ident

32.0 KB

1. // tests/apps.mjs — THE GATE OF PIECE 2 (ticket #25): apps, one id per app, the login
2. // button, the exchange. Real headless Chrome (tests/cdp.mjs, --disable-gpu) drives:
3. // register apps in ident → set up the test app → "Log in with ident" → ident login →
4. // choose identity → back → exchange → the test app shows the id. Plus the negatives.
5. //
6. // Own servers only, NEVER the dev server and NEVER real mail:
7. // ident :8370 (IDENT_MAIL_SINK), ident :8371 (grant TTL 1.5 s, for the expiry case),
8. // test app A :8372, test app B :8373 (both against ident :8370).
9. // Own storage: .scratch/apps-gate/ (wiped at start). Chrome debug ports 8670-8679.
10. // Screenshots: .scratch/apps-*.png (390 and 1280 px) — look at them.
11. //
12. // Run: node tests/apps.mjs (exit 0 = all passed)
13. import { spawn } from 'node:child_process';
14. import { readFileSync, writeFileSync, rmSync, mkdirSync, existsSync } from 'node:fs';
15. import { dirname, join } from 'node:path';
16. import { fileURLToPath } from 'node:url';
17. import { launchBrowser, sleep } from './cdp.mjs';
19. const APP = join(dirname(fileURLToPath(import.meta.url)), '..');
20. const G = join(APP, '.scratch/apps-gate');
21. const SHOTS = join(APP, '.scratch');
22. const ID = 'http://127.0.0.1:8370', IDS = 'http://127.0.0.1:8371';
23. const TA = 'http://127.0.0.1:8372', TB = 'http://127.0.0.1:8373';
24. const CHROME_PORTS = [8670, 8679];
26. let passed = 0, failed = 0;
27. const check = (name, ok, detail = '') => {
28. if (ok) { passed++; console.log(' ok ' + name); }
29. else { failed++; console.log(' FAIL ' + name + (detail ? ' — ' + detail : '')); }
30. };
32. // ---- servers ----------------------------------------------------------------------------
33. const procs = [];
34. function start(cwd, env, log) {
35. const p = spawn(join(APP, 'bin/hybriel'), ['project.hl'], {
36. cwd, env: { ...process.env, SMTP_HOST: '', SMTP_USER: '', SMTP_PASSWORD: '', ...env },
37. stdio: ['ignore', 'pipe', 'pipe'],
38. });
39. let out = '';
40. p.stdout.on('data', d => { out += d; }); p.stderr.on('data', d => { out += d; });
41. p.on('exit', () => writeFileSync(join(G, log), out));
42. procs.push({ p, log, out: () => out });
43. return p;
44. }
45. async function up(url) {
46. for (let i = 0; i < 80; i++) { try { await fetch(url + '/', { redirect: 'manual' }); return; } catch {} await sleep(250); }
47. throw new Error('server did not come up: ' + url);
48. }
49. function stopAll() { for (const { p } of procs) { try { p.kill(); } catch {} } }
51. rmSync(G, { recursive: true, force: true });
52. mkdirSync(G, { recursive: true });
53. const identEnv = (port, dir, extra = {}) => ({
54. IDENT_PORT: String(port), IDENT_STORAGE: join(G, dir, 'ident'), IDENT_SESSIONS: join(G, dir, 'sess') + '/',
55. IDENT_MAIL_SINK: join(G, dir, 'mail.txt'), IDENT_IP_LIMIT: '1000', IDENT_IP_DAY_LIMIT: '1000', ...extra,
56. });
57. mkdirSync(join(G, 'main'), { recursive: true }); mkdirSync(join(G, 'short'), { recursive: true });
58. start(APP, identEnv(8370, 'main'), 'ident-main.log');
59. start(APP, identEnv(8371, 'short', { IDENT_GRANT_TTL_MS: '1500' }), 'ident-short.log');
60. const testapp = (port, file) => start(join(APP, 'testapp'), {
61. TESTAPP_PORT: String(port), TESTAPP_URL: 'http://127.0.0.1:' + port, IDENT_URL: ID, TESTAPP_STORE: join(G, file),
62. }, 'testapp-' + port + '.log');
63. testapp(8372, 'testapp-a.json'); testapp(8373, 'testapp-b.json');
64. await Promise.all([up(ID), up(IDS), up(TA), up(TB)]);
66. // ---- helpers ----------------------------------------------------------------------------
67. const lastCode = (dir, email) => {
68. const lines = readFileSync(join(G, dir, 'mail.txt'), 'utf8').trim().split('\n').filter(l => l.startsWith(email + ' '));
69. return lines.length ? lines[lines.length - 1].split(' ')[1] : null;
70. };
71. let emitI = 0;
72. // hybriel#16 (mission 036): hl:web itself refuses an emit with one argument too many — the ack is
73. // ok:false "… the `session` parameter is filled by the server, never by the peer"; the face never runs.
74. const framework_refused = (raw) => { try { const j = JSON.parse(raw); return j.ok === false && /the `session` parameter is filled by the server/.test(j.error || ''); } catch { return false; } };
75. async function emit(base, event, payload, cookie) {
76. const r = await fetch(base + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', ...(cookie ? { cookie } : {}) }, body: JSON.stringify({ t: 'emit', i: ++emitI, event, payload }) });
77. const t = await r.text();
78. let j = null; try { j = JSON.parse(t); } catch {}
79. return { status: r.status, cookie: (r.headers.get('set-cookie') || '').split(';')[0], value: j && j.value, raw: t };
80. }
81. async function exchange(base, body) {
82. const r = await fetch(base + '/api/exchange', { method: 'POST', headers: { 'content-type': 'application/json' }, body: typeof body === 'string' ? body : JSON.stringify(body) });
83. const t = await r.text();
84. let j = null; try { j = JSON.parse(t); } catch {}
85. return { status: r.status, j, t };
86. }
87. // log in over the emit API (for the non-browser parts): answers the cookie; the account's
88. // identities (oldest first; ids are mpackdb UUIDs since mission 009) land in idsOf[cookie]
89. const idsOf = {};
90. // (mission 010: the code is requested with POST /api/code — no longer a face; the session
91. // cookie comes from the verifyCode frame, which mints it)
92. async function apiLogin(base, dir, email) {
93. const q = await fetch(base + '/api/code', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ email }) });
94. if (q.status !== 200) throw new Error('code request failed: ' + q.status + ' ' + await q.text());
95. const v = await emit(base, 'verifyCode', [email, lastCode(dir, email), 'UTC']);
96. if (!v.value || !v.value.account || !v.cookie) throw new Error('api login failed: ' + v.raw);
97. idsOf[v.cookie] = v.value.identities.map(i => i.id);
98. return v.cookie;
99. }
100. // the ids a signed-in page renders in its buttons' value attributes (SSR), in order, once each
101. async function ssrIds(base, path, cookie) {
102. const t = await (await fetch(base + path, { headers: { cookie } })).text();
103. return [...new Set([...t.matchAll(/value="([0-9a-z]{12})"/g)].map(m => m[1]))];
104. }
105. // a login button press + choice over HTTP: answers the one-time code
106. async function codeFor(base, cookie, key, returnUrl, identity) {
107. const l = await fetch(base + '/login?key=' + key + '&return=' + encodeURIComponent(returnUrl), { redirect: 'manual' });
108. const rid = (l.headers.get('location') || '').split('/').pop();
109. const c = await emit(base, 'chooseIdentity', [rid, identity], cookie);
110. if (!c.value || !c.value.url) throw new Error('choose failed: ' + c.raw);
111. return new URL(c.value.url).searchParams.get('ident_code');
112. }
114. const pages = [];
115. async function ready(p) { await p.waitFor('!!window.__hl && window.__hl.socket && window.__hl.socket.readyState === 1', { label: 'hydrated' }); }
116. async function viewport(p, w) {
117. await p.send('Emulation.setDeviceMetricsOverride', { width: w, height: w < 500 ? 844 : 900, deviceScaleFactor: 1, mobile: w < 500 });
118. }
119. async function shot(p, name) {
120. for (const w of [390, 1280]) {
121. await viewport(p, w);
122. await sleep(150);
123. const over = await p.evaluate('document.documentElement.scrollWidth > window.innerWidth');
124. check(`${name} @${w}px: no horizontal overflow`, !over);
125. const { data } = await p.send('Page.captureScreenshot', { format: 'png', captureBeyondViewport: true });
126. writeFileSync(join(SHOTS, `apps-${name}-${w}.png`), Buffer.from(data, 'base64'));
127. }
128. await viewport(p, 1280);
129. }
130. // confirm() answers: the next dialog is accepted (true) or dismissed (false)
131. function onDialogs(p) {
132. p.dialogAnswers = [];
133. p.dialogs = [];
134. p.conn.onEvent((msg) => {
135. if (msg.sessionId !== p.sessionId || msg.method !== 'Page.javascriptDialogOpening') return;
136. p.dialogs.push(msg.params.message);
137. const accept = p.dialogAnswers.length ? p.dialogAnswers.shift() : false;
138. p.send('Page.handleJavaScriptDialog', { accept }).catch(() => {});
139. });
140. }
141. const here = (p) => p.evaluate('location.href');
142. const txt = (p, sel) => p.evaluate(`(document.querySelector(${JSON.stringify(sel)}) || {}).textContent || ''`);
144. async function browserLogin(p, email) {
145. await p.waitForSelector('#email');
146. await ready(p);
147. await p.type('#email', email);
148. await p.click('#sendcode');
149. // ident#20: a sent code navigates to the code page (/code, /signin/<rid>/code)
150. await p.waitFor('/\\/code$/.test(location.pathname) && !!document.querySelector("#code")', { label: 'code page' });
151. await ready(p);
152. await p.type('#code', lastCode('main', email));
153. await p.click('#verify');
154. }
155. // ident#20: a REAL reload (Page.reload), then hydrated
156. async function reload(p) {
157. p._loaded = false;
158. await p.send('Page.reload', { ignoreCache: false });
159. const deadline = Date.now() + 15000;
160. while (!p._loaded && Date.now() < deadline) await sleep(25);
161. if (!p._loaded) throw new Error('reload: load event never fired');
162. await ready(p);
163. }
165. let browser1, browser2;
166. try {
167. browser1 = await launchBrowser({ debugPortRange: CHROME_PORTS });
168. browser2 = await launchBrowser({ debugPortRange: CHROME_PORTS });
169. const p = await browser1.newPage(); pages.push(p); onDialogs(p);
170. await viewport(p, 1280);
172. // ==== 1. sign in to ident, register two apps ==========================================
173. console.log('# apps: register, list, secret shown once');
174. const ALICE = '[email protected]';
175. await p.goto(ID + '/apps');
176. check('signed out /apps asks to sign in', /sign in/i.test(await txt(p, '#signinfirst')));
177. await p.goto(ID + '/');
178. await browserLogin(p, ALICE);
179. await p.waitForSelector('#skip');
180. await p.click('#skip');
181. await p.waitFor('!document.querySelector("#identityform")');
182. await p.goto(ID + '/apps');
183. await p.waitForSelector('#newapp'); await ready(p);
184. check('no apps yet', /No apps yet/.test(await txt(p, '#noapps')));
185. const register = async (name, origins) => {
186. await p.click('#newapp');
187. await p.waitForSelector('#appform');
188. await p.type('#fappname', name);
189. await p.type('#forigins', origins);
190. await p.click('#saveapp');
191. await p.waitFor('!!document.querySelector("#secret") || /\\S/.test(document.querySelector("#message").textContent)');
192. };
193. // a bad origin first: refused, named
194. await register('Bad', 'http://127.0.0.1:8372/callback');
195. check('origin with a path refused', /no path/.test(await txt(p, '#message')), await txt(p, '#message'));
196. await p.click('#cancelapp');
197. await register('Test app A', 'http://127.0.0.1:8372');
198. const secretA = (await txt(p, '#secret')).trim();
199. check('secret shown after register (sk_ + 48 hex)', /^sk_[0-9a-f]{48}$/.test(secretA), secretA);
200. const keyA = (await txt(p, '#apps li:nth-child(1) .apikey')).trim();
201. check('API key listed (pk_ + 32 hex)', /^pk_[0-9a-f]{32}$/.test(keyA), keyA);
202. // hybriel#121 (mission 048): a face taking the session syncs the session-derived list back — a row added on top would show twice
203. check('first app listed ONCE (no session-sync double row)', (await p.evaluate('document.querySelectorAll("#apps li").length')) === 1, await txt(p, '#apps'));
204. await shot(p, 'secret');
205. await p.click('#secretdone');
206. await p.waitFor('!document.querySelector("#secretbox")');
207. await p.goto(ID + '/apps'); await ready(p);
208. check('secret not shown again after reload', !(await p.evaluate('document.body.textContent.includes(' + JSON.stringify(secretA) + ')')));
209. await register('Test app B', 'http://127.0.0.1:8373, http://localhost:8373');
210. const secretB = (await txt(p, '#secret')).trim();
211. const keyB = (await txt(p, '#apps li:nth-child(2) .apikey')).trim();
212. check('second app: own key and secret', keyB !== keyA && secretB !== secretA && /^pk_/.test(keyB));
213. check('second app: two rows, each app ONCE', (await p.evaluate('[...document.querySelectorAll("#apps li .apikey")].map(e => e.textContent.trim()).join(" ")')) === keyA + ' ' + keyB, await txt(p, '#apps'));
214. check('origins listed', (await txt(p, '#apps li:nth-child(2)')).includes('http://127.0.0.1:8373 http://localhost:8373'));
215. await p.click('#secretdone');
216. await shot(p, 'list');
217. // edit: rename B and keep one origin
218. await p.click('#apps li:nth-child(2) .edit');
219. await p.waitForSelector('#appform');
220. check('edit form filled', (await p.evaluate('document.querySelector("#forigins").value')) === 'http://127.0.0.1:8373 http://localhost:8373');
221. await p.type('#fappname', 'Test app B2', { clear: true });
222. await p.type('#forigins', 'http://127.0.0.1:8373', { clear: true });
223. await p.click('#saveapp');
224. await p.waitFor('/App saved/.test(document.querySelector("#notice").textContent)');
225. const bRow = await txt(p, '#apps li:nth-child(2)');
226. check('edit saved (name, origins, key unchanged)', bRow.includes('Test app B2') && !bRow.includes('localhost') && bRow.includes(keyB), bRow);
228. // ==== 2. the test apps are set up with key + secret ===================================
229. console.log('# test app setup');
230. const setupApp = async (base, key, secret) => {
231. await p.goto(base + '/');
232. await p.type('#key', key, { clear: true });
233. await p.type('#secret', secret, { clear: true });
234. await p.evaluate('window.__old = 1');
235. await p.click('#savesetup');
236. await p.waitFor('!window.__old && document.readyState === "complete" && (!!document.querySelector("#login") || !!document.querySelector("#result"))', { label: 'setup saved' });
237. check('test app ' + base + ' saved key + secret', (await txt(p, '#setupkey')) === key, await txt(p, 'body'));
238. };
239. await setupApp(TA, keyA, secretA);
240. check('test app A set up', (await txt(p, '#setupkey')) === keyA);
241. await setupApp(TB, keyB, secretB);
243. // ==== 3. the login button, signed in already, one identity ============================
244. console.log('# login button: signed in, one identity');
245. const pressLogin = async (base) => {
246. await p.goto(base + '/');
247. await p.click('#login');
248. await p.waitFor('location.pathname.startsWith("/signin/") && !!document.querySelector("#apprequest")', { label: 'ident sign-in page' });
249. await ready(p);
250. };
251. const chooseAndReturn = async (nth, base) => {
252. await p.waitForSelector('#chooselist');
253. await p.click(`#chooselist li:nth-child(${nth}) .choose`);
254. await p.waitFor(`location.href.startsWith(${JSON.stringify(base + '/callback')}) && !!document.querySelector("#result")`, { label: 'back at the app' });
255. return { identity: (await txt(p, '#identity')).trim(), state: await txt(p, '#userstate'), answer: await txt(p, '#answer'), result: await txt(p, '#result') };
256. };
257. await pressLogin(TA);
258. check('ident names the app and its origin', (await txt(p, '#appname')) === 'Test app A' && (await txt(p, '#apporigin')) === 'http://127.0.0.1:8372');
259. check('one identity: still shown, one choice', (await p.evaluate('document.querySelectorAll("#chooselist li").length')) === 1 && (await txt(p, '#chooselist li')).includes('Default'));
260. check('identities management not shown on the app page', !(await p.evaluate('!!document.querySelector("#identitiessection")')));
261. await shot(p, 'choose-one');
262. const a1 = await chooseAndReturn(1, TA);
263. check('back at test app A with an identity id', /^[2-9a-hj-km-np-z]{5}$/.test(a1.identity), JSON.stringify(a1));
264. check('the app got ONLY the id (no email, no names)', a1.answer === JSON.stringify({ identity: a1.identity }), a1.answer);
265. check('test app: new user', a1.state === 'new user');
266. await shot(p, 'testapp-result');
267. await pressLogin(TA);
268. const a2 = await chooseAndReturn(1, TA);
269. check('same identity, same app → same id', a2.identity === a1.identity && a2.state === 'welcome back', JSON.stringify(a2));
270. await pressLogin(TB);
271. const b1 = await chooseAndReturn(1, TB);
272. check('same identity, second app → the SAME id (ident#23)', b1.identity === a1.identity, JSON.stringify([a1.identity, b1.identity]));
274. // ==== 4. two identities: the choice matters ============================================
275. console.log('# two identities');
276. await p.goto(ID + '/'); await ready(p);
277. await p.click('#newidentity');
278. await p.waitForSelector('#identityform');
279. await p.type('#fidentityname', 'Work');
280. await p.click('#saveidentity');
281. await p.waitFor('document.querySelectorAll("#identities li").length === 2');
282. await pressLogin(TA);
283. check('two identities offered', (await p.evaluate('document.querySelectorAll("#chooselist li").length')) === 2);
284. await shot(p, 'choose-two');
285. const aWork = await chooseAndReturn(2, TA);
286. check('other identity, same app → other id', /^[2-9a-hj-km-np-z]{5}$/.test(aWork.identity) && aWork.identity !== a1.identity && aWork.state === 'new user', JSON.stringify(aWork));
287. await pressLogin(TA);
288. const aDef = await chooseAndReturn(1, TA);
289. check('first identity again → its old id', aDef.identity === a1.identity);
291. // ==== 5. signed out: ident login first, then the choice ===============================
292. console.log('# login button: signed out');
293. const q = await browser2.newPage(); pages.push(q); onDialogs(q);
294. await viewport(q, 1280);
295. await q.goto(TB + '/');
296. await q.click('#login');
297. await q.waitFor('location.pathname.startsWith("/signin/") && !!document.querySelector("#email")', { label: 'ident login for the app' });
298. check('signed out: login form under the app banner', (await txt(q, '#apprequest')).includes('Test app B2'));
299. await shot(q, 'signin-for-app');
300. const BOB = '[email protected]';
301. // ident#20 (mission 032): the app login's code step is the page /signin/<rid>/code and
302. // survives a reload; the code entered after it signs in and the app flow completes
303. await ready(q);
304. const ridPath = await q.evaluate('location.pathname');
305. await q.type('#email', BOB);
306. await q.click('#sendcode');
307. await q.waitFor(`location.pathname === ${JSON.stringify(ridPath + '/code')} && !!document.querySelector("#code")`, { label: 'app code page' });
308. await ready(q);
309. check('ident#20: app login: "Send me a code" → /signin/<rid>/code with the code form', /^\/signin\/[0-9a-f]{32}\/code$/.test(await q.evaluate('location.pathname')) && (await txt(q, '#sentto strong')) === BOB, await q.evaluate('location.pathname'));
310. await reload(q);
311. check('ident#20: app login: RELOAD of /signin/<rid>/code → code form for bob, still under the app banner', (await q.evaluate('location.pathname')) === ridPath + '/code' && (await txt(q, '#sentto strong')) === BOB && !!(await q.evaluate('!!document.querySelector("#code") && !document.querySelector("#email")')) && (await txt(q, '#apprequest')).includes('Test app B2'), await txt(q, 'ident-card'));
312. await shot(q, 'code-for-app-reloaded');
313. await q.type('#code', lastCode('main', BOB));
314. await q.click('#verify');
315. // a first login: the optional names come first, then the choice
316. await q.waitForSelector('#welcome');
317. check('ident#20: app login: signed in after the reload, address bar back on /signin/<rid>', (await q.evaluate('location.pathname')) === ridPath, await q.evaluate('location.pathname'));
318. check('first login via an app: optional names first', /optional/.test(await txt(q, '#welcome')) && !(await q.evaluate('!!document.querySelector("#chooselist")')));
319. await q.click('#skip');
320. await q.waitForSelector('#chooselist');
321. await q.click('#chooselist li:nth-child(1) .choose');
322. await q.waitFor(`location.href.startsWith(${JSON.stringify(TB + '/callback')}) && !!document.querySelector("#identity")`);
323. const bob = (await txt(q, '#identity')).trim();
324. check('another account → another id', /^[2-9a-hj-km-np-z]{5}$/.test(bob) && bob !== b1.identity && bob !== a1.identity);
325. // an existing account signs in via the app: no names form, straight to the choice
326. await q.goto(ID + '/'); await ready(q);
327. await q.click('#signout');
328. await q.waitForSelector('#email');
329. await q.goto(TB + '/');
330. await q.click('#login');
331. await q.waitFor('!!document.querySelector("#email")');
332. // ident#20: "Other address" on the app's code page → back to /signin/<rid>, the email form
333. await ready(q);
334. const ridPath2 = await q.evaluate('location.pathname');
335. await q.type('#email', '[email protected]');
336. await q.click('#sendcode');
337. await q.waitFor(`location.pathname === ${JSON.stringify(ridPath2 + '/code')} && !!document.querySelector("#back")`, { label: 'app code page 2' });
338. await ready(q);
339. await q.click('#back');
340. await q.waitFor(`location.pathname === ${JSON.stringify(ridPath2)} && !!document.querySelector("#email")`, { label: 'back to the app sign-in' });
341. check('ident#20: app login: "Other address" → /signin/<rid> email form under the app banner', (await txt(q, '#apprequest')).includes('Test app B2') && !(await q.evaluate('!!document.querySelector("#code")')));
342. await reload(q);
343. check('ident#20: app login: … and a reload stays on the email form', (await q.evaluate('location.pathname')) === ridPath2 && (await q.evaluate('!!document.querySelector("#email") && !document.querySelector("#code")')));
344. await q.goto(ID + ridPath2 + '/code');
345. await q.waitForSelector('#email');
346. check('ident#20: app login: /signin/<rid>/code with nothing pending → back to /signin/<rid>', (await q.evaluate('location.pathname')) === ridPath2);
347. await browserLogin(q, BOB);
348. await q.waitForSelector('#chooselist');
349. check('known account: straight to the choice (no names form)', !(await q.evaluate('!!document.querySelector("#welcome")')));
350. await q.click('#chooselist li:nth-child(1) .choose');
351. await q.waitFor(`!!document.querySelector("#identity")`);
352. check('after an OTP login: same id as before', (await txt(q, '#identity')).trim() === bob);
354. // ==== 6. the login button refuses: error page, never a redirect =======================
355. console.log('# login button negatives');
356. const badLogin = async (qs, re, label) => {
357. const before = p.messages.length;
358. await p.goto(ID + '/login' + qs);
359. const url = await here(p);
360. const msg = await txt(p, '#errormessage');
361. check(label + ' → error page, no redirect', url.startsWith(ID + '/login') && re.test(msg), url + ' | ' + msg);
362. p.messages.splice(before); // the page's own 400 is expected in the console
363. };
364. await badLogin('?key=' + keyA + '&return=' + encodeURIComponent('http://evil.example.org/callback'), /not one of the origins/, 'foreign origin');
365. await badLogin('?key=' + keyA + '&return=' + encodeURIComponent('http://127.0.0.1:8373/callback'), /not one of the origins/, "the other app's origin");
366. await badLogin('?key=' + keyA + '&return=' + encodeURIComponent('http://127.0.0.1:[email protected]/'), /not one of the origins/, 'user@host trick');
367. await badLogin('?key=' + keyA + '&return=' + encodeURIComponent('javascript:alert(1)'), /http/, 'javascript: URL');
368. await badLogin('?key=' + keyA, /missing/, 'no return URL');
369. await badLogin('?key=pk_00000000000000000000000000000000&return=' + encodeURIComponent(TA + '/callback'), /no app has this API key/, 'unknown key');
370. await badLogin('?return=' + encodeURIComponent(TA + '/callback'), /missing/, 'no key');
371. const res = await fetch(ID + '/login?key=' + keyA + '&return=' + encodeURIComponent('http://evil.example.org/'), { redirect: 'manual' });
372. check('foreign origin: HTTP 400, no Location', res.status === 400 && !res.headers.get('location'), res.status + ' ' + res.headers.get('location'));
373. await shot(p, 'error');
374. await p.goto(ID + '/signin/0123456789abcdef0123456789abcdef');
375. check('unknown request id → "expired" page', /unknown or expired/.test(await txt(p, '#badrequest')));
377. // ==== 7. the exchange ==================================================================
378. console.log('# exchange');
379. const aliceCookie = await apiLogin(ID, 'main', ALICE);
380. const aliceId = idsOf[aliceCookie][0]; // her default (oldest) identity
381. check('ids: identity ids are 12-char mpackdb UUIDs', idsOf[aliceCookie].length >= 1 && idsOf[aliceCookie].every(i => /^[0-9a-z]{12}$/.test(i)), JSON.stringify(idsOf[aliceCookie]));
382. let code = await codeFor(ID, aliceCookie, keyA, TA + '/callback', aliceId);
383. let r = await exchange(ID, { key: keyA, secret: secretB, code });
384. check('wrong secret → 401', r.status === 401, r.t);
385. r = await exchange(ID, { key: 'pk_x', secret: secretA, code });
386. check('unknown key → 401', r.status === 401, r.t);
387. r = await exchange(ID, { key: keyA, secret: secretA, code });
388. check('right key + secret → 200 { identity } only', r.status === 200 && JSON.stringify(Object.keys(r.j)) === '["identity"]' && r.j.identity === a1.identity, r.t);
389. r = await exchange(ID, { key: keyA, secret: secretA, code });
390. check('reused code → 400', r.status === 400 && /already used/.test(r.j.error), r.t);
391. code = await codeFor(ID, aliceCookie, keyA, TA + '/callback', aliceId);
392. r = await exchange(ID, { key: keyB, secret: secretB, code });
393. check("other app's code → 400", r.status === 400 && /not issued to this app/.test(r.j.error), r.t);
394. r = await exchange(ID, { key: keyA, secret: secretA, code });
395. check('a code shown to the wrong app is spent → 400', r.status === 400, r.t);
396. r = await exchange(ID, { key: keyA, secret: secretA, code: 'nope' });
397. check('unknown code → 400', r.status === 400, r.t);
398. r = await exchange(ID, '{"key": "x",');
399. check('invalid JSON → 400', r.status === 400 && /not valid JSON/.test(r.j.error), r.t);
400. r = await exchange(ID, '[1]');
401. check('not an object → 400', r.status === 400 && /object/.test(r.j.error), r.t);
402. r = await exchange(ID, { key: keyA, secret: secretA });
403. check('missing field → 400 naming it', r.status === 400 && r.j.error === 'missing field: code', r.t);
404. r = await exchange(ID, { key: keyA, secret: secretA, code: 'x', email: 'x' });
405. check('unknown field → 400 naming it', r.status === 400 && r.j.error === 'unknown field: email', r.t);
406. r = await exchange(ID, { key: keyA, secret: secretA, code: 5 });
407. check('wrong type → 400 naming it', r.status === 400 && /field code must be a string/.test(r.j.error), r.t);
408. r = await exchange(ID, '{"key":"\\ud83d\\ude00","secret":"a","code":"b"}');
409. check('surrogate escape → 400 (not 500)', r.status === 400, r.t);
410. const g = await fetch(ID + '/api/exchange');
411. check('GET /api/exchange → 405', g.status === 405);
412. // expiry, on the short-clock server (grant TTL 1.5 s)
413. const sc = await apiLogin(IDS, 'short', '[email protected]');
414. const sApp = (await emit(IDS, 'appCreate', [{ name: 'S', origins: [TA] }], sc)).value;
415. const sCode = await codeFor(IDS, sc, sApp.app.apiKey, TA + '/callback', idsOf[sc][0]);
416. await sleep(2000);
417. r = await exchange(IDS, { key: sApp.app.apiKey, secret: sApp.secret, code: sCode });
418. check('expired code → 400', r.status === 400 && /expired/.test(r.j.error), r.t);
419. const sCode2 = await codeFor(IDS, sc, sApp.app.apiKey, TA + '/callback', idsOf[sc][0]);
420. r = await exchange(IDS, { key: sApp.app.apiKey, secret: sApp.secret, code: sCode2 });
421. check('fresh code on the short server → 200', r.status === 200, r.t);
423. // ==== 8. faces: forged sessions (#31), strict fields, other accounts ==================
424. console.log('# faces');
425. const forged = { user: { id: 1 } };
426. for (const [ev, args] of [['appCreate', [{ name: 'X', origins: [TA] }]], ['appUpdate', [1, { name: 'X', origins: [TA] }]], ['appNewSecret', [1]], ['appDelete', [1]], ['chooseIdentity', ['x', 1]]]) {
427. const f = await emit(ID, ev, [...args, forged]);
428. check(`forged session argument refused: ${ev}`, framework_refused(f.raw) || (f.value && /not signed in/.test(f.value.error)), f.raw);
429. }
430. let e = await emit(ID, 'appCreate', [{ name: 'X', origins: [TA], secret: 'mine' }], aliceCookie);
431. check('appCreate unknown field → named', e.value.error === 'unknown field: secret' && e.value.field === 'secret', e.raw);
432. e = await emit(ID, 'appCreate', [{ name: 'X' }], aliceCookie);
433. check('appCreate missing origins → named', e.value.field === 'origins', e.raw);
434. e = await emit(ID, 'appCreate', [{ name: '', origins: [TA] }], aliceCookie);
435. check('appCreate empty name refused', e.value.field === 'name', e.raw);
436. e = await emit(ID, 'appCreate', [{ name: 'X', origins: 'http://a.b' }], aliceCookie);
437. check('appCreate origins not a list refused', e.value.field === 'origins', e.raw);
438. e = await emit(ID, 'appCreate', [{ name: 'X', origins: Array.from({ length: 11 }, (_, i) => 'http://h' + i + '.example') }], aliceCookie);
439. check('appCreate 11 origins refused', /at most 10/.test(e.value.error), e.raw);
440. e = await emit(ID, 'appCreate', [{ name: 'X', origins: ['ftp://a.b'] }], aliceCookie);
441. check('appCreate ftp origin refused', e.value.field === 'origins', e.raw);
442. const bobCookie = await apiLogin(ID, 'main', BOB);
443. const aliceApp = (await ssrIds(ID, '/apps', aliceCookie))[0];
444. check('ids: app ids are 12-char mpackdb UUIDs (read off /apps)', /^[0-9a-z]{12}$/.test(aliceApp || ''), JSON.stringify(aliceApp));
445. e = await emit(ID, 'appUpdate', [aliceApp, { name: 'hijack', origins: ['http://evil.example'] }], bobCookie);
446. check("another account cannot edit alice's app", e.value.error === 'no such app', e.raw);
447. e = await emit(ID, 'appNewSecret', [aliceApp], bobCookie);
448. check("another account cannot renew alice's secret", e.value.error === 'no such app', e.raw);
449. e = await emit(ID, 'appDelete', [aliceApp], bobCookie);
450. check("another account cannot delete alice's app", e.value.error === 'no such app', e.raw);
451. const l = await fetch(ID + '/login?key=' + keyA + '&return=' + encodeURIComponent(TA + '/callback'), { redirect: 'manual' });
452. const rid = l.headers.get('location').split('/').pop();
453. e = await emit(ID, 'chooseIdentity', [rid, aliceId], bobCookie);
454. check("choosing another account's identity refused", e.value.error === 'no such identity', e.raw);
455. e = await emit(ID, 'chooseIdentity', [rid, 1], aliceCookie);
456. check('chooseIdentity wrong type (a number, the old ids) refused', /must be a string/.test(e.value.error), e.raw);
457. e = await emit(ID, 'appUpdate', [1, { name: 'X', origins: [TA] }], aliceCookie);
458. check('appUpdate with an old numeric id: no such app', e.value.error === 'no such app', e.raw);
460. // ==== 9. new secret, delete (browser) ==================================================
461. console.log('# new secret, delete');
462. await p.goto(ID + '/apps'); await ready(p);
463. p.dialogAnswers.push(false);
464. await p.click('#apps li:nth-child(1) .newsecret');
465. await sleep(300);
466. check('new secret: dismissed confirm changes nothing', !(await p.evaluate('!!document.querySelector("#secretbox")')) && p.dialogs.length === 1);
467. p.dialogAnswers.push(true);
468. await p.click('#apps li:nth-child(1) .newsecret');
469. await p.waitForSelector('#secret');
470. const secretA2 = (await txt(p, '#secret')).trim();
471. check('new secret shown once, differs', /^sk_[0-9a-f]{48}$/.test(secretA2) && secretA2 !== secretA);
472. await p.click('#secretdone');
473. code = await codeFor(ID, aliceCookie, keyA, TA + '/callback', aliceId);
474. r = await exchange(ID, { key: keyA, secret: secretA, code });
475. check('old secret → 401 after renewal', r.status === 401, r.t);
476. r = await exchange(ID, { key: keyA, secret: secretA2, code });
477. check('new secret works, same id', r.status === 200 && r.j.identity === a1.identity, r.t);
478. // the test app still has the old secret: its exchange fails visibly
479. await pressLogin(TA);
480. await p.click('#chooselist li:nth-child(1) .choose');
481. const beforeOld = p.messages.length;
482. await p.waitFor('!!document.querySelector("#result")');
483. await sleep(300);
484. p.messages.splice(beforeOld); // the test app's own 400 page is expected
485. check('test app with the old secret: exchange refused (401)', (await txt(p, '#status')) === '401', await txt(p, '#result'));
486. await setupApp(TA, keyA, secretA2);
487. await pressLogin(TA);
488. const a3 = await chooseAndReturn(1, TA);
489. check('test app with the new secret: logged in, same id', a3.identity === a1.identity, JSON.stringify(a3));
490. // delete app B
491. await p.goto(ID + '/apps'); await ready(p);
492. p.dialogAnswers.push(true);
493. await p.click('#apps li:nth-child(2) .delete');
494. await p.waitFor('document.querySelectorAll("#apps li").length === 1');
495. check('app deleted from the list', !(await txt(p, '#apps')).includes('Test app B2'));
496. await badLogin('?key=' + keyB + '&return=' + encodeURIComponent(TB + '/callback'), /no app has this API key/, 'deleted app key');
498. // ==== 10. console ======================================================================
499. const probs = pages.flatMap(x => x.problems().map(m => m.text));
500. check('no console errors or warnings', probs.length === 0, probs.join(' | '));
501. } catch (err) {
502. failed++;
503. console.log(' FAIL (aborted) ' + (err && err.stack || err));
504. for (const x of pages) console.log('--- console:\n' + x.dumpConsole());
505. } finally {
506. for (const b of [browser1, browser2]) { if (b) { try { await b.close(); } catch {} } }
507. stopAll();
508. await sleep(300);
509. }
510. console.log(`\n${passed} passed, ${failed} failed`);
511. process.exit(failed ? 1 : 0);