test(web): the same-tab sign-in check also runs with the extension host on its own origin

Author: ndemianc

web/test/e2e-signin-tab.mjs

@@ -16,8 +16,8 @@
 //   - a result left by a callback page whose editor is gone is delivered when the editor next starts,
 //     and an old one is not.
 //
-//   node web/test/e2e-signin-tab.mjs --static <vscode-web dir> --extensions <built extensions dir>
-//   node web/test/e2e-signin-tab.mjs --dist <release dir>
+//   node web/test/e2e-signin-tab.mjs --static <vscode-web dir> --extensions <built extensions dir> [--product <json>]
+//   node web/test/e2e-signin-tab.mjs --dist <release dir> --stub-port <the account port it was built with>
 import { spawn } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -44,7 +44,12 @@ const check = (name, ok, detail = '') => { results.push(ok); console.log(`${ok ?
 const stub = await startStub({ editorOrigin, port: args['stub-port'] ? Number(args['stub-port']) : 0 });
 const server = spawn(process.execPath, [path.join(HERE, '..', 'serve.mjs'), '--port', String(PORT), ...(DIST
 	? ['--dist', DIST]
-	: ['--static', STATIC, '--extensions', EXTS, '--extension-names', 'levelcode-ai,levelcode-web', '--account', stub.origin])], { stdio: 'inherit' });
+	: ['--static', STATIC, '--extensions', EXTS, '--extension-names', 'levelcode-ai,levelcode-web', '--account', stub.origin,
+		...(args.product ? ['--product', args.product] : [])])], { stdio: 'inherit' });
+// With the extension host on an origin of its own (--product with webEndpointUrlTemplate, or a release built with
+// --ext-host-origin) its fetches carry THAT origin, not the editor's.
+let hardened = /webEndpointUrlTemplate/.test(args.product || '');
+if (DIST) { try { hardened = !/\(same origin/.test(fs.readFileSync(path.join(DIST, 'build.json'), 'utf8')); } catch { /* keep */ } }
 let chrome;
 const finish = async (code) => { try { chrome && chrome.close(); } catch {} try { server.kill(); } catch {} try { await stub.close(); } catch {} process.exit(code); };
 process.on('SIGINT', () => finish(130));
@@ -66,7 +71,8 @@ try {
 	await page.waitFor(() => exchanges() >= 1, { ms: 90000, label: 'code exchange' }).catch(() => null);
 	check('the code was exchanged, with the verifier that was kept across the reload', exchanges() === 1, 'exchanges: ' + exchanges());
 	const exch = stub.state.log.find((e) => e.path === '/api/levelcode/v1/auth/exchange' && e.method === 'POST') || {};
-	check('the exchange came from the editor\'s origin (CORS answered)', exch.origin === editorOrigin, 'from ' + exch.origin);
+	check(hardened ? 'the exchange came from the extension host\'s own origin (CORS answered)' : 'the exchange came from the editor\'s origin (CORS answered)',
+		hardened ? /^https?:\/\/v--[a-z0-9]+\./.test(exch.origin || '') : exch.origin === editorOrigin, 'from ' + exch.origin);
 	await workbenchReady(page);
 	await page.waitFor(() => accountCalls() >= 1, { ms: 30000, label: 'the account API with the new token' }).catch(() => null);
 	check('the editor then used its session against the account API', accountCalls() >= 1, 'calls: ' + accountCalls());