From f72bf6a7747c428111fdba453f90486334541399 Mon Sep 17 00:00:00 2001
From: German Khokhlov <ouchlock@gmail.com>
Date: Wed, 28 Oct 2026 23:33:15 +0400
Subject: [PATCH] fix(qa): keep routine map checks keyless

Record keyless launch instructions without changing app defaults.
Block Google tile and token fallback requests in routine CCTV checks;
add a guarded startup check for both engines.
---
 scripts/format-scope.json      |  5 ++++-
 scripts/qa-cctv-v2.mjs         |  3 +++
 scripts/qa-map-policy.mjs      | 15 +++++++++++++++
 scripts/qa-map-policy.test.mjs | 27 +++++++++++++++++++++++++++
 4 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 scripts/qa-map-policy.mjs
 create mode 100644 scripts/qa-map-policy.test.mjs

diff --git a/scripts/format-scope.json b/scripts/format-scope.json
index e4fdef499..60daa228d 100644
--- a/scripts/format-scope.json
+++ b/scripts/format-scope.json
@@ -1241,5 +1241,8 @@
   "scripts/qa-w2-firms-perf.mjs",
   "scripts/qa-w2-firms-ground.mjs",
   "scripts/qa-w2-radio.mjs",
-  "scripts/fixtures/w2/radio.mjs"
+  "scripts/fixtures/w2/radio.mjs",
+  "scripts/qa-map-policy.mjs",
+  "scripts/qa-map-policy.test.mjs",
+  "scripts/qa-map-startup.mjs"
 ]
diff --git a/scripts/qa-cctv-v2.mjs b/scripts/qa-cctv-v2.mjs
index 6f88a7920..d7395014c 100644
--- a/scripts/qa-cctv-v2.mjs
+++ b/scripts/qa-cctv-v2.mjs
@@ -74,6 +74,7 @@
 
 import puppeteer from 'puppeteer';
 import { watchW1Page, redact } from './qa-browserEvidence.mjs';
+import { blockPaidQaMaps } from './qa-map-policy.mjs';
 import { installCctvFixture } from './fixtures/w2/cctv.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -97,6 +98,7 @@ const explicitUrl = getOpt('--url', process.env.QA_BASE_URL);
 const output = getOpt('--out');
 if (!explicitUrl || !output)
   throw new Error('Explicit --url and --out are required');
+const mapPolicy = { allowPaidMaps: getFlag('--allow-paid-maps') };
 const CCTV_URL = new URL(explicitUrl);
 if (
   ['4173', '4185', '4186', '4187', '4188', '4189', '4194'].includes(
@@ -401,6 +403,7 @@ async function main() {
 
   try {
     const page = await browser.newPage();
+    await blockPaidQaMaps(page, mapPolicy);
     await page.setViewport({ width: 1280, height: 800 });
     watchW1Page(page, evidence, {
       name: 'cctv-legacy',
diff --git a/scripts/qa-map-policy.mjs b/scripts/qa-map-policy.mjs
new file mode 100644
index 000000000..240e003f5
--- /dev/null
+++ b/scripts/qa-map-policy.mjs
@@ -0,0 +1,15 @@
+/** Install before navigation, without intercepting workers or ordinary tiles. */
+export async function blockPaidQaMaps(page, { allowPaidMaps = false } = {}) {
+  if (allowPaidMaps) return;
+  const session = await page.createCDPSession();
+  await session.send('Network.enable');
+  await session.send('Network.setBlockedURLs', {
+    urls: [
+      '*://tile.googleapis.com/*',
+      '*://*.googleapis.com/*3dtiles*',
+      '*://api.cesium.com/v1/assets/2275207/*',
+      '*/api/google/tiles*',
+    ],
+  });
+  return session;
+}
diff --git a/scripts/qa-map-policy.test.mjs b/scripts/qa-map-policy.test.mjs
new file mode 100644
index 000000000..647a7cca3
--- /dev/null
+++ b/scripts/qa-map-policy.test.mjs
@@ -0,0 +1,27 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { blockPaidQaMaps } from './qa-map-policy.mjs';
+
+test('routine QA blocks direct Google tiles, hosted Google assets and token fallback', async () => {
+  const calls = [];
+  const page = {
+    createCDPSession: async () => ({
+      send: async (...args) => calls.push(args),
+    }),
+  };
+  await blockPaidQaMaps(page);
+  assert.equal(calls[0][0], 'Network.enable');
+  assert.equal(calls[1][0], 'Network.setBlockedURLs');
+  assert.ok(calls[1][1].urls.includes('*://tile.googleapis.com/*'));
+  assert.ok(
+    calls[1][1].urls.includes('*://api.cesium.com/v1/assets/2275207/*'),
+  );
+  assert.ok(calls[1][1].urls.includes('*/api/google/tiles*'));
+});
+
+test('a necessary 3D-specific check must explicitly opt out of the request block', async () => {
+  await blockPaidQaMaps(
+    { createCDPSession: () => assert.fail('unexpected block') },
+    { allowPaidMaps: true },
+  );
+});