The privacy policy says "no third-party analytics, no tracking, no advertising
… no third-party script runs on any page". Verified by hand 2026-09-02, then
armed here so a future line cannot quietly break it.

The test renders the five marketing pages and collects every external host they
*load* — src, <link href>, <iframe src>, @import, CSS url() — not <a href>,
which is navigation. It asserts the set is exactly the one disclosed host,
stats.oddie.app, self-hosted Plausible.

Two things it does deliberately, both because a negative passes on nothing:

- Rendered with analytics ON (put_env :analytics_domain), because the Plausible
  tag is gated on that assign and is absent in :test. Without it the disclosed
  host never appears and the control cannot fire. fetch_env restores an absent
  key to absent rather than to a stored nil.
- The control — the disclosed host must be found — is asserted BEFORE the
  absence. A run that reports zero external hosts has failed to parse the page,
  not proved the site clean, and those two are the same green without it.

Proven to fail before trusting it: a third-party <script src> goes red on the
foreign-host assertion across all five pages; removing stats.oddie.app goes red
on the control. Restored, 4 passed, mix ci green.

Its limit is in the moduledoc: it covers the rendered marketing pages only. The
"no processor, no analytics provider" clause lives in the homeserver's outbound
calls and the dependency lock files, which no page-fetching test can reach.
Those were verified by hand and would need their own instruments.

Module is now async: false because the test mutates application env.

jlxq0 merged commit ed30fd0733 into main

2026-09-02 01:03:07 +00:00

jlxq0 deleted branch privacy-boundary-check

2026-09-02 01:03:07 +00:00

jlxq0 referenced this pull request from a commit

2026-09-02 01:03:07 +00:00

Merge pull request 'test(privacy): the marketing pages reach only the disclosed self-hosted host' (#11) from privacy-boundary-check into main