ident

14.6 KB

1. // tests/migration.mjs — THE MIGRATION GATE (mission 009, ticket ident #10 / old #39):
2. // an OLD-FORMAT store (tests/oldstore-009.hl: `*id` tables, numeric public ids, sessions
3. // holding `user: {id: <number>}`) → tools/migrate-009.hl on a COPY, twice (idempotent) →
4. // the new code on the migrated store:
5. // * a migrated session is still signed in (HTTP and a real Chrome);
6. // * an app's STORED per-app ids come out of the exchange again with its UNCHANGED key +
7. // secret (login button in Chrome through the test app → "welcome back"; selector);
8. // * a code issued before the migration (grants) still exchanges; the per-app id of a
9. // deleted identity stays; every appIdentity byte-identical.
10. // Own servers: ident :8395, test app :8396 (the fixture app's origin); storage
11. // .scratch/migration-gate (wiped at start); Chrome on 8710-8719. Screenshot .scratch/migration-*.png
12. import { spawn, execFileSync } from 'node:child_process';
13. import { readFileSync, writeFileSync, rmSync, mkdirSync, cpSync } from 'node:fs';
14. import { createHash } from 'node:crypto';
15. import { dirname, join } from 'node:path';
16. import { fileURLToPath } from 'node:url';
17. import { launchBrowser, sleep } from './cdp.mjs';
19. const APP = join(dirname(fileURLToPath(import.meta.url)), '..');
20. const G = join(APP, '.scratch/migration-gate');
21. const BIN = join(APP, 'bin/hybriel');
22. const ID = 'http://127.0.0.1:8395', TA = 'http://127.0.0.1:8396';
23. const J = JSON.stringify;
24. const x = (c, n) => c.repeat(n);
25. const K1 = 'pk_' + x('1', 32), S1 = 'sk_' + x('2', 48), K2 = 'pk_' + x('3', 32), S2 = 'sk_' + x('4', 48);
26. const AI = { def: x('a', 32), work: x('b', 32), gone: x('c', 32), bob: x('d', 32) };
28. let passed = 0, failed = 0;
29. const check = (name, ok, detail = '') => {
30. if (ok) { passed++; console.log(' ok ' + name); }
31. else { failed++; console.log(' FAIL ' + name + (detail ? ' — ' + detail : '')); }
32. };
33. const run = (script, env) => execFileSync(BIN, [script], { cwd: APP, env: { ...process.env, ...env }, encoding: 'utf8' });
35. rmSync(G, { recursive: true, force: true });
36. mkdirSync(join(G, 'old'), { recursive: true });
37. mkdirSync(join(G, 'sess'), { recursive: true });
39. // ---- 1. the old-format store and its sessions -------------------------------------------
40. console.log('# old store');
41. const made = run(join(APP, 'tests/oldstore-009.hl'), { OLD_PREFIX: join(G, 'old/ident') });
42. check('fixture: old store written', /accounts 2 identities 3 apps 2 connections 4 otp 1 sends 1 requests 1 grants 1/.test(made), made.trim());
43. // hl:webex session files: the file name is sha256(sid), the content JSON (webex sessions.hl)
44. const SID = { alice: x('1a', 16), bob: x('2b', 16), anon: x('3c', 16) };
45. const sess = (sid, user) => writeFileSync(join(G, 'sess', createHash('sha256').update(sid).digest('hex')),
46. J({ created: Date.now() - 5000, data: {}, id: sid, seen: Date.now() - 1000, user }), { mode: 0o600 });
47. sess(SID.alice, { id: 1 }); sess(SID.bob, { id: 2 }); sess(SID.anon, null);
49. // ---- 2. migrate a COPY, twice -------------------------------------------------------------
50. console.log('# migrate');
51. cpSync(join(G, 'old'), join(G, 'oldcopy'), { recursive: true }); // opening a table rewrites it (hybriel #40)
52. const menv = { IDENT_OLD_STORAGE: join(G, 'oldcopy/ident'), IDENT_STORAGE: join(G, 'new'), IDENT_SESSIONS_MIGRATE: join(G, 'sess') };
53. const r1 = run(join(APP, 'tools/migrate-009.hl'), menv);
54. writeFileSync(join(G, 'migrate-run1.txt'), r1);
55. check('run 1: accounts 2, identities 3, apps 2, connections 4 (one of a deleted identity), otp/sends/requests/grants 1 each',
56. /accounts 2 new/.test(r1) && /identities 3 new/.test(r1) && /apps 2 new/.test(r1) && /connections 4 new/.test(r1) && /otp 1 new/.test(r1) && /sends 1 new/.test(r1) && /requests 1 new/.test(r1) && /grants 1 new/.test(r1), r1);
57. check('run 1: sessions 2 migrated, 1 anonymous left alone; 0 failed', /sessions 2 new, 0 already there, 1 anonymous, 0 left alone/.test(r1) && /migrate: 0 failed/.test(r1), r1);
58. const r2 = run(join(APP, 'tools/migrate-009.hl'), menv);
59. writeFileSync(join(G, 'migrate-run2.txt'), r2);
60. check('run 2 (idempotent): nothing new anywhere, 0 failed', !/ [1-9]\d* new/.test(r2) && /sessions 0 new, 2 already there/.test(r2) && /migrate: 0 failed/.test(r2), r2);
61. const sAlice = JSON.parse(readFileSync(join(G, 'sess', createHash('sha256').update(SID.alice).digest('hex')), 'utf8'));
62. check('alice\'s session now holds her account\'s UUID', /^[0-9a-z]{12}$/.test(sAlice.user.id) && sAlice.id === SID.alice, J(sAlice.user));
63. // the migrated store, read on a COPY
64. cpSync(join(G, 'new'), join(G, 'newcopy'), { recursive: true });
65. const st = JSON.parse(run(join(APP, 'tools/dump-store.hl'), { IDENT_STORAGE: join(G, 'newcopy') }));
66. check('every per-app id byte-identical (4 connections)', J(st.connections.map(c => c.appIdentity).sort()) === J(Object.values(AI).sort()), J(st.connections.map(c => c.appIdentity)));
67. check('API keys and secret hashes byte-identical', J(st.apps.map(a => [a.apiKey, a.secretHash]).sort()) === J([[K1, createHash('sha256').update(S1).digest('hex')], [K2, createHash('sha256').update(S2).digest('hex')]].sort()));
68. check('all keys are 12-char UUIDs, references rewritten', Object.values(st).flat().every(r => /^[0-9a-z]{12}$/.test(r.id))
69. && st.identities.every(i => st.accounts.some(a => a.id === i.account)) && st.apps.every(a => st.accounts.some(c => c.id === a.owner)));
70. const goneConn = st.connections.find(c => c.appIdentity === AI.gone);
71. check('the deleted identity\'s connection is kept as gone:4', goneConn && goneConn.identity === 'gone:4', J(goneConn));
73. // ---- 3. the new code on the migrated store -------------------------------------------------
74. const procs = [];
75. function start(cwd, env, log) {
76. const p = spawn(BIN, ['project.hl'], { cwd, env: { ...process.env, SMTP_HOST: '', SMTP_USER: '', SMTP_PASSWORD: '', ...env }, stdio: ['ignore', 'pipe', 'pipe'] });
77. let out = ''; p.stdout.on('data', d => { out += d; }); p.stderr.on('data', d => { out += d; });
78. p.on('exit', () => writeFileSync(join(G, log), out));
79. procs.push(p);
80. }
81. start(APP, { IDENT_PORT: '8395', IDENT_STORAGE: join(G, 'new'), IDENT_SESSIONS: join(G, 'sess') + '/', IDENT_MAIL_SINK: join(G, 'mail.txt'), IDENT_IP_LIMIT: '1000', IDENT_IP_DAY_LIMIT: '1000' }, 'ident.log');
82. for (let i = 0; i < 80; i++) { try { await fetch(ID + '/', { redirect: 'manual' }); break; } catch {} await sleep(250); }
83. // ident#23: the identities got their short ids at boot; each app trades its stored per-app ids for them in one step
84. const migrateIds = async (key, secret, finish) => { const r = await fetch(ID + '/api/migrate-ids', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J(finish ? { key, secret, finish } : { key, secret }) }); return { status: r.status, j: await r.json() }; };
85. const m1 = await migrateIds(K1, S1), m2 = await migrateIds(K2, S2);
86. const SHORT = /^[2-9a-hj-km-np-z]{5}$/;
87. check('migrate-ids (app 1): Default and Work map to short ids; the deleted identity is left out',
88. m1.status === 200 && J(Object.keys(m1.j.ids).sort()) === J([AI.def, AI.work].sort()) && Object.values(m1.j.ids).every(v => SHORT.test(v)) && m1.j.ids[AI.def] !== m1.j.ids[AI.work], J(m1));
89. check('migrate-ids (app 2): Bob maps to a short id', m2.status === 200 && J(Object.keys(m2.j.ids)) === J([AI.bob]) && SHORT.test(m2.j.ids[AI.bob]), J(m2));
90. const M = { ...m1.j.ids, ...m2.j.ids };
91. const wrong = await migrateIds(K1, S2);
92. check('migrate-ids with the wrong secret → 401', wrong.status === 401, J(wrong));
93. writeFileSync(join(G, 'testapp.json'), J({ key: K1, secret: S1, users: { [M[AI.def]]: { n: 1 }, [M[AI.work]]: { n: 2 } }, count: 2, sessions: {} }));
94. start(join(APP, 'testapp'), { TESTAPP_PORT: '8396', TESTAPP_URL: TA, IDENT_URL: ID, TESTAPP_STORE: join(G, 'testapp.json') }, 'testapp.log');
95. for (let i = 0; i < 80; i++) { try { await fetch(TA + '/', { redirect: 'manual' }); break; } catch {} await sleep(250); }
97. let browser = null;
98. try {
99. console.log('# sessions');
100. const home = async (sid) => (await fetch(ID + '/', { headers: { cookie: 'identsid=' + sid } })).text();
101. let h = await home(SID.alice);
102. check('alice\'s OLD cookie: still signed in, her identities (Default first = default, Work; the deleted one absent)',
103. h.includes('[email protected]') && /Default[\s\S]*default[\s\S]*Work/.test(h) && !h.includes('>Old<'), h.slice(0, 200));
104. h = await home(SID.bob);
105. check('bob\'s OLD cookie: still signed in as bob', h.includes('[email protected]') && !h.includes('[email protected]'));
106. h = await home(SID.anon);
107. check('the anonymous session: signed out (sign-in form)', h.includes('id="emailform"') && !h.includes('id="meemail"'));
108. const aliceIds = [...new Set([...(await home(SID.alice)).matchAll(/value="([0-9a-z]{12})"/g)].map(m => m[1]))];
109. check('alice\'s identity ids are UUIDs (2)', aliceIds.length === 2, J(aliceIds));
111. console.log('# exchange');
112. const exchange = async (body) => { const r = await fetch(ID + '/api/exchange', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J(body) }); return { status: r.status, j: await r.json() }; };
113. let e = await exchange({ key: K1, secret: S1, code: x('e', 48) });
114. check('a code issued BEFORE the migration still exchanges → the Work identity\'s stored id', e.status === 200 && e.j.identity === M[AI.work], J(e));
115. e = await exchange({ key: K1, secret: S1, code: x('e', 48) });
116. check('…once', e.status === 400, J(e));
117. const emit = async (event, payload, sid) => (await (await fetch(ID + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', cookie: 'identsid=' + sid }, body: J({ t: 'emit', i: 1, event, payload }) })).json()).value;
118. const bobIds = [...new Set([...(await home(SID.bob)).matchAll(/value="([0-9a-z]{12})"/g)].map(m => m[1]))];
119. const l = await fetch(ID + '/login?key=' + K2 + '&return=' + encodeURIComponent('http://127.0.0.1:8397/cb'), { redirect: 'manual' });
120. const v = await emit('chooseIdentity', [l.headers.get('location').split('/').pop(), bobIds[0]], SID.bob);
121. e = await exchange({ key: K2, secret: S2, code: new URL(v.url).searchParams.get('ident_code') });
122. check('bob (old cookie) → Bob app (unchanged key + secret) → his stored id', e.status === 200 && e.j.identity === M[AI.bob], J(e));
123. const sel = await fetch(ID + '/api/selector/identities?key=' + K1, { headers: { origin: TA, cookie: 'identsid=' + SID.alice } });
124. const sj = await sel.json();
125. check('selector: signed in, Default and Work', sel.status === 200 && sj.signedIn && J(sj.identities.map(i => i.name)) === J(['Default', 'Work']), J(sj));
126. const ch = await (await fetch(ID + '/api/selector/choose?key=' + K1, { method: 'POST', headers: { origin: TA, cookie: 'identsid=' + SID.alice, 'content-type': 'application/json' }, body: J({ identity: sj.identities[1].id }) })).json();
127. e = await exchange({ key: K1, secret: S1, code: ch.code });
128. check('selector choice Work → exchange → the stored Work id', e.status === 200 && e.j.identity === M[AI.work], J(e));
130. console.log('# old ids until the app has migrated');
131. const notify = async (key, secret, identity) => { const r = await fetch(ID + '/api/notify', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J({ key, secret, identity, name: 'New comment', text: 'hello' }) }); return r.status; };
132. check('notify: the OLD per-app id still works before the app migrated', (await notify(K1, S1, AI.work)) === 200);
133. check('notify: the short id works too', (await notify(K1, S1, M[AI.work])) === 200);
134. check('notify: the old id of ANOTHER app\'s user → 404', (await notify(K1, S1, AI.bob)) === 404);
135. const fin = await migrateIds(K1, S1, true);
136. check('migrate-ids finish: same map, marked finished', fin.status === 200 && fin.j.finished === true && J(fin.j.ids) === J(m1.j.ids), J(fin));
137. check('after finish: the old id is gone (404), the short id still works', (await notify(K1, S1, AI.work)) === 404 && (await notify(K1, S1, M[AI.work])) === 200);
138. check('after finish: nothing left to map', J((await migrateIds(K1, S1)).j.ids) === '{}');
139. check('app 2 was not finished: its old id still works', (await notify(K2, S2, AI.bob)) === 200);
141. console.log('# browser');
142. browser = await launchBrowser({ debugPortRange: [8710, 8719] });
143. const p = await browser.newPage();
144. await p.send('Network.enable');
145. await p.send('Network.setCookie', { name: 'identsid', value: SID.alice, url: ID, httpOnly: true, sameSite: 'Lax' });
146. await p.goto(ID + '/');
147. await p.waitFor('!!document.querySelector("#identities") && !!window.__hl && window.__hl.socket && window.__hl.socket.readyState === 1', { label: 'ident signed in' });
148. check('Chrome with alice\'s old cookie: signed in, Default (default badge) and Work',
149. (await p.evaluate('document.querySelector("#meemail").textContent')) === '[email protected]'
150. && J(await p.evaluate('[...document.querySelectorAll("#identities li")].map(li => li.querySelector("identity-label, identityLabel").textContent + (li.querySelector("default-badge, defaultBadge") ? "*" : ""))')) === J(['Default*', 'Work']));
151. const { data } = await p.send('Page.captureScreenshot', { format: 'png' });
152. writeFileSync(join(APP, '.scratch/migration-signedin-1280.png'), Buffer.from(data, 'base64'));
153. const viaButton = async (nth) => {
154. await p.goto(TA + '/');
155. await p.click('#login');
156. await p.waitFor('location.pathname.startsWith("/signin/") && !!document.querySelector("#chooselist") && !!window.__hl && window.__hl.socket && window.__hl.socket.readyState === 1', { label: 'choice' });
157. await p.click(`#chooselist li:nth-child(${nth}) .choose`);
158. await p.waitFor(`location.href.startsWith(${J(TA + '/callback')}) && !!document.querySelector("#result")`, { label: 'back at the app' });
159. return { identity: await p.evaluate('document.querySelector("#identity").textContent.trim()'), state: await p.evaluate('document.querySelector("#userstate").textContent') };
160. };
161. let b = await viaButton(1);
162. check('Chrome: test app → login button → Default → the SAME stored id, "welcome back"', b.identity === M[AI.def] && b.state === 'welcome back', J(b));
163. b = await viaButton(2);
164. check('Chrome: test app → login button → Work → the SAME stored id, "welcome back"', b.identity === M[AI.work] && b.state === 'welcome back', J(b));
165. const shot = await p.send('Page.captureScreenshot', { format: 'png' });
166. writeFileSync(join(APP, '.scratch/migration-testapp-1280.png'), Buffer.from(shot.data, 'base64'));
167. const ta = JSON.parse(readFileSync(join(G, 'testapp.json'), 'utf8'));
168. check('the test app made no new users (count still 2)', ta.count === 2, J(ta.count));
169. check('Chrome: no console errors', p.problems().length === 0, J(p.problems()));
170. } catch (err) {
171. failed++; console.log(' FAIL (aborted) ' + err.stack);
172. } finally {
173. if (browser) await browser.close();
174. for (const p of procs) { try { p.kill(); } catch {} }
175. await sleep(300);
176. }
177. console.log(`\n${passed} passed, ${failed} failed`);
178. process.exit(failed ? 1 : 0);