {force: true});
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage.includes('Counts recorded since'));
+  const html = parse(result.answerPage);
+  assert.equal(html.querySelectorAll('table').length, 0);
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics reports recorded counts with a valid auth code on a POST request', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {tutorialWeb: 3},
+    mcpToolCalls: {listReports: 5},
+    apiOperations: {},
+    managerActivity: {}
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  assert.equal(result.status, 'ok');
+  const html = parse(result.answerPage);
+  const tables = html.querySelectorAll('table');
+  assert.equal(tables.length, 2);
+  assert.ok(result.answerPage.includes('tutorialWeb'));
+  assert.ok(result.answerPage.includes('5'));
+  assert.ok(result.answerPage.includes('at 00:00'));
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics sorts each category by descending count', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {manage: 1, tutorialWeb: 9, otherPage: 4},
+    mcpToolCalls: {},
+    apiOperations: {},
+    managerActivity: {}
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  const html = parse(result.answerPage);
+  const names = html.querySelectorAll('table')[0]!.querySelectorAll('tbody td:first-child')
+  .map(cell => cell.text);
+  assert.deepEqual(names, ['tutorialWeb', 'otherPage', 'manage']);
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics reports manager page activity, sorted by descending failure count', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {},
+    mcpToolCalls: {},
+    apiOperations: {},
+    managerActivity: {
+      metrics: {ok: 5, error: 0},
+      reannotate: {ok: 1, error: 8}
+    }
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  assert.ok(result.answerPage.includes('Manager page activity'));
+  const html = parse(result.answerPage);
+  const tables = html.querySelectorAll('table');
+  assert.equal(tables.length, 1);
+  const managerTable = tables[0]!;
+  const rows = managerTable.querySelectorAll('tbody tr').map(row =>
+    row.querySelectorAll('td').map(cell => cell.text)
+  );
+  assert.deepEqual(rows, [['reannotate', '1', '8'], ['metrics', '5', '0']]);
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics reports no manager activity yet when none has been recorded', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {},
+    mcpToolCalls: {},
+    apiOperations: {},
+    managerActivity: {}
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  const html = parse(result.answerPage);
+  assert.equal(html.querySelectorAll('table').length, 0);
+  assert.ok(result.answerPage.includes('None yet.'));
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics clears all counts and shows a confirmation when clearCounts is submitted via POST', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {tutorialWeb: 9},
+    mcpToolCalls: {listReports: 3},
+    apiOperations: {getReport: 1},
+    managerActivity: {reannotate: {ok: 1, error: 2}}
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code&clearCounts=on', 'POST');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage.includes('Counts cleared.'));
+  const html = parse(result.answerPage);
+  assert.equal(html.querySelectorAll('table').length, 0);
+  const metrics = JSON.parse(await fs.readFile(metricsPath(), 'utf8'));
+  assert.deepEqual(metrics.pageViews, {});
+  assert.deepEqual(metrics.mcpToolCalls, {});
+  assert.deepEqual(metrics.apiOperations, {});
+  assert.deepEqual(metrics.managerActivity, {});
+  assert.notEqual(metrics.since, '260101T0000');
+  await fs.rm(metricsPath(), {force: true});
+});
+
+test('metrics does not clear counts, and does not show a confirmation, when clearCounts is not submitted', async () => {
+  await fs.writeFile(metricsPath(), getJSON({
+    since: '260101T0000',
+    pageViews: {tutorialWeb: 9},
+    mcpToolCalls: {},
+    apiOperations: {},
+    managerActivity: {}
+  }));
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  assert.ok(!result.answerPage.includes('Counts cleared.'));
+  const metrics = JSON.parse(await fs.readFile(metricsPath(), 'utf8'));
+  assert.equal(metrics.pageViews.tutorialWeb, 9);
+  await fs.rm(metricsPath(), {force: true});
+});

package/web/pruneReportsForm/index.html

@@ -14,7 +14,7 @@
     <main>
       <h1><a href="/">Kilotest</a>: Prune reports</h1>
       <p>__intro__</p>
-      <form action="/pruneReportsForm.html">
+      <form action="/pruneReportsForm.html" method="post">
         <fieldset>
           <legend>Reports</legend>
           __reports__

package/web/pruneReportsForm/index.ts

@@ -10,7 +10,7 @@ import {reportDeletionForm} from '../reportDeletion.ts';
 // FUNCTIONS
 
 // Returns a form for deleting non-latest reports.
-export const answer = async (_: any, search: string) => reportDeletionForm(import.meta.dirname, search, {
+export const answer = async (_: any, search: string, method: string) => reportDeletionForm(import.meta.dirname, search, method, {
   intro: 'Choose the superseded reports to delete.',
   emptyIntro: 'Each target has only 1 report, so there are no superseded reports to delete.',
   failurePrefix: 'Deleting superseded reports failed',

package/web/pruneReportsForm/pruneReportsForm.test.ts

@@ -35,32 +35,40 @@ after(async () => {
 
 // TESTS
 
-test('pruneReportsForm displays a list of reports when no submission', async () => {
-  const result = await answer(null, '');
+test('pruneReportsForm displays a list of reports on a GET request', async () => {
+  const result = await answer(null, '', 'GET');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage);
   const html = parse(result.answerPage);
   assert.ok(html.querySelector('title'));
 });
 
-test('pruneReportsForm returns an error for an invalid auth code', async () => {
-  const result = await answer(null, 'authCode=wrong&report=260101T0000-mix');
+test('pruneReportsForm ignores a report query string on a GET request', async () => {
+  const reportPath = path.join(reportsPath(), '260101T0000-mix.json');
+  const result = await answer(null, 'authCode=test-auth-code&report=260101T0000-mix', 'GET');
+  assert.equal(result.status, 'ok');
+  // The report should NOT have been deleted by a mere GET request.
+  await fs.access(reportPath);
+});
+
+test('pruneReportsForm returns an error for an invalid auth code on a POST request', async () => {
+  const result = await answer(null, 'authCode=wrong&report=260101T0000-mix', 'POST');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
-test('pruneReportsForm returns an error when deleting a nonexistent report', async () => {
-  const result = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope');
+test('pruneReportsForm returns an error when deleting a nonexistent report on a POST request', async () => {
+  const result = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope', 'POST');
   assert.equal(result.status, 'error');
   assert.ok(result.message?.includes('Deleting superseded reports'));
 });
 
-test('pruneReportsForm deletes a superseded report with valid auth code', async () => {
+test('pruneReportsForm deletes a superseded report with valid auth code on a POST request', async () => {
   // 260101T0000-mix is superseded by 260202T0000-new (same URL).
   const reportPath = path.join(reportsPath(), '260101T0000-mix.json');
   const backup = await fs.readFile(reportPath, 'utf8');
   try {
-    const result = await answer(null, 'authCode=test-auth-code&report=260101T0000-mix');
+    const result = await answer(null, 'authCode=test-auth-code&report=260101T0000-mix', 'POST');
     assert.equal(result.status, 'ok');
     await fs.access(reportPath).then(
       () => {throw new Error('Report should have been deleted');},
@@ -77,7 +85,7 @@ test('pruneReportsForm returns an error when a report file is corrupt', async ()
   const backup = await fs.readFile(reportPath, 'utf8');
   try {
     await fs.writeFile(reportPath, 'not valid json');
-    const result = await answer(null, '');
+    const result = await answer(null, '', 'GET');
     assert.equal(result.status, 'error');
   }
   finally {

package/web/reannotate/index.ts

@@ -63,9 +63,12 @@ export const answer = async (authCode: string) => {
       answerPage
     };
   }
-  // Otherwise, i.e. if the authorization code is invalid, return an error page.
+  // Otherwise, i.e. if the authorization code is invalid, return an error page. The
+  // message is deliberately vague so as not to confirm to an attacker that the
+  // authorization code specifically (as opposed to some other part of the request) is
+  // what was wrong.
   return {
     status: 'error',
-    message: 'Invalid authorization code'
+    message: 'Invalid request'
   };
 };

package/web/reannotate/reannotate.test.ts

@@ -59,7 +59,7 @@ test('answer returns an error for an invalid authorization code', async () => {
   const {answer} = await import('./index.ts');
   const result = await answer('wrong-code');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
 test('answer returns an error when no reports are available', async () => {

package/web/renewWCAG/index.ts

@@ -61,10 +61,13 @@ export const answer = async (authCode: string) => {
       };
     }
   }
+  // The message is deliberately vague so as not to confirm to an attacker that the
+  // authorization code specifically (as opposed to some other part of the request) is
+  // what was wrong.
   else {
     return {
       status: 'error',
-      message: 'Authorization code invalid'
+      message: 'Invalid request'
     };
   }
 };

package/web/renewWCAG/renewWCAG.test.ts

@@ -65,7 +65,7 @@ test('answer returns an error for an invalid authorization code', async () => {
   const {answer} = await import('./index.ts');
   const result = await answer('wrong-code');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Authorization code invalid');
+  assert.equal(result.message, 'Invalid request');
 });
 
 test('answer returns an error when the WCAG map source returns a non-200 status', async () => {

package/web/reportDeletion.ts

@@ -32,18 +32,21 @@ export type DeletionSpec = {
 
 // FUNCTIONS
 
-// Returns a form for deleting the reports that the predicate marks as deletable.
+// Returns a form for deleting the reports that the predicate marks as deletable. A GET
+// request never processes a submission, regardless of its query string; only a POST
+// request (the form's own submission) does.
 export const reportDeletionForm = async (
   dirName: string,
   search: string,
+  method: string,
   deletionSpec: DeletionSpec
 ): Promise<{status: string; message?: string; answerPage?: string}> => {
   const {emptyIntro, failurePrefix, intro, isDeletable} = deletionSpec;
   const searchParams = new URLSearchParams(search);
   const authCode = searchParams?.get('authCode');
   const jobNames = searchParams?.getAll('report');
-  // If the form has been displayed by itself after a submission and any reports are to be deleted:
-  if (jobNames?.length) {
+  // If the form has been submitted and any reports are to be deleted:
+  if (method === 'POST' && jobNames?.length) {
     // If the authorization code is valid:
     if (authCode === process.env.AUTH_CODE) {
       try {
@@ -64,10 +67,12 @@ export const reportDeletionForm = async (
     }
     // Otherwise, i.e. if the authorization code is invalid:
     else {
-      // Report the error.
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
       return {
         status: 'error',
-        message: 'Invalid authorization code'
+        message: 'Invalid request'
       };
     }
   }

package/web/rewindReportsForm/index.html

@@ -14,7 +14,7 @@
     <main>
       <h1><a href="/">Kilotest</a>: Rewind reports</h1>
       <p>__intro__</p>
-      <form action="/rewindReportsForm.html">
+      <form action="/rewindReportsForm.html" method="post">
         <fieldset>
           <legend>Reports</legend>
           __reports__

package/web/rewindReportsForm/index.ts

@@ -10,7 +10,7 @@ import {reportDeletionForm} from '../reportDeletion.ts';
 // FUNCTIONS
 
 // Returns a form for deleting latest superseding reports.
-export const answer = async (_: any, search: string) => reportDeletionForm(import.meta.dirname, search, {
+export const answer = async (_: any, search: string, method: string) => reportDeletionForm(import.meta.dirname, search, method, {
   intro: 'Choose the latest superseding reports to delete.',
   emptyIntro: 'Each target has only 1 report, so there are no reports to delete.',
   failurePrefix: 'Deleting latest superseding reports failed',