From 024c95b576be7ba039c925b25a962b346e026ce8 Mon Sep 17 00:00:00 2001
From: Distronode <254259913+distronode-com@users.noreply.github.com>
Date: Wed, 16 Sep 2026 20:24:28 -0400
Subject: [PATCH] booking: give browser autofill nothing to classify in the
 honeypot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some real people could not book: POST /v1/bookings answered 400. The
booking page's hidden honeypot was <label>Company<input name="company">,
and @MinosChatzidakis worked out in #33 that Chrome's autofill fills it
from the visitor's address profile. The server then treats a person as a
bot. autocomplete="off" was already on the input and did not stop it.

That label and name are exactly what Chrome looks for. Its classification
patterns live in
components/autofill/core/browser/form_parsing/resources/
legacy_regex_patterns.json (chromium/src 0520a5aa3f76), where COMPANY_NAME
is company|business|organization|organisation, matched against both the
label and the name attribute.

The input now has no label and is name="hp", id="f-hp". The submit script
reads it by that id and still posts it as "company", so the API, the embed
widget and any third-party client are unchanged, and a filled value is
still rejected.

The name was chosen by running candidates through every pattern in that
file, all languages, as a case-insensitive search the way ICU find() does:
"hp" and "f-hp" match nothing. A label-free input is not label-free to
Chrome, though. form_autofill_util.cc infers a label from nearby text, and
for this markup its div walk climbs to #form-view and picks up the Back
button and the chosen slot, e.g. "Back Fri, Sep 18 · 10:00 AM". That
string was generated for every weekday, month and half hour in all eight
shipped locales (32,264 strings) and run through the same patterns. One
matches: German Wednesday, "Zurück Mi., ...", hits MIDDLE_INITIAL on "Mi".
Chromium assigns MIDDLE_INITIAL only inside a first-name and last-name
sequence (name_field_parser.cc), and this form has a single full-name
field, so that cannot become a classification.

The embed widget needs no change. Its honeypot has never had a label, name
or id, and its inferred label comes from the same Back-plus-slot text.

This is checked against Chromium's local heuristics only. Its server-side
crowdsourced predictions, Safari, Firefox and password managers were not
tested, and no real Chrome profile was autofilled.

TestBookPage_honeypotGivesAutofillNothingToClassify renders the page and
holds the honeypot to: one input, no label or text, no placeholder,
aria-label, title or value, a name and id free of common autofill words,
and a submit script that posts that input as "company". Putting the old
markup back fails it on six assertions, and restoring only the "Company"
label fails it on two. TestCreateBooking_honeypotRejected already covers
the server side and still fails when the check is disabled.

In a real browser against a built binary, a normal booking posted
"company":"" and got 201 with no console errors, and a filled honeypot got
400 with "booking rejected: honeypot filled" in the log.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                           | 15 ++++++
 docs/ARCHITECTURE.md                   |  8 +++
 internal/handler/booking_abuse_test.go | 75 ++++++++++++++++++++++++++
 internal/handler/templates/book.html   | 12 +++--
 4 files changed, 107 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f45a54ce..e11c61b9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,21 @@ exact tag (`ghcr.io/calnode/calnode:0.1.0`) if you need stability between upgrad
 
 ## [Unreleased]
 
+### Fixed
+- **Booking no longer fails with a 400 for people whose browser autofills the hidden
+  honeypot field.** The booking page's anti-bot field was labelled "Company" and named
+  `company`, which is exactly what Chrome looks for when filling an organisation from an
+  address profile, so autofill filled it despite `autocomplete="off"` and the server
+  rejected a real person as a bot. Fixes
+  [#33](https://github.com/Calnode/calnode/issues/33), diagnosed by
+  [@MinosChatzidakis](https://github.com/MinosChatzidakis).
+
+  The input now has no label and a neutral `name="hp"`/`id="f-hp"`, checked against
+  Chromium's own field-classification patterns. The API is unchanged: the page still
+  posts the value as `company`, so the embed widget and any third-party client keep
+  working, and a filled value is still rejected. The embed widget needed no change; its
+  honeypot never had a label, name or id.
+
 ## [0.9.0] - 2026-09-10
 
 ### Added
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index e91d5db6..23f281c9 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -424,6 +424,14 @@ them - the most common "why can't I see those times".
   (`maxBookingsPerEmailPerHour`) backstops rotating-IP spam; and the booking form has a
   hidden **honeypot** (`company`) that rejects bots. Booker email *verification* is
   intentionally absent — it would need a pending-booking state (a deliberate non-goal).
+  - **The honeypot input must give browser autofill nothing to classify.** Autofill
+    fills fields it recognises by label text and `name`/`id`, and a "Company" label with
+    `name="company"` made Chrome fill it from real bookers' address profiles despite
+    `autocomplete="off"`, so the server rejected people as bots (#33). On
+    `book.html` it has no label and a neutral `name="hp"`/`id="f-hp"`; the embed
+    widget's has no label, name or id at all. Only the JSON field is called `company`.
+    `TestBookPage_honeypotGivesAutofillNothingToClassify` holds the rendered markup to
+    that.
 - **Cancel:** `CancelBooking` (admin) and `CancelByToken` (manage link) share
   `Handler.cancelSideEffects` — loops `booking_hosts`, cancels each host's calendar
   event by its stored id, notifies each host + the attendee (attendee "With:" = the
diff --git a/internal/handler/booking_abuse_test.go b/internal/handler/booking_abuse_test.go
index 4398b64a..02424e45 100644
--- a/internal/handler/booking_abuse_test.go
+++ b/internal/handler/booking_abuse_test.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"regexp"
 	"strings"
 	"testing"
 )
@@ -25,6 +26,80 @@ func TestCreateBooking_honeypotRejected(t *testing.T) {
 	}
 }
 
+// autofillTokens is a small subset of the words Chromium classifies a field by
+// (components/autofill/core/browser/form_parsing/resources/legacy_regex_patterns.json):
+// company, name, email, phone and address, in the languages this project ships. It is
+// deliberately a tripwire for the obvious regression, not a copy of that file.
+var autofillTokens = regexp.MustCompile(`(?i)compan|business|organi[sz]ation|firma|empresa|soci[eé]t[eé]|azienda|bedrijf|f[öo]retag|name|nom|nombre|e.?mail|courriel|correo|phone|tel|mobile|addr|street|city|zip|postal|country`)
+
+// TestBookPage_honeypotGivesAutofillNothingToClassify: browser autofill fills fields it
+// recognises by label and name, and a "Company" label with name="company" made Chrome
+// fill the honeypot from a real booker's address profile, so the server rejected people
+// as bots (#33). The rendered input must carry no label and no autofill-recognisable
+// name or id, while the page still posts it as "company".
+func TestBookPage_honeypotGivesAutofillNothingToClassify(t *testing.T) {
+	h, key, _ := setupWorkspace(t)
+	slug, _ := seedEventTypeHTTP(t, h, key)
+
+	req := httptest.NewRequest(http.MethodGet, "/book/"+slug, nil)
+	req.SetPathValue("slug", slug)
+	rec := httptest.NewRecorder()
+	h.BookPage(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("BookPage: %d — %s", rec.Code, rec.Body.String())
+	}
+	body := rec.Body.String()
+
+	const wrapperOpen = `<div aria-hidden="true" style="position:absolute;left:-5000px;`
+	start := strings.Index(body, wrapperOpen)
+	if start < 0 {
+		t.Fatalf("honeypot wrapper not found in the booking page")
+	}
+	end := strings.Index(body[start:], "</div>")
+	if end < 0 {
+		t.Fatalf("honeypot wrapper is not closed")
+	}
+	block := body[start : start+end]
+
+	inputs := regexp.MustCompile(`<input\b[^>]*>`).FindAllString(block, -1)
+	if len(inputs) != 1 {
+		t.Fatalf("honeypot wrapper holds %d inputs; want exactly 1:\n%s", len(inputs), block)
+	}
+	if text := strings.TrimSpace(regexp.MustCompile(`<[^>]*>`).ReplaceAllString(block, "")); text != "" {
+		t.Errorf("honeypot wrapper contains text %q, which autofill reads as the field's label", text)
+	}
+	if strings.Contains(block, "<label") {
+		t.Errorf("honeypot has a <label>; autofill classifies fields by label text:\n%s", block)
+	}
+
+	attrs := map[string]string{}
+	for _, m := range regexp.MustCompile(`([a-z-]+)="([^"]*)"`).FindAllStringSubmatch(inputs[0], -1) {
+		attrs[m[1]] = m[2]
+	}
+	if attrs["id"] == "" {
+		t.Fatalf("honeypot input has no id for the submit script to read: %s", inputs[0])
+	}
+	for _, a := range []string{"name", "id"} {
+		if autofillTokens.MatchString(attrs[a]) {
+			t.Errorf("honeypot %s=%q is a word autofill classifies fields by", a, attrs[a])
+		}
+	}
+	for _, a := range []string{"placeholder", "aria-label", "title", "value"} {
+		if v, ok := attrs[a]; ok {
+			t.Errorf("honeypot has %s=%q, which autofill can read as a label", a, v)
+		}
+	}
+	if strings.Contains(body, `name="company"`) || strings.Contains(body, `id="f-company"`) {
+		t.Error(`the page still renders a field named or id'd "company"`)
+	}
+
+	// The API field is unchanged: the submit script must read this input by its id and
+	// post it as "company", or the server-side check silently stops seeing bots.
+	if want := "company: $('" + attrs["id"] + "').value"; !strings.Contains(body, want) {
+		t.Errorf("submit script does not post the honeypot as company; want %q in the page", want)
+	}
+}
+
 // TestCreateBooking_perEmailThrottle: one email can create up to the hourly cap
 // across distinct slots, then is throttled with 429.
 func TestCreateBooking_perEmailThrottle(t *testing.T) {
diff --git a/internal/handler/templates/book.html b/internal/handler/templates/book.html
index e2bd96d6..76468a6e 100644
--- a/internal/handler/templates/book.html
+++ b/internal/handler/templates/book.html
@@ -191,9 +191,15 @@ <h1 class="event-name">{{.Name}}</h1>
       <p class="slot-label" id="form-slot-label"></p>
       <form id="booking-form" novalidate>
         <!-- Honeypot: hidden from humans (off-screen, not tabbable); a bot that fills
-             "company" is rejected server-side. Real submissions leave it empty. -->
+             it is rejected server-side. It is still posted as "company" (the API field),
+             but the input itself must give browser autofill nothing to classify: no
+             label, and a name/id that matches none of Chromium's field patterns
+             (components/autofill/core/browser/form_parsing/resources/
+             legacy_regex_patterns.json). A "Company" label and name="company" made Chrome
+             fill it from the booker's address profile, rejecting real people (#33),
+             although autocomplete="off" was already set. -->
         <div aria-hidden="true" style="position:absolute;left:-5000px;height:0;width:0;overflow:hidden;">
-          <label>Company<input id="f-company" name="company" type="text" tabindex="-1" autocomplete="off"></label>
+          <input id="f-hp" name="hp" type="text" tabindex="-1" autocomplete="off">
         </div>
         <div class="field">
           <label for="f-name">{{call .T "name_label"}}</label>
@@ -682,7 +688,7 @@ <h3>{{call .T "booking_confirmed"}}</h3>
           email: form.email.value.trim(),
           timezone: TZ,
           language: LOCALE,
-          company: form.company.value,
+          company: $('f-hp').value,
           answers,
         }),
       });