diff --git a/tools/lab/wonderink-lesson-site.py b/tools/lab/wonderink-lesson-site.py
index 46cec25..6f32178 100644
--- a/tools/lab/wonderink-lesson-site.py
+++ b/tools/lab/wonderink-lesson-site.py
@@ -14,6 +14,18 @@ of picture a lesson might put under a teacher's pointer:
print that fetches it again gets a 404, not a picture
OTHER_PORT the same pictures from another origin, with no CORS
+and a stand-in for WonderInk's own start page and sign-in, built the way
+the real site's is (read from its code, and measured with a real
+account): the sign-in is cookies its JavaScript writes, and rrf-auth is
+"Basic " and the base64 of the email and password — so a check can prove
+that nothing Wonder Ink writes down holds one. Sign out calls
+/rrframework/dataStore/signout and then sets them to "".
+
+ /app "Signed in as …" if rrf-auth is set, else a sign-in form
+ /app?busy=1 the same, plus what a site does by itself: a request
+ every second and an animation, and no input at all
+ /links every kind of link a lesson has, for following them
+
Every request is logged, one JSON line each, so a check can say what was
fetched while it printed. What was measured with this, and why Print
image fetches nothing, is in classroom-wonderink's _take_picture.
@@ -21,6 +33,7 @@ image fetches nothing, is in classroom-wonderink's _take_picture.
import http.server
import json
+import re
import sys
import threading
import time
@@ -31,7 +44,7 @@ from urllib.parse import urlparse
PICTURES = Path(sys.argv[1])
PORT, OTHER = int(sys.argv[2]), int(sys.argv[3])
LOG = Path(sys.argv[4])
-TYPES = {".png": "image/png", ".jpg": "image/jpeg", ".webp": "image/webp"}
+TYPES = {".png": "image/png", ".jpg": "image/jpeg", ".webp": "image/webp", ".pdf": "application/pdf"}
fetched_once = set()
lock = threading.Lock()
@@ -51,6 +64,7 @@ img, canvas { width: 180px; height: 120px; object-fit: contain; border: 1px soli
+