|
| 1 | +import test from "node:test"; |
| 2 | +import assert from "node:assert/strict"; |
| 3 | +import { ensureTestEnv } from "./helpers.js"; |
| 4 | + |
| 5 | +ensureTestEnv(); |
| 6 | +delete process.env.ADMIN_PASSWORD; |
| 7 | +delete process.env.CG_API_KEY; |
| 8 | + |
| 9 | +const { saveSettings } = await import("../src/config/settings.js"); |
| 10 | +const { hashPassword } = await import("../src/web/security.js"); |
| 11 | +const { createWebApp } = await import("../src/web/app.js"); |
| 12 | +const password = "disposable-login-browser-fixture"; |
| 13 | + |
| 14 | +async function startApp(t) { |
| 15 | + saveSettings({ adminPassword: await hashPassword(password), apiKey: "" }); |
| 16 | + const app = createWebApp(); |
| 17 | + const server = await new Promise((resolve) => { |
| 18 | + const listening = app.listen(0, "127.0.0.1", () => resolve(listening)); |
| 19 | + }); |
| 20 | + t.after(() => new Promise((resolve) => { server.closeAllConnections(); server.close(resolve); })); |
| 21 | + return `http://127.0.0.1:${server.address().port}`; |
| 22 | +} |
| 23 | + |
| 24 | +test("logged-out sign-in serves its real assets while the dashboard stays gated", async (t) => { |
| 25 | + const base = await startApp(t); |
| 26 | + const page = await fetch(`${base}/login.html`); |
| 27 | + assert.equal(page.status, 200); |
| 28 | + const html = await page.text(); |
| 29 | + const assets = [...html.matchAll(/(?:src=|href=|url\()"([^"?]+)(?:\?[^\"]*)?"/g)].map((match) => match[1]); |
| 30 | + assert.ok(assets.includes("/login.js"), "exercise the actual login page's script dependency"); |
| 31 | + assert.ok(assets.some((asset) => asset.endsWith(".woff2")), "exercise the login page's font dependencies"); |
| 32 | + for (const asset of assets) { |
| 33 | + const response = await fetch(`${base}${asset}?v=login-regression`, { redirect: "manual" }); |
| 34 | + assert.equal(response.status, 200, `${asset} must load without a session or redirect`); |
| 35 | + assert.equal(response.headers.get("location"), null); |
| 36 | + const bytes = Buffer.from(await response.arrayBuffer()); |
| 37 | + if (asset.endsWith(".js")) { |
| 38 | + assert.match(response.headers.get("content-type"), /javascript/); |
| 39 | + assert.match(bytes.toString(), /addEventListener/); |
| 40 | + assert.equal(response.headers.get("cache-control"), "no-cache"); |
| 41 | + } else if (asset.endsWith(".woff2")) { |
| 42 | + assert.match(response.headers.get("content-type"), /font\/woff2/); |
| 43 | + assert.equal(bytes.subarray(0, 4).toString(), "wOF2"); |
| 44 | + } else { |
| 45 | + assert.match(response.headers.get("content-type"), /image\/svg\+xml/); |
| 46 | + } |
| 47 | + const head = await fetch(`${base}${asset}`, { method: "HEAD", redirect: "manual" }); |
| 48 | + assert.equal(head.status, 200); |
| 49 | + } |
| 50 | + for (const route of ["/", "/app.js", "/styles.css", "/fonts/poppins-500-latin.woff2", "/login.js-extra"]) { |
| 51 | + const response = await fetch(`${base}${route}`, { redirect: "manual" }); |
| 52 | + assert.equal(response.status, 302, `${route} must remain session-gated`); |
| 53 | + assert.equal(response.headers.get("location"), "/login.html"); |
| 54 | + await response.arrayBuffer(); |
| 55 | + } |
| 56 | + const settings = await fetch(`${base}/api/settings`); |
| 57 | + assert.equal(settings.status, 401); |
| 58 | + await settings.arrayBuffer(); |
| 59 | +}); |
| 60 | + |
| 61 | +test("fresh browser signs in through the form and returns to working sign-in after logout", { skip: !process.env.CG_BROWSER_MODULE }, async (t) => { |
| 62 | + const base = await startApp(t); |
| 63 | + const { chromium } = await import(process.env.CG_BROWSER_MODULE); |
| 64 | + const browser = await chromium.launch({ headless: true, executablePath: process.env.CG_BROWSER_EXECUTABLE }); |
| 65 | + t.after(() => browser.close()); |
| 66 | + const context = await browser.newContext(); |
| 67 | + const page = await context.newPage(); |
| 68 | + const errors = []; |
| 69 | + page.on("pageerror", (error) => errors.push(error.message)); |
| 70 | + await page.goto(base); |
| 71 | + assert.equal(new URL(page.url()).pathname, "/login.html"); |
| 72 | + assert.deepEqual(await context.cookies(), []); |
| 73 | + await page.locator("#pw").fill("wrong-disposable-password"); |
| 74 | + await page.getByRole("button", { name: "Sign in" }).click(); |
| 75 | + await page.locator("#err").filter({ hasText: "Wrong password" }).waitFor(); |
| 76 | + await page.locator("#pw").fill(password); |
| 77 | + await Promise.all([ |
| 78 | + page.waitForURL(`${base}/`), |
| 79 | + page.getByRole("button", { name: "Sign in" }).click(), |
| 80 | + ]); |
| 81 | + const session = (await context.cookies()).find((cookie) => cookie.name === "cg_session"); |
| 82 | + assert.ok(session); |
| 83 | + assert.equal(session.httpOnly, true); |
| 84 | + assert.equal(session.sameSite, "Strict"); |
| 85 | + assert.equal(await page.evaluate(async () => (await fetch("/api/settings")).status), 200); |
| 86 | + assert.equal(await page.evaluate(async () => (await fetch("/api/logout", { method: "POST" })).status), 200); |
| 87 | + await page.goto(base); |
| 88 | + assert.equal(new URL(page.url()).pathname, "/login.html"); |
| 89 | + await page.locator("#pw").fill(password); |
| 90 | + await Promise.all([ |
| 91 | + page.waitForURL(`${base}/`), |
| 92 | + page.getByRole("button", { name: "Sign in" }).click(), |
| 93 | + ]); |
| 94 | + assert.deepEqual(errors, []); |
| 95 | +}); |
0 commit comments