ident

31.5 KB

1. // tests/apps.mjs — THE GATE OF PIECE 2 (ticket #25): apps, one id per app, the login
2. // button, the exchange. Real headless Chrome (tests/cdp.mjs, --disable-gpu) drives:
3. // register apps in ident → set up the test app → "Log in with ident" → ident login →
4. // choose identity → back → exchange → the test app shows the id. Plus the negatives.
5. //
6. // Own servers only, NEVER the dev server and NEVER real mail:
7. // ident :8370 (IDENT_MAIL_SINK), ident :8371 (grant TTL 1.5 s, for the expiry case),
8. // test app A :8372, test app B :8373 (both against ident :8370).
9. // Own storage: .scratch/apps-gate/ (wiped at start). Chrome debug ports 8670-8679.
10. // Screenshots: .scratch/apps-*.png (390 and 1280 px) — look at them.
11. //
12. // Run: node tests/apps.mjs (exit 0 = all passed)
13. import { spawn } from 'node:child_process';
14. import { readFileSync, writeFileSync, rmSync, mkdirSync, existsSync } from 'node:fs';
15. import { dirname, join } from 'node:path';
16. import { fileURLToPath } from 'node:url';
17. import { launchBrowser, sleep } from './cdp.mjs';
19. const APP = join(dirname(fileURLToPath(import.meta.url)), '..');
20. const G = join(APP, '.scratch/apps-gate');
21. const SHOTS = join(APP, '.scratch');
22. const ID = 'http://127.0.0.1:8370', IDS = 'http://127.0.0.1:8371';
23. const TA = 'http://127.0.0.1:8372', TB = 'http://127.0.0.1:8373';
24. const CHROME_PORTS = [8670, 8679];
26. let passed = 0, failed = 0;
27. const check = (name, ok, detail = '') => {
28. if (ok) { passed++; console.log(' ok ' + name); }
29. else { failed++; console.log(' FAIL ' + name + (detail ? ' — ' + detail : '')); }
30. };
32. // ---- servers ----------------------------------------------------------------------------
33. const procs = [];
34. function start(cwd, env, log) {
35. const p = spawn(join(APP, 'bin/hybriel'), ['project.hl'], {
36. cwd, env: { ...process.env, SMTP_HOST: '', SMTP_USER: '', SMTP_PASSWORD: '', ...env },
37. stdio: ['ignore', 'pipe', 'pipe'],
38. });
39. let out = '';
40. p.stdout.on('data', d => { out += d; }); p.stderr.on('data', d => { out += d; });
41. p.on('exit', () => writeFileSync(join(G, log), out));
42. procs.push({ p, log, out: () => out });
43. return p;
44. }
45. async function up(url) {
46. for (let i = 0; i < 80; i++) { try { await fetch(url + '/', { redirect: 'manual' }); return; } catch {} await sleep(250); }
47. throw new Error('server did not come up: ' + url);
48. }
49. function stopAll() { for (const { p } of procs) { try { p.kill(); } catch {} } }
51. rmSync(G, { recursive: true, force: true });
52. mkdirSync(G, { recursive: true });
53. const identEnv = (port, dir, extra = {}) => ({
54. IDENT_PORT: String(port), IDENT_STORAGE: join(G, dir, 'ident'), IDENT_SESSIONS: join(G, dir, 'sess') + '/',
55. IDENT_MAIL_SINK: join(G, dir, 'mail.txt'), IDENT_IP_LIMIT: '1000', IDENT_IP_DAY_LIMIT: '1000', ...extra,
56. });
57. mkdirSync(join(G, 'main'), { recursive: true }); mkdirSync(join(G, 'short'), { recursive: true });
58. start(APP, identEnv(8370, 'main'), 'ident-main.log');
59. start(APP, identEnv(8371, 'short', { IDENT_GRANT_TTL_MS: '1500' }), 'ident-short.log');
60. const testapp = (port, file) => start(join(APP, 'testapp'), {
61. TESTAPP_PORT: String(port), TESTAPP_URL: 'http://127.0.0.1:' + port, IDENT_URL: ID, TESTAPP_STORE: join(G, file),
62. }, 'testapp-' + port + '.log');
63. testapp(8372, 'testapp-a.json'); testapp(8373, 'testapp-b.json');
64. await Promise.all([up(ID), up(IDS), up(TA), up(TB)]);
66. // ---- helpers ----------------------------------------------------------------------------
67. const lastCode = (dir, email) => {
68. const lines = readFileSync(join(G, dir, 'mail.txt'), 'utf8').trim().split('\n').filter(l => l.startsWith(email + ' '));
69. return lines.length ? lines[lines.length - 1].split(' ')[1] : null;
70. };
71. let emitI = 0;
72. // hybriel#16 (mission 036): hl:web itself refuses an emit with one argument too many — the ack is
73. // ok:false "… the `session` parameter is filled by the server, never by the peer"; the face never runs.
74. const framework_refused = (raw) => { try { const j = JSON.parse(raw); return j.ok === false && /the `session` parameter is filled by the server/.test(j.error || ''); } catch { return false; } };
75. async function emit(base, event, payload, cookie) {
76. const r = await fetch(base + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', ...(cookie ? { cookie } : {}) }, body: JSON.stringify({ t: 'emit', i: ++emitI, event, payload }) });
77. const t = await r.text();
78. let j = null; try { j = JSON.parse(t); } catch {}
79. return { status: r.status, cookie: (r.headers.get('set-cookie') || '').split(';')[0], value: j && j.value, raw: t };
80. }
81. async function exchange(base, body) {
82. const r = await fetch(base + '/api/exchange', { method: 'POST', headers: { 'content-type': 'application/json' }, body: typeof body === 'string' ? body : JSON.stringify(body) });
83. const t = await r.text();
84. let j = null; try { j = JSON.parse(t); } catch {}
85. return { status: r.status, j, t };
86. }
87. // log in over the emit API (for the non-browser parts): answers the cookie; the account's
88. // identities (oldest first; ids are mpackdb UUIDs since mission 009) land in idsOf[cookie]
89. const idsOf = {};
90. // (mission 010: the code is requested with POST /api/code — no longer a face; the session
91. // cookie comes from the verifyCode frame, which mints it)
92. async function apiLogin(base, dir, email) {
93. const q = await fetch(base + '/api/code', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email }) });
94. if (q.status !== 200) throw new Error('code request failed: ' + q.status + ' ' + await q.text());
95. const v = await emit(base, 'verifyCode', [email, lastCode(dir, email), 'UTC']);
96. if (!v.value || !v.value.account || !v.cookie) throw new Error('api login failed: ' + v.raw);
97. idsOf[v.cookie] = v.value.identities.map(i => i.id);
98. return v.cookie;
99. }
100. // the ids a signed-in page renders in its buttons' value attributes (SSR), in order, once each
101. async function ssrIds(base, path, cookie) {
102. const t = await (await fetch(base + path, { headers: { cookie } })).text();
103. return [...new Set([...t.matchAll(/value="([0-9a-z]{12})"/g)].map(m => m[1]))];
104. }
105. // a login button press + choice over HTTP: answers the one-time code
106. async function codeFor(base, cookie, key, returnUrl, identity) {
107. const l = await fetch(base + '/login?key=' + key + '&return=' + encodeURIComponent(returnUrl), { redirect: 'manual' });
108. const rid = (l.headers.get('location') || '').split('/').pop();
109. const c = await emit(base, 'chooseIdentity', [rid, identity], cookie);
110. if (!c.value || !c.value.url) throw new Error('choose failed: ' + c.raw);
111. return new URL(c.value.url).searchParams.get('ident_code');
112. }
114. const pages = [];
115. async function ready(p) { await p.waitFor('!!window.__hl && window.__hl.socket && window.__hl.socket.readyState === 1', { label: 'hydrated' }); }
116. async function viewport(p, w) {
117. await p.send('Emulation.setDeviceMetricsOverride', { width: w, height: w < 500 ? 844 : 900, deviceScaleFactor: 1, mobile: w < 500 });
118. }
119. async function shot(p, name) {
120. for (const w of [390, 1280]) {
121. await viewport(p, w);
122. await sleep(150);
123. const over = await p.evaluate('document.documentElement.scrollWidth > window.innerWidth');
124. check(`${name} @${w}px: no horizontal overflow`, !over);
125. const { data } = await p.send('Page.captureScreenshot', { format: 'png', captureBeyondViewport: true });
126. writeFileSync(join(SHOTS, `apps-${name}-${w}.png`), Buffer.from(data, 'base64'));
127. }
128. await viewport(p, 1280);
129. }
130. // confirm() answers: the next dialog is accepted (true) or dismissed (false)
131. function onDialogs(p) {
132. p.dialogAnswers = [];
133. p.dialogs = [];
134. p.conn.onEvent((msg) => {
135. if (msg.sessionId !== p.sessionId || msg.method !== 'Page.javascriptDialogOpening') return;
136. p.dialogs.push(msg.params.message);
137. const accept = p.dialogAnswers.length ? p.dialogAnswers.shift() : false;
138. p.send('Page.handleJavaScriptDialog', { accept }).catch(() => {});
139. });
140. }
141. const here = (p) => p.evaluate('location.href');
142. const txt = (p, sel) => p.evaluate(`(document.querySelector(${JSON.stringify(sel)}) || {}).textContent || ''`);
144. async function browserLogin(p, email) {
145. await p.waitForSelector('#email');
146. await ready(p);
147. await p.type('#email', email);
148. await p.click('#sendcode');
149. // ident#20: a sent code navigates to the code page (/code, /signin/<rid>/code)
150. await p.waitFor('/\\/code$/.test(location.pathname) && !!document.querySelector("#code")', { label: 'code page' });
151. await ready(p);
152. await p.type('#code', lastCode('main', email));
153. await p.click('#verify');
154. }
155. // ident#20: a REAL reload (Page.reload), then hydrated
156. async function reload(p) {
157. p._loaded = false;
158. await p.send('Page.reload', { ignoreCache: false });
159. const deadline = Date.now() + 15000;
160. while (!p._loaded && Date.now() < deadline) await sleep(25);
161. if (!p._loaded) throw new Error('reload: load event never fired');
162. await ready(p);
163. }
165. let browser1, browser2;
166. try {
167. browser1 = await launchBrowser({ debugPortRange: CHROME_PORTS });
168. browser2 = await launchBrowser({ debugPortRange: CHROME_PORTS });
169. const p = await browser1.newPage(); pages.push(p); onDialogs(p);
170. await viewport(p, 1280);
172. // ==== 1. sign in to ident, register two apps ==========================================
173. console.log('# apps: register, list, secret shown once');
174. const ALICE = '[email protected]';
175. await p.goto(ID + '/apps');
176. check('signed out /apps asks to sign in', /sign in/i.test(await txt(p, '#signinfirst')));
177. await p.goto(ID + '/');
178. await browserLogin(p, ALICE);
179. await p.waitForSelector('#skip');
180. await p.click('#skip');
181. await p.waitFor('!document.querySelector("#identityform")');
182. await p.goto(ID + '/apps');
183. await p.waitForSelector('#newapp'); await ready(p);
184. check('no apps yet', /No apps yet/.test(await txt(p, '#noapps')));
185. const register = async (name, origins) => {
186. await p.click('#newapp');
187. await p.waitForSelector('#appform');
188. await p.type('#fappname', name);
189. await p.type('#forigins', origins);
190. await p.click('#saveapp');
191. await p.waitFor('!!document.querySelector("#secret") || /\\S/.test(document.querySelector("#message").textContent)');
192. };
193. // a bad origin first: refused, named
194. await register('Bad', 'http://127.0.0.1:8372/callback');
195. check('origin with a path refused', /no path/.test(await txt(p, '#message')), await txt(p, '#message'));
196. await p.click('#cancelapp');
197. await register('Test app A', 'http://127.0.0.1:8372');
198. const secretA = (await txt(p, '#secret')).trim();
199. check('secret shown after register (sk_ + 48 hex)', /^sk_[0-9a-f]{48}$/.test(secretA), secretA);
200. const keyA = (await txt(p, '#apps li:nth-child(1) .apikey')).trim();
201. check('API key listed (pk_ + 32 hex)', /^pk_[0-9a-f]{32}$/.test(keyA), keyA);
202. await shot(p, 'secret');
203. await p.click('#secretdone');
204. await p.waitFor('!document.querySelector("#secretbox")');
205. await p.goto(ID + '/apps'); await ready(p);
206. check('secret not shown again after reload', !(await p.evaluate('document.body.textContent.includes(' + JSON.stringify(secretA) + ')')));
207. await register('Test app B', 'http://127.0.0.1:8373, http://localhost:8373');
208. const secretB = (await txt(p, '#secret')).trim();
209. const keyB = (await txt(p, '#apps li:nth-child(2) .apikey')).trim();
210. check('second app: own key and secret', keyB !== keyA && secretB !== secretA && /^pk_/.test(keyB));
211. check('origins listed', (await txt(p, '#apps li:nth-child(2)')).includes('http://127.0.0.1:8373 http://localhost:8373'));
212. await p.click('#secretdone');
213. await shot(p, 'list');
214. // edit: rename B and keep one origin
215. await p.click('#apps li:nth-child(2) .edit');
216. await p.waitForSelector('#appform');
217. check('edit form filled', (await p.evaluate('document.querySelector("#forigins").value')) === 'http://127.0.0.1:8373 http://localhost:8373');
218. await p.type('#fappname', 'Test app B2', { clear: true });
219. await p.type('#forigins', 'http://127.0.0.1:8373', { clear: true });
220. await p.click('#saveapp');
221. await p.waitFor('/App saved/.test(document.querySelector("#notice").textContent)');
222. const bRow = await txt(p, '#apps li:nth-child(2)');
223. check('edit saved (name, origins, key unchanged)', bRow.includes('Test app B2') && !bRow.includes('localhost') && bRow.includes(keyB), bRow);
225. // ==== 2. the test apps are set up with key + secret ===================================
226. console.log('# test app setup');
227. const setupApp = async (base, key, secret) => {
228. await p.goto(base + '/');
229. await p.type('#key', key, { clear: true });
230. await p.type('#secret', secret, { clear: true });
231. await p.evaluate('window.__old = 1');
232. await p.click('#savesetup');
233. await p.waitFor('!window.__old && document.readyState === "complete" && (!!document.querySelector("#login") || !!document.querySelector("#result"))', { label: 'setup saved' });
234. check('test app ' + base + ' saved key + secret', (await txt(p, '#setupkey')) === key, await txt(p, 'body'));
235. };
236. await setupApp(TA, keyA, secretA);
237. check('test app A set up', (await txt(p, '#setupkey')) === keyA);
238. await setupApp(TB, keyB, secretB);
240. // ==== 3. the login button, signed in already, one identity ============================
241. console.log('# login button: signed in, one identity');
242. const pressLogin = async (base) => {
243. await p.goto(base + '/');
244. await p.click('#login');
245. await p.waitFor('location.pathname.startsWith("/signin/") && !!document.querySelector("#apprequest")', { label: 'ident sign-in page' });
246. await ready(p);
247. };
248. const chooseAndReturn = async (nth, base) => {
249. await p.waitForSelector('#chooselist');
250. await p.click(`#chooselist li:nth-child(${nth}) .choose`);
251. await p.waitFor(`location.href.startsWith(${JSON.stringify(base + '/callback')}) && !!document.querySelector("#result")`, { label: 'back at the app' });
252. return { identity: (await txt(p, '#identity')).trim(), state: await txt(p, '#userstate'), answer: await txt(p, '#answer'), result: await txt(p, '#result') };
253. };
254. await pressLogin(TA);
255. check('ident names the app and its origin', (await txt(p, '#appname')) === 'Test app A' && (await txt(p, '#apporigin')) === 'http://127.0.0.1:8372');
256. check('one identity: still shown, one choice', (await p.evaluate('document.querySelectorAll("#chooselist li").length')) === 1 && (await txt(p, '#chooselist li')).includes('Default'));
257. check('identities management not shown on the app page', !(await p.evaluate('!!document.querySelector("#identitiessection")')));
258. await shot(p, 'choose-one');
259. const a1 = await chooseAndReturn(1, TA);
260. check('back at test app A with an identity id', /^[2-9a-hj-km-np-z]{5}$/.test(a1.identity), JSON.stringify(a1));
261. check('the app got ONLY the id (no email, no names)', a1.answer === JSON.stringify({ identity: a1.identity }), a1.answer);
262. check('test app: new user', a1.state === 'new user');
263. await shot(p, 'testapp-result');
264. await pressLogin(TA);
265. const a2 = await chooseAndReturn(1, TA);
266. check('same identity, same app → same id', a2.identity === a1.identity && a2.state === 'welcome back', JSON.stringify(a2));
267. await pressLogin(TB);
268. const b1 = await chooseAndReturn(1, TB);
269. check('same identity, second app → the SAME id (ident#23)', b1.identity === a1.identity, JSON.stringify([a1.identity, b1.identity]));
271. // ==== 4. two identities: the choice matters ============================================
272. console.log('# two identities');
273. await p.goto(ID + '/'); await ready(p);
274. await p.click('#newidentity');
275. await p.waitForSelector('#identityform');
276. await p.type('#fidentityname', 'Work');
277. await p.click('#saveidentity');
278. await p.waitFor('document.querySelectorAll("#identities li").length === 2');
279. await pressLogin(TA);
280. check('two identities offered', (await p.evaluate('document.querySelectorAll("#chooselist li").length')) === 2);
281. await shot(p, 'choose-two');
282. const aWork = await chooseAndReturn(2, TA);
283. check('other identity, same app → other id', /^[2-9a-hj-km-np-z]{5}$/.test(aWork.identity) && aWork.identity !== a1.identity && aWork.state === 'new user', JSON.stringify(aWork));
284. await pressLogin(TA);
285. const aDef = await chooseAndReturn(1, TA);
286. check('first identity again → its old id', aDef.identity === a1.identity);
288. // ==== 5. signed out: ident login first, then the choice ===============================
289. console.log('# login button: signed out');
290. const q = await browser2.newPage(); pages.push(q); onDialogs(q);
291. await viewport(q, 1280);
292. await q.goto(TB + '/');
293. await q.click('#login');
294. await q.waitFor('location.pathname.startsWith("/signin/") && !!document.querySelector("#email")', { label: 'ident login for the app' });
295. check('signed out: login form under the app banner', (await txt(q, '#apprequest')).includes('Test app B2'));
296. await shot(q, 'signin-for-app');
297. const BOB = '[email protected]';
298. // ident#20 (mission 032): the app login's code step is the page /signin/<rid>/code and
299. // survives a reload; the code entered after it signs in and the app flow completes
300. await ready(q);
301. const ridPath = await q.evaluate('location.pathname');
302. await q.type('#email', BOB);
303. await q.click('#sendcode');
304. await q.waitFor(`location.pathname === ${JSON.stringify(ridPath + '/code')} && !!document.querySelector("#code")`, { label: 'app code page' });
305. await ready(q);
306. check('ident#20: app login: "Send me a code" → /signin/<rid>/code with the code form', /^\/signin\/[0-9a-f]{32}\/code$/.test(await q.evaluate('location.pathname')) && (await txt(q, '#sentto strong')) === BOB, await q.evaluate('location.pathname'));
307. await reload(q);
308. check('ident#20: app login: RELOAD of /signin/<rid>/code → code form for bob, still under the app banner', (await q.evaluate('location.pathname')) === ridPath + '/code' && (await txt(q, '#sentto strong')) === BOB && !!(await q.evaluate('!!document.querySelector("#code") && !document.querySelector("#email")')) && (await txt(q, '#apprequest')).includes('Test app B2'), await txt(q, 'ident-card'));
309. await shot(q, 'code-for-app-reloaded');
310. await q.type('#code', lastCode('main', BOB));
311. await q.click('#verify');
312. // a first login: the optional names come first, then the choice
313. await q.waitForSelector('#welcome');
314. check('ident#20: app login: signed in after the reload, address bar back on /signin/<rid>', (await q.evaluate('location.pathname')) === ridPath, await q.evaluate('location.pathname'));
315. check('first login via an app: optional names first', /optional/.test(await txt(q, '#welcome')) && !(await q.evaluate('!!document.querySelector("#chooselist")')));
316. await q.click('#skip');
317. await q.waitForSelector('#chooselist');
318. await q.click('#chooselist li:nth-child(1) .choose');
319. await q.waitFor(`location.href.startsWith(${JSON.stringify(TB + '/callback')}) && !!document.querySelector("#identity")`);
320. const bob = (await txt(q, '#identity')).trim();
321. check('another account → another id', /^[2-9a-hj-km-np-z]{5}$/.test(bob) && bob !== b1.identity && bob !== a1.identity);
322. // an existing account signs in via the app: no names form, straight to the choice
323. await q.goto(ID + '/'); await ready(q);
324. await q.click('#signout');
325. await q.waitForSelector('#email');
326. await q.goto(TB + '/');
327. await q.click('#login');
328. await q.waitFor('!!document.querySelector("#email")');
329. // ident#20: "Other address" on the app's code page → back to /signin/<rid>, the email form
330. await ready(q);
331. const ridPath2 = await q.evaluate('location.pathname');
332. await q.type('#email', '[email protected]');
333. await q.click('#sendcode');
334. await q.waitFor(`location.pathname === ${JSON.stringify(ridPath2 + '/code')} && !!document.querySelector("#back")`, { label: 'app code page 2' });
335. await ready(q);
336. await q.click('#back');
337. await q.waitFor(`location.pathname === ${JSON.stringify(ridPath2)} && !!document.querySelector("#email")`, { label: 'back to the app sign-in' });
338. check('ident#20: app login: "Other address" → /signin/<rid> email form under the app banner', (await txt(q, '#apprequest')).includes('Test app B2') && !(await q.evaluate('!!document.querySelector("#code")')));
339. await reload(q);
340. check('ident#20: app login: … and a reload stays on the email form', (await q.evaluate('location.pathname')) === ridPath2 && (await q.evaluate('!!document.querySelector("#email") && !document.querySelector("#code")')));
341. await q.goto(ID + ridPath2 + '/code');
342. await q.waitForSelector('#email');
343. check('ident#20: app login: /signin/<rid>/code with nothing pending → back to /signin/<rid>', (await q.evaluate('location.pathname')) === ridPath2);
344. await browserLogin(q, BOB);
345. await q.waitForSelector('#chooselist');
346. check('known account: straight to the choice (no names form)', !(await q.evaluate('!!document.querySelector("#welcome")')));
347. await q.click('#chooselist li:nth-child(1) .choose');
348. await q.waitFor(`!!document.querySelector("#identity")`);
349. check('after an OTP login: same id as before', (await txt(q, '#identity')).trim() === bob);
351. // ==== 6. the login button refuses: error page, never a redirect =======================
352. console.log('# login button negatives');
353. const badLogin = async (qs, re, label) => {
354. const before = p.messages.length;
355. await p.goto(ID + '/login' + qs);
356. const url = await here(p);
357. const msg = await txt(p, '#errormessage');
358. check(label + ' → error page, no redirect', url.startsWith(ID + '/login') && re.test(msg), url + ' | ' + msg);
359. p.messages.splice(before); // the page's own 400 is expected in the console
360. };
361. await badLogin('?key=' + keyA + '&return=' + encodeURIComponent('http://evil.example.org/callback'), /not one of the origins/, 'foreign origin');
362. await badLogin('?key=' + keyA + '&return=' + encodeURIComponent('http://127.0.0.1:8373/callback'), /not one of the origins/, "the other app's origin");
363. await badLogin('?key=' + keyA + '&return=' + encodeURIComponent('http://127.0.0.1:[email protected]/'), /not one of the origins/, 'user@host trick');
364. await badLogin('?key=' + keyA + '&return=' + encodeURIComponent('javascript:alert(1)'), /http/, 'javascript: URL');
365. await badLogin('?key=' + keyA, /missing/, 'no return URL');
366. await badLogin('?key=pk_00000000000000000000000000000000&return=' + encodeURIComponent(TA + '/callback'), /no app has this API key/, 'unknown key');
367. await badLogin('?return=' + encodeURIComponent(TA + '/callback'), /missing/, 'no key');
368. const res = await fetch(ID + '/login?key=' + keyA + '&return=' + encodeURIComponent('http://evil.example.org/'), { redirect: 'manual' });
369. check('foreign origin: HTTP 400, no Location', res.status === 400 && !res.headers.get('location'), res.status + ' ' + res.headers.get('location'));
370. await shot(p, 'error');
371. await p.goto(ID + '/signin/0123456789abcdef0123456789abcdef');
372. check('unknown request id → "expired" page', /unknown or expired/.test(await txt(p, '#badrequest')));
374. // ==== 7. the exchange ==================================================================
375. console.log('# exchange');
376. const aliceCookie = await apiLogin(ID, 'main', ALICE);
377. const aliceId = idsOf[aliceCookie][0]; // her default (oldest) identity
378. check('ids: identity ids are 12-char mpackdb UUIDs', idsOf[aliceCookie].length >= 1 && idsOf[aliceCookie].every(i => /^[0-9a-z]{12}$/.test(i)), JSON.stringify(idsOf[aliceCookie]));
379. let code = await codeFor(ID, aliceCookie, keyA, TA + '/callback', aliceId);
380. let r = await exchange(ID, { key: keyA, secret: secretB, code });
381. check('wrong secret → 401', r.status === 401, r.t);
382. r = await exchange(ID, { key: 'pk_x', secret: secretA, code });
383. check('unknown key → 401', r.status === 401, r.t);
384. r = await exchange(ID, { key: keyA, secret: secretA, code });
385. check('right key + secret → 200 { identity } only', r.status === 200 && JSON.stringify(Object.keys(r.j)) === '["identity"]' && r.j.identity === a1.identity, r.t);
386. r = await exchange(ID, { key: keyA, secret: secretA, code });
387. check('reused code → 400', r.status === 400 && /already used/.test(r.j.error), r.t);
388. code = await codeFor(ID, aliceCookie, keyA, TA + '/callback', aliceId);
389. r = await exchange(ID, { key: keyB, secret: secretB, code });
390. check("other app's code → 400", r.status === 400 && /not issued to this app/.test(r.j.error), r.t);
391. r = await exchange(ID, { key: keyA, secret: secretA, code });
392. check('a code shown to the wrong app is spent → 400', r.status === 400, r.t);
393. r = await exchange(ID, { key: keyA, secret: secretA, code: 'nope' });
394. check('unknown code → 400', r.status === 400, r.t);
395. r = await exchange(ID, '{"key": "x",');
396. check('invalid JSON → 400', r.status === 400 && /not valid JSON/.test(r.j.error), r.t);
397. r = await exchange(ID, '[1]');
398. check('not an object → 400', r.status === 400 && /object/.test(r.j.error), r.t);
399. r = await exchange(ID, { key: keyA, secret: secretA });
400. check('missing field → 400 naming it', r.status === 400 && r.j.error === 'missing field: code', r.t);
401. r = await exchange(ID, { key: keyA, secret: secretA, code: 'x', email: 'x' });
402. check('unknown field → 400 naming it', r.status === 400 && r.j.error === 'unknown field: email', r.t);
403. r = await exchange(ID, { key: keyA, secret: secretA, code: 5 });
404. check('wrong type → 400 naming it', r.status === 400 && /field code must be a string/.test(r.j.error), r.t);
405. r = await exchange(ID, '{"key":"\\ud83d\\ude00","secret":"a","code":"b"}');
406. check('surrogate escape → 400 (not 500)', r.status === 400, r.t);
407. const g = await fetch(ID + '/api/exchange');
408. check('GET /api/exchange → 405', g.status === 405);
409. // expiry, on the short-clock server (grant TTL 1.5 s)
410. const sc = await apiLogin(IDS, 'short', '[email protected]');
411. const sApp = (await emit(IDS, 'appCreate', [{ name: 'S', origins: [TA] }], sc)).value;
412. const sCode = await codeFor(IDS, sc, sApp.app.apiKey, TA + '/callback', idsOf[sc][0]);
413. await sleep(2000);
414. r = await exchange(IDS, { key: sApp.app.apiKey, secret: sApp.secret, code: sCode });
415. check('expired code → 400', r.status === 400 && /expired/.test(r.j.error), r.t);
416. const sCode2 = await codeFor(IDS, sc, sApp.app.apiKey, TA + '/callback', idsOf[sc][0]);
417. r = await exchange(IDS, { key: sApp.app.apiKey, secret: sApp.secret, code: sCode2 });
418. check('fresh code on the short server → 200', r.status === 200, r.t);
420. // ==== 8. faces: forged sessions (#31), strict fields, other accounts ==================
421. console.log('# faces');
422. const forged = { user: { id: 1 } };
423. for (const [ev, args] of [['appCreate', [{ name: 'X', origins: [TA] }]], ['appUpdate', [1, { name: 'X', origins: [TA] }]], ['appNewSecret', [1]], ['appDelete', [1]], ['chooseIdentity', ['x', 1]]]) {
424. const f = await emit(ID, ev, [...args, forged]);
425. check(`forged session argument refused: ${ev}`, framework_refused(f.raw) || (f.value && /not signed in/.test(f.value.error)), f.raw);
426. }
427. let e = await emit(ID, 'appCreate', [{ name: 'X', origins: [TA], secret: 'mine' }], aliceCookie);
428. check('appCreate unknown field → named', e.value.error === 'unknown field: secret' && e.value.field === 'secret', e.raw);
429. e = await emit(ID, 'appCreate', [{ name: 'X' }], aliceCookie);
430. check('appCreate missing origins → named', e.value.field === 'origins', e.raw);
431. e = await emit(ID, 'appCreate', [{ name: '', origins: [TA] }], aliceCookie);
432. check('appCreate empty name refused', e.value.field === 'name', e.raw);
433. e = await emit(ID, 'appCreate', [{ name: 'X', origins: 'http://a.b' }], aliceCookie);
434. check('appCreate origins not a list refused', e.value.field === 'origins', e.raw);
435. e = await emit(ID, 'appCreate', [{ name: 'X', origins: Array.from({ length: 11 }, (_, i) => 'http://h' + i + '.example') }], aliceCookie);
436. check('appCreate 11 origins refused', /at most 10/.test(e.value.error), e.raw);
437. e = await emit(ID, 'appCreate', [{ name: 'X', origins: ['ftp://a.b'] }], aliceCookie);
438. check('appCreate ftp origin refused', e.value.field === 'origins', e.raw);
439. const bobCookie = await apiLogin(ID, 'main', BOB);
440. const aliceApp = (await ssrIds(ID, '/apps', aliceCookie))[0];
441. check('ids: app ids are 12-char mpackdb UUIDs (read off /apps)', /^[0-9a-z]{12}$/.test(aliceApp || ''), JSON.stringify(aliceApp));
442. e = await emit(ID, 'appUpdate', [aliceApp, { name: 'hijack', origins: ['http://evil.example'] }], bobCookie);
443. check("another account cannot edit alice's app", e.value.error === 'no such app', e.raw);
444. e = await emit(ID, 'appNewSecret', [aliceApp], bobCookie);
445. check("another account cannot renew alice's secret", e.value.error === 'no such app', e.raw);
446. e = await emit(ID, 'appDelete', [aliceApp], bobCookie);
447. check("another account cannot delete alice's app", e.value.error === 'no such app', e.raw);
448. const l = await fetch(ID + '/login?key=' + keyA + '&return=' + encodeURIComponent(TA + '/callback'), { redirect: 'manual' });
449. const rid = l.headers.get('location').split('/').pop();
450. e = await emit(ID, 'chooseIdentity', [rid, aliceId], bobCookie);
451. check("choosing another account's identity refused", e.value.error === 'no such identity', e.raw);
452. e = await emit(ID, 'chooseIdentity', [rid, 1], aliceCookie);
453. check('chooseIdentity wrong type (a number, the old ids) refused', /must be a string/.test(e.value.error), e.raw);
454. e = await emit(ID, 'appUpdate', [1, { name: 'X', origins: [TA] }], aliceCookie);
455. check('appUpdate with an old numeric id: no such app', e.value.error === 'no such app', e.raw);
457. // ==== 9. new secret, delete (browser) ==================================================
458. console.log('# new secret, delete');
459. await p.goto(ID + '/apps'); await ready(p);
460. p.dialogAnswers.push(false);
461. await p.click('#apps li:nth-child(1) .newsecret');
462. await sleep(300);
463. check('new secret: dismissed confirm changes nothing', !(await p.evaluate('!!document.querySelector("#secretbox")')) && p.dialogs.length === 1);
464. p.dialogAnswers.push(true);
465. await p.click('#apps li:nth-child(1) .newsecret');
466. await p.waitForSelector('#secret');
467. const secretA2 = (await txt(p, '#secret')).trim();
468. check('new secret shown once, differs', /^sk_[0-9a-f]{48}$/.test(secretA2) && secretA2 !== secretA);
469. await p.click('#secretdone');
470. code = await codeFor(ID, aliceCookie, keyA, TA + '/callback', aliceId);
471. r = await exchange(ID, { key: keyA, secret: secretA, code });
472. check('old secret → 401 after renewal', r.status === 401, r.t);
473. r = await exchange(ID, { key: keyA, secret: secretA2, code });
474. check('new secret works, same id', r.status === 200 && r.j.identity === a1.identity, r.t);
475. // the test app still has the old secret: its exchange fails visibly
476. await pressLogin(TA);
477. await p.click('#chooselist li:nth-child(1) .choose');
478. const beforeOld = p.messages.length;
479. await p.waitFor('!!document.querySelector("#result")');
480. await sleep(300);
481. p.messages.splice(beforeOld); // the test app's own 400 page is expected
482. check('test app with the old secret: exchange refused (401)', (await txt(p, '#status')) === '401', await txt(p, '#result'));
483. await setupApp(TA, keyA, secretA2);
484. await pressLogin(TA);
485. const a3 = await chooseAndReturn(1, TA);
486. check('test app with the new secret: logged in, same id', a3.identity === a1.identity, JSON.stringify(a3));
487. // delete app B
488. await p.goto(ID + '/apps'); await ready(p);
489. p.dialogAnswers.push(true);
490. await p.click('#apps li:nth-child(2) .delete');
491. await p.waitFor('document.querySelectorAll("#apps li").length === 1');
492. check('app deleted from the list', !(await txt(p, '#apps')).includes('Test app B2'));
493. await badLogin('?key=' + keyB + '&return=' + encodeURIComponent(TB + '/callback'), /no app has this API key/, 'deleted app key');
495. // ==== 10. console ======================================================================
496. const probs = pages.flatMap(x => x.problems().map(m => m.text));
497. check('no console errors or warnings', probs.length === 0, probs.join(' | '));
498. } catch (err) {
499. failed++;
500. console.log(' FAIL (aborted) ' + (err && err.stack || err));
501. for (const x of pages) console.log('--- console:\n' + x.dumpConsole());
502. } finally {
503. for (const b of [browser1, browser2]) { if (b) { try { await b.close(); } catch {} } }
504. stopAll();
505. await sleep(300);
506. }
507. console.log(`\n${passed} passed, ${failed} failed`);
508. process.exit(failed ? 1 : 0);