tickets

72.9 KB

1. // tests/browser.mjs — THE GATE of tickets.worldapi.org: its own server on its own
2. // storage, the import command, the JSON API, and TWO real headless Chromes (two
3. // viewers) for the live push. Everything is checked in the browser's DOM, not in
4. // curl output. Ticket #10 added: the strict API table (unknown / missing / empty /
5. // wrong-type fields → 400 naming the field, nothing written), Vienna local time (checked
6. // against node's Intl, also tests/localtime.hl's DST edges), and the paragraph import
7. // (a CRLF fixture in .scratch/gate-import → #7, rendered with a blank line between).
8. // Ticket #15 added: `author` required on every POST (missing/empty → 400 naming author),
9. // invalid JSON → 400 { error } without source paths (jsoncheck.hl), the web forms have no
10. // name field (author 'creator'), and list lines kept by the import (.scratch/gate-import-lists → hybriel #3).
11. // Ticket #38 (mission 008) added: UUID keys + storage in <store>/mpackdb, per-project
12. // numbers and URLs /projects/<slug>/<number>. The gate FIRST writes an old-format store
13. // (tests/oldstore.hl: 5 tickets, old #1–#5 in projects alpha / beta.example.org), migrates
14. // it TWICE with tools/migrate-008.hl (the second run must write nothing), and runs the
15. // server on the migrated tables: old numbers answer on /api/tickets/<n>, /tickets/<n>
16. // redirects (301) to the new URL, the per-project API, live pushes carrying the new hrefs.
17. // Ticket #7 (mission 011) added LOGIN VIA IDENT: the gate runs its OWN ident (a copy of
18. // ident's code without .env / storage — codes go to a mail sink, never real mail; tests/identkit.mjs)
19. // on :8353, registers tickets there (origin = this gate's server), and then: every API write
20. // needs `Authorization: Bearer <token>` (401 otherwise, checked before the body; `author` in a
21. // body → 400), a machine user "gate" logs in through the login button's server half
22. // (/login/callback) and makes its token over the face; the FIRST server runs without
23. // TICKETS_CREATOR_IDENTITY (nobody may confirm/reject → 403), the second with alice's per-app id.
24. // In the browsers: signed out = reading only; A (alice, the creator) logs in with the identity
25. // SELECTOR, B (bob) with the LOGIN BUTTON; both get the display-name prompt; writes show the
26. // user as author; bob cannot confirm/reject, alice can; bob's token on /you: shown once → API
27. // write as bob → revoke → 401; forged face sessions (#31) are refused; old events keep their
28. // authors; logout resets the selector.
29. // Ticket #12 (mission 024) added THE MARKDOWN EDITOR: comment, state note, edit summary and new-ticket
30. // summary are <md-editor>s around their textareas (shared/md-editor.js). Real typing (formatting
31. // while typing, "- " lists, Ctrl+Enter sends), the toolbar by click / tap at 390px, a hostile rich
32. // paste reduced to the subset, the edit form opening the stored Markdown byte for byte, SSR keeps
33. // the plain textareas (no JS = as before). The component's own test: worldapi-components/test/run.mjs.
34. //
35. // node tests/browser.mjs (TICKETS_GATE_PORT to move the server, default 8352;
36. // TICKETS_GATE_IDENT_PORT the gate's ident, default 8353;
37. // TICKETS_GATE_IDENT_DIR ident's code, default ../ident.worldapi.org)
38. //
39. // Debug ports: 8620-8629 (browser A) and 8630-8639 (browser B) — TICKETS_GATE_CHROME_A /
40. // TICKETS_GATE_CHROME_B ("8810-8814") move them (mission 017: parallel workers get disjoint
41. // port ranges). Screenshots at 390px
42. // and 1280px land in .scratch/gate-*.png — LOOK at them. The whole server log is kept in
43. // .scratch/gate-server.log. Every process started here (server, import runs, Chromes)
44. // is stopped by PID in `finally`.
45. import { spawn, spawnSync } from 'node:child_process';
46. import http from 'node:http';
47. import { rmSync, mkdirSync, writeFileSync, existsSync, readdirSync, copyFileSync } from 'node:fs';
48. import { dirname, join, resolve } from 'node:path';
49. import { fileURLToPath } from 'node:url';
50. import { launchBrowser } from './cdp.mjs';
51. import { startIdent } from './identkit.mjs';
53. if (!process.env.HL_CHROME && existsSync('/opt/google/chrome/chrome')) process.env.HL_CHROME = '/opt/google/chrome/chrome';
54. const HERE = dirname(fileURLToPath(import.meta.url));
55. const APP = resolve(HERE, '..');
56. const BIN = join(APP, 'bin/hybriel');
57. const PORT = Number(process.env.TICKETS_GATE_PORT || 8352);
58. const BASE = `http://127.0.0.1:${PORT}`;
59. const SCRATCH = join(APP, '.scratch');
60. const STORE = join(SCRATCH, 'gate-store');
61. const IDENT_PORT = Number(process.env.TICKETS_GATE_IDENT_PORT || 8353);
62. // ident's CODE (read only — copied without .env/storage by identkit): the sibling folder,
63. // or the Loreana path when the gate runs in a copy (.scratch/dev…)
64. const IDENT_DIR = process.env.TICKETS_GATE_IDENT_DIR || [resolve(APP, '../ident.worldapi.org'), '/media/STORAGE/projects/ident.worldapi.org'].find(d => existsSync(join(d, 'project.hl')));
65. rmSync(STORE, { recursive: true, force: true });
66. mkdirSync(join(STORE, 'mpackdb'), { recursive: true });
68. let failures = 0, passes = 0;
69. function check(label, ok, detail = '') {
70. console.log(`${ok ? 'ok ' : 'FAIL'} ${label}${ok ? '' : ' — ' + detail}`);
71. if (ok) passes++; else failures++;
72. }
73. const sleep = (ms) => new Promise(r => setTimeout(r, ms));
74. const J = JSON.stringify;
76. // ---- the legacy fixture (ticket #20): a store from before projects were own data; the server's migrate.hl
77. // turns it into projects with ids, members and the new states at its first start ----------------------
78. const hl = (script, env) => { const r = spawnSync(BIN, [script], { cwd: APP, env: { ...process.env, ...env }, encoding: 'utf8', timeout: 60000 }); return (r.stdout || '') + (r.stderr || ''); };
79. const fixture = hl('tests/oldstore.hl', { TICKETS_STORAGE: join(STORE, 'mpackdb') });
80. check('migrate: the pre-#20 fixture is written (2 projects, 5 tickets, 8 events)', /oldstore: 2 projects, 5 tickets, 8 events/.test(fixture), fixture);
82. // ---- the servers: our own ident, then tickets (twice: without and with a creator) ----------
83. let log = '';
84. let server = null;
85. let ident = null;
86. // ticket #9 (mission 012): the exchanges ident RECEIVES from tickets, counted by a small proxy
87. // between the two (tickets' IDENT_EXCHANGE_URL → here → our ident)
88. const EXCH_PORT = Number(process.env.TICKETS_GATE_EXCHANGE_PORT || 8357);
89. const exchanges = [];
90. const exchProxy = http.createServer((req, res) => {
91. let body = '';
92. req.on('data', d => body += d);
93. req.on('end', async () => {
94. try {
95. const r = await fetch(`http://127.0.0.1:${IDENT_PORT}${req.url}`, { method: req.method, headers: { 'content-type': req.headers['content-type'] || 'application/json' }, body: req.method === 'GET' ? undefined : body });
96. const t = await r.text();
97. let code = ''; try { code = JSON.parse(body).code || ''; } catch {}
98. exchanges.push({ path: req.url, code, status: r.status });
99. res.writeHead(r.status, { 'content-type': r.headers.get('content-type') || 'application/json' });
100. res.end(t);
101. } catch (e) { req.socket.destroy(); } // ident stopped: tickets must see NO answer, like a direct connection
102. });
103. });
104. await new Promise((ok, bad) => { exchProxy.once('error', bad); exchProxy.listen(EXCH_PORT, '127.0.0.1', ok); });
105. let APPKEY = null;
106. function startTickets(extraEnv) {
107. log += `\n==== tickets server start ${J(Object.keys(extraEnv))}\n`;
108. server = spawn(BIN, ['project.hl'], {
109. cwd: APP,
110. env: { ...process.env, TICKETS_PORT: String(PORT), TICKETS_STORAGE: join(STORE, 'mpackdb'), TICKETS_SESSIONS: join(STORE, 'sessions'),
111. IDENT_URL: `http://127.0.0.1:${IDENT_PORT}`, IDENT_EXCHANGE_URL: `http://127.0.0.1:${EXCH_PORT}`, TICKETS_PUBLIC_URL: BASE, IDENT_API_KEY: APPKEY.key, IDENT_API_SECRET: APPKEY.secret,
112. TICKETS_CREATOR_IDENTITY: '', TICKETS_WATCH: '0', ...extraEnv },
113. stdio: ['ignore', 'pipe', 'pipe'],
114. });
115. server.stdout.on('data', d => log += d); server.stderr.on('data', d => log += d);
116. }
117. async function stopTickets() {
118. if (!server) return;
119. const s = server;
120. try { s.kill('SIGTERM'); } catch {}
121. await new Promise(r => { if (s.exitCode !== null || s.signalCode !== null) return r(); s.once('exit', r); setTimeout(r, 3000); });
122. }
123. async function ticketsUp() {
124. for (let i = 0; i < 80; i++) { try { const r = await fetch(BASE + '/'); if (r.ok) return; } catch {} await sleep(250); }
125. throw new Error('server did not come up\n' + log);
126. }
128. // THE API: reads never carry a token (reading is public); writes carry the gate user's
129. // token unless another (or none: null) is given
130. let TOKEN = null;
131. const api = async (method, path, body, token = TOKEN) => {
132. const headers = body ? { 'content-type': 'application/json' } : {};
133. if (method !== 'GET' && token) headers.authorization = 'Bearer ' + token;
134. const r = await fetch(BASE + path, { method, headers, body: body ? J(body) : undefined });
135. let json = null; try { json = await r.json(); } catch {}
136. return { status: r.status, json };
137. };
138. const runImport = (token = TOKEN) => {
139. const r = spawnSync(BIN, ['import.hl'], { cwd: APP, env: { ...process.env, TICKETS_URL: BASE, TICKETS_TOKEN: token || '' }, encoding: 'utf8', timeout: 60000 });
140. return (r.stdout || '') + (r.stderr || '');
141. };
142. // a face over the REST carrier (POST /__hl/emit) with a cookie (or none)
143. let emitI = 0;
144. // hybriel#16 (mission 036): hl:web itself refuses an emit with one argument too many — the ack is
145. // ok:false "… the `session` parameter is filled by the server, never by the peer"; the face never runs.
146. const framework_refused = (raw) => { try { const j = JSON.parse(raw); return j.ok === false && /the `session` parameter is filled by the server/.test(j.error || ''); } catch { return false; } };
147. const temit = async (event, payload, cookie) => {
148. const r = await fetch(BASE + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', ...(cookie ? { cookie } : {}) }, body: J({ t: 'emit', i: ++emitI, event, payload }) });
149. const raw = await r.text();
150. let j = null; try { j = JSON.parse(raw); } catch {}
151. return { status: r.status, value: j ? j.value : undefined, raw };
152. };
153. const cookieOf = (r) => (r.headers.get('set-cookie') || '').split(';')[0];
154. const texts = (page, sel) => page.evaluate(`Array.from(document.querySelectorAll(${J(sel)})).map(e => e.textContent.trim())`);
155. const type = (page, sel, value) => page.evaluate(`(() => { const i = document.querySelector(${J(sel)}); i.value = ${J(value)}; i.dispatchEvent(new Event("input", { bubbles: true })); })()`);
156. const choose = (page, sel, value) => page.evaluate(`(() => { const i = document.querySelector(${J(sel)}); i.value = ${J(value)}; i.dispatchEvent(new Event("change", { bubbles: true })); })()`);
157. const connected = (page, label) => page.waitFor('!!window.__hl && window.__hl.socket && window.__hl.socket.readyState === 1', { label });
158. // a client-side navigation by a REAL click, then the socket announced the new mounts
159. const clickNav = async (page, sel, cond, label) => { await page.click(sel); await page.waitFor(cond, { label }); await sleep(300); };
160. async function viewport(page, width, height) {
161. await page.send('Emulation.setDeviceMetricsOverride', { width, height, deviceScaleFactor: 1, mobile: width < 600 });
162. await sleep(250);
163. }
164. async function shot(page, name) {
165. const { data } = await page.send('Page.captureScreenshot', { format: 'png', captureBeyondViewport: true });
166. writeFileSync(join(SCRATCH, `gate-${name}.png`), Buffer.from(data, 'base64'));
167. }
168. const noOverflow = (page) => page.evaluate('document.documentElement.scrollWidth <= window.innerWidth');
169. // INSIDE ident's selector (shadow DOM): an expression over its root `r`, and a REAL click
170. const sh = (expr) => `(() => { const h = document.querySelector('#selector'); const r = h && h.shadowRoot; if (!r) return null; return (${expr}); })()`;
171. async function shClick(page, inner, name = null) {
172. const find = `(() => { const h = document.querySelector('#selector'); const r = h && h.shadowRoot; if (!r) return null; const el = ${name === null ? `r.querySelector(${J(inner)})` : `[...r.querySelectorAll(${J(inner)})].find(b => b.textContent === ${J(name)})`}; if (!el) return null; el.scrollIntoView({ block: 'center' }); const b = el.getBoundingClientRect(); if (!b.width) return null; return { x: b.left + b.width / 2, y: b.top + b.height / 2 }; })()`;
173. const box = await page.waitFor(find, { label: 'selector ' + inner + ' ' + (name || '') });
174. const at = { x: Math.round(box.x), y: Math.round(box.y), button: 'left', clickCount: 1 };
175. await page.send('Input.dispatchMouseEvent', { type: 'mouseMoved', ...at, buttons: 0 });
176. await page.send('Input.dispatchMouseEvent', { type: 'mousePressed', ...at, buttons: 1 });
177. await page.send('Input.dispatchMouseEvent', { type: 'mouseReleased', ...at, buttons: 0 });
178. }
179. const connectedIdent = (page) => page.waitFor('!!window.__hl && window.__hl.socket && window.__hl.socket.readyState === 1', { label: 'ident page hydrated' });
180. // sign in to OUR ident on ident's own page (email → code from the sink → skip the names)
181. async function identSignIn(page, email) {
182. await page.goto(ident.base + '/');
183. await page.waitForSelector('#email');
184. await connectedIdent(page);
185. await page.type('#email', email);
186. await page.click('#sendcode');
187. // ident#20: a sent code NAVIGATES to ident's /code page; type only once that page is hydrated
188. await page.waitFor('/\\/code$/.test(location.pathname) && !!document.querySelector("#code")', { label: 'ident /code page' });
189. await connectedIdent(page);
190. await page.type('#code', ident.lastCode(email));
191. await page.click('#verify');
192. await page.waitForSelector('#signout', { timeout: 10000 });
193. }
195. // TICKET #11 (mission 014): the gate must stay green while other browsers load the machine.
196. // Every wait of a page (waitFor / waitForSelector / click / goto) gets SLOW× its timeout
197. // (TICKETS_GATE_SLOW, default 3: 10 s → 30 s) — a wait that succeeds returns at once, so a green
198. // run costs nothing; only a real failure waits longer before it says so.
199. const SLOW = Number(process.env.TICKETS_GATE_SLOW || 3);
200. function patient(page) {
201. const waitFor = page.waitFor.bind(page);
202. page.waitFor = (expr, o = {}) => waitFor(expr, { ...o, timeout: (o.timeout || 10000) * SLOW });
203. const goto = page.goto.bind(page);
204. page.goto = (url, o = {}) => goto(url, { ...o, timeout: (o.timeout || 15000) * SLOW });
205. return page;
206. }
208. let A, B;
209. try {
210. // ---- ticket #7: our own ident, tickets registered in it ----------------------------------
211. ident = await startIdent({ identDir: IDENT_DIR, workDir: join(STORE, 'ident'), port: IDENT_PORT });
212. const alice = await ident.signIn('[email protected]');
213. const bob = await ident.signIn('[email protected]');
214. const gateAcct = await ident.signIn('[email protected]');
215. APPKEY = await ident.registerApp(alice, 'tickets (gate)', [BASE]);
216. check('ident: our own ident runs (a copy without .env), tickets is registered (key + secret)', /^pk_[0-9a-f]{32}$/.test(APPKEY.key) && /^sk_[0-9a-f]{48}$/.test(APPKEY.secret) && !existsSync(join(STORE, 'ident', 'ident-code', '.env')));
217. // alice's per-app id — what the architect puts into TICKETS_CREATOR_IDENTITY
218. const ALICE_ID = await ident.exchange(APPKEY, await ident.selectorCode(alice, APPKEY, BASE));
219. const GATE_ID = await ident.exchange(APPKEY, await ident.selectorCode(gateAcct, APPKEY, BASE));
220. check('ident: one identity id per identity (a short id, or the old 32 hex)', /^[0-9a-z]{5,64}$/.test(ALICE_ID) && /^[0-9a-z]{5,64}$/.test(GATE_ID) && ALICE_ID !== GATE_ID, ALICE_ID + ' ' + GATE_ID);
222. // ---- server #1: NO creator configured ---------------------------------------------------
223. startTickets({});
224. await ticketsUp();
225. // the machine user "gate": the login button's SERVER half (ident → /login/callback?ident_code=)
226. const first = await fetch(BASE + '/');
227. const GATE_COOKIE = cookieOf(first);
228. check('login: a page visit gets the tickets session cookie (hlsid)', /^hlsid=[0-9a-f]+$/.test(GATE_COOKIE), GATE_COOKIE);
229. const noCode = await fetch(BASE + '/login/callback', { headers: { cookie: GATE_COOKIE }, redirect: 'manual' });
230. check('login: /login/callback without a code → 400 page, no redirect', noCode.status === 400 && !noCode.headers.get('location') && /no login code/.test(await noCode.text()));
231. const badCode = await fetch(BASE + '/login/callback?ident_code=' + 'ab'.repeat(24), { headers: { cookie: GATE_COOKIE }, redirect: 'manual' });
232. check('login: an unknown code → 400 "ident refused the login", no redirect', badCode.status === 400 && !badCode.headers.get('location') && /ident refused the login \(400/.test(await badCode.text()));
233. const gateCode = await ident.selectorCode(gateAcct, APPKEY, BASE);
234. const cb = await fetch(BASE + '/login/callback?ident_code=' + gateCode, { headers: { cookie: GATE_COOKIE }, redirect: 'manual' });
235. check('login: /login/callback exchanges the code → 302 to /', cb.status === 302 && cb.headers.get('location') === '/', cb.status + ' ' + cb.headers.get('location'));
236. const again = await fetch(BASE + '/login/callback?ident_code=' + gateCode, { headers: { cookie: GATE_COOKIE }, redirect: 'manual' });
237. check('login: the same code again → 400 (single use)', again.status === 400 && /already used/.test(await again.text()));
238. // ticket #10: the button's return URL carries ?next=<page> (login.js); /login/callback follows
239. // only a same-origin PATH, anything else → /
240. for (const [next, want] of [
241. ['/projects/alpha/2', '/projects/alpha/2'], ['/project/alpha/state/open?x=1&y=2', '/project/alpha/state/open?x=1&y=2'], ['/inbox', '/inbox'],
242. ['/%2F%2Fevil.example', '/%2F%2Fevil.example'],
243. ['//evil.example/x', '/'], ['https://evil.example/', '/'], ['http:/evil.example', '/'], ['/\\evil.example', '/'], ['javascript:alert(1)', '/'],
244. ['evil.example', '/'], ['/a b', '/'], ['/x\r\nSet-Cookie: a=b', '/'], ['/x"><script>', '/'], ['/login/callback', '/'], ['/' + 'a'.repeat(500), '/'], ['', '/'],
245. ]) {
246. const c = await ident.selectorCode(gateAcct, APPKEY, BASE);
247. const r = await fetch(BASE + '/login/callback?next=' + encodeURIComponent(next) + '&ident_code=' + c, { headers: { cookie: GATE_COOKIE }, redirect: 'manual' });
248. check(`return (#10): next=${J(next.length > 40 ? next.slice(0, 20) + '…(' + next.length + ')' : next)} → 302 ${want}`, r.status === 302 && r.headers.get('location') === want, r.status + ' ' + r.headers.get('location'));
249. }
250. let html = await (await fetch(BASE + '/', { headers: { cookie: GATE_COOKIE } })).text();
251. check('login: first login → the page asks for a display name, no write form yet', html.includes('id="nameform"') && !html.includes('id="newticketform"') && html.includes('class="in"'));
252. check('login: the page never carries the identity id (only /you does)', !html.includes(GATE_ID));
253. let f = await temit('commentOn', ['x', 'before the name'], GATE_COOKIE);
254. check('login: no writing before a display name', f.value && /display name first/.test(f.value.error), f.raw);
255. f = await temit('saveDisplayName', [' '], GATE_COOKIE);
256. check('name: an empty display name is refused', f.value && /must not be empty/.test(f.value.error), f.raw);
257. f = await temit('saveDisplayName', ['x'.repeat(61)], GATE_COOKIE);
258. check('name: 61 characters are refused', f.value && /too long/.test(f.value.error), f.raw);
259. f = await temit('saveDisplayName', ['gate'], GATE_COOKIE);
260. check('name: "gate" saved (answer: name, named — no identity id)', f.value && f.value.name === 'gate' && f.value.named === true && !f.raw.includes(GATE_ID), f.raw);
261. f = await temit('saveDisplayName', ['gate2'], GATE_COOKIE);
262. check('name: asked once — a second name is refused', f.value && /already set/.test(f.value.error), f.raw);
263. html = await (await fetch(BASE + '/', { headers: { cookie: GATE_COOKIE } })).text();
264. check('name: afterwards no prompt; no role yet → no ticket form, a role hint (ticket #20)', !html.includes('id="nameform"') && !html.includes('id="newticketform"') && html.includes('id="rolehint"'));
265. f = await temit('tokenCreate', ['gate machine'], GATE_COOKIE);
266. TOKEN = f.value && f.value.token;
267. check('token: created over the face — tkt_ + 48 hex, listed with its label', /^tkt_[0-9a-f]{48}$/.test(TOKEN || '') && f.value.tokens.length === 1 && f.value.tokens[0].label === 'gate machine' && !J(f.value.tokens).includes(TOKEN), f.raw);
268. const you0 = await (await fetch(BASE + '/you', { headers: { cookie: GATE_COOKIE } })).text();
269. check('/you shows the user its own ident id and "not a member of any project yet"', you0.includes(GATE_ID) && /not a member of any project yet/.test(you0) && !you0.includes(TOKEN));
270. // ticket #20: the legacy projects have NO admin yet (no creator configured) and the gate user is no member: every write is refused
271. const nm1 = await api('POST', '/api/tickets/1/comments', { text: 'not a member' });
272. const nm2 = await api('POST', '/api/projects/alpha/tickets/1/state', { state: 'review' });
273. const nm3 = await api('POST', '/api/projects/alpha/tickets', { subject: 'not a member' });
274. check('roles: a non-member cannot comment / change the state / open a ticket → 403, nothing written', nm1.status === 403 && nm2.status === 403 && nm3.status === 403 && (await api('GET', '/api/tickets/1')).json.events.length === 3, J([nm1, nm2, nm3]) + J([(await api('GET', '/api/projects/alpha')).status, (await api('GET', '/api/tickets/1')).status]) + log.slice(-900) + log.slice(-600));
275. check('migration: at the first start the log says what was migrated', /migrated: 2 project\(s\) turned into records/.test(log) && /migrated: 5 ticket\(s\) linked to their project by id/.test(log), log.slice(0, 400));
276. await stopTickets();
278. // ---- server #2: the gate user is the creator → admin of the legacy projects (its session + token survive) --
279. startTickets({ TICKETS_CREATOR_IDENTITY: GATE_ID });
280. await ticketsUp();
281. html = await (await fetch(BASE + '/', { headers: { cookie: GATE_COOKIE } })).text();
282. check('restart: the gate user is still logged in (session on disk)', /id="whoami"[^>]*>gate</.test(html), html.slice(0, 200));
284. // ---- the migrated legacy tickets: old numbers still answer (ticket #38) ---------------
285. const PT = (slug, n) => `/api/projects/${slug}/tickets/${n}`;
286. const old1 = await api('GET', '/api/tickets/1');
287. check('legacy: GET /api/tickets/1 (old number) answers alpha #1 with project, number, href, oldNumber',
288. old1.status === 200 && old1.json.ticket.project === 'alpha' && old1.json.ticket.number === 1 && old1.json.ticket.ref === '#1' && old1.json.ticket.oldNumber === 1
289. && old1.json.ticket.href === '/projects/alpha/1' && old1.json.ticket.apiHref === PT('alpha', 1) && /^[0-9a-z]{8,}$/.test(old1.json.ticket.id), J(old1.json).slice(0, 500));
290. check('legacy: history kept in order with authors, texts and times (same ms → old order)',
291. J(old1.json.events.map(e => [e.seq, e.kind, e.author, e.text, e.to, e.createdMs])) === J([[1, 'created', 'creator', '', '', 1790000000000], [2, 'comment', 'worker', 'legacy comment on one', '', 1790000300000], [3, 'state', 'worker', 'started', 'progress', 1790000300000]]), J(old1.json.events));
292. check('legacy: state, subject, times and event count kept', old1.json.ticket.state === 'progress' && old1.json.ticket.subject === 'Legacy alpha one' && old1.json.ticket.createdMs === 1790000000000 && old1.json.ticket.updatedMs === 1790000300000 && old1.json.ticket.events === 3, J(old1.json.ticket));
293. const a2 = await api('GET', PT('alpha', 2));
294. check('legacy: GET /api/projects/alpha/tickets/2 is old #3 (per-project form)', a2.status === 200 && a2.json.ticket.oldNumber === 3 && a2.json.ticket.subject === 'Question: legacy alpha two' && J(a2.json.events.map(e => e.kind)) === J(['created', 'comment']), J(a2.json).slice(0, 300));
295. check('legacy: old #4 is alpha #3, old #5 is beta.example.org #2', (await api('GET', '/api/tickets/4')).json.ticket.href === '/projects/alpha/3' && (await api('GET', '/api/tickets/5')).json.ticket.href === '/projects/beta.example.org/2');
296. const byUuid = await api('GET', '/api/tickets/' + old1.json.ticket.id);
297. check('legacy: /api/tickets/<uuid> answers the same ticket', byUuid.status === 200 && byUuid.json.ticket.href === '/projects/alpha/1');
298. check('legacy: unknown old number / number / project → 404', (await api('GET', '/api/tickets/6')).status === 404 && (await api('GET', PT('alpha', 4))).status === 404 && (await api('GET', PT('nope', 1))).status === 404 && (await api('GET', '/api/projects/nope/tickets')).status === 404);
299. const oldCmt = await api('POST', '/api/tickets/4/comments', { text: 'via the old number' });
300. check('legacy: POST /api/tickets/4/comments (old number, gate token) → 201, lands on alpha #3, author = the token\'s user', oldCmt.status === 201 && oldCmt.json.event.author === 'gate' && oldCmt.json.ticket.href === '/projects/alpha/3' && oldCmt.json.ticket.oldNumber === 4 && oldCmt.json.event.seq === 2 && oldCmt.json.event.number === 3 && oldCmt.json.event.project === 'alpha', J(oldCmt.json));
301. const newCmt = await api('POST', PT('alpha', 3) + '/comments', { text: 'via the project number' });
302. check('legacy: POST /api/projects/alpha/tickets/3/comments → 201 on the same ticket', newCmt.status === 201 && newCmt.json.ticket.id === oldCmt.json.ticket.id && newCmt.json.ticket.events === 3);
303. const newSt = await api('POST', PT('beta.example.org', 2) + '/state', { state: 'on-hold', text: 'parked' });
304. check('legacy: POST /api/projects/beta.example.org/tickets/2/state → 201', newSt.status === 201 && newSt.json.ticket.state === 'pending' && (await api('GET', '/api/tickets/5')).json.ticket.state === 'pending', J(newSt.json));
305. const a4 = await api('POST', '/api/projects/alpha/tickets', { subject: 'New alpha after the migration' });
306. check('numbers: POST /api/projects/alpha/tickets → alpha #4, no old number', a4.status === 201 && a4.json.ticket.number === 4 && a4.json.ticket.href === '/projects/alpha/4' && !('oldNumber' in a4.json.ticket) && a4.json.ticket.hasOld === false, J(a4.json));
307. for (const t of ['gamma', 'antcolony', 'tickets.worldapi.org', 'ident.worldapi.org', 'gitoria.worldapi.org']) await api('POST', '/api/projects', { title: t, slug: t });
308. const g1 = await api('POST', '/api/tickets', { project: 'gamma', subject: 'first of a new project' });
309. check('numbers: a new project starts at 1 (POST /api/tickets)', g1.status === 201 && g1.json.ticket.project === 'gamma' && g1.json.ticket.number === 1 && g1.json.ticket.href === '/projects/gamma/1', J(g1.json));
310. const g2 = await api('POST', '/api/tickets', { project: 'gamma', subject: 'second of gamma' });
311. check('numbers: … and counts on (gamma #2)', g2.json.ticket.number === 2 && (await api('GET', PT('gamma', 2))).json.ticket.subject === 'second of gamma');
312. check('numbers: the per-project POST refuses a project field (strict)', (await api('POST', '/api/projects/alpha/tickets', { subject: 's', project: 'alpha' })).json.field === 'project');
313. const redir = await fetch(BASE + '/tickets/3', { redirect: 'manual' });
314. check('legacy: GET /tickets/3 (old page URL) → 301 Location /projects/alpha/2', redir.status === 301 && redir.headers.get('location') === '/projects/alpha/2', redir.status + ' ' + redir.headers.get('location'));
315. check('legacy: GET /tickets/99 → 404', (await fetch(BASE + '/tickets/99', { redirect: 'manual' })).status === 404);
316. const LEGACY = (await api('GET', '/api/tickets')).json.tickets.length; // 5 migrated + alpha #4 + gamma #1, #2
318. // ---- import: the five AntColony ticket files, twice ----------------------------------
319. const imp0 = runImport(null);
320. check('import: without TICKETS_TOKEN every file is refused (401), nothing written', /import: 0 new, 0 already there, 5 failed/.test(imp0) && /FAIL .*: 401/.test(imp0) && (await api('GET', '/api/tickets')).json.tickets.length === LEGACY, imp0);
321. const imp1 = runImport();
322. check('import: first run creates all five', /import: 5 new, 0 already there, 0 failed/.test(imp1), imp1);
323. check('import: numbered per project (antcolony #1, #2)', /NEW 0004-scheduler\.md → antcolony #1/.test(imp1) && /NEW 0005-agent\.md → antcolony #2/.test(imp1) && /NEW 0001-tickets-app\.md → tickets\.worldapi\.org #1/.test(imp1), imp1);
324. const imp2 = runImport();
325. check('import: second run is idempotent (0 new, 5 already there)', /import: 0 new, 5 already there, 0 failed/.test(imp2), imp2);
326. let list = await api('GET', '/api/tickets');
327. const TOTAL = LEGACY + 5;
328. check('api: GET /api/tickets lists five more after two imports', list.status === 200 && list.json.tickets.length === TOTAL && list.json.tickets.filter(t => t.source).length === 5, J(list).slice(0, 300));
329. let one = await api('GET', PT('tickets.worldapi.org', 1));
330. check('api: tickets.worldapi.org #1 is the first file (project, subject, summary, a created event)',
331. one.status === 200 && one.json.ticket.project === 'tickets.worldapi.org' && one.json.ticket.subject === 'Build the World Ticket System in Hybriel'
332. && one.json.ticket.summary.startsWith('Everyone can write everyone a ticket. This is the only state store of AntColony, so it comes first. Minimal scope:')
333. && one.json.events.length === 1 && one.json.events[0].kind === 'created' && one.json.events[0].text === 'imported from 0001-tickets-app.md' && one.json.events[0].author === 'gate', J(one.json).slice(0, 400));
334. check('api: antcolony #1 is the scheduler file', (await api('GET', PT('antcolony', 1))).json.ticket.source === '0004-scheduler.md');
335. check('api: unknown ticket is a 404', (await api('GET', '/api/tickets/99')).status === 404 && (await api('GET', PT('antcolony', 99))).status === 404);
336. check('api: a ticket without subject is refused (400)', (await api('POST', '/api/tickets', { project: 'x' })).status === 400);
337. check('api: an unknown state is refused (400)', (await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'nope' })).status === 400);
338. check('api: an empty comment is refused (400)', (await api('POST', PT('ident.worldapi.org', 1) + '/comments', { text: ' ' })).status === 400);
339. check('api: filter by project', (await api('GET', '/api/tickets?project=antcolony')).json.tickets.length === 2 && (await api('GET', '/api/projects/antcolony/tickets')).json.tickets.length === 2);
340. check('api: filter by project + state on the per-project list', (await api('GET', '/api/projects/alpha/tickets?state=in-progress')).json.tickets.map(t => t.number).join() === '1');
341. const projects = await api('GET', '/api/projects');
342. const imported = (await api('GET', '/api/tickets')).json.tickets.filter(t => t.source);
343. check('import: hard-wrapped lines are joined (no line break left in the five)', imported.length === 5 && imported.every(t => !t.summary.includes('\n')));
344. check('api: projects (creation order) and states', J(projects.json.projects) === J(['alpha', 'beta.example.org', 'gamma', 'antcolony', 'tickets.worldapi.org', 'ident.worldapi.org', 'gitoria.worldapi.org']) && projects.json.states.length === 7, J(projects.json));
346. // ---- the API is strict (ticket #10): every refused body writes NOTHING ----------------
347. const rawPost = async (path, raw, auth = 'Bearer ' + TOKEN) => {
348. const r = await fetch(BASE + path, { method: 'POST', headers: { 'content-type': 'application/json', ...(auth ? { authorization: auth } : {}) }, body: raw });
349. let json = null; try { json = await r.clone().json(); } catch {}
350. return { status: r.status, json, text: json ? '' : await r.text() };
351. };
352. const strictCases = [
353. // [path, raw body, expected status, expected `field` (null = none), error must include]
354. ['/api/tickets', J({ project: 'x', subject: 's', bogus: '1' }), 400, 'bogus', "unknown field 'bogus'"],
355. ['/api/tickets', J({ project: 'x', subject: 's', Subject: 't' }), 400, 'Subject', "unknown field 'Subject'"],
356. ['/api/tickets', J({ project: 'x' }), 400, 'subject', "field 'subject' is required"],
357. ['/api/tickets', J({ subject: 's' }), 400, 'project', "field 'project' is required"],
358. ['/api/tickets', J({ project: 'x', subject: ' ' }), 400, 'subject', "field 'subject' must not be empty"],
359. ['/api/tickets', J({ project: '', subject: 's' }), 400, 'project', "field 'project' must not be empty"],
360. ['/api/tickets', J({ project: 'x', subject: 5 }), 400, 'subject', "field 'subject' must be a string"],
361. ['/api/tickets', J({ project: 'x', subject: 's', summary: null }), 400, 'summary', "field 'summary' must be a string"],
362. ['/api/tickets', J({ project: 'a b', subject: 's' }), 400, 'project', 'no such project'],
363. // ticket #7: NO free author any more — the author is the token's user; a body naming one is refused
364. ['/api/tickets', J({ project: 'x', subject: 's', author: ['a'] }), 400, 'author', "no field 'author' any more"],
365. ['/api/tickets', J({ project: 'x', subject: 's', author: 'gate' }), 400, 'author', "no field 'author' any more: the author is the user of your API token"],
366. ['/api/tickets', J({ project: 'x', subject: 's', summary: 'y', author: ' ' }), 400, 'author', "no field 'author' any more"],
367. ['/api/tickets/2/comments', J({ text: 'x', author: 'creator' }), 400, 'author', "no field 'author' any more"],
368. ['/api/tickets/2/comments', J({ text: 'x', author: '' }), 400, 'author', "no field 'author' any more"],
369. ['/api/tickets/2/state', J({ state: 'in progress', author: 'creator' }), 400, 'author', "no field 'author' any more"],
370. ['/api/tickets/2/state', J({ state: 'confirmed', text: 'n', author: ' ' }), 400, 'author', "no field 'author' any more"],
371. ['/api/tickets', J([1, 2]), 400, '', 'must be a JSON object'],
372. ['/api/tickets', J('text'), 400, '', 'must be a JSON object'],
373. ['/api/tickets', '', 400, '', 'must be a JSON object'],
374. ['/api/tickets/2/comments', J({ text: 'hi', state: 'open' }), 400, 'state', "unknown field 'state'"],
375. ['/api/tickets/2/comments', J({}), 400, 'text', "field 'text' is required"],
376. ['/api/tickets/2/comments', J({ text: ' ' }), 400, 'text', "field 'text' must not be empty"],
377. ['/api/tickets/2/comments', J({ text: { a: 1 } }), 400, 'text', "field 'text' must be a string"],
378. ['/api/tickets/2/comments', J({ text: true }), 400, 'text', "field 'text' must be a string"],
379. ['/api/tickets/2/comments', J({ text: 'x', author: 7 }), 400, 'author', "no field 'author' any more"],
380. ['/api/tickets/2/state', J({ state: 'open', note: 'x' }), 400, 'note', "unknown field 'note'"],
381. ['/api/tickets/2/state', J({ text: 'x' }), 400, 'state', "field 'state' is required"],
382. ['/api/tickets/2/state', J({ state: '' }), 400, 'state', "field 'state' must not be empty"],
383. ['/api/tickets/2/state', J({ state: 3 }), 400, 'state', "field 'state' must be a string"],
384. ['/api/tickets/2/state', J({ state: 'nope' }), 400, 'state', 'unknown state'],
385. ['/api/tickets/2/state', J({ state: 'open' }), 400, 'state', 'already open'],
386. ['/api/tickets/99/comments', J({ text: 'x' }), 404, null, 'no such ticket'],
387. // ticket #38: the slug is the project name, so a new name must be URL-safe; the per-project form is as strict
388. ['/api/tickets', J({ project: 'a#b', subject: 's' }), 400, 'project', 'no such project'],
389. ['/api/tickets', J({ project: 'ä', subject: 's' }), 400, 'project', 'no such project'],
390. ['/api/projects/beta.example.org/tickets/1/comments', J({ text: 'x', author: 'a' }), 400, 'author', "no field 'author' any more"],
391. ['/api/projects/beta.example.org/tickets/1/comments', J({ text: 'x', bogus: '1' }), 400, 'bogus', "unknown field 'bogus'"],
392. ['/api/projects/beta.example.org/tickets/1/state', J({ state: 'open' }), 400, 'state', 'already open'],
393. ['/api/projects/beta.example.org/tickets/1/state', J({ state: 5 }), 400, 'state', "field 'state' must be a string"],
394. ['/api/projects/beta.example.org/tickets', J({ subject: 's', author: 'a' }), 400, 'author', "no field 'author' any more"],
395. ['/api/projects/beta.example.org/tickets/9/comments', J({ text: 'x' }), 404, null, 'no such ticket'],
396. ['/api/projects/beta.example.org/tickets/x/comments', J({ text: 'x' }), 404, null, 'no such ticket'],
397. ];
398. for (const [path, raw, want, field, says] of strictCases) {
399. const r = await rawPost(path, raw);
400. const ok = r.status === want && r.json && typeof r.json.error === 'string' && r.json.error.includes(says) && (field === null || r.json.field === field);
401. check(`strict: POST ${path} ${raw || '(empty)'} → ${want}${field ? ' naming ' + field : ''}`, ok, r.status + ' ' + J(r.json) + r.text);
402. }
403. // invalid JSON (ticket #15): refused by jsoncheck.hl BEFORE JSON.parse → 400 { error },
404. // no source path (workaround for hybriel #12: an uncaught JSON.parse answered 500 + api.hl:31:9)
405. const badJsonCases = [
406. ['/api/tickets', '{"project":"x",', 15], ['/api/tickets', '{bad', 1], ['/api/tickets', "{'project':'x'}", 1],
407. ['/api/tickets', '{"project":"x","subject":"s","summary":"a",}', 43], ['/api/tickets', '[1 2]', 3],
408. ['/api/tickets/2/comments', '{"text":"x","n":"a"} trailing', 21], ['/api/tickets/2/comments', '{"text":"\\x","n":"a"}', 10],
409. ['/api/tickets/2/state', '{"state":01}', 10], ['/api/tickets/2/state', '['.repeat(70), 64], ['/api/tickets/2/state', ' ', 3],
410. // LONE \u surrogate escapes: hl's JSON.parse still refuses them (would be a 500) → refused by the check
411. // (a valid pair parses since hybriel#15, mission 036: see the two checks below)
412. ['/api/tickets/2/comments', '{"text":"\\ud800"}', 10], ['/api/tickets/2/comments', '{"text":"\\udc00"}', 10],
413. ['/api/tickets/2/comments', '{"text":"\\ud83dx"}', 10], ['/api/tickets/2/comments', '{"text":"\\ud83d\\u0041"}', 10],
414. ];
415. for (const [path, raw, at] of badJsonCases) {
416. const r = await rawPost(path, raw);
417. const ok = r.status === 400 && r.json && J(Object.keys(r.json)) === J(['error']) && r.json.error === 'invalid JSON at character ' + at && !/\.hl|\//.test(r.json.error);
418. check(`strict: invalid JSON POST ${path} ${raw.length > 40 ? raw.slice(0, 40) + '…' : raw} → 400 at ${at}, no source path`, ok, r.status + ' ' + J(r.json) + r.text);
419. }
420. // valid but unusual JSON is NOT mistaken for invalid (escapes, unicode, numbers, nesting) → normal field errors
421. const oddValid = await rawPost('/api/tickets/2/comments', '{ "text" : "q\\"b\\\\s\\/\\u00e9\\n", "n": [-1.5e+3, 0, true, null, {"x":[]}] }');
422. check('strict: valid unusual JSON passes the check (→ unknown field n, not invalid JSON)', oddValid.status === 400 && oddValid.json && oddValid.json.field === 'n', oddValid.status + ' ' + J(oddValid.json) + oddValid.text);
423. const pairOnly = await rawPost('/api/tickets/2/comments', '{"text":"\\ud83d\\ude00","n":"a"}');
424. check('strict: a valid \\u surrogate pair passes the check (hybriel#15 → unknown field n, not invalid JSON)', pairOnly.status === 400 && pairOnly.json && pairOnly.json.field === 'n', pairOnly.status + ' ' + J(pairOnly.json) + pairOnly.text);
425. const escaped = await rawPost('/api/tickets/3/comments', '{"text":"q\\"b\\\\s\\/\\u00e9 \u{1F600} end \\ud83d\\ude00"}');
426. check('strict: a comment with JSON escapes (\\" \\\\ \\/ \\u00e9 \\ud83d\\ude00) and a raw emoji is stored decoded (201)', escaped.status === 201 && escaped.json.event.text === 'q"b\\s/\u00e9 \u{1F600} end \u{1F600}', escaped.status + ' ' + J(escaped.json) + escaped.text);
427. const afterStrict = await api('GET', '/api/tickets');
428. check('strict: the refused requests wrote nothing (same ticket count, old #2 = beta.example.org #1 has one event)', afterStrict.json.tickets.length === TOTAL && (await api('GET', '/api/tickets/2')).json.events.length === 1 && (await api('GET', PT('beta.example.org', 1))).json.events.length === 1, J(afterStrict.json.tickets.map(t => t.ref)));
429. check('strict: GET /api/inbox refuses POST (405)', (await rawPost('/api/inbox', '{}')).status === 405);
431. // ---- ticket #7: API writes need a valid token — 401 BEFORE the body is looked at ----------
432. const before401 = J((await api('GET', '/api/tickets')).json.tickets.map(t => [t.ref, t.events]));
433. const authCases = [
434. // [path, raw body, Authorization header (null = none), label]
435. ['/api/tickets', J({ project: 'x', subject: 's' }), null, 'no token'],
436. ['/api/projects/alpha/tickets', J({ subject: 's' }), null, 'no token'],
437. ['/api/tickets/2/comments', J({ text: 'x' }), null, 'no token'],
438. ['/api/projects/alpha/tickets/1/comments', J({ text: 'x' }), null, 'no token'],
439. ['/api/tickets/2/state', J({ state: 'in progress' }), null, 'no token'],
440. ['/api/projects/alpha/tickets/1/state', J({ state: 'on hold' }), null, 'no token'],
441. ['/api/tickets/2/comments', J({ text: 'x' }), 'Bearer tkt_' + '0'.repeat(48), 'an unknown token'],
442. ['/api/tickets/2/comments', J({ text: 'x' }), 'Bearer ' + TOKEN + '0', 'a token with one character more'],
443. ['/api/tickets/2/comments', J({ text: 'x' }), 'Bearer ' + TOKEN.slice(0, -1), 'a token with one character less'],
444. ['/api/tickets/2/comments', J({ text: 'x' }), TOKEN, 'the token without "Bearer"'],
445. ['/api/tickets/2/comments', J({ text: 'x' }), 'Basic ' + TOKEN, 'Basic instead of Bearer'],
446. ['/api/tickets/2/comments', J({ text: 'x' }), 'Bearer ', 'an empty Bearer'],
447. ['/api/tickets/2/comments', '{bad', null, 'no token + invalid JSON (auth first)'],
448. ['/api/tickets/2/comments', J({ text: 'x', author: 'creator' }), null, 'no token + an author field (auth first)'],
449. ];
450. for (const [path, raw, auth, label] of authCases) {
451. const r = await rawPost(path, raw, auth);
452. check(`auth: POST ${path} with ${label} → 401`, r.status === 401 && r.json && /Authorization: Bearer/.test(r.json.error), r.status + ' ' + J(r.json) + r.text);
453. }
454. check('auth: the refused writes wrote nothing', J((await api('GET', '/api/tickets')).json.tickets.map(t => [t.ref, t.events])) === before401);
455. const anonRead = await fetch(BASE + '/api/tickets/1');
456. check('auth: reading needs no token (GET without Authorization → 200)', anonRead.status === 200);
458. // ---- local time (ticket #10): Europe/Vienna, storage stays epoch ms -----------------------
459. const vienna = new Intl.DateTimeFormat('sv-SE', { timeZone: 'Europe/Vienna', year: 'numeric', month: '2-digit', day: '2-digit', hour: '2-digit', minute: '2-digit', hourCycle: 'h23' });
460. const lt = spawnSync(BIN, ['tests/localtime.hl'], { cwd: APP, encoding: 'utf8', timeout: 30000 });
461. const ltLines = (lt.stdout || '').trim().split('\n').filter(Boolean);
462. const ltBad = ltLines.filter(l => { const [ms, ...rest] = l.split(' '); return vienna.format(new Date(Number(ms))) !== rest.join(' '); });
463. check('time: localtime.hl matches Intl Europe/Vienna on DST edges 2000–2100', ltLines.length === 11 && ltBad.length === 0, J(ltBad) + (lt.stderr || ''));
464. const t2 = (await api('GET', PT('ident.worldapi.org', 1))).json;
465. check('time: API rows render updatedMs / createdMs in Vienna time', t2.ticket.updated === vienna.format(new Date(t2.ticket.updatedMs)) && t2.events[0].when === vienna.format(new Date(t2.events[0].createdMs)), J([t2.ticket.updated, t2.ticket.updatedMs, t2.events[0].when]));
467. // ---- two viewers ------------------------------------------------------------------
468. const range = (v, dflt) => (v || dflt).split('-').map(Number);
469. A = await launchBrowser({ debugPortRange: range(process.env.TICKETS_GATE_CHROME_A, '8620-8629') });
470. B = await launchBrowser({ debugPortRange: range(process.env.TICKETS_GATE_CHROME_B, '8630-8639') });
471. const a = patient(await A.newPage());
472. const b = patient(await B.newPage());
474. // SSR of the list
475. await a.goto(BASE + '/');
476. await a.waitForSelector('#tickets li');
477. await connected(a, 'A connected');
478. check('list: SSR shows every ticket (migrated + new + imported)', (await texts(a, '#tickets li')).length === TOTAL, J(await texts(a, '#tickets li')));
479. check('list: every row has a state badge, a #ref link and its project', await a.evaluate(`Array.from(document.querySelectorAll('#tickets li')).every(li => li.querySelector('ticket-state') && /^#\\d+/.test(li.querySelector('a.subject').textContent) && li.querySelector('ticket-meta a'))`));
480. check('list: every ticket link is /projects/<project>/<number> of its row', await a.evaluate(`Array.from(document.querySelectorAll('#tickets li')).every(li => li.querySelector('a.subject').getAttribute('href') === '/projects/' + li.querySelector('ticket-meta a').textContent + '/' + li.querySelector('ticket-ref').textContent.slice(1))`));
481. check('list: the project filter offers all seven projects', (await texts(a, '#projectfilter a')).length === 8, J(await texts(a, '#projectfilter a')));
482. check('list: palette — accent is purple #c586c0, danger #f44747', await a.evaluate(`(() => { const cs = getComputedStyle(document.documentElement); return cs.getPropertyValue('--color-accent').trim() === '#c586c0' && getComputedStyle(document.querySelector('.brand')).color === 'rgb(197, 134, 192)' && getComputedStyle(document.body).backgroundColor === 'rgb(25, 30, 35)'; })()`), await a.evaluate(`getComputedStyle(document.querySelector('.brand')).color + ' ' + getComputedStyle(document.body).backgroundColor`));
483. check('list: danger token resolves to #f44747', await a.evaluate(`(() => { const s = document.createElement('span'); s.style.color = 'var(--color-danger)'; document.body.append(s); const c = getComputedStyle(s).color; s.remove(); return c; })()`) === 'rgb(244, 71, 71)');
485. // filters by real clicks (client-side navigation)
486. await clickNav(a, '#projectfilter a[href="/project/antcolony"]', 'location.pathname === "/project/antcolony" && document.querySelectorAll("#tickets li").length === 2', 'project filter');
487. check('filter: project antcolony shows its two tickets', J(await texts(a, '#tickets ticket-meta a')) === J(['antcolony', 'antcolony']), J(await texts(a, '#tickets ticket-meta a')));
488. check('filter: the chosen project is marked selected', (await a.text('#projectfilter a.selected')) === 'antcolony');
489. await clickNav(a, '#statefilter a[href="/project/antcolony/state/progress"]', 'location.pathname === "/project/antcolony/state/progress" && !!document.querySelector("#empty")', 'state filter');
490. check('filter: project + state "progress" is empty (nothing in progress yet)', (await texts(a, '#tickets li')).length === 0);
491. await clickNav(a, '#statefilter a[href="/project/antcolony"]', 'document.querySelectorAll("#tickets li").length === 2', 'state filter cleared');
492. check('filter: clearing the state keeps the project', (await a.evaluate('location.pathname')) === '/project/antcolony');
493. await a.goto(BASE + '/state/open');
494. await a.waitForSelector('#tickets li');
495. const OPEN = (await api('GET', '/api/tickets?state=open')).json.tickets.length;
496. check('filter: /state/open by URL (SSR) shows every open ticket', (await texts(a, '#tickets li')).length === OPEN, OPEN);
498. // ---- a migrated ticket in the browser: the old URL redirects, a real click opens the new one
499. await a.goto(BASE + '/tickets/4');
500. await a.waitForSelector('#subject');
501. check('legacy: the old URL /tickets/4 lands on /projects/alpha/3 (redirect in the browser)', (await a.evaluate('location.pathname')) === '/projects/alpha/3' && (await a.text('#subject')) === 'Legacy alpha three' && (await a.text('#ref')) === '#3', await a.evaluate('location.href'));
502. check('legacy: the page says "formerly #4"', (await a.text('#oldref')) === 'formerly #4', await a.text('#oldref'));
503. check('legacy: its history holds the created event and both API comments, in order', J(await texts(a, '#events li event-text')) === J(['via the old number', 'via the project number']) && (await texts(a, '#events li')).length === 3, J(await texts(a, '#events li')));
504. await a.goto(BASE + '/project/alpha');
505. await a.waitForSelector('#tickets li');
506. await connected(a, 'A on alpha');
507. await clickNav(a, '#tickets a.subject[href="/projects/alpha/1"]', 'location.pathname === "/projects/alpha/1" && !!document.querySelector("#events li")', 'click alpha #1');
508. check('legacy: a real click on a list row opens /projects/alpha/1 (old #1, history in order)', (await a.text('#subject')) === 'Legacy alpha one' && (await a.text('#oldref')) === 'formerly #1' && J(await texts(a, '#events li event-text')) === J(['legacy comment on one', 'started']), J(await texts(a, '#events li')));
509. await a.goto(BASE + '/projects/gamma/1');
510. await a.waitForSelector('#subject');
511. check('numbers: a new ticket has no "formerly"', (await a.text('#ref')) === '#1' && !(await a.evaluate('!!document.querySelector("#oldref")')));
512. await a.goto(BASE + '/projects/alpha/99');
513. await a.waitForSelector('#gone');
514. check('numbers: an unknown number shows "no such ticket"', (await a.text('#gone')).includes('no such ticket'));
515. await a.goto(BASE + '/projects/gamma');
516. await a.waitForSelector('#tickets li');
517. check('numbers: /projects/<slug> lists that project', (await texts(a, '#tickets li')).length === 2 && (await a.text('#heading')) === 'gamma');
519. // ---- old events keep their authors (ticket #7) --------------------------------------------
520. await a.goto(BASE + '/projects/alpha/1');
521. await a.waitForSelector('#events li');
522. check('legacy: old events show their stored authors (creator, worker, worker)', J(await texts(a, '#events event-head strong')) === J(['creator', 'worker', 'worker']), J(await texts(a, '#events event-head strong')));
524. // ---- signed out: reading only (ticket #7) --------------------------------------------------
525. const IDENT1 = '/projects/ident.worldapi.org/1';
526. await a.goto(BASE + IDENT1);
527. await a.waitForSelector('#events li');
528. await connected(a, 'A on ident #1 (signed out)');
529. check('signed out: the ticket page shows the history, a login hint and NO write forms', (await texts(a, '#events li')).length === 1 && !!(await a.evaluate('!!document.querySelector("#loginhint")')) && !(await a.evaluate('!!document.querySelector("#commentform") || !!document.querySelector("#stateform")')));
530. check('signed out: top right the selector ("choose ident") and "Log in with ident"', await a.evaluate(`(() => { const s = document.querySelector('#selector'); const r = s && s.shadowRoot; const btn = document.querySelector('#loginbutton'); const hb = document.querySelector('application-header').getBoundingClientRect(); const sb = s.getBoundingClientRect(); return !!r && /choose/.test(r.querySelector('#choose').textContent) && !s.hasAttribute('logged-in') && !!btn && sb.right > hb.right - 400; })()`));
531. check('signed out: the login button goes to ident /login with the app key and the callback', (await a.evaluate('document.querySelector("#loginbutton").getAttribute("href")')) === `${ident.base}/login?key=${APPKEY.key}&return=${encodeURIComponent(BASE + '/login/callback')}`, await a.evaluate('document.querySelector("#loginbutton").getAttribute("href")'));
532. check('signed out: the selector is restyled to tickets\' accent (purple)', await a.evaluate(sh('getComputedStyle(r.querySelector("#choose")).backgroundColor')) === 'rgb(197, 134, 192)');
533. let anonCookie = (await a.cookies([BASE])).filter(c => c.name === 'hlsid').map(c => 'hlsid=' + c.value)[0];
534. const anonTry = await temit('commentOn', [(await api('GET', PT('ident.worldapi.org', 1))).json.ticket.id, 'anonymous'], anonCookie);
535. check('signed out: a web write (the face, with the browser\'s own cookie) is refused', anonTry.value && /log in with ident/.test(anonTry.value.error), anonTry.raw);
536. for (const [w, h, name] of [[390, 844, 'phone'], [1280, 900, 'desktop']]) {
537. await viewport(a, w, h);
538. check(`layout ${name} ${w}px: signed-out header (selector + login button) has no horizontal overflow`, await noOverflow(a));
539. await shot(a, `${name}-signedout`);
540. }
541. await viewport(a, 1280, 900);
543. // ---- A = alice (the creator): sign in to ident, then the SELECTOR on tickets ---------------
544. await identSignIn(a, '[email protected]');
545. await a.goto(BASE + IDENT1);
546. await a.waitForSelector('#events li');
547. await connected(a, 'A on ident #1');
548. await a.evaluate('window.__loginMarker = 1');
549. await shClick(a, '#choose');
550. await a.waitFor(sh(`r.querySelectorAll('[part~="identity"]').length > 0`), { label: 'selector list' });
551. check('selector: lists alice\'s identity', J(await a.evaluate(sh(`[...r.querySelectorAll('[part~="identity"]')].map(b => b.textContent)`))) === J(['Default']));
552. await shClick(a, '[part~="identity"]', 'Default');
553. await a.waitForSelector('#nameform', { timeout: 10000 });
554. check('selector login: no reload, the host set logged-in, the name prompt appears', (await a.evaluate('window.__loginMarker')) === 1 && await a.evaluate('document.querySelector("#selector").hasAttribute("logged-in") && document.querySelector("#selector").loggedIn === true') && /logged in with/.test(await a.evaluate(sh('r.querySelector("#status").textContent'))));
555. check('selector login: still no write forms before the name', !(await a.evaluate('!!document.querySelector("#commentform")')));
556. for (const [w, h, name] of [[390, 844, 'phone'], [1280, 900, 'desktop']]) {
557. await viewport(a, w, h);
558. check(`layout ${name} ${w}px: name prompt has no horizontal overflow`, await noOverflow(a));
559. await shot(a, `${name}-name`);
560. }
561. await viewport(a, 1280, 900);
562. await a.type('#displayname', 'alice');
563. await a.click('#namesave');
564. await a.waitFor('!document.querySelector("#nameform") && !!document.querySelector("#memberhint")', { label: 'A named, no role yet: a member hint, no forms' });
565. check('name: saved; no role yet → a role hint, no comment form; top right shows "alice"', (await a.evaluate('window.__loginMarker')) === 1 && (await a.text('#whoami')) === 'alice' && !(await a.evaluate('!!document.querySelector("#commentform")')));
566. // ticket #20: the admin (the gate user, the creator) gives alice a role in every project; the page follows live
567. const grant = async (name, role) => { for (const slug of (await api('GET', '/api/projects')).json.projects) { const g = await api('POST', `/api/projects/${slug}/members`, { user: name, role }); if (g.status !== 200 && g.status !== 201) throw new Error('grant failed ' + slug + ' ' + J(g)); } };
568. await grant('alice', 'admin');
569. await a.goto(BASE + IDENT1);
570. await a.waitFor('!!document.querySelector("#commentform")', { label: 'A: the forms appear after alice got a role' });
571. await connected(a, 'A on ident #1 with a role');
572. await a.evaluate('window.__loginMarker = 1');
573. check('roles: alice made admin → the comment form appears (page reloaded), no member hint', !(await a.evaluate('!!document.querySelector("#memberhint")')));
574. for (const [w, h, name] of [[390, 844, 'phone'], [1280, 900, 'desktop']]) {
575. await viewport(a, w, h);
576. check(`layout ${name} ${w}px: logged-in header has no horizontal overflow`, await noOverflow(a));
577. await shot(a, `${name}-loggedin`);
578. }
579. await viewport(a, 1280, 900);
580. const aliceCookie = (await a.cookies([BASE])).filter(c => c.name === 'hlsid').map(c => 'hlsid=' + c.value)[0];
581. const aliceHtml = await (await fetch(BASE + '/', { headers: { cookie: aliceCookie } })).text();
582. const ALICE_UID = (/\\?"user\\?":\{\\?"id\\?":\\?"([0-9a-z]{12})/.exec(aliceHtml) || [])[1];
583. check('session: the page knows alice\'s tickets user id, NEVER her identity id', /^[0-9a-z]{12}$/.test(ALICE_UID || '') && !aliceHtml.includes(ALICE_ID), ALICE_UID);
585. // ---- B = bob: sign in to ident, then the LOGIN BUTTON ---------------------------------------
586. await identSignIn(b, '[email protected]');
587. await b.goto(BASE + '/');
588. await b.waitForSelector('#loginbutton');
589. await b.click('#loginbutton');
590. await b.waitForSelector('#chooselist', { timeout: 10000 });
591. check('button: tickets → ident /signin/<rid> (choose an identity)', (await b.evaluate('location.href')).startsWith(ident.base + '/signin/'));
592. await connectedIdent(b);
593. await b.click('#chooselist li:nth-child(1) .choose');
594. await b.waitFor(`location.href === ${J(BASE + '/')} && !!document.querySelector('#nameform')`, { timeout: 10000, label: 'B back with the name prompt' });
595. check('button: back on tickets (/login/callback → /), logged in, asked for a name', await b.evaluate('document.querySelector("#selector").classList.contains("in")') && !(await b.evaluate('!!document.querySelector("#newticket")')));
596. await connected(b, 'B on / after the button login');
597. await b.type('#displayname', 'bob');
598. await b.click('#namesave');
599. await b.waitFor('!document.querySelector("#nameform") && !!document.querySelector("#rolehint")', { label: 'B named' });
600. check('button: bob named (no role yet: a role hint, no new-ticket form)', (await b.text('#whoami')) === 'bob' && !(await b.evaluate('!!document.querySelector("#newticket")')));
601. await grant('bob', 'edit');
602. await b.goto(BASE + '/');
603. await b.waitFor('!!document.querySelector("#newticket")', { label: 'B: the new-ticket form appears with the role edit' });
604. await connected(b, 'B on / with a role');
605. check('roles: bob made edit → the new-ticket form appears', (await b.text('#whoami')) === 'bob');
606. const bobCookie = (await b.cookies([BASE])).filter(c => c.name === 'hlsid').map(c => 'hlsid=' + c.value)[0];
608. // ---- the ticket page, two viewers ---------------------------------------------------
609. await b.goto(BASE + IDENT1);
610. await b.waitForSelector('#events li');
611. await connected(b, 'B on ident #1');
612. await sleep(300);
613. check('ticket: subject, ref, project, state', (await a.text('#subject')) === 'Rebuild ident in Hybriel: email OTP login' && (await a.text('#ref')) === '#1' && (await a.text('#project')) === 'ident.worldapi.org' && (await a.text('#state')) === 'open', [await a.text('#subject'), await a.text('#ref'), await a.text('#project'), await a.text('#state')].join(' | '));
614. check('ticket: the imported summary is one paragraph (hard wraps joined)', await a.evaluate(`!document.querySelector('#summary').textContent.includes('\\n') && document.querySelector('#summary').textContent.startsWith('Login for all worldapi apps (tickets, gitoria, …). Only email one-time codes, no passwords. Built on hl:webex;')`), await a.text('#summary'));
615. check('time: the ticket page shows Vienna time (opened / updated / history)', await a.evaluate(`[document.querySelector('ticket-view header time').textContent, document.querySelector('#updated').textContent, document.querySelector('#events li time').textContent]`).then(v => J(v) === J([t2.ticket.created, t2.ticket.updated, t2.events[0].when]) && t2.ticket.created === vienna.format(new Date(t2.events[0].createdMs))), J(t2.ticket));
616. check('ticket: history starts with the import event (by the token\'s user "gate")', (await texts(a, '#events li')).length === 1 && (await a.text('#events li')).includes('gate opened the ticket'), await a.text('#events li'));
618. // A comments (real typing into the form, real click) → B sees it without reload
619. check('ticket: no author field (ticket #7: the author is the logged-in user)', await a.evaluate('!document.querySelector("#author") && !document.querySelector("input[name=author]")'));
620. await type(a, '#commenttext', 'first comment from A\nsecond line');
621. await a.click('#commentsend');
622. await a.waitFor('document.querySelectorAll("#events li").length === 2', { label: 'A sees its comment' });
623. check('comment: appended in the writing browser, author = the login (alice)', (await a.text('#events li:last-child')).includes('alice commented') && (await a.text('#events li:last-child event-text')) === 'first comment from A\nsecond line', await a.text('#events li:last-child'));
624. check('comment: the textarea was cleared', await a.evaluate('document.querySelector("#commenttext").value === ""'));
625. await b.waitFor('document.querySelectorAll("#events li").length === 2', { label: 'B got the comment live' });
626. check('live: B sees A\'s comment without a reload', (await b.text('#events li:last-child event-text')) === 'first comment from A\nsecond line');
627. check('live: B did not reload (no navigation entry)', await b.evaluate('performance.getEntriesByType("navigation").length === 1 && performance.getEntriesByType("navigation")[0].type === "navigate"'));
628. await b.evaluate('window.__gateMarker = 42'); // survives only if B never reloads
630. // ---- ticket #20: the new states, the roles, projects with members, the inbox (browser + API) ------------------
631. // A (alice, admin) moves ident #1 to "review": B follows live; the ticket is assigned to the project's first admin (the gate user)
632. check('shell: no inbox count yet (nothing assigned to bob)', !(await b.evaluate('!!document.querySelector("#inboxcount")')));
633. check('state: the choices are the new state names', J((await texts(a, '#newstate option')).sort()) === J(['canceled', 'done', 'pending', 'progress', 'reopened', 'review']), J(await texts(a, '#newstate option')));
634. await choose(a, '#newstate', 'review');
635. await type(a, '#statenote', 'please test');
636. await a.click('#statesend');
637. await a.waitFor('document.querySelector("#state").textContent === "review"', { label: 'A state changed' });
638. check('state: A shows the new state and a state event with the note', (await a.text('#events li:nth-last-child(2)')).includes('alice changed the state') && (await a.text('#events li:nth-last-child(2) ticket-state')) === 'review' && (await a.text('#events li:nth-last-child(2) event-text')) === 'please test' && (await a.text('#events li:last-child')).includes('assigned the ticket to gate'), await a.text('#events li:last-child'));
639. await b.waitFor('document.querySelector("#state").textContent === "review"', { label: 'B state live' });
640. check('live: B\'s state badge followed, no reload', (await b.evaluate('document.querySelector("#state").className')) === 'review' && (await b.evaluate('window.__gateMarker')) === 42);
641. const inboxOf = async (tok) => { const r = await fetch(BASE + '/api/inbox', { headers: { authorization: 'Bearer ' + tok } }); let json = null; try { json = await r.json(); } catch {} return { status: r.status, json }; };
642. const inbox0 = await inboxOf(TOKEN);
643. check('inbox: the gate user (first admin) has ident #1 in review, only tickets assigned to them', inbox0.status === 200 && inbox0.json.review.some(t => t.subject === 'Rebuild ident in Hybriel: email OTP login') && [...inbox0.json.review, ...inbox0.json.pending].every(t => t.assignee === 'gate'), J(inbox0.json).slice(0, 400));
644. const oldNames = await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'awaiting creator' });
645. check('states: the old name "awaiting creator" is an alias of review (already there → 400 "already")', oldNames.status === 400 && /already review/.test(oldNames.json.error), J(oldNames));
646. const aliasBack = await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'in progress' });
647. check('states: "in progress" is an alias of progress (201)', aliasBack.status === 201 && aliasBack.json.ticket.state === 'progress', J(aliasBack).slice(0, 300));
648. await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'open' });
650. // roles: bob = use → comment + open ⇄ review, nothing else (web and API)
651. let aliceTok0 = null;
652. const bobTok = (await temit('tokenCreate', ['bob gate'], bobCookie)).value.token;
653. await api('POST', '/api/projects/ident.worldapi.org/members', { user: 'bob', role: 'use' });
654. await b.goto(BASE + IDENT1);
655. await b.waitForSelector('#stateform');
656. await connected(b, 'B on ident #1 as use');
657. check('roles: bob (use) sees only review in the state choices (ticket is open)', J(await texts(b, '#newstate option')) === J(['review']), J(await texts(b, '#newstate option')));
658. const useDone = await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'done' }, bobTok);
659. const useReview = await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'review' }, bobTok);
660. const useNew = await api('POST', '/api/projects/ident.worldapi.org/tickets', { subject: 'use may not' }, bobTok);
661. const useSettings = await api('POST', '/api/projects/ident.worldapi.org/members', { user: 'bob', role: 'admin' }, bobTok);
662. const useComment = await api('POST', PT('ident.worldapi.org', 1) + '/comments', { text: 'a use member comments' }, bobTok);
663. check('roles: use → done 403, review 201, new ticket 403, members 403, comment 201', [useDone.status, useReview.status, useNew.status, useSettings.status, useComment.status].join() === '403,201,403,403,201', J([useDone, useNew, useSettings]).slice(0, 500));
664. await b.goto(BASE + '/projects/ident.worldapi.org/settings');
665. await b.waitForSelector('#notadmin');
666. check('roles: the settings page of a non-admin says so and has no forms', !(await b.evaluate('!!document.querySelector("#detailsform")')));
667. await api('POST', '/api/projects/ident.worldapi.org/members', { user: 'bob', role: 'edit' });
668. const editAssign = await api('POST', PT('ident.worldapi.org', 1) + '/assign', { assignee: 'bob' }, bobTok);
669. check('roles: edit may assign (201) and move to any state', editAssign.status === 201 || editAssign.status === 200, J(editAssign).slice(0, 300));
670. const editPending = await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'pending' }, bobTok);
671. check('roles: edit → pending 201; "on hold" is an alias of pending', editPending.status === 201 && editPending.json.ticket.state === 'pending', J(editPending).slice(0, 300));
672. // the inbox page of bob: pending and review, only what is assigned to him
673. await b.goto(BASE + '/inbox');
674. await b.waitForSelector('#pendingbox');
675. await connected(b, 'B inbox');
676. check('inbox: bob has ident #1 under pending, review is empty', (await texts(b, '#pending li a.subject')).length === 1 && (await b.text('#pending li a.subject')).includes('Rebuild ident') && !!(await b.evaluate('!!document.querySelector("#reviewempty")')), J(await texts(b, '#pendingbox')));
677. await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'review' }, bobTok);
678. await b.waitFor('document.querySelectorAll("#review li").length === 1 && document.querySelectorAll("#pending li").length === 0', { label: 'inbox follows the state change live' });
679. check('inbox: the ticket moved from pending to review live, header count 1', (await b.text('#inboxcount')) === '1');
680. aliceTok0 = (await temit('tokenCreate', ['alice #20'], aliceCookie)).value.token;
681. check('inbox: alice (admin, nothing assigned) has an empty inbox', (await inboxOf(aliceTok0)).json.review.length === 0);
683. // a new project by hand: title → slug proposed, admin can change it; old slugs keep working
684. await a.goto(BASE + '/new-project');
685. await a.waitForSelector('#projectform');
686. await connected(a, 'A on /new-project');
687. await type(a, '#projecttitle', 'My Project');
688. await a.waitFor('document.querySelector("#projectslug").value === "my-project"', { label: 'slug proposed' });
689. check('project: the slug my-project is proposed from the title', (await a.evaluate('document.querySelector("#projectslug").value')) === 'my-project');
690. await a.click('#projectcreate');
691. await a.waitForSelector('#created');
692. const mp = await api('GET', '/api/projects/my-project');
693. check('project: created; alice is its first admin; it has no tickets', mp.status === 200 && mp.json.project.title === 'My Project' && J(mp.json.members.map(m => [m.name, m.role])) === J([['alice', 'admin']]), J(mp.json).slice(0, 400));
694. await a.goto(BASE + '/projects/my-project/settings');
695. await a.waitForSelector('#detailsform');
696. await connected(a, 'A on settings');
697. await type(a, '#setslug', 'my-proj');
698. await type(a, '#setdescription', 'The **first** project.');
699. await a.click('#detailssave');
700. await a.waitFor('!!document.querySelector("#savemessage") && document.querySelector("#savemessage").textContent.length > 0', { label: 'saved' });
701. const mp2 = await api('GET', '/api/projects/my-proj');
702. const mpOld = await api('GET', '/api/projects/my-project');
703. check('project: the slug changed, the description is kept, the old slug still resolves', mp2.status === 200 && mp2.json.project.description === 'The **first** project.' && mpOld.status === 200 && mpOld.json.project.slug === 'my-proj', J([mp2.json.project, mpOld.status]).slice(0, 400));
704. await a.goto(BASE + '/projects/my-project');
705. await a.waitForSelector('#heading');
706. check('project: the old address still opens the project page', (await a.text('#heading')) === 'My Project' || (await a.text('#heading')).includes('My Project'), await a.text('#heading'));
707. // members in the settings page: add bob as use; remove; the last admin cannot go
708. await a.goto(BASE + '/projects/my-proj/settings');
709. await a.waitForSelector('#addform');
710. await connected(a, 'A on settings again');
711. await type(a, '#addref', 'bob');
712. await choose(a, '#addrole', 'use');
713. await a.click('#addsave');
714. await a.waitFor('document.querySelectorAll("#members li").length === 2', { label: 'bob added' });
715. check('members: bob added as use in the settings page', J((await api('GET', '/api/projects/my-proj')).json.members.map(m => [m.name, m.role])) === J([['alice', 'admin'], ['bob', 'use']]));
716. const lastAdmin = await api('POST', '/api/projects/my-proj/members', { user: 'alice', role: 'use' }, aliceTok0);
717. check('members: the last admin cannot be demoted (400)', lastAdmin.status === 400 && /at least one admin/.test(lastAdmin.json.error), J(lastAdmin));
718. const badRole = await api('POST', '/api/projects/my-proj/members', { user: 'bob', role: 'boss' }, aliceTok0);
719. check('members: an unknown role is refused (400)', badRole.status === 400 && badRole.json.field === 'role', J(badRole));
720. const rm = await api('POST', '/api/projects/my-proj/members/remove', { user: 'bob' }, aliceTok0);
721. check('members: an admin removes a member (200)', rm.status === 200 && rm.json.members.length === 1, J(rm).slice(0, 300));
723. // an invite link through ident
724. const inv = await api('POST', '/api/projects/my-proj/invites', { role: 'use' }, aliceTok0);
725. check('invite: an admin gets an ident invite link for the role use', inv.status === 201 && /^https?:\/\//.test(inv.json.url || ''), J(inv).slice(0, 400));
726. // carol opens the link, chooses her identity at ident → ident sends her back to tickets with the invite id → she is a member
727. const carol = await ident.signIn('[email protected]');
728. const invPage = await fetch(inv.json.url, { redirect: 'manual' });
729. const rid = (invPage.headers.get('location') || '').split('/').pop();
730. const chosen = await ident.emit('chooseIdentity', [rid, carol.identities[0].id], carol.cookie);
731. const back = chosen.value && chosen.value.url ? await fetch(chosen.value.url.replace(/^https?:\/\/[^/]+/, BASE), { redirect: 'manual' }) : { status: 0, headers: new Headers() };
732. const carolCookie = (back.headers.get('set-cookie') || '').split(';')[0];
733. const carolFace = await temit('saveDisplayName', ['carol'], carolCookie);
734. const mp3 = (await api('GET', '/api/projects/my-proj')).json;
735. check('invite: carol follows the link, picks an identity at ident, is sent back → member with the role use', invPage.status === 302 && back.status === 302 && J(mp3.members.map(m => [m.name, m.role]).filter(x => x[0] === 'carol' || x[1] === 'use')) === J([['carol', 'use']]), J([invPage.status, chosen.raw.slice(0, 200), back.status, mp3.members]).slice(0, 600));
736. const invBob = await api('POST', '/api/projects/my-proj/invites', { role: 'use' }, bobTok);
737. check('invite: a non-admin gets 403', invBob.status === 403, J(invBob).slice(0, 200));
739. // the new pages fit the screen (phone and desktop), with the project's data on them
740. for (const [path, sel, name] of [['/projects/my-proj/settings', '#addform', 'settings'], ['/new-project', '#projectform', 'new-project'], ['/projects/my-proj', '#heading', 'project']]) {
741. await a.goto(BASE + path);
742. await a.waitForSelector(sel);
743. await connected(a, 'A on ' + path);
744. for (const [w, h, dev] of [[390, 844, 'phone'], [1280, 900, 'desktop']]) {
745. await viewport(a, w, h);
746. check(`layout ${dev} ${w}px: ${name} page has no horizontal overflow`, await noOverflow(a));
747. await shot(a, `${dev}-${name}`);
748. }
749. }
750. await viewport(a, 1280, 900);
751. await b.goto(BASE + '/inbox');
752. await b.waitForSelector('#pendingbox');
753. for (const [w, h, dev] of [[390, 844, 'phone'], [1280, 900, 'desktop']]) {
754. await viewport(b, w, h);
755. check(`layout ${dev} ${w}px: inbox page has no horizontal overflow`, await noOverflow(b));
756. }
757. await viewport(b, 1280, 900);
759. // ---- the browsers said nothing bad (checked BEFORE ident goes down, ticket #11) ------------------
760. const problems = [...a.problems(), ...b.problems()].map(m => m.text).filter(t => !/favicon/.test(t));
761. check('console: no errors or warnings in either browser', problems.length === 0, J(problems).slice(0, 800));
762. // ---- ident down: a login fails politely, the server keeps serving ----------------------------
763. // TICKET #11: no page may be loading while ident stops (a tickets page loads ident's
764. // selector.js → ERR_CONNECTION_REFUSED in the console). Both browsers park on about:blank
765. // first and stay there; the phase is checked with fetch only, and the console again after.
766. for (const p of [a, b]) { await p.goto('about:blank'); }
767. await sleep(300);
768. const quietBefore = [...a.problems(), ...b.problems()].length;
769. await ident.stop();
770. const down = await fetch(BASE + '/login/callback?ident_code=' + 'cd'.repeat(24), { headers: { cookie: GATE_COOKIE }, redirect: 'manual' });
771. const downText = await down.text();
772. const downFace = await temit('identLogin', ['cd'.repeat(24)], GATE_COOKIE);
773. check('ident down: /login/callback → 400 "ident did not answer" (no 500, no source path)', down.status === 400 && /ident did not answer/.test(downText) && !/\.hl/.test(downText), down.status + ' ' + downText.slice(0, 300));
774. check('ident down: the selector face answers "ident did not answer", the server keeps serving', downFace.value && downFace.value.error === 'ident did not answer' && (await fetch(BASE + '/')).status === 200, downFace.raw);
776. const lateProblems = [...a.problems(), ...b.problems()].slice(quietBefore).map(m => m.text);
777. check('console: nothing new while ident was down (the browsers were parked, #11)', lateProblems.length === 0, J(lateProblems).slice(0, 800));
778. } catch (e) {
779. check('gate ran to the end', false, e.stack || String(e));
780. } finally {
781. for (const br of [A, B]) { if (br) { try { await br.close(); } catch {} } }
782. await stopTickets();
783. if (ident) { await ident.stop(); writeFileSync(join(SCRATCH, 'gate-ident.log'), ident.log()); }
784. exchProxy.close();
785. writeFileSync(join(SCRATCH, 'gate-server.log'), log);
786. }
787. console.log(`\n${passes} passed, ${failures} failed`);
788. process.exit(failures ? 1 : 0);