Skip to content

chore(release): v1.3.1 - #122

Merged
catapult-counterweight[bot] merged 6 commits into
mainfrom
dev
Nov 13, 2026
Merged

catapult-counterweight[bot] merged 6 commits into
mainfrom
dev

Conversation

@catapult-counterweight

Copy link
Copy Markdown
Contributor

Sors cette PR du draft pour publier la release ; elle fusionnera quand les checks seront verts. Pour la programmer, indique ci-dessous une date AAAA-MM-JJ HH:MM, en heure de Paris.

  • Le bot met à jour le changelog

Sortie programmée :

Fixes

  • battlenet: get through Blizzard's security check when a bot logs in (9b8736f)
  • battlenet: only count a security check click once it is sent (3296f04)
  • merge the Battle.net login security check fix into dev (2ce2a2a)

catapult-counterweight Bot and others added 5 commits November 13, 2026 22:39
Report de `v1.3.0` (#116) de `main` vers `dev`.

L'auto-merge est activé : la PR se fusionne d'elle-même (commit de
merge) dès que les checks passent ; tant qu'elle est ouverte, la
promotion depuis et vers `dev` est refusée.
The choose page was marked as handled before the click, so a poll landing
before the button rendered never asked for the code. Unknown pages with a
text field are no longer taken for a code page, so the timeout diagnostic
reports them, and a code being submitted is not asked for again.
## Summary

Adding a Battle.net bot in production failed with "No answer from the
login page in time": from a new device or IP, Blizzard puts two steps
between the password and the ticket, and the login browser recognised
neither.

- **Security Check** (`/login/<locale>/challenge/<uuid>/choose`): a
method picker (`<select>`, "E-Mail" by default) with no text field. The
browser now keeps the default method, clicks Submit and keeps waiting.
- **Code page** (`/login/<locale>/challenge/<uuid>`,
`input[autocomplete=one-time-code]`): now reported as "code required",
so the admin's code field appears. The code is filled in; the page
submits it by itself (Submit is clicked only if it is still there), then
the usual ticket redirect follows.
- Both steps and selectors were captured live against the Blizzard site
from a fresh browser (2026-11-14) and replace the unverified ones.
- On a timeout, a WARN now describes the page (URL without query, title,
visible inputs/buttons/alerts — never input values, e-mail-like text
masked), so an unknown Blizzard page shows up in the logs.

## Module to restart

catapult-api.

## Tests

`fr.enimaloc.catapult.service.battlenet.login.*`: new
`LoginPageInspectionTest` (8) plus the existing coordinator, flow and
browser tests — green. The full flow against Blizzard is validated in
production with a single admin login once deployed.
@catapult-counterweight catapult-counterweight Bot added the release PR de promotion (bot) label Nov 13, 2026
@enimaloc
enimaloc marked this pull request as ready for review November 13, 2026 23:40
@catapult-counterweight
catapult-counterweight Bot merged commit b8d7aed into main Nov 13, 2026
6 checks passed
catapult-counterweight Bot added a commit that referenced this pull request Nov 14, 2026
Report de `v1.3.1` (#122) de `main` vers `dev`.

L'auto-merge est activé : la PR se fusionne d'elle-même (commit de
merge) dès que les checks passent ; tant qu'elle est ouverte, la
promotion depuis et vers `dev` est refusée.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release PR de promotion (bot)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant