ident

33.1 KB

1. // tests/selector.mjs — THE GATE OF PIECE 3 (ticket #26): the identity selector. Real
2. // headless Chrome (tests/cdp.mjs, --disable-gpu): signed in to ident on the ident origin →
3. // the test app's page on its own origin shows <ident-selector> with the right identities →
4. // select → one-time code → the test app's server exchanges it → the page switches to
5. // logged in WITHOUT A RELOAD → `logged-in` → host logout resets the selector. Plus the
6. // negatives (unregistered origin, wrong key, signed out, forged sessions #31, code reuse,
7. // strict API) and a host restyle that must change the look.
8. //
9. // Own servers only, NEVER the dev server and NEVER real mail:
10. // ident :8390 (IDENT_MAIL_SINK), test app A :8391, test app B :8392 (both against :8390),
11. // a plain node page on :8393 = an origin NOT registered for any app.
12. // Own storage: .scratch/selector-gate/ (wiped at start). Chrome debug ports 8690-8699.
13. // Screenshots: .scratch/selector-*.png (390 and 1280 px) — look at them.
14. //
15. // Run: node tests/selector.mjs (exit 0 = all passed)
16. import { spawn } from 'node:child_process';
17. import { createServer } from 'node:http';
18. import { readFileSync, writeFileSync, rmSync, mkdirSync, existsSync } from 'node:fs';
19. import { dirname, join } from 'node:path';
20. import { fileURLToPath } from 'node:url';
21. import { launchBrowser, sleep } from './cdp.mjs';
23. if (!process.env.HL_CHROME && existsSync('/opt/google/chrome/chrome')) process.env.HL_CHROME = '/opt/google/chrome/chrome';
24. const APP = join(dirname(fileURLToPath(import.meta.url)), '..');
25. const G = join(APP, '.scratch/selector-gate');
26. const SHOTS = join(APP, '.scratch');
27. const ID = 'http://127.0.0.1:8390';
28. const TA = 'http://127.0.0.1:8391', TB = 'http://127.0.0.1:8392', EVIL = 'http://127.0.0.1:8393';
29. const CHROME_PORTS = [8690, 8699];
30. const J = JSON.stringify;
32. let passed = 0, failed = 0;
33. const check = (name, ok, detail = '') => {
34. if (ok) { passed++; console.log(' ok ' + name); }
35. else { failed++; console.log(' FAIL ' + name + (detail ? ' — ' + detail : '')); }
36. };
38. // ---- servers ----------------------------------------------------------------------------
39. const procs = [];
40. function start(cwd, env, log) {
41. const p = spawn(join(APP, 'bin/hybriel'), ['project.hl'], {
42. cwd, env: { ...process.env, SMTP_HOST: '', SMTP_USER: '', SMTP_PASSWORD: '', ...env },
43. stdio: ['ignore', 'pipe', 'pipe'],
44. });
45. let out = '';
46. p.stdout.on('data', d => { out += d; }); p.stderr.on('data', d => { out += d; });
47. p.on('exit', () => writeFileSync(join(G, log), out));
48. procs.push({ p, log });
49. return p;
50. }
51. async function up(url) {
52. for (let i = 0; i < 80; i++) { try { await fetch(url + '/', { redirect: 'manual' }); return; } catch {} await sleep(250); }
53. throw new Error('server did not come up: ' + url);
54. }
55. rmSync(G, { recursive: true, force: true });
56. mkdirSync(join(G, 'main'), { recursive: true });
57. start(APP, {
58. IDENT_PORT: '8390', IDENT_STORAGE: join(G, 'main', 'ident'), IDENT_SESSIONS: join(G, 'main', 'sess') + '/',
59. IDENT_MAIL_SINK: join(G, 'main', 'mail.txt'), IDENT_IP_LIMIT: '1000', IDENT_IP_DAY_LIMIT: '1000',
60. }, 'ident.log');
61. const testapp = (port, file) => start(join(APP, 'testapp'), {
62. TESTAPP_PORT: String(port), TESTAPP_URL: 'http://127.0.0.1:' + port, IDENT_URL: ID, TESTAPP_STORE: join(G, file),
63. }, 'testapp-' + port + '.log');
64. testapp(8391, 'testapp-a.json'); testapp(8392, 'testapp-b.json');
65. // the UNREGISTERED ORIGIN: a page that includes the selector with app A's key
66. let evilKey = '';
67. const evil = createServer((req, res) => {
68. res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
69. res.end(`<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>not registered</title></head><body style="background:#222;color:#ccc;font:16px system-ui"><p>an origin not registered in ident</p><ident-selector id="selector" key="${evilKey}"></ident-selector><script src="${ID}/selector.js"></script></body></html>`);
70. });
71. await new Promise(r => evil.listen(8393, '127.0.0.1', r));
72. await Promise.all([up(ID), up(TA), up(TB)]);
74. // ---- helpers ----------------------------------------------------------------------------
75. const lastCode = (email) => {
76. const lines = readFileSync(join(G, 'main', 'mail.txt'), 'utf8').trim().split('\n').filter(l => l.startsWith(email + ' '));
77. return lines.length ? lines[lines.length - 1].split(' ')[1] : null;
78. };
79. let emitI = 0;
80. // hybriel#16 (mission 036): hl:web itself refuses an emit with one argument too many — the ack is
81. // ok:false "… the `session` parameter is filled by the server, never by the peer"; the face never runs.
82. const framework_refused = (raw) => { try { const j = JSON.parse(raw); return j.ok === false && /the `session` parameter is filled by the server/.test(j.error || ''); } catch { return false; } };
83. async function emit(event, payload, cookie) {
84. const r = await fetch(ID + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', ...(cookie ? { cookie } : {}) }, body: J({ t: 'emit', i: ++emitI, event, payload }) });
85. const t = await r.text();
86. let j = null; try { j = JSON.parse(t); } catch {}
87. return { status: r.status, value: j && j.value, raw: t };
88. }
89. // a request to ident as a browser on `origin` would send it (node may set Origin)
90. async function call(method, path, { origin, cookie, body, headers = {} } = {}) {
91. const h = { ...headers };
92. if (origin) h.origin = origin;
93. if (cookie) h.cookie = cookie;
94. if (body !== undefined && !h['content-type']) h['content-type'] = 'application/json';
95. const r = await fetch(ID + path, { method, headers: h, body: body === undefined ? undefined : (typeof body === 'string' ? body : J(body)), redirect: 'manual' });
96. const t = await r.text();
97. let j = null; try { j = JSON.parse(t); } catch {}
98. return { status: r.status, j, t, h: r.headers };
99. }
100. async function exchange(body) {
101. const r = await fetch(ID + '/api/exchange', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J(body) });
102. return { status: r.status, j: await r.json().catch(() => null) };
103. }
105. const pages = [];
106. async function ready(p) { await p.waitFor('!!window.__hl && window.__hl.socket && window.__hl.socket.readyState === 1', { label: 'hydrated' }); }
107. async function viewport(p, w) {
108. await p.send('Emulation.setDeviceMetricsOverride', { width: w, height: w < 500 ? 844 : 900, deviceScaleFactor: 1, mobile: w < 500 });
109. }
110. async function shot(p, name) {
111. for (const w of [390, 1280]) {
112. await viewport(p, w);
113. await sleep(200);
114. const over = await p.evaluate('document.documentElement.scrollWidth > window.innerWidth');
115. check(`${name} @${w}px: no horizontal overflow`, !over);
116. const { data } = await p.send('Page.captureScreenshot', { format: 'png', captureBeyondViewport: true });
117. writeFileSync(join(SHOTS, `selector-${name}-${w}.png`), Buffer.from(data, 'base64'));
118. }
119. await viewport(p, 1280);
120. }
121. const txt = (p, sel) => p.evaluate(`(document.querySelector(${J(sel)}) || {}).textContent || ''`);
122. // INSIDE THE SELECTOR'S SHADOW ROOT
123. const sh = (hostSel, expr) => `(() => { const h = document.querySelector(${J(hostSel)}); const r = h && h.shadowRoot; if (!r) return null; return (${expr}); })()`;
124. const shText = (p, inner, host = '#selector') => p.evaluate(sh(host, `(r.querySelector(${J(inner)}) || {}).textContent || ''`));
125. const shNames = (p, host = '#selector') => p.evaluate(sh(host, `[...r.querySelectorAll('[part~="identity"]')].map(b => b.textContent)`));
126. // a REAL click (Input domain) on an element inside the shadow root; `name` picks an
127. // identity button by its text
128. async function shClick(p, inner, { host = '#selector', name = null, timeout = 8000 } = {}) {
129. const find = `(() => { const h = document.querySelector(${J(host)}); const r = h && h.shadowRoot; if (!r) return null; ` +
130. `const el = ${name === null ? `r.querySelector(${J(inner)})` : `[...r.querySelectorAll(${J(inner)})].find(b => b.textContent === ${J(name)})`}; ` +
131. `if (!el) return null; el.scrollIntoView({ block: 'center' }); const b = el.getBoundingClientRect(); if (!b.width) return null; return { x: b.left + b.width / 2, y: b.top + b.height / 2 }; })()`;
132. const box = await p.waitFor(find, { timeout, label: `shadow ${host} ${inner} ${name || ''}` });
133. const base = { x: Math.round(box.x), y: Math.round(box.y), button: 'left', clickCount: 1 };
134. await p.send('Input.dispatchMouseEvent', { type: 'mouseMoved', ...base, buttons: 0 });
135. await p.send('Input.dispatchMouseEvent', { type: 'mousePressed', ...base, buttons: 1 });
136. await p.send('Input.dispatchMouseEvent', { type: 'mouseReleased', ...base, buttons: 0 });
137. }
138. const waitList = (p, host = '#selector') => p.waitFor(sh(host, `r.querySelectorAll('[part~="identity"]').length > 0`), { label: 'identity list in ' + host });
139. const waitMsg = (p, re, host = '#selector') => p.waitFor(sh(host, `/${re}/.test((r.querySelector('#message') || {}).textContent || '')`), { label: 'selector message ' + re });
140. const shStyle = (p, inner, prop) => p.evaluate(sh('#selector', `getComputedStyle(r.querySelector(${J(inner)}))[${J(prop)}]`));
142. let browser1, browser2;
143. try {
144. browser1 = await launchBrowser({ debugPortRange: CHROME_PORTS });
145. browser2 = await launchBrowser({ debugPortRange: CHROME_PORTS });
146. const p = await browser1.newPage(); pages.push(p);
147. await viewport(p, 1280);
149. // ==== 1. sign in to ident (on ident's origin), two identities, two apps ================
150. console.log('# setup: ident account, identities, apps, test apps');
151. const ALICE = '[email protected]';
152. await p.goto(ID + '/');
153. await p.waitForSelector('#email'); await ready(p);
154. await p.type('#email', ALICE);
155. await p.click('#sendcode');
156. await p.waitFor('/\\/code$/.test(location.pathname) && !!document.querySelector("#code")', { label: 'code page' });
157. await ready(p); // ident#20: the code step is its own page (/code) — wait for it to hydrate
158. await p.type('#code', lastCode(ALICE));
159. await p.click('#verify');
160. await p.waitForSelector('#skip');
161. await p.click('#skip');
162. await p.waitFor('!document.querySelector("#identityform")');
163. await p.click('#newidentity');
164. await p.waitForSelector('#identityform');
165. await p.type('#fidentityname', 'Work');
166. await p.click('#saveidentity');
167. await p.waitFor('document.querySelectorAll("#identities li").length === 2');
168. const register = async (name, origins) => {
169. await p.goto(ID + '/apps'); await p.waitForSelector('#newapp'); await ready(p);
170. await p.click('#newapp');
171. await p.waitForSelector('#appform');
172. await p.type('#fappname', name);
173. await p.type('#forigins', origins);
174. await p.click('#saveapp');
175. await p.waitForSelector('#secret');
176. const secret = (await txt(p, '#secret')).trim();
177. const keys = await p.evaluate('[...document.querySelectorAll("#apps .apikey")].map(e => e.textContent.trim())');
178. await p.click('#secretdone');
179. return { key: keys[keys.length - 1], secret };
180. };
181. const A = await register('Selector app A', TA);
182. const B = await register('Selector app B', TB);
183. check('two apps registered', /^pk_[0-9a-f]{32}$/.test(A.key) && /^pk_[0-9a-f]{32}$/.test(B.key) && A.key !== B.key, J([A.key, B.key]));
184. evilKey = A.key;
185. const setupApp = async (base, key, secret) => {
186. await p.goto(base + '/');
187. await p.type('#key', key, { clear: true });
188. await p.type('#secret', secret, { clear: true });
189. await p.evaluate('window.__old = 1');
190. await p.click('#savesetup');
191. await p.waitFor('!window.__old && document.readyState === "complete" && !!document.querySelector("#setupkey")', { label: 'setup saved' });
192. check('test app ' + base + ' set up', (await txt(p, '#setupkey')) === key);
193. };
194. await setupApp(TA, A.key, A.secret);
195. await setupApp(TB, B.key, B.secret);
196. const aliceCookie = (await p.cookies([ID])).filter(c => c.name === 'identsid').map(c => 'identsid=' + c.value)[0];
197. check('browser holds the ident session cookie (identsid)', !!aliceCookie);
199. // ==== 2. the selector on the test app's page: closed, open, identities ================
200. console.log('# selector: shown, opened, identities');
201. await p.goto(TA + '/');
202. await p.waitFor('!!customElements.get("ident-selector") && !!document.querySelector("#selector").shadowRoot', { label: 'selector defined' });
203. check('the page includes ident\'s script', await p.evaluate(`!![...document.scripts].find(s => s.src === ${J(ID + '/selector.js')})`));
204. check('selector is configured with the app\'s API key', (await p.evaluate('document.querySelector("#selector").getAttribute("key")')) === A.key);
205. check('selector first says "choose ident"', (await shText(p, '#choose')).replace(/[▼▲]/g, '').trim() === 'choose ident', await shText(p, '#choose'));
206. check('not logged in: no logged-in attribute', !(await p.evaluate('document.querySelector("#selector").hasAttribute("logged-in")')));
207. check('shadow DOM in ident\'s design (accent #ce9178)', (await shStyle(p, '#choose', 'backgroundColor')) === 'rgb(206, 145, 120)', await shStyle(p, '#choose', 'backgroundColor'));
208. await shot(p, 'closed');
209. await shClick(p, '#choose');
210. await waitList(p);
211. const names = await shNames(p);
212. check('open: the signed-in user\'s identities (identity names)', J(names) === J(['Default', 'Work']), J(names));
213. await shot(p, 'open');
214. // what ident answered (read by the page itself, as the script does)
215. const listA = await p.evaluate(`fetch(${J(ID + '/api/selector/identities?key=' + A.key)}, { credentials: 'include' }).then(r => r.json())`);
216. check('answer: only { signedIn, identities: [{ id, name }] }', listA.signedIn === true && listA.identities.every(i => J(Object.keys(i)) === '["id","name"]'), J(listA));
217. check('list ids are opaque (32 hex, not ident\'s identity ids)', listA.identities.every(i => /^[0-9a-f]{32}$/.test(i.id)), J(listA));
218. const noEmail = !J(listA).includes('alice');
219. check('no email in the answer', noEmail);
220. const toggleClosed = async () => { await shClick(p, '#choose'); await p.waitFor(sh('#selector', `!r.querySelector('#panel')`)); };
221. await toggleClosed();
222. check('clicking again closes it', true);
224. // ==== 3. select = login, without a reload ============================================
225. console.log('# select → code → host exchange → logged in without reload');
226. await p.evaluate('window.__noReload = 1; window.__codes = []; document.querySelector("#selector").addEventListener("ident-login", e => window.__codes.push(e.detail.code))');
227. const cookiesBefore = (await p.cookies([TA])).map(c => c.name).sort();
228. await shClick(p, '#choose');
229. await waitList(p);
230. await shClick(p, '[part~="identity"]', { name: 'Work' });
231. await p.waitFor('/Logged in/.test(document.querySelector("#loginstate").textContent) && !!document.querySelector("#identity")', { label: 'logged in via selector' });
232. check('no reload happened', (await p.evaluate('window.__noReload')) === 1);
233. const codes = await p.evaluate('window.__codes');
234. check('ident-login event carried a one-time code (48 hex)', codes.length === 1 && /^[0-9a-f]{48}$/.test(codes[0]), J(codes));
235. const idWork = (await txt(p, '#identity')).trim();
236. check('host exchanged it: the identity\'s short id', /^[2-9a-hj-km-np-z]{5}$/.test(idWork), idWork);
237. check('test app: new user', (await txt(p, '#userstate')) === 'new user');
238. check('host set logged-in', await p.evaluate('document.querySelector("#selector").hasAttribute("logged-in") && document.querySelector("#selector").loggedIn === true'));
239. const status = await shText(p, '#status');
240. check('selector shows the logged-in state with the identity', /logged in with ident/.test(status) && /Work/.test(status) && !(await p.evaluate(sh('#selector', `!!r.querySelector('#choose')`))), status);
241. check('logout offered', !(await p.evaluate('document.querySelector("#logout").hidden')));
242. const cookiesAfter = (await p.cookies([TA])).map(c => c.name).sort();
243. check('the selector set no cookie (only the test app\'s own session cookie is new)', J(cookiesAfter.filter(n => !cookiesBefore.includes(n))) === J(['testapp8391sid']), J([cookiesBefore, cookiesAfter]));
244. await shot(p, 'loggedin');
245. const reuse = await exchange({ key: A.key, secret: A.secret, code: codes[0] });
246. check('code reuse: the selector\'s code a second time → 400', reuse.status === 400 && /already used/.test(reuse.j.error), J(reuse));
248. // the host knows its session: after a reload it renders logged-in itself
249. await p.goto(TA + '/');
250. await p.waitFor('!!customElements.get("ident-selector")');
251. check('reload: host renders <ident-selector logged-in>', await p.evaluate('document.querySelector("#selector").hasAttribute("logged-in")'));
252. check('reload: still logged in in the test app', /Logged in/.test(await txt(p, '#loginstate')));
254. // ==== 4. host logout resets the selector =============================================
255. console.log('# host logout');
256. await p.evaluate('window.__noReload = 1');
257. await p.click('#logout');
258. await p.waitFor('/Not logged in/.test(document.querySelector("#loginstate").textContent)');
259. check('logout: no reload', (await p.evaluate('window.__noReload')) === 1);
260. check('logout: selector reset (no logged-in, says "choose ident" again)', !(await p.evaluate('document.querySelector("#selector").hasAttribute("logged-in")')) && /choose/.test(await shText(p, '#choose')));
261. await p.goto(TA + '/');
262. await p.waitFor('!!customElements.get("ident-selector")');
263. check('after logout + reload: not logged in', !(await p.evaluate('document.querySelector("#selector").hasAttribute("logged-in")')) && /Not logged in/.test(await txt(p, '#loginstate')));
265. // ==== 5. the other identity, and the same one via the login button ===================
266. console.log('# ids: per identity, same as the button flow');
267. await shClick(p, '#choose');
268. await waitList(p);
269. await shClick(p, '[part~="identity"]', { name: 'Default' });
270. await p.waitFor('!!document.querySelector("#identity")');
271. const idDefault = (await txt(p, '#identity')).trim();
272. check('other identity → other id, new user', /^[2-9a-hj-km-np-z]{5}$/.test(idDefault) && idDefault !== idWork && (await txt(p, '#userstate')) === 'new user', J([idDefault, idWork]));
273. await p.click('#logout');
274. await p.waitFor('/Not logged in/.test(document.querySelector("#loginstate").textContent)');
275. await p.click('#login');
276. await p.waitForSelector('#chooselist'); await ready(p);
277. await p.click('#chooselist li:nth-child(2) .choose');
278. await p.waitFor(`location.href.startsWith(${J(TA + '/callback')}) && !!document.querySelector("#identity")`);
279. check('login button with Work → the same id as the selector gave', (await txt(p, '#identity')).trim() === idWork && (await txt(p, '#userstate')) === 'welcome back');
280. // app B: the same identity gets the same id there
281. await p.goto(TB + '/');
282. await shClick(p, '#choose');
283. await waitList(p);
284. const listB = await p.evaluate(`fetch(${J(ID + '/api/selector/identities?key=' + B.key)}, { credentials: 'include' }).then(r => r.json())`);
285. check('list ids differ per app', listB.identities.every((x, i) => x.id !== listA.identities[i].id), J([listA, listB]));
286. await shClick(p, '[part~="identity"]', { name: 'Work' });
287. await p.waitFor('!!document.querySelector("#identity")');
288. const idWorkB = (await txt(p, '#identity')).trim();
289. check('same identity, app B → the SAME id', idWorkB === idWork);
291. // ==== 6. restyle by the host =========================================================
292. console.log('# restyle by the host');
293. await p.goto(TA + '/');
294. await p.waitFor('!!customElements.get("ident-selector")');
295. // the login button above logged this browser in to the test app: log out first
296. if (await p.evaluate('!document.querySelector("#logout").hidden')) {
297. await p.click('#logout');
298. await p.waitFor(sh('#selector', `!!r.querySelector('#choose')`), { label: 'selector reset' });
299. }
300. const before = { bg: await shStyle(p, '#choose', 'backgroundColor'), radius: await shStyle(p, '#choose', 'borderTopLeftRadius'), tt: await shStyle(p, '#choose', 'textTransform') };
301. await p.evaluate(`document.head.insertAdjacentHTML('beforeend', '<style id="restyle">#selector { --ident-accent: rgb(86, 155, 212); --ident-radius: 0px; } #selector::part(button) { text-transform: uppercase; } #selector::part(identity) { font-style: italic; }</style>')`);
302. const after = { bg: await shStyle(p, '#choose', 'backgroundColor'), radius: await shStyle(p, '#choose', 'borderTopLeftRadius'), tt: await shStyle(p, '#choose', 'textTransform') };
303. check('custom property --ident-accent changes the button colour', before.bg === 'rgb(206, 145, 120)' && after.bg === 'rgb(86, 155, 212)', J([before, after]));
304. check('custom property --ident-radius changes the corners', before.radius !== '0px' && after.radius === '0px', J([before, after]));
305. check('::part(button) restyles from the host', before.tt === 'none' && after.tt === 'uppercase', J([before, after]));
306. await shClick(p, '#choose');
307. await waitList(p);
308. check('::part(identity) restyles the list', (await p.evaluate(sh('#selector', `getComputedStyle(r.querySelector('[part~="identity"]')).fontStyle`))) === 'italic');
309. await shot(p, 'restyled-open');
310. await p.evaluate('document.querySelector("#restyle").remove()');
311. await toggleClosed();
313. // ==== 7. negatives in the browser ====================================================
314. console.log('# negatives: origin, key, signed out');
315. // (a) an origin not registered for the app — same site, so the ident cookie DOES travel;
316. // only the Origin check stops it
317. await p.goto(EVIL + '/');
318. await p.waitFor('!!customElements.get("ident-selector")');
319. await shClick(p, '#choose');
320. await waitMsg(p, 'does not answer this site');
321. check('unregistered origin: no identities, an explanation', (await shNames(p)).length === 0);
322. const evilFetch = await p.evaluate(`fetch(${J(ID + '/api/selector/identities?key=' + A.key)}, { credentials: 'include' }).then(r => 'got ' + r.status, e => 'blocked: ' + e.name)`);
323. check('unregistered origin: the browser gets nothing (CORS)', evilFetch === 'blocked: TypeError', evilFetch);
324. const evilChoose = await p.evaluate(`fetch(${J(ID + '/api/selector/choose?key=' + A.key)}, { method: 'POST', credentials: 'include', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ identity: ${J(listA.identities[0].id)} }) }).then(r => 'got ' + r.status, e => 'blocked: ' + e.name)`);
325. check('unregistered origin: choose blocked (preflight refused)', evilChoose === 'blocked: TypeError', evilChoose);
326. await shot(p, 'unregistered');
327. p.messages.splice(0); // the CORS refusals above are expected console errors
328. // (b) wrong key on a registered origin: app B's key on app A's page, and a made-up key
329. await p.goto(TA + '/');
330. await p.waitFor('!!customElements.get("ident-selector")');
331. const before2 = p.messages.length;
332. for (const [label, key] of [["another app's key", B.key], ['an unknown key', 'pk_' + '0'.repeat(32)]]) {
333. await p.evaluate(`document.querySelector("#other") && document.querySelector("#other").remove(); document.querySelector("#selectorbox").insertAdjacentHTML('beforeend', '<ident-selector id="other" key="${key}"></ident-selector>')`);
334. await shClick(p, '#choose', { host: '#other' });
335. await waitMsg(p, 'does not answer this site', '#other');
336. check(`wrong key (${label}): no identities`, (await shNames(p, '#other')).length === 0);
337. }
338. p.messages.splice(before2);
339. // (c) signed out of ident: the second browser has no ident session
340. const q = await browser2.newPage(); pages.push(q);
341. await viewport(q, 1280);
342. await q.goto(TA + '/');
343. await q.waitFor('!!customElements.get("ident-selector")');
344. await shClick(q, '#choose');
345. await waitMsg(q, 'not signed in to ident');
346. check('signed out of ident: no identities, a link to sign in to ident', (await shNames(q)).length === 0 && (await q.evaluate(sh('#selector', `r.querySelector('#signin').href`))) === ID + '/');
347. const outList = await q.evaluate(`fetch(${J(ID + '/api/selector/identities?key=' + A.key)}, { credentials: 'include' }).then(r => r.json())`);
348. check('signed out: ident answers { signedIn: false, identities: [] }', outList.signedIn === false && Array.isArray(outList.identities) && outList.identities.length === 0 && Object.keys(outList).length === 2, J(outList));
349. await shot(q, 'signedout');
351. // ==== 8. the API directly: CORS headers, strict body, forged sessions ================
352. console.log('# API: CORS, strict, forged sessions');
353. let r = await call('GET', '/api/selector/identities?key=' + A.key, { origin: TA, cookie: aliceCookie });
354. check('registered origin + key: 200, ACAO = that exact origin, credentials true', r.status === 200 && r.h.get('access-control-allow-origin') === TA && r.h.get('access-control-allow-credentials') === 'true' && r.j.identities.length === 2, `${r.status} ${r.h.get('access-control-allow-origin')} ${r.t}`);
355. check('Vary: Origin, no Set-Cookie from the selector API', /Origin/.test(r.h.get('vary') || '') && !r.h.get('set-cookie'));
356. r = await call('GET', '/api/selector/identities?key=' + A.key, { origin: EVIL, cookie: aliceCookie });
357. check('unregistered origin: 403, no CORS headers, no identities', r.status === 403 && !r.h.get('access-control-allow-origin') && !r.t.includes('Work'), `${r.status} ${r.t}`);
358. r = await call('GET', '/api/selector/identities?key=' + B.key, { origin: TA, cookie: aliceCookie });
359. check("another app's key on this origin: 403, no CORS headers", r.status === 403 && !r.h.get('access-control-allow-origin'), `${r.status} ${r.t}`);
360. r = await call('GET', '/api/selector/identities', { origin: TA, cookie: aliceCookie });
361. check('no key: 403', r.status === 403, r.t);
362. r = await call('GET', '/api/selector/identities?key=' + A.key, { cookie: aliceCookie });
363. check('no Origin header: 403', r.status === 403, r.t);
364. r = await call('GET', '/api/selector/identities?key=' + A.key, { origin: 'null', cookie: aliceCookie });
365. check('Origin null: 403', r.status === 403, r.t);
366. r = await call('GET', '/api/selector/identities?key=' + A.key, { origin: TA + '.evil.example', cookie: aliceCookie });
367. check('origin with the registered one as prefix: 403', r.status === 403, r.t);
368. r = await call('GET', '/api/selector/identities?key=' + A.key, { origin: TA, cookie: 'identsid=' + 'f'.repeat(32) });
369. check('made-up ident cookie: signed out', r.status === 200 && r.j.signedIn === false, r.t);
370. r = await call('OPTIONS', '/api/selector/choose?key=' + A.key, { origin: TA, headers: { 'access-control-request-method': 'POST', 'access-control-request-headers': 'content-type' } });
371. check('preflight from a registered origin: 204 + allow POST, Content-Type', r.status === 204 && r.h.get('access-control-allow-origin') === TA && /POST/.test(r.h.get('access-control-allow-methods')) && /Content-Type/i.test(r.h.get('access-control-allow-headers')), `${r.status} ${[...r.h].join(' ')}`);
372. r = await call('OPTIONS', '/api/selector/choose?key=' + A.key, { origin: EVIL });
373. check('preflight from an unregistered origin: 403, no CORS headers', r.status === 403 && !r.h.get('access-control-allow-origin'), `${r.status}`);
374. const pick = listA.identities[1].id; // Work
375. const choose = (body, opt = {}) => call('POST', '/api/selector/choose?key=' + A.key, { origin: TA, cookie: aliceCookie, body, ...opt });
376. r = await choose({ identity: pick });
377. check('choose: 200 { code } only', r.status === 200 && J(Object.keys(r.j)) === '["code"]' && /^[0-9a-f]{48}$/.test(r.j.code), r.t);
378. const code1 = r.j.code;
379. let x = await exchange({ key: A.key, secret: A.secret, code: code1 });
380. check('exchange of a selector code → the same id as in the browser', x.status === 200 && x.j.identity === idWork, J(x));
381. x = await exchange({ key: A.key, secret: A.secret, code: code1 });
382. check('the same code again → 400', x.status === 400, J(x));
383. r = await choose({ identity: pick });
384. x = await exchange({ key: B.key, secret: B.secret, code: r.j.code });
385. check("a selector code for app A presented by app B → 400", x.status === 400 && /not issued to this app/.test(x.j.error), J(x));
386. x = await exchange({ key: A.key, secret: A.secret, code: r.j.code });
387. check('…and it is spent', x.status === 400, J(x));
388. r = await choose({ identity: pick }, { origin: EVIL });
389. check('choose from an unregistered origin: 403, no code', r.status === 403 && !r.t.includes('code"'), r.t);
390. r = await choose({ identity: pick }, { cookie: undefined });
391. check('choose without an ident session: 401', r.status === 401, r.t);
392. r = await choose({ identity: pick, session: { user: { id: 1 } } }, { cookie: undefined });
393. check('forged session in the body: refused (unknown field)', r.status === 400 && r.j.error === 'unknown field: session', r.t);
394. r = await choose({ identity: pick, user: { id: 1 } });
395. check('unknown field: named', r.status === 400 && r.j.error === 'unknown field: user', r.t);
396. r = await choose({});
397. check('missing identity: named', r.status === 400 && r.j.error === 'missing field: identity', r.t);
398. r = await choose({ identity: 2 });
399. check('identity of the wrong type: named', r.status === 400 && /field identity must be a string/.test(r.j.error), r.t);
400. r = await choose('{"identity": ');
401. check('invalid JSON: 400', r.status === 400 && /not valid JSON/.test(r.j.error), r.t);
402. r = await choose('["x"]');
403. check('not an object: 400', r.status === 400, r.t);
404. // ident's own identity ids (UUIDs since mission 009) as the SSR page renders them in the Edit buttons
405. const ownIds = [...new Set([...(await (await fetch(ID + '/', { headers: { cookie: aliceCookie } })).text()).matchAll(/value="([0-9a-z]{12})"/g)].map(m => m[1]))];
406. check("alice's ident identity ids read off / (2, UUIDs)", ownIds.length === 2, J(ownIds));
407. r = await choose({ identity: ownIds[0] || 'x' });
408. check("ident's own identity id is not accepted as a pick: 400", r.status === 400 && r.j.error === 'no such identity', r.t);
409. r = await choose({ identity: '2' });
410. check("an old numeric identity id is not accepted as a pick: 400", r.status === 400 && r.j.error === 'no such identity', r.t);
411. r = await choose({ identity: listB.identities[1].id });
412. check("app B's pick on app A: 400", r.status === 400, r.t);
413. r = await call('GET', '/api/selector/choose?key=' + A.key, { origin: TA, cookie: aliceCookie });
414. check('GET choose: 405', r.status === 405, r.t);
415. r = await call('POST', '/api/selector/identities?key=' + A.key, { origin: TA, cookie: aliceCookie, body: {} });
416. check('POST identities: 405', r.status === 405, r.t);
417. // another account: bob's session cannot use alice's pick
418. // (bob logs in over the emit carrier with the cookie the first frame got)
419. // (mission 010: the code comes from POST /api/code; the verifyCode frame mints the cookie)
420. await fetch(ID + '/api/code', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J({ email: '[email protected]' }) });
421. const vBr = await fetch(ID + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J({ t: 'emit', i: ++emitI, event: 'verifyCode', payload: ['[email protected]', lastCode('[email protected]'), 'UTC'] }) });
422. const bCookie = (vBr.headers.get('set-cookie') || '').split(';')[0];
423. const vBt = await vBr.text();
424. const vB = { value: (JSON.parse(vBt) || {}).value, raw: vBt };
425. check('bob signed in (emit carrier)', !!(vB.value && vB.value.account), vB.raw);
426. r = await choose({ identity: pick }, { cookie: bCookie });
427. check("another account cannot choose alice's identity", r.status === 400 && r.j.error === 'no such identity', r.t);
428. r = await call('GET', '/api/selector/identities?key=' + A.key, { origin: TA, cookie: bCookie });
429. check("another account sees only its own identities", r.status === 200 && r.j.identities.length === 1 && r.j.identities[0].name === 'Default' && r.j.identities[0].id !== listA.identities[0].id, r.t);
430. // #31: the faces still refuse a forged trailing session argument
431. const forged = { user: { id: 1 } };
432. for (const [ev, args] of [['addIdentity', [{ identityName: 'X' }]], ['editIdentity', [1, { identityName: 'X' }]], ['dropIdentity', [2]], ['changeTimeZone', ['UTC']], ['chooseIdentity', ['x', 1]], ['appCreate', [{ name: 'X', origins: [TA] }]], ['appNewSecret', [1]], ['appDelete', [1]]]) {
433. const f = await emit(ev, [...args, forged]);
434. check(`forged session argument refused (#31): ${ev}`, framework_refused(f.raw) || (f.value && /not signed in/.test(f.value.error)), f.raw);
435. }
437. // ident sign-out in browser 1 → the selector there gets nothing either
438. await p.goto(ID + '/'); await ready(p);
439. await p.click('#signout');
440. await p.waitForSelector('#email');
441. await p.goto(TA + '/');
442. await p.waitFor('!!customElements.get("ident-selector")');
443. await shClick(p, '#choose');
444. await waitMsg(p, 'not signed in to ident');
445. check('after signing out of ident: no identities', (await shNames(p)).length === 0);
446. r = await call('GET', '/api/selector/identities?key=' + A.key, { origin: TA, cookie: aliceCookie });
447. check('after signing out of ident: the old cookie gets signedIn false', r.status === 200 && r.j.signedIn === false, r.t);
449. // ==== 9. console =====================================================================
450. const probs = pages.flatMap(pg => pg.problems().map(m => m.text));
451. check('no console errors or warnings (besides the expected CORS refusals)', probs.length === 0, probs.join(' | '));
452. } catch (err) {
453. failed++;
454. console.log(' FAIL (aborted) ' + (err && err.stack || err));
455. for (const pg of pages) console.log('--- console:\n' + pg.dumpConsole());
456. } finally {
457. for (const b of [browser1, browser2]) { if (b) { try { await b.close(); } catch {} } }
458. for (const { p } of procs) { try { p.kill(); } catch {} }
459. evil.close();
460. await sleep(300);
461. }
462. console.log(`\n${passed} passed, ${failed} failed`);
463. process.exit(failed ? 1 : 0);