tickets

19.4 KB

1. // tests/connect.mjs — THE CONNECT GATE (ticket #21): an app (gitoria) is connected to ONE project. A small ident STUB (only POST /api/exchange: one-time code → short ident id, like ident#23) and its own tickets server on a fresh store; alice (admin of her projects), bob (a member)
2. // and carol (logged in, no role) log in; then over HTTP: the request refusals (return address), the one-time code, the
3. // exchange, the key's reach (its project only; create / comment / state; roles apply to the NAMED person; no
4. // settings / members / other project / relations), the disconnect; and in a real headless Chrome: the connect page
5. // (log-in hint, project choice, a new project, confirm, the link back), the project page's line and its Disconnect.
6. // Ports: TICKETS_CONNECT_PORT (8700), TICKETS_CONNECT_IDENT_PORT (8701), Chrome debug 8703-8709.
7. // node tests/connect.mjs
8. import { spawn } from 'node:child_process';
9. import { rmSync, mkdirSync, existsSync } from 'node:fs';
10. import { dirname, join, resolve } from 'node:path';
11. import { fileURLToPath } from 'node:url';
12. import { launchBrowser } from './cdp.mjs';
13. import http from 'node:http';
15. if (!process.env.HL_CHROME && existsSync('/opt/google/chrome/chrome')) process.env.HL_CHROME = '/opt/google/chrome/chrome';
16. const HERE = dirname(fileURLToPath(import.meta.url));
17. const APP = resolve(HERE, '..');
18. const BIN = join(APP, 'bin/hybriel');
19. const PORT = Number(process.env.TICKETS_CONNECT_PORT || 8700);
20. const IDENT_PORT = Number(process.env.TICKETS_CONNECT_IDENT_PORT || 8701);
21. const BASE = `http://127.0.0.1:${PORT}`;
22. const GITORIA = 'http://127.0.0.1:8702'; // the "app": only its URL is used (listed in TICKETS_CONNECT_ORIGINS)
23. const WORK = join(APP, '.scratch/connect-gate');
24. const STORE = join(WORK, 'store');
25. const J = JSON.stringify;
26. const sleep = (ms) => new Promise(r => setTimeout(r, ms));
27. rmSync(WORK, { recursive: true, force: true });
28. mkdirSync(join(STORE, 'mpackdb'), { recursive: true });
30. let passes = 0, failures = 0;
31. const check = (label, ok, detail = '') => { console.log(`${ok ? 'ok ' : 'FAIL'} ${label}${ok ? '' : ' — ' + detail}`); if (ok) passes++; else failures++; };
33. let log = '', server = null, ident = null, browser = null;
34. async function main() {
35. // the ident stub: a one-time code → the identity it was minted for (5-character ids, as ident#23)
36. const codes = new Map();
37. let codeN = 0;
38. const mint = (identity) => { const c = (++codeN).toString(16).padStart(8, '0').repeat(3); codes.set(c, identity); return c; };
39. ident = http.createServer((req, res) => {
40. let body = ''; req.on('data', d => body += d);
41. req.on('end', () => {
42. if (req.url === '/api/exchange' && req.method === 'POST') {
43. const b = JSON.parse(body || '{}'); const id = codes.get(b.code); codes.delete(b.code);
44. res.writeHead(id && b.secret === 'sk_stub' ? 200 : 400, { 'content-type': 'application/json' });
45. return res.end(J(id ? { identity: id } : { error: 'unknown code' }));
46. }
47. res.writeHead(404); res.end('');
48. });
49. });
50. await new Promise(ok => ident.listen(IDENT_PORT, '127.0.0.1', ok));
51. ident.base = `http://127.0.0.1:${IDENT_PORT}`;
52. ident.stop = () => new Promise(ok => ident.close(ok));
53. const app = { key: 'pk_stub', secret: 'sk_stub' };
54. const alice0 = { id: 'a2b3c' }, bob0 = { id: 'b4c5d' }, carol0 = { id: 'c6d7e' };
55. server = spawn(BIN, ['project.hl'], { cwd: APP, stdio: ['ignore', 'pipe', 'pipe'], env: { ...process.env, TICKETS_PORT: String(PORT), TICKETS_STORAGE: join(STORE, 'mpackdb'), TICKETS_SESSIONS: join(STORE, 'sessions'),
56. IDENT_URL: ident.base, IDENT_EXCHANGE_URL: ident.base, TICKETS_PUBLIC_URL: BASE, IDENT_API_KEY: app.key, IDENT_API_SECRET: app.secret, TICKETS_CREATOR_IDENTITY: '', TICKETS_WATCH: '0', HL_HOST: '127.0.0.1', TICKETS_CONNECT_ORIGINS: GITORIA } });
57. server.stdout.on('data', d => log += d); server.stderr.on('data', d => log += d);
58. for (let i = 0; i < 80; i++) { try { if ((await fetch(BASE + '/')).ok) break; } catch {} await sleep(250); }
60. let emitI = 0;
61. const temit = async (event, payload, cookie) => {
62. const r = await fetch(BASE + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', ...(cookie ? { cookie } : {}) }, body: J({ t: 'emit', i: ++emitI, event, payload }) });
63. const raw = await r.text(); let j = null; try { j = JSON.parse(raw); } catch {}
64. return j ? j.value : undefined;
65. };
66. const call = async (method, path, body, headers = {}) => {
67. const r = await fetch(BASE + path, { method, headers: { ...(body ? { 'content-type': 'application/json' } : {}), ...headers }, body: body ? J(body) : undefined, redirect: 'manual' });
68. let json = null; const t = await r.text(); try { json = JSON.parse(t); } catch {}
69. return { status: r.status, json, text: t, headers: r.headers };
70. };
71. const login = async (who, name) => {
72. const code = mint(who.id);
73. const identity = who.id;
74. const r = await fetch(BASE + '/login/callback?ident_code=' + code, { redirect: 'manual' });
75. const cookie = (r.headers.get('set-cookie') || '').split(';')[0];
76. if (name) await temit('saveDisplayName', [name], cookie);
77. return { cookie, identity };
78. };
79. const alice = await login(alice0, 'alice'), bob = await login(bob0, 'bob'), carol = await login(carol0, 'carol');
80. const tok = async (u) => (await temit('tokenCreate', ['gate'], u.cookie)).token;
81. alice.token = await tok(alice); bob.token = await tok(bob);
82. const auth = (t, extra = {}) => ({ authorization: 'Bearer ' + t, ...extra });
84. // ---- projects: alice admins "gitoria-tickets" and "other"; bob is a member (edit) of gitoria-tickets, carol nothing
85. let r = await call('POST', '/api/projects', { title: 'Gitoria tickets', slug: 'gt' }, auth(alice.token));
86. check('setup: alice opens project gt', r.status === 201, J(r.json));
87. r = await call('POST', '/api/projects', { title: 'Other', slug: 'other' }, auth(alice.token));
88. check('setup: alice opens project other', r.status === 201, J(r.json));
89. r = await call('POST', '/api/projects/gt/members', { user: bob.identity, role: 'edit' }, auth(alice.token));
90. check('setup: bob is edit in gt', r.status === 200, J(r.json));
91. const bobUse = await call('POST', '/api/projects', { title: 'Bobs', slug: 'bobs' }, auth(bob.token));
92. await call('POST', '/api/projects/bobs/members', { user: alice.identity, role: 'use' }, auth(bob.token));
94. // ---- the request
95. const good = `/connect?app=gitoria&label=${encodeURIComponent('anton/repo')}&return=${encodeURIComponent(GITORIA + '/connect/back')}&state=abc123`;
96. r = await call('GET', good);
97. const nonce = (r.headers.get('location') || '').replace('/connect/', '');
98. check('request: a valid request redirects to /connect/<nonce>', r.status === 302 && /^[0-9a-f]{32}$/.test(nonce), r.status + ' ' + r.headers.get('location'));
99. for (const [what, q] of [
100. ['a return address on another host', `app=x&return=${encodeURIComponent('https://evil.example.com/x')}`],
101. ['a worldapi.org lookalike', `app=x&return=${encodeURIComponent('https://worldapi.org.evil.com/x')}`],
102. ['userinfo in the return address', `app=x&return=${encodeURIComponent('https://[email protected]/x')}`],
103. ['http on worldapi.org', `app=x&return=${encodeURIComponent('http://gitoria.worldapi.org/x')}`],
104. ['no return address', 'app=x'],
105. ['no app name', `return=${encodeURIComponent('https://gitoria.worldapi.org/x')}`],
106. ]) { r = await call('GET', '/connect?' + q); check('request refused: ' + what, r.status === 400 && !r.headers.get('location'), r.status + ' ' + r.text.slice(0, 200)); }
107. r = await call('GET', `/connect?app=x&return=${encodeURIComponent('https://gitoria.worldapi.org/back?x=1')}`);
108. check('request: a subdomain of worldapi.org is allowed', r.status === 302, String(r.status));
110. // ---- the confirmation (face): only a named user, only an admin project, once
111. const page = await call('GET', '/connect/' + nonce);
112. check('page: the connect page names the app, its label and its host', page.status === 200 && page.text.includes('gitoria') && page.text.includes('anton/repo') && page.text.includes('127.0.0.1:8702'), page.text.slice(0, 200));
113. check('page: an unknown request says used up or expired', (await call('GET', '/connect/' + '0'.repeat(32))).text.includes('used up or expired'));
114. let v = await temit('connectConfirm', [nonce, '', 'x'], null);
115. check('confirm: signed out → refused', v && v.error, J(v));
116. const gtId = (await call('GET', '/api/projects/gt')).json.project.id;
117. const otherId = (await call('GET', '/api/projects/other')).json.project.id;
118. v = await temit('connectConfirm', [nonce, gtId, ''], carol.cookie);
119. check('confirm: carol (no role in gt) → refused, request still open', v && v.error && v.error.includes('only an admin'), J(v));
120. v = await temit('connectConfirm', [nonce, gtId, ''], bob.cookie);
121. check('confirm: bob (edit, not admin) → refused', v && v.error && v.error.includes('only an admin'), J(v));
122. v = await temit('connectConfirm', [nonce, gtId, ''], alice.cookie);
123. check('confirm: alice (admin) → a link back with a one-time code and the state', v && v.url && v.url.startsWith(GITORIA + '/connect/back?code=') && v.url.endsWith('&state=abc123'), J(v));
124. const code = v.url.match(/code=([0-9a-f]+)/)[1];
125. v = await temit('connectConfirm', [nonce, gtId, ''], alice.cookie);
126. check('confirm: the same request twice → refused', v && v.error && v.error.includes('used up'), J(v));
128. // ---- the exchange
129. r = await call('POST', '/api/connect/exchange', { code: 'ab'.repeat(24) });
130. check('exchange: a wrong code → 400', r.status === 400, r.status + ' ' + r.text);
131. r = await call('POST', '/api/connect/exchange', { code });
132. const key = r.json && r.json.key;
133. check('exchange: the code gives a key for gt (shown once)', r.status === 200 && /^tktc_[0-9a-f]{48}$/.test(key) && r.json.project === 'gt', r.status + ' ' + r.text);
134. r = await call('POST', '/api/connect/exchange', { code });
135. check('exchange: the code works once only', r.status === 400, r.status + ' ' + r.text);
136. check('exchange: the key is not stored in clear', !(await call('GET', '/api/projects/gt/connections')).text.includes(key));
138. // ---- the key's reach
139. const named = (who) => auth(key, { 'x-tickets-identity': who.identity });
140. r = await call('POST', '/api/projects/gt/tickets', { subject: 'from the app' }, named(bob));
141. check('key: creates a ticket as the named person (bob, role edit)', r.status === 201 && r.json.ticket.subject === 'from the app', r.status + ' ' + r.text);
142. const num = r.json && r.json.ticket && r.json.ticket.number;
143. r = await call('GET', '/api/projects/gt/tickets/' + num);
144. check('key: the ticket is created BY bob (event author, same ident id)', r.json.events[0].author === 'bob' && r.json.events[0].userId !== '', J(r.json.events && r.json.events[0]));
145. r = await call('POST', '/api/tickets', { project: 'gt', subject: 'via the global route' }, named(alice));
146. check('key: POST /api/tickets with project gt works too (alice)', r.status === 201, r.status + ' ' + r.text);
147. r = await call('POST', `/api/projects/gt/tickets/${num}/comments`, { text: 'mentioned in PR #7' }, named(bob));
148. check('key: posts a comment "mentioned in PR" as bob', r.status === 201 && r.json.event.author === 'bob', r.status + ' ' + r.text);
149. r = await call('POST', `/api/projects/gt/tickets/${num}/state`, { state: 'review', text: 'fixed by commit abc' }, named(bob));
150. check('key: changes the state (fixed by commit → review)', r.status === 201 && r.json.ticket.state === 'review', r.status + ' ' + r.text);
151. r = await call('POST', '/api/projects/gt/tickets', { subject: 'no person' }, auth(key));
152. check('key: without X-Tickets-Identity → 403 naming the header', r.status === 403 && r.text.includes('X-Tickets-Identity'), r.status + ' ' + r.text);
153. r = await call('POST', '/api/projects/gt/tickets', { subject: 'carol' }, named(carol));
154. check('key: a person with no role in the project → 403 (roles apply)', r.status === 403, r.status + ' ' + r.text);
155. r = await call('POST', '/api/projects/gt/tickets', { subject: 'nobody' }, auth(key, { 'x-tickets-identity': 'zzzzz' }));
156. check('key: an identity that never logged in → 403', r.status === 403, r.status + ' ' + r.text);
157. r = await call('POST', '/api/projects/other/tickets', { subject: 'wrong project' }, named(alice));
158. check('key: another project → 403', r.status === 403 && r.text.includes('another project'), r.status + ' ' + r.text);
159. r = await call('POST', '/api/tickets', { project: 'other', subject: 'wrong project' }, named(alice));
160. check('key: POST /api/tickets naming another project → 403', r.status === 403, r.status + ' ' + r.text);
161. const oth = (await call('POST', '/api/projects/other/tickets', { subject: 'in other' }, auth(alice.token))).json.ticket.number;
162. r = await call('POST', `/api/projects/other/tickets/${oth}/comments`, { text: 'token still works' }, auth(alice.token));
163. check('token: a user token still comments and changes state as before', r.status === 201 && (await call('POST', `/api/projects/other/tickets/${oth}/state`, { state: 'progress' }, auth(alice.token))).status === 201, r.status + ' ' + r.text);
164. r = await call('POST', `/api/projects/other/tickets/${oth}/comments`, { text: 'x' }, named(alice));
165. check('key: a comment on a ticket of another project → 403', r.status === 403, r.status + ' ' + r.text);
166. r = await call('POST', `/api/tickets/${(await call('GET', '/api/projects/other/tickets/' + oth)).json.ticket.id}/state`, { state: 'review' }, named(alice));
167. check('key: a state change by ticket id in another project → 403', r.status === 403, r.status + ' ' + r.text);
168. for (const [what, m, p, b] of [
169. ['project settings', 'POST', '/api/projects/gt', { title: 'hacked' }],
170. ['members', 'POST', '/api/projects/gt/members', { user: carol.identity, role: 'admin' }],
171. ['invites', 'POST', '/api/projects/gt/invites', { role: 'use' }],
172. ['a new project', 'POST', '/api/projects', { title: 'nope' }],
173. ['editing a ticket', 'POST', `/api/projects/gt/tickets/${num}/edit`, { subject: 'x' }],
174. ['assigning', 'POST', `/api/projects/gt/tickets/${num}/assign`, { assignee: 'bob' }],
175. ['the parent link', 'POST', `/api/projects/gt/tickets/${num}/parent`, { parent: '' }],
176. ['disconnecting', 'POST', '/api/projects/gt/connections/remove', { id: 'x' }],
177. ['the inbox', 'GET', '/api/inbox', null],
178. ]) { r = await call(m, p, b, named(alice)); check('key cannot use: ' + what, r.status === 401, r.status + ' ' + r.text.slice(0, 120)); }
179. check('key: the project settings did not change', (await call('GET', '/api/projects/gt')).json.project.title === 'Gitoria tickets');
180. r = await call('POST', '/api/projects/gt/tickets', { subject: 'bad key' }, auth('tktc_' + '0'.repeat(48), { 'x-tickets-identity': alice.identity }));
181. check('key: a wrong key → 401', r.status === 401, String(r.status));
182. r = await call('GET', '/api/projects/gt/connections');
183. check('list: gt shows the connection "gitoria: anton/repo" (public)', r.json.connections.length === 1 && r.json.connections[0].text === 'gitoria: anton/repo' && r.json.connections[0].by === 'alice', J(r.json));
184. check('list: the project other shows none', (await call('GET', '/api/projects/other/connections')).json.connections.length === 0);
186. // ---- disconnect through the API: only an admin; the key dies at once
187. const cid = r.json.connections[0].id;
188. r = await call('POST', '/api/projects/gt/connections/remove', { id: cid }, auth(bob.token));
189. check('disconnect: bob (edit) → 403', r.status === 403, r.status + ' ' + r.text);
190. r = await call('POST', '/api/projects/gt/connections/remove', { id: cid }, auth(alice.token));
191. check('disconnect: alice (admin) → connection gone', r.status === 200 && r.json.connections.length === 0, r.status + ' ' + r.text);
192. r = await call('POST', '/api/projects/gt/tickets', { subject: 'after' }, named(alice));
193. check('disconnect: the key is dead at once → 401', r.status === 401, String(r.status));
195. // ---- the browser: log in, connect a new project, see it on the project page, disconnect
196. browser = await launchBrowser({ debugPortRange: [8703, 8709] });
197. const p = await browser.newPage();
198. const nonce2 = ((await call('GET', good.replace('abc123', 'st2'))).headers.get('location') || '').replace('/connect/', '');
199. await p.goto(BASE + '/connect/' + nonce2);
200. await p.waitForSelector('#connecttitle');
201. check('browser: signed out → the login hint, no form', (await p.evaluate('!!document.querySelector("#loginhint") && !document.querySelector("#connectform")')));
202. const cookieName = alice.cookie.split('=')[0];
203. await p.send('Network.setCookie', { name: cookieName, value: alice.cookie.slice(cookieName.length + 1), url: BASE });
204. await p.goto(BASE + '/connect/' + nonce2);
205. await p.waitForSelector('#connectform');
206. check('browser: alice logged in → the project choice lists her admin projects and "A new project"',
207. J(await p.evaluate('Array.from(document.querySelectorAll("#connectproject option")).map(o => o.textContent.trim())')) === J(['Gitoria tickets', 'Other', 'A new project']));
208. check('browser: it says which app and host asks', (await p.evaluate('document.querySelector("#connectwho").textContent')).includes('anton/repo'));
209. await p.evaluate('(() => { const s = document.querySelector("#connectproject"); s.value = ""; s.dispatchEvent(new Event("change", { bubbles: true })); })()');
210. await p.waitForSelector('#connecttitleinput');
211. await p.type('#connecttitleinput', 'Repo tickets');
212. await p.click('#connectconfirm');
213. await p.waitForSelector('#connectcontinue');
214. const back = await p.evaluate('document.querySelector("#connectcontinue").href');
215. check('browser: after confirming, the page links back to the app with code and state', back.startsWith(GITORIA + '/connect/back?code=') && back.endsWith('&state=st2'), back);
216. r = await call('POST', '/api/connect/exchange', { code: back.match(/code=([0-9a-f]+)/)[1] });
217. const key2 = r.json.key;
218. check('browser: the exchange gives a key for the NEW project', r.status === 200 && r.json.project === 'repo-tickets', r.status + ' ' + r.text);
219. await p.goto(BASE + '/projects/repo-tickets');
220. await p.waitForSelector('#connections');
221. check('browser: the project page shows "Connected to gitoria: anton/repo" and an admin sees Disconnect',
222. (await p.evaluate('document.querySelector("#connections").textContent')).includes('Connected to gitoria: anton/repo') && await p.evaluate('!!document.querySelector("#connections .disconnect")'));
223. await p.click('#connections .disconnect');
224. await p.waitFor('!document.querySelector("#connections")', { label: 'connection line gone' });
225. r = await call('POST', '/api/projects/repo-tickets/tickets', { subject: 'x' }, auth(key2, { 'x-tickets-identity': alice.identity }));
226. check('browser: after Disconnect the key is dead (401)', r.status === 401, String(r.status));
227. // a reader (not logged in) sees the line but no button
228. r = await call('POST', '/api/projects/gt/connections/remove', { id: 'x' }, auth(alice.token));
229. const p2 = await browser.newPage();
230. await p2.goto(BASE + '/projects/other');
231. await p2.waitForSelector('#heading');
232. check('browser: a project without a connection shows no line', await p2.evaluate('!document.querySelector("#connections")'));
233. check('server log: no absorbed errors from the connect code', !/error absorbed/.test(log), log.split('\n').filter(l => /error absorbed/.test(l)).slice(0, 3).join(' | '));
234. }
235. try { await main(); } catch (e) { failures++; console.log('FAIL gate crashed — ' + (e && e.stack || e)); console.log(log.slice(-2500)); }
236. finally {
237. try { if (browser) await browser.close(); } catch {}
238. try { if (server) server.kill('SIGTERM'); } catch {}
239. try { if (ident) await ident.stop(); } catch {}
240. console.log(`\n${passes} passed, ${failures} failed`);
241. process.exit(failures ? 1 : 0);
242. }