ident

15.5 KB

1. // tests/invites.mjs — THE GATE OF THE INVITE SERVICE (ticket ident#22): an app invites people
2. // by link through ident. Real headless Chrome (tests/cdp.mjs, --disable-gpu) opens the links;
3. // the API parts run over HTTP. Own servers only, NEVER the dev server, NEVER real mail:
4. // ident :8700 (IDENT_MAIL_SINK, a "day" of 3 s so an invite expires within the run),
5. // test app :8701 (the app of the invites, against ident :8700).
6. // Own storage: .scratch/invites-gate/ (wiped at start). Chrome debug ports 8706-8709.
7. //
8. // Run: node tests/invites.mjs (exit 0 = all passed)
9. import { spawn } from 'node:child_process';
10. import { readFileSync, writeFileSync, rmSync, mkdirSync, existsSync } from 'node:fs';
11. import { dirname, join } from 'node:path';
12. import { fileURLToPath } from 'node:url';
13. import { launchBrowser, sleep } from './cdp.mjs';
15. const APP = join(dirname(fileURLToPath(import.meta.url)), '..');
16. const G = join(APP, '.scratch/invites-gate');
17. const ID = 'http://127.0.0.1:8700', TA = 'http://127.0.0.1:8701';
19. let passed = 0, failed = 0;
20. const check = (name, ok, detail = '') => {
21. if (ok) { passed++; console.log(' ok ' + name); }
22. else { failed++; console.log(' FAIL ' + name + (detail ? ' — ' + detail : '')); }
23. };
25. const procs = [];
26. function start(cwd, env, log) {
27. const p = spawn(join(APP, 'bin/hybriel'), ['project.hl'], { cwd, env: { ...process.env, SMTP_HOST: '', SMTP_USER: '', SMTP_PASSWORD: '', ...env }, stdio: ['ignore', 'pipe', 'pipe'] });
28. let out = '';
29. p.stdout.on('data', d => { out += d; }); p.stderr.on('data', d => { out += d; });
30. p.on('exit', () => writeFileSync(join(G, log), out));
31. procs.push(p);
32. }
33. async function up(url) {
34. for (let i = 0; i < 80; i++) { try { await fetch(url + '/', { redirect: 'manual' }); return; } catch {} await sleep(250); }
35. throw new Error('server did not come up: ' + url);
36. }
37. const stopAll = () => { for (const p of procs) { try { p.kill(); } catch {} } };
39. rmSync(G, { recursive: true, force: true });
40. mkdirSync(join(G, 'ident'), { recursive: true });
41. start(APP, { IDENT_PORT: '8700', IDENT_STORAGE: join(G, 'ident'), IDENT_SESSIONS: join(G, 'sess') + '/', IDENT_MAIL_SINK: join(G, 'mail.txt'), IDENT_IP_LIMIT: '1000', IDENT_IP_DAY_LIMIT: '1000', IDENT_INVITE_DAY_MS: '3000', IDENT_INVITE_MAIL_LIMIT: '3' }, 'ident.log');
42. await up(ID);
44. const lastCode = (email) => {
45. const f = join(G, 'mail.txt');
46. const lines = existsSync(f) ? readFileSync(f, 'utf8').trim().split('\n').filter(l => l.startsWith(email + ' ')) : [];
47. return lines.length ? lines[lines.length - 1].split(' ')[1] : null;
48. };
49. const inviteMails = () => { const f = join(G, 'mail.txt.invites'); return existsSync(f) ? readFileSync(f, 'utf8').trim().split('\n').filter(Boolean) : []; };
50. let emitI = 0;
51. async function emit(event, payload, cookie) {
52. const r = await fetch(ID + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', ...(cookie ? { cookie } : {}) }, body: JSON.stringify({ t: 'emit', i: ++emitI, event, payload }) });
53. const t = await r.text();
54. let j = null; try { j = JSON.parse(t); } catch {}
55. return { cookie: (r.headers.get('set-cookie') || '').split(';')[0], value: j && j.value, raw: t };
56. }
57. async function post(path, body, base = ID) {
58. const r = await fetch(base + path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: typeof body === 'string' ? body : JSON.stringify(body) });
59. const t = await r.text();
60. let j = null; try { j = JSON.parse(t); } catch {}
61. return { status: r.status, j, t };
62. }
64. // the app's owner: an ident account + the app (over the faces)
65. await post('/api/code', { email: '[email protected]' });
66. const own = await emit('verifyCode', ['[email protected]', lastCode('[email protected]'), 'UTC']);
67. const created = (await emit('appCreate', [{ name: 'Demo tickets', origins: [TA] }], own.cookie)).value;
68. const KEY = created.app.apiKey, SECRET = created.secret;
69. writeFileSync(join(G, 'testapp.json'), JSON.stringify({ key: KEY, secret: SECRET, users: {}, count: 0, sessions: {} }));
70. start(join(APP, 'testapp'), { TESTAPP_PORT: '8701', TESTAPP_URL: TA, IDENT_URL: ID, TESTAPP_STORE: join(G, 'testapp.json') }, 'testapp.log');
71. await up(TA);
72. const A = { key: KEY, secret: SECRET };
73. const mk = (extra = {}) => post('/api/invites', { ...A, project: 'Website', role: 'editor', return: TA + '/callback', ...extra });
74. const idOf = (invId) => post('/api/invites/get', { ...A, id: invId });
76. let br;
77. try {
78. // ---- the API: negatives -----------------------------------------------------------------
79. console.log('API');
80. let r = await post('/api/invites', { ...A, key: 'pk_' + '0'.repeat(32), project: 'p', role: 'r', return: TA + '/callback' });
81. check('unknown key → 401', r.status === 401, r.t);
82. r = await post('/api/invites', { ...A, secret: 'sk_' + '0'.repeat(48), project: 'p', role: 'r', return: TA + '/callback' });
83. check('wrong secret → 401', r.status === 401, r.t);
84. r = await mk({ bogus: 1 });
85. check('unknown field → 400 naming it', r.status === 400 && /unknown field: bogus/.test(r.j.error), r.t);
86. r = await post('/api/invites', { ...A, project: 'p', role: 'r' });
87. check('missing return → 400 naming it', r.status === 400 && /missing field: return/.test(r.j.error), r.t);
88. r = await mk({ return: 'http://evil.example/cb' });
89. check('return outside the app origins → 400', r.status === 400 && /not one of the origins/.test(r.j.error), r.t);
90. r = await mk({ uses: 0 });
91. check('uses 0 → 400', r.status === 400 && /uses/.test(r.j.error), r.t);
92. r = await mk({ days: 1.5 });
93. check('days 1.5 → 400', r.status === 400 && /days/.test(r.j.error), r.t);
94. r = await mk({ email: 'nope' });
95. check('bad email → 400', r.status === 400 && /email/.test(r.j.error), r.t);
96. r = await mk({ role: '' });
97. check('empty role → 400', r.status === 400 && /role/.test(r.j.error), r.t);
98. r = await fetch(ID + '/api/invites');
99. check('GET on the create call → 405', r.status === 405);
100. r = await fetch(ID + '/invite/' + '0'.repeat(32), { redirect: 'manual' });
101. check('unknown link → 404 error page', r.status === 404 && /not valid/.test(await r.text()));
103. // ---- 1. a new address: email → code → back in the app ------------------------------------
104. console.log('new person, private window');
105. r = await mk({ days: 90 });
106. check('create → 200 with link, single use, open', r.status === 200 && /\/invite\/[0-9a-f]{32}$/.test(r.j.url) && r.j.uses === 1 && r.j.state === 'open' && r.j.url.startsWith(ID), r.t);
107. const inv1 = r.j;
108. br = await launchBrowser({ debugPortRange: [8706, 8709] });
109. const p = await br.newPage();
110. await p.send('Emulation.setTimezoneOverride', { timezoneId: 'Europe/Vienna' });
111. await p.goto(inv1.url);
112. await p.waitFor('!!window.__hl && window.__hl.socket && window.__hl.socket.readyState === 1', { label: 'hydrated' });
113. check('link → ident sign-in for the app, worded as an invitation', /You are invited to\s*Demo tickets/.test(await p.text('#apprequest')), await p.text('#apprequest'));
114. await p.type('#email', '[email protected]');
115. await p.click('#sendcode');
116. await p.waitFor('!!document.querySelector("#code")', { label: 'code form' });
117. await p.type('#code', lastCode('[email protected]'));
118. await p.click('#verify');
119. await p.waitFor('!!document.querySelector("#skip")', { label: 'welcome form' });
120. await p.click('#skip');
121. await p.waitFor('!!document.querySelector("#chooselist .choose")', { label: 'choose list' });
122. await p.click('#chooselist .choose');
123. await p.waitFor('!!document.querySelector("#invite")', { label: 'back in the app', timeout: 15000 });
124. check('back in the app: invite reports used, accepted by the logged-in identity', (await p.text('#invitestate')) === 'used' && (await p.text('#invitewho')) === 'this identity', await p.text('#invite'));
125. check('the invite carries its project and role', (await p.text('#inviteproject')) === 'Website' && (await p.text('#inviterole')) === 'editor');
126. const g = await idOf(inv1.id);
127. check('get: used 1 of 1, one identity, state used', g.j.invite.state === 'used' && g.j.invite.used === 1 && g.j.invite.identities.length === 1 && /^[2-9a-hj-km-np-z]{5}$/.test(g.j.invite.identities[0]), g.t);
128. check('the answer never contains the link or an email', !/newbie|invite\//.test(g.t));
130. // ---- 2. the same link again --------------------------------------------------------------
131. console.log('used, revoked, expired');
132. const again = await fetch(inv1.url, { redirect: 'manual' });
133. const againText = await again.text();
134. check('the same link again → "already used"', again.status === 410 && /already used/.test(againText), again.status + againText.slice(0, 80));
135. r = await mk();
136. const inv2 = r.j;
137. r = await post('/api/invites/revoke', { ...A, id: inv2.id });
138. check('revoke an open invite → revoked', r.status === 200 && r.j.invite.state === 'revoked', r.t);
139. const rv = await fetch(inv2.url, { redirect: 'manual' });
140. check('a revoked link → "withdrawn"', rv.status === 410 && /withdrawn/.test(await rv.text()));
141. r = await post('/api/invites/revoke', { ...A, id: inv1.id });
142. check('revoking a used invite is refused (409)', r.status === 409, r.t);
143. r = await mk({ days: 1 });
144. const inv3 = r.j;
145. await sleep(3300);
146. const ex = await fetch(inv3.url, { redirect: 'manual' });
147. check('an expired link → "expired"', ex.status === 410 && /expired/.test(await ex.text()));
148. check('get: state expired', (await idOf(inv3.id)).j.invite.state === 'expired');
150. // ---- 3. already logged in to ident: one click --------------------------------------------
151. console.log('logged in to ident already');
152. r = await mk({ days: 90 });
153. const inv4 = r.j;
154. await p.goto(inv4.url);
155. await p.waitFor('!!document.querySelector("#chooselist .choose")', { label: 'choose list (signed in)' });
156. check('signed in: no email step, only the identity choice', !(await p.evaluate('!!document.querySelector("#email")')));
157. await p.click('#chooselist .choose');
158. await p.waitFor('!!document.querySelector("#invite")', { label: 'back in the app', timeout: 15000 });
159. check('one click → back in the app, invite used', (await p.text('#invitestate')) === 'used');
160. const g4 = await idOf(inv4.id);
161. check('the same identity accepted both invites (one id per app)', g4.j.invite.identities[0] === g.j.invite.identities[0]);
163. // ---- 4. several uses, list ---------------------------------------------------------------
164. console.log('two uses, list');
165. r = await mk({ uses: 2, project: 'Docs', days: 90 });
166. const inv5 = r.j;
167. const accept = async () => {
168. const q = await fetch(inv5.url, { redirect: 'manual' });
169. const rid = (q.headers.get('location') || '').split('/').pop();
170. return { q, rid };
171. };
172. const a1 = await accept();
173. check('open invite → 302 to the sign-in of the app', a1.q.status === 302 && /^\/signin\/[0-9a-f]{32}$/.test(a1.q.headers.get('location')));
174. // two different people accept it over the faces
175. const people = [];
176. for (const e of ['[email protected]', '[email protected]', '[email protected]']) {
177. await post('/api/code', { email: e });
178. const v = await emit('verifyCode', [e, lastCode(e), 'UTC']);
179. people.push({ cookie: v.cookie, ident: v.value.identities[0].id });
180. }
181. const choose = async (who, rid) => (await emit('chooseIdentity', [rid, who.ident], who.cookie)).value;
182. let c1 = await choose(people[0], a1.rid);
183. check('first person accepts → return URL with ident_code and invite', !!c1.url && c1.url.includes('ident_code=') && c1.url.includes('invite=' + inv5.id), JSON.stringify(c1));
184. const a2 = await accept();
185. let c2 = await choose(people[1], a2.rid);
186. check('second person accepts', !!c2.url, JSON.stringify(c2));
187. const a3 = await fetch(inv5.url, { redirect: 'manual' });
188. check('third opening: used up → "already used"', a3.status === 410 && /already used/.test(await a3.text()));
189. const g5 = await idOf(inv5.id);
190. check('get: used 2 of 2 with two different identities', g5.j.invite.used === 2 && g5.j.invite.uses === 2 && g5.j.invite.identities[0] !== g5.j.invite.identities[1], g5.t);
191. // a request parked BEFORE the last use, accepted AFTER it, is refused with a clear message
192. r = await mk({ uses: 1, days: 90 });
193. const inv6 = r.j;
194. const early = (await fetch(inv6.url, { redirect: 'manual' })).headers.get('location').split('/').pop();
195. const early2 = (await fetch(inv6.url, { redirect: 'manual' })).headers.get('location').split('/').pop();
196. const ok1 = await choose(people[0], early);
197. const bad = await choose(people[2], early2);
198. check('two parked requests, one use: first wins, second told "already used"', !!ok1.url && bad.error && /already used/.test(bad.error), JSON.stringify([ok1, bad]));
199. r = await post('/api/invites/list', { ...A });
200. check('list: all invites of the app with states', r.status === 200 && r.j.invites.length === 6 && r.j.invites.some(i => i.state === 'revoked') && r.j.invites.some(i => i.state === 'expired') && r.j.invites.some(i => i.state === 'used'), r.t);
201. r = await post('/api/invites/list', { ...A, project: 'Docs' });
202. check('list narrowed to a project', r.j.invites.length === 1 && r.j.invites[0].project === 'Docs');
203. const other = await post('/api/invites/get', { ...A, id: 'nonexistent1' });
204. check('get an unknown id → 404', other.status === 404);
206. // ---- 5. mail through ident's mailer ------------------------------------------------------
207. console.log('mail');
208. r = await mk({ email: '[email protected]', days: 90 });
209. check('create with an address → mailed', r.status === 200 && r.j.mailed === true, r.t);
210. const mails = inviteMails();
211. check('the mail (sink) holds the address and the very link', mails.length === 1 && mails[0] === '[email protected] ' + r.j.url, JSON.stringify(mails));
212. const mailedLink = r.j.url;
213. await mk({ email: '[email protected]', days: 90 }); await mk({ email: '[email protected]', days: 90 });
214. r = await mk({ email: '[email protected]', days: 90 });
215. check('a 4th mail within the day is refused (429), nothing sent', r.status === 429 && inviteMails().length === 3, r.t);
216. const p2 = await br.newPage();
217. await p2.goto(mailedLink);
218. await p2.waitFor('!!document.querySelector("#apprequest")', { label: 'sign-in from the mailed link' });
219. check('the mailed link opens ident sign-in', /invited to\s*Demo tickets/.test(await p2.text('#apprequest')));
221. // ---- 6. the test app page ----------------------------------------------------------------
222. console.log('the app page');
223. await p2.goto(TA + '/invites');
224. await p2.waitFor('!!document.querySelector("#invites")', { label: 'invites page' });
225. check('the app lists its invites with their state', (await p2.evaluate('document.querySelectorAll("#invites li").length')) >= 9);
226. await p2.type('#iproject', 'FromForm', { clear: true });
227. await p2.click('#create');
228. await p2.waitFor('!!document.querySelector("#link")', { label: 'link shown' });
229. const link = await p2.evaluate('document.querySelector("#link").value');
230. check('the app shows the link and a share link', /\/invite\/[0-9a-f]{32}$/.test(link) && /^mailto:/.test(await p2.evaluate('document.querySelector("#share").getAttribute("href")')), link);
231. await p2.click('#invites li:last-child .revoke');
232. await p2.waitFor('/revoked/.test(document.querySelector("#invites li:last-child .state")?.textContent || "")', { label: 'revoked in the list' });
233. check('the app revokes it from the list', /revoked/.test(await p2.text('#invites li:last-child .state')), await p2.text('#invites li:last-child'));
234. r = await post('/api/invites/list', { ...A, project: 'FromForm' });
235. check('ident agrees: revoked', r.j.invites.length === 1 && r.j.invites[0].state === 'revoked', r.t);
236. } catch (e) {
237. failed++; console.log(' FAIL exception — ' + (e && e.stack || e));
238. } finally {
239. if (br) await br.close();
240. stopAll();
241. console.log(`\n${passed} passed, ${failed} failed`);
242. process.exit(failed ? 1 : 0);
243. }