tickets

86.3 KB

1. // tests/browser.mjs — THE GATE of tickets.worldapi.org: its own server on its own
2. // storage, the import command, the JSON API, and TWO real headless Chromes (two
3. // viewers) for the live push. Everything is checked in the browser's DOM, not in
4. // curl output. Ticket #10 added: the strict API table (unknown / missing / empty /
5. // wrong-type fields → 400 naming the field, nothing written), Vienna local time (checked
6. // against node's Intl, also tests/localtime.hl's DST edges), and the paragraph import
7. // (a CRLF fixture in .scratch/gate-import → #7, rendered with a blank line between).
8. // Ticket #15 added: `author` required on every POST (missing/empty → 400 naming author),
9. // invalid JSON → 400 { error } without source paths (jsoncheck.hl), the web forms have no
10. // name field (author 'creator'), and list lines kept by the import (.scratch/gate-import-lists → hybriel #3).
11. // Ticket #38 (mission 008) added: UUID keys + storage in <store>/mpackdb, per-project
12. // numbers and URLs /<slug>/<number> (ticket #25; was /projects/<slug>/<number>). The gate FIRST writes an old-format store
13. // (tests/oldstore.hl: 5 tickets, old #1–#5 in projects alpha / beta.example.org), migrates
14. // it TWICE with tools/migrate-008.hl (the second run must write nothing), and runs the
15. // server on the migrated tables: old numbers answer on /api/tickets/<n>, /tickets/<n>
16. // redirects (301) to the new URL, the per-project API, live pushes carrying the new hrefs.
17. // Ticket #7 (mission 011) added LOGIN VIA IDENT: the gate runs its OWN ident (a copy of
18. // ident's code without .env / storage — codes go to a mail sink, never real mail; tests/identkit.mjs)
19. // on :8353, registers tickets there (origin = this gate's server), and then: every API write
20. // needs `Authorization: Bearer <token>` (401 otherwise, checked before the body; `author` in a
21. // body → 400), a machine user "gate" logs in through the login button's server half
22. // (/login/callback) and makes its token over the face; the FIRST server runs without
23. // TICKETS_CREATOR_IDENTITY (nobody may confirm/reject → 403), the second with alice's per-app id.
24. // In the browsers: signed out = reading only; A (alice, the creator) logs in with the identity
25. // SELECTOR, B (bob) with the LOGIN BUTTON; both get the display-name prompt; writes show the
26. // user as author; bob cannot confirm/reject, alice can; bob's token on /you: shown once → API
27. // write as bob → revoke → 401; forged face sessions (#31) are refused; old events keep their
28. // authors; logout resets the selector.
29. // Ticket #12 (mission 024) added THE MARKDOWN EDITOR: comment, state note, edit summary and new-ticket
30. // summary are <md-editor>s around their textareas (shared/md-editor.js). Real typing (formatting
31. // while typing, "- " lists, Ctrl+Enter sends), the toolbar by click / tap at 390px, a hostile rich
32. // paste reduced to the subset, the edit form opening the stored Markdown byte for byte, SSR keeps
33. // the plain textareas (no JS = as before). The component's own test: worldapi-components/test/run.mjs.
34. //
35. // node tests/browser.mjs (TICKETS_GATE_PORT to move the server, default 8352;
36. // TICKETS_GATE_IDENT_PORT the gate's ident, default 8353;
37. // TICKETS_GATE_IDENT_DIR ident's code, default ../ident.worldapi.org)
38. //
39. // Debug ports: 8620-8629 (browser A) and 8630-8639 (browser B) — TICKETS_GATE_CHROME_A /
40. // TICKETS_GATE_CHROME_B ("8810-8814") move them (mission 017: parallel workers get disjoint
41. // port ranges); browser C (mission 046, the installable app / offline part at the end) 8640-8649,
42. // TICKETS_GATE_CHROME_C. Screenshots at 390px
43. // and 1280px land in .scratch/gate-*.png — LOOK at them. The whole server log is kept in
44. // .scratch/gate-server.log. Every process started here (server, import runs, Chromes)
45. // is stopped by PID in `finally`.
46. import { spawn, spawnSync } from 'node:child_process';
47. import http from 'node:http';
48. import { rmSync, mkdirSync, writeFileSync, existsSync, readdirSync, copyFileSync, readFileSync } from 'node:fs';
49. import { dirname, join, resolve } from 'node:path';
50. import { fileURLToPath } from 'node:url';
51. import { launchBrowser } from './cdp.mjs';
52. import { startIdent } from './identkit.mjs';
54. if (!process.env.HL_CHROME && existsSync('/opt/google/chrome/chrome')) process.env.HL_CHROME = '/opt/google/chrome/chrome';
55. const HERE = dirname(fileURLToPath(import.meta.url));
56. const APP = resolve(HERE, '..');
57. const BIN = join(APP, 'bin/hybriel');
58. const PORT = Number(process.env.TICKETS_GATE_PORT || 8352);
59. const BASE = `http://127.0.0.1:${PORT}`;
60. const SCRATCH = join(APP, '.scratch');
61. const STORE = join(SCRATCH, 'gate-store');
62. const IDENT_PORT = Number(process.env.TICKETS_GATE_IDENT_PORT || 8353);
63. // ident's CODE (read only — copied without .env/storage by identkit): the sibling folder,
64. // or the Loreana path when the gate runs in a copy (.scratch/dev…)
65. const IDENT_DIR = process.env.TICKETS_GATE_IDENT_DIR || [resolve(APP, '../ident.worldapi.org'), '/media/STORAGE/projects/ident.worldapi.org'].find(d => existsSync(join(d, 'project.hl')));
66. rmSync(STORE, { recursive: true, force: true });
67. mkdirSync(join(STORE, 'mpackdb'), { recursive: true });
69. let failures = 0, passes = 0;
70. function check(label, ok, detail = '') {
71. console.log(`${ok ? 'ok ' : 'FAIL'} ${label}${ok ? '' : ' — ' + detail}`);
72. if (ok) passes++; else failures++;
73. }
74. const sleep = (ms) => new Promise(r => setTimeout(r, ms));
75. const J = JSON.stringify;
77. // ---- the legacy fixture (ticket #20): a store from before projects were own data; the server's migrate.hl
78. // turns it into projects with ids, members and the new states at its first start ----------------------
79. const hl = (script, env) => { const r = spawnSync(BIN, [script], { cwd: APP, env: { ...process.env, ...env }, encoding: 'utf8', timeout: 60000 }); return (r.stdout || '') + (r.stderr || ''); };
80. const fixture = hl('tests/oldstore.hl', { TICKETS_STORAGE: join(STORE, 'mpackdb') });
81. check('migrate: the pre-#20 fixture is written (2 projects, 5 tickets, 8 events)', /oldstore: 2 projects, 5 tickets, 8 events/.test(fixture), fixture);
83. // ---- the servers: our own ident, then tickets (twice: without and with a creator) ----------
84. let log = '';
85. let server = null;
86. let ident = null;
87. // ticket #9 (mission 012): the exchanges ident RECEIVES from tickets, counted by a small proxy
88. // between the two (tickets' IDENT_EXCHANGE_URL → here → our ident)
89. const EXCH_PORT = Number(process.env.TICKETS_GATE_EXCHANGE_PORT || 8357);
90. const exchanges = [];
91. const exchProxy = http.createServer((req, res) => {
92. let body = '';
93. req.on('data', d => body += d);
94. req.on('end', async () => {
95. try {
96. const r = await fetch(`http://127.0.0.1:${IDENT_PORT}${req.url}`, { method: req.method, headers: { 'content-type': req.headers['content-type'] || 'application/json' }, body: req.method === 'GET' ? undefined : body });
97. const t = await r.text();
98. let code = ''; try { code = JSON.parse(body).code || ''; } catch {}
99. exchanges.push({ path: req.url, code, status: r.status });
100. res.writeHead(r.status, { 'content-type': r.headers.get('content-type') || 'application/json' });
101. res.end(t);
102. } catch (e) { req.socket.destroy(); } // ident stopped: tickets must see NO answer, like a direct connection
103. });
104. });
105. await new Promise((ok, bad) => { exchProxy.once('error', bad); exchProxy.listen(EXCH_PORT, '127.0.0.1', ok); });
106. let APPKEY = null;
107. function startTickets(extraEnv) {
108. log += `\n==== tickets server start ${J(Object.keys(extraEnv))}\n`;
109. server = spawn(BIN, ['project.hl'], {
110. cwd: APP,
111. env: { ...process.env, TICKETS_PORT: String(PORT), TICKETS_STORAGE: join(STORE, 'mpackdb'), TICKETS_SESSIONS: join(STORE, 'sessions'),
112. IDENT_URL: `http://127.0.0.1:${IDENT_PORT}`, IDENT_EXCHANGE_URL: `http://127.0.0.1:${EXCH_PORT}`, TICKETS_PUBLIC_URL: BASE, IDENT_API_KEY: APPKEY.key, IDENT_API_SECRET: APPKEY.secret,
113. TICKETS_CREATOR_IDENTITY: '', TICKETS_WATCH: '0', ...extraEnv },
114. stdio: ['ignore', 'pipe', 'pipe'],
115. });
116. server.stdout.on('data', d => log += d); server.stderr.on('data', d => log += d);
117. }
118. async function stopTickets() {
119. if (!server) return;
120. const s = server;
121. try { s.kill('SIGTERM'); } catch {}
122. await new Promise(r => { if (s.exitCode !== null || s.signalCode !== null) return r(); s.once('exit', r); setTimeout(r, 3000); });
123. }
124. async function ticketsUp() {
125. for (let i = 0; i < 80; i++) { try { const r = await fetch(BASE + '/'); if (r.ok) return; } catch {} await sleep(250); }
126. throw new Error('server did not come up\n' + log);
127. }
129. // THE API: reads never carry a token (reading is public); writes carry the gate user's
130. // token unless another (or none: null) is given
131. let TOKEN = null;
132. const api = async (method, path, body, token = TOKEN) => {
133. const headers = body ? { 'content-type': 'application/json' } : {};
134. if (method !== 'GET' && token) headers.authorization = 'Bearer ' + token;
135. const r = await fetch(BASE + path, { method, headers, body: body ? J(body) : undefined });
136. let json = null; try { json = await r.json(); } catch {}
137. return { status: r.status, json };
138. };
139. const runImport = (token = TOKEN) => {
140. const r = spawnSync(BIN, ['tools/import.hl'], { cwd: APP, env: { ...process.env, TICKETS_URL: BASE, TICKETS_TOKEN: token || '' }, encoding: 'utf8', timeout: 60000 });
141. return (r.stdout || '') + (r.stderr || '');
142. };
143. // a face over the REST carrier (POST /__hl/emit) with a cookie (or none)
144. let emitI = 0;
145. // hybriel#16 (mission 036): hl:web itself refuses an emit with one argument too many — the ack is
146. // ok:false "… the `session` parameter is filled by the server, never by the peer"; the face never runs.
147. const framework_refused = (raw) => { try { const j = JSON.parse(raw); return j.ok === false && /the `session` parameter is filled by the server/.test(j.error || ''); } catch { return false; } };
148. const temit = async (event, payload, cookie) => {
149. const r = await fetch(BASE + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', ...(cookie ? { cookie } : {}) }, body: J({ t: 'emit', i: ++emitI, event, payload }) });
150. const raw = await r.text();
151. let j = null; try { j = JSON.parse(raw); } catch {}
152. return { status: r.status, value: j ? j.value : undefined, raw };
153. };
154. const cookieOf = (r) => (r.headers.get('set-cookie') || '').split(';')[0];
155. const texts = (page, sel) => page.evaluate(`Array.from(document.querySelectorAll(${J(sel)})).map(e => e.textContent.trim())`);
156. const type = (page, sel, value) => page.evaluate(`(() => { const i = document.querySelector(${J(sel)}); i.value = ${J(value)}; i.dispatchEvent(new Event("input", { bubbles: true })); })()`);
157. const choose = (page, sel, value) => page.evaluate(`(() => { const i = document.querySelector(${J(sel)}); i.value = ${J(value)}; i.dispatchEvent(new Event("change", { bubbles: true })); })()`);
158. // CONNECTED = the server has READ the tab's `hello` (its mounts), not just an open socket: a push the server sends
159. // before that reaches no component (mission 046: "inbox follows the state change live" failed ~1 in 5 when the API
160. // write overtook the hello). A `ping` sent after the hello on the same socket is answered after it — its pong proves it.
161. const helloRead = `new Promise((ok) => { const s = window.__hl.socket; const h = (ev) => { let f = null; try { f = JSON.parse(ev.data); } catch {} if (f && f.t === 'pong') { s.removeEventListener('message', h); ok(true); } }; s.addEventListener('message', h); s.send(JSON.stringify({ t: 'ping' })); setTimeout(() => ok(false), 10000); })`;
162. const connected = async (page, label) => {
163. await page.waitFor('!!window.__hl && window.__hl.socket && window.__hl.socket.readyState === 1', { label });
164. if (!(await page.evaluate(helloRead))) throw new Error('no pong after the hello: ' + label);
165. };
166. // a client-side navigation by a REAL click, then the socket announced the new mounts
167. const clickNav = async (page, sel, cond, label) => { await page.click(sel); await page.waitFor(cond, { label }); await sleep(300); };
168. async function viewport(page, width, height) {
169. await page.send('Emulation.setDeviceMetricsOverride', { width, height, deviceScaleFactor: 1, mobile: width < 600 });
170. await sleep(250);
171. }
172. async function shot(page, name) {
173. const { data } = await page.send('Page.captureScreenshot', { format: 'png', captureBeyondViewport: true });
174. writeFileSync(join(SCRATCH, `gate-${name}.png`), Buffer.from(data, 'base64'));
175. }
176. const noOverflow = (page) => page.evaluate('document.documentElement.scrollWidth <= window.innerWidth');
177. // INSIDE ident's selector (shadow DOM): an expression over its root `r`, and a REAL click
178. const sh = (expr) => `(() => { const h = document.querySelector('#selector'); const r = h && h.shadowRoot; if (!r) return null; return (${expr}); })()`;
179. async function shClick(page, inner, name = null) {
180. const find = `(() => { const h = document.querySelector('#selector'); const r = h && h.shadowRoot; if (!r) return null; const el = ${name === null ? `r.querySelector(${J(inner)})` : `[...r.querySelectorAll(${J(inner)})].find(b => b.textContent === ${J(name)})`}; if (!el) return null; el.scrollIntoView({ block: 'center' }); const b = el.getBoundingClientRect(); if (!b.width) return null; return { x: b.left + b.width / 2, y: b.top + b.height / 2 }; })()`;
181. const box = await page.waitFor(find, { label: 'selector ' + inner + ' ' + (name || '') });
182. const at = { x: Math.round(box.x), y: Math.round(box.y), button: 'left', clickCount: 1 };
183. await page.send('Input.dispatchMouseEvent', { type: 'mouseMoved', ...at, buttons: 0 });
184. await page.send('Input.dispatchMouseEvent', { type: 'mousePressed', ...at, buttons: 1 });
185. await page.send('Input.dispatchMouseEvent', { type: 'mouseReleased', ...at, buttons: 0 });
186. }
187. const connectedIdent = (page) => page.waitFor('!!window.__hl && window.__hl.socket && window.__hl.socket.readyState === 1', { label: 'ident page hydrated' });
188. // sign in to OUR ident on ident's own page (email → code from the sink → skip the names)
189. async function identSignIn(page, email) {
190. await page.goto(ident.base + '/');
191. await page.waitForSelector('#email');
192. await connectedIdent(page);
193. await page.type('#email', email);
194. await page.click('#sendcode');
195. // ident#20: a sent code NAVIGATES to ident's /code page; type only once that page is hydrated
196. await page.waitFor('/\\/code$/.test(location.pathname) && !!document.querySelector("#code")', { label: 'ident /code page' });
197. await connectedIdent(page);
198. await page.type('#code', ident.lastCode(email));
199. await page.click('#verify');
200. await page.waitForSelector('#signout', { timeout: 10000 });
201. }
203. // TICKET #11 (mission 014): the gate must stay green while other browsers load the machine.
204. // Every wait of a page (waitFor / waitForSelector / click / goto) gets SLOW× its timeout
205. // (TICKETS_GATE_SLOW, default 3: 10 s → 30 s) — a wait that succeeds returns at once, so a green
206. // run costs nothing; only a real failure waits longer before it says so.
207. const SLOW = Number(process.env.TICKETS_GATE_SLOW || 3);
208. function patient(page) {
209. const waitFor = page.waitFor.bind(page);
210. page.waitFor = (expr, o = {}) => waitFor(expr, { ...o, timeout: (o.timeout || 10000) * SLOW });
211. const goto = page.goto.bind(page);
212. page.goto = (url, o = {}) => goto(url, { ...o, timeout: (o.timeout || 15000) * SLOW });
213. return page;
214. }
216. let A, B, C;
217. const range = (v, dflt) => (v || dflt).split('-').map(Number);
218. try {
219. // ---- ticket #7: our own ident, tickets registered in it ----------------------------------
220. ident = await startIdent({ identDir: IDENT_DIR, workDir: join(STORE, 'ident'), port: IDENT_PORT });
221. const alice = await ident.signIn('[email protected]');
222. const bob = await ident.signIn('[email protected]');
223. const gateAcct = await ident.signIn('[email protected]');
224. APPKEY = await ident.registerApp(alice, 'tickets (gate)', [BASE]);
225. check('ident: our own ident runs (a copy without .env), tickets is registered (key + secret)', /^pk_[0-9a-f]{32}$/.test(APPKEY.key) && /^sk_[0-9a-f]{48}$/.test(APPKEY.secret) && !existsSync(join(STORE, 'ident', 'ident-code', '.env')));
226. // alice's per-app id — what the architect puts into TICKETS_CREATOR_IDENTITY
227. const ALICE_ID = await ident.exchange(APPKEY, await ident.selectorCode(alice, APPKEY, BASE));
228. const GATE_ID = await ident.exchange(APPKEY, await ident.selectorCode(gateAcct, APPKEY, BASE));
229. check('ident: one identity id per identity (a short id, or the old 32 hex)', /^[0-9a-z]{5,64}$/.test(ALICE_ID) && /^[0-9a-z]{5,64}$/.test(GATE_ID) && ALICE_ID !== GATE_ID, ALICE_ID + ' ' + GATE_ID);
231. // ---- server #1: NO creator configured ---------------------------------------------------
232. startTickets({});
233. await ticketsUp();
234. // the machine user "gate": the login button's SERVER half (ident → /login/callback?ident_code=)
235. const first = await fetch(BASE + '/');
236. const GATE_COOKIE = cookieOf(first);
237. check('login: a page visit gets the tickets session cookie (hlsid)', /^hlsid=[0-9a-f]+$/.test(GATE_COOKIE), GATE_COOKIE);
238. const noCode = await fetch(BASE + '/login/callback', { headers: { cookie: GATE_COOKIE }, redirect: 'manual' });
239. check('login: /login/callback without a code → 400 page, no redirect', noCode.status === 400 && !noCode.headers.get('location') && /no login code/.test(await noCode.text()));
240. const badCode = await fetch(BASE + '/login/callback?ident_code=' + 'ab'.repeat(24), { headers: { cookie: GATE_COOKIE }, redirect: 'manual' });
241. check('login: an unknown code → 400 "ident refused the login", no redirect', badCode.status === 400 && !badCode.headers.get('location') && /ident refused the login \(400/.test(await badCode.text()));
242. const gateCode = await ident.selectorCode(gateAcct, APPKEY, BASE);
243. const cb = await fetch(BASE + '/login/callback?ident_code=' + gateCode, { headers: { cookie: GATE_COOKIE }, redirect: 'manual' });
244. check('login: /login/callback exchanges the code → 302 to /', cb.status === 302 && cb.headers.get('location') === '/', cb.status + ' ' + cb.headers.get('location'));
245. const again = await fetch(BASE + '/login/callback?ident_code=' + gateCode, { headers: { cookie: GATE_COOKIE }, redirect: 'manual' });
246. check('login: the same code again → 400 (single use)', again.status === 400 && /already used/.test(await again.text()));
247. // ticket #10: the button's return URL carries ?next=<page> (login.js); /login/callback follows
248. // only a same-origin PATH, anything else → /
249. for (const [next, want] of [
250. ['/projects/alpha/2', '/projects/alpha/2'], ['/project/alpha/state/open?x=1&y=2', '/project/alpha/state/open?x=1&y=2'], ['/inbox', '/inbox'],
251. ['/%2F%2Fevil.example', '/%2F%2Fevil.example'],
252. ['//evil.example/x', '/'], ['https://evil.example/', '/'], ['http:/evil.example', '/'], ['/\\evil.example', '/'], ['javascript:alert(1)', '/'],
253. ['evil.example', '/'], ['/a b', '/'], ['/x\r\nSet-Cookie: a=b', '/'], ['/x"><script>', '/'], ['/login/callback', '/'], ['/' + 'a'.repeat(500), '/'], ['', '/'],
254. ]) {
255. const c = await ident.selectorCode(gateAcct, APPKEY, BASE);
256. const r = await fetch(BASE + '/login/callback?next=' + encodeURIComponent(next) + '&ident_code=' + c, { headers: { cookie: GATE_COOKIE }, redirect: 'manual' });
257. check(`return (#10): next=${J(next.length > 40 ? next.slice(0, 20) + '…(' + next.length + ')' : next)} → 302 ${want}`, r.status === 302 && r.headers.get('location') === want, r.status + ' ' + r.headers.get('location'));
258. }
259. let html = await (await fetch(BASE + '/', { headers: { cookie: GATE_COOKIE } })).text();
260. check('login: first login → the page asks for a display name, no write form yet', html.includes('id="nameform"') && !html.includes('id="newticketform"') && html.includes('class="in"'));
261. check('login: the page never carries the identity id (only /you does)', !html.includes(GATE_ID));
262. let f = await temit('commentOn', ['x', 'before the name'], GATE_COOKIE);
263. check('login: no writing before a display name', f.value && /display name first/.test(f.value.error), f.raw);
264. f = await temit('saveDisplayName', [' '], GATE_COOKIE);
265. check('name: an empty display name is refused', f.value && /must not be empty/.test(f.value.error), f.raw);
266. f = await temit('saveDisplayName', ['x'.repeat(61)], GATE_COOKIE);
267. check('name: 61 characters are refused', f.value && /too long/.test(f.value.error), f.raw);
268. f = await temit('saveDisplayName', ['gate'], GATE_COOKIE);
269. check('name: "gate" saved (answer: name, named — no identity id)', f.value && f.value.name === 'gate' && f.value.named === true && !f.raw.includes(GATE_ID), f.raw);
270. f = await temit('saveDisplayName', ['gate2'], GATE_COOKIE);
271. check('name: asked once — a second name is refused', f.value && /already set/.test(f.value.error), f.raw);
272. html = await (await fetch(BASE + '/', { headers: { cookie: GATE_COOKIE } })).text();
273. check('name: afterwards no prompt; no role yet → no ticket form, a role hint (ticket #20)', !html.includes('id="nameform"') && !html.includes('id="newticketform"') && html.includes('id="rolehint"'));
274. f = await temit('tokenCreate', ['gate machine'], GATE_COOKIE);
275. TOKEN = f.value && f.value.token;
276. check('token: created over the face — tkt_ + 48 hex, listed with its label', /^tkt_[0-9a-f]{48}$/.test(TOKEN || '') && f.value.tokens.length === 1 && f.value.tokens[0].label === 'gate machine' && !J(f.value.tokens).includes(TOKEN), f.raw);
277. const you0 = await (await fetch(BASE + '/you', { headers: { cookie: GATE_COOKIE } })).text();
278. check('/you shows the user its own ident id and "not a member of any project yet"', you0.includes(GATE_ID) && /not a member of any project yet/.test(you0) && !you0.includes(TOKEN));
279. // ticket #20: the legacy projects have NO admin yet (no creator configured) and the gate user is no member: every write is refused
280. const nm1 = await api('POST', '/api/tickets/1/comments', { text: 'not a member' });
281. const nm2 = await api('POST', '/api/projects/alpha/tickets/1/state', { state: 'review' });
282. const nm3 = await api('POST', '/api/projects/alpha/tickets', { subject: 'not a member' });
283. check('roles: a non-member cannot comment / change the state / open a ticket → 403, nothing written', nm1.status === 403 && nm2.status === 403 && nm3.status === 403 && (await api('GET', '/api/tickets/1')).json.events.length === 3, J([nm1, nm2, nm3]) + J([(await api('GET', '/api/projects/alpha')).status, (await api('GET', '/api/tickets/1')).status]) + log.slice(-900) + log.slice(-600));
284. check('migration: at the first start the log says what was migrated', /migrated: 2 project\(s\) turned into records/.test(log) && /migrated: 5 ticket\(s\) linked to their project by id/.test(log), log.slice(0, 400));
285. await stopTickets();
287. // ---- server #2: the gate user is the creator → admin of the legacy projects (its session + token survive) --
288. startTickets({ TICKETS_CREATOR_IDENTITY: GATE_ID });
289. await ticketsUp();
290. html = await (await fetch(BASE + '/', { headers: { cookie: GATE_COOKIE } })).text();
291. check('restart: the gate user is still logged in (session on disk)', /id="whoami"[^>]*>gate</.test(html), html.slice(0, 200));
293. // ---- the migrated legacy tickets: old numbers still answer (ticket #38) ---------------
294. const PT = (slug, n) => `/api/projects/${slug}/tickets/${n}`;
295. const old1 = await api('GET', '/api/tickets/1');
296. check('legacy: GET /api/tickets/1 (old number) answers alpha #1 with project, number, href, oldNumber',
297. old1.status === 200 && old1.json.ticket.project === 'alpha' && old1.json.ticket.number === 1 && old1.json.ticket.ref === '#1' && old1.json.ticket.oldNumber === 1
298. && old1.json.ticket.href === '/alpha/1' && old1.json.ticket.apiHref === PT('alpha', 1) && /^[0-9a-z]{8,}$/.test(old1.json.ticket.id), J(old1.json).slice(0, 500));
299. check('legacy: history kept in order with authors, texts and times (same ms → old order)',
300. J(old1.json.events.map(e => [e.seq, e.kind, e.author, e.text, e.to, e.createdMs])) === J([[1, 'created', 'creator', '', '', 1790000000000], [2, 'comment', 'worker', 'legacy comment on one', '', 1790000300000], [3, 'state', 'worker', 'started', 'progress', 1790000300000]]), J(old1.json.events));
301. check('legacy: state, subject, times and event count kept', old1.json.ticket.state === 'progress' && old1.json.ticket.subject === 'Legacy alpha one' && old1.json.ticket.createdMs === 1790000000000 && old1.json.ticket.updatedMs === 1790000300000 && old1.json.ticket.events === 3, J(old1.json.ticket));
302. const a2 = await api('GET', PT('alpha', 2));
303. check('legacy: GET /api/projects/alpha/tickets/2 is old #3 (per-project form)', a2.status === 200 && a2.json.ticket.oldNumber === 3 && a2.json.ticket.subject === 'Question: legacy alpha two' && J(a2.json.events.map(e => e.kind)) === J(['created', 'comment']), J(a2.json).slice(0, 300));
304. check('legacy: old #4 is alpha #3, old #5 is beta.example.org #2', (await api('GET', '/api/tickets/4')).json.ticket.href === '/alpha/3' && (await api('GET', '/api/tickets/5')).json.ticket.href === '/beta.example.org/2');
305. const byUuid = await api('GET', '/api/tickets/' + old1.json.ticket.id);
306. check('legacy: /api/tickets/<uuid> answers the same ticket', byUuid.status === 200 && byUuid.json.ticket.href === '/alpha/1');
307. check('legacy: unknown old number / number / project → 404', (await api('GET', '/api/tickets/6')).status === 404 && (await api('GET', PT('alpha', 4))).status === 404 && (await api('GET', PT('nope', 1))).status === 404 && (await api('GET', '/api/projects/nope/tickets')).status === 404);
308. const oldCmt = await api('POST', '/api/tickets/4/comments', { text: 'via the old number' });
309. check('legacy: POST /api/tickets/4/comments (old number, gate token) → 201, lands on alpha #3, author = the token\'s user', oldCmt.status === 201 && oldCmt.json.event.author === 'gate' && oldCmt.json.ticket.href === '/alpha/3' && oldCmt.json.ticket.oldNumber === 4 && oldCmt.json.event.seq === 2 && oldCmt.json.event.number === 3 && oldCmt.json.event.project === 'alpha', J(oldCmt.json));
310. const newCmt = await api('POST', PT('alpha', 3) + '/comments', { text: 'via the project number' });
311. check('legacy: POST /api/projects/alpha/tickets/3/comments → 201 on the same ticket', newCmt.status === 201 && newCmt.json.ticket.id === oldCmt.json.ticket.id && newCmt.json.ticket.events === 3);
312. const newSt = await api('POST', PT('beta.example.org', 2) + '/state', { state: 'on-hold', text: 'parked' });
313. check('legacy: POST /api/projects/beta.example.org/tickets/2/state → 201', newSt.status === 201 && newSt.json.ticket.state === 'pending' && (await api('GET', '/api/tickets/5')).json.ticket.state === 'pending', J(newSt.json));
314. const a4 = await api('POST', '/api/projects/alpha/tickets', { subject: 'New alpha after the migration' });
315. check('numbers: POST /api/projects/alpha/tickets → alpha #4, no old number', a4.status === 201 && a4.json.ticket.number === 4 && a4.json.ticket.href === '/alpha/4' && !('oldNumber' in a4.json.ticket) && a4.json.ticket.hasOld === false, J(a4.json));
316. for (const t of ['gamma', 'antcolony', 'tickets.worldapi.org', 'ident.worldapi.org', 'gitoria.worldapi.org']) await api('POST', '/api/projects', { title: t, slug: t });
317. const g1 = await api('POST', '/api/tickets', { project: 'gamma', subject: 'first of a new project' });
318. check('numbers: a new project starts at 1 (POST /api/tickets)', g1.status === 201 && g1.json.ticket.project === 'gamma' && g1.json.ticket.number === 1 && g1.json.ticket.href === '/gamma/1', J(g1.json));
319. const g2 = await api('POST', '/api/tickets', { project: 'gamma', subject: 'second of gamma' });
320. check('numbers: … and counts on (gamma #2)', g2.json.ticket.number === 2 && (await api('GET', PT('gamma', 2))).json.ticket.subject === 'second of gamma');
321. check('numbers: the per-project POST refuses a project field (strict)', (await api('POST', '/api/projects/alpha/tickets', { subject: 's', project: 'alpha' })).json.field === 'project');
322. const redir = await fetch(BASE + '/tickets/3', { redirect: 'manual' });
323. check('legacy: GET /tickets/3 (old page URL) → 301 Location /alpha/2', redir.status === 301 && redir.headers.get('location') === '/alpha/2', redir.status + ' ' + redir.headers.get('location'));
324. check('legacy: GET /tickets/99 → 404', (await fetch(BASE + '/tickets/99', { redirect: 'manual' })).status === 404);
325. const LEGACY = (await api('GET', '/api/tickets')).json.tickets.length; // 5 migrated + alpha #4 + gamma #1, #2
327. // ---- import: the five AntColony ticket files, twice ----------------------------------
328. const imp0 = runImport(null);
329. check('import: without TICKETS_TOKEN every file is refused (401), nothing written', /import: 0 new, 0 already there, 5 failed/.test(imp0) && /FAIL .*: 401/.test(imp0) && (await api('GET', '/api/tickets')).json.tickets.length === LEGACY, imp0);
330. const imp1 = runImport();
331. check('import: first run creates all five', /import: 5 new, 0 already there, 0 failed/.test(imp1), imp1);
332. check('import: numbered per project (antcolony #1, #2)', /NEW 0004-scheduler\.md → antcolony #1/.test(imp1) && /NEW 0005-agent\.md → antcolony #2/.test(imp1) && /NEW 0001-tickets-app\.md → tickets\.worldapi\.org #1/.test(imp1), imp1);
333. const imp2 = runImport();
334. check('import: second run is idempotent (0 new, 5 already there)', /import: 0 new, 5 already there, 0 failed/.test(imp2), imp2);
335. let list = await api('GET', '/api/tickets');
336. const TOTAL = LEGACY + 5;
337. check('api: GET /api/tickets lists five more after two imports', list.status === 200 && list.json.tickets.length === TOTAL && list.json.tickets.filter(t => t.source).length === 5, J(list).slice(0, 300));
338. let one = await api('GET', PT('tickets.worldapi.org', 1));
339. check('api: tickets.worldapi.org #1 is the first file (project, subject, summary, a created event)',
340. one.status === 200 && one.json.ticket.project === 'tickets.worldapi.org' && one.json.ticket.subject === 'Build the World Ticket System in Hybriel'
341. && one.json.ticket.summary.startsWith('Everyone can write everyone a ticket. This is the only state store of AntColony, so it comes first. Minimal scope:')
342. && one.json.events.length === 1 && one.json.events[0].kind === 'created' && one.json.events[0].text === 'imported from 0001-tickets-app.md' && one.json.events[0].author === 'gate', J(one.json).slice(0, 400));
343. check('api: antcolony #1 is the scheduler file', (await api('GET', PT('antcolony', 1))).json.ticket.source === '0004-scheduler.md');
344. check('api: unknown ticket is a 404', (await api('GET', '/api/tickets/99')).status === 404 && (await api('GET', PT('antcolony', 99))).status === 404);
345. check('api: a ticket without subject is refused (400)', (await api('POST', '/api/tickets', { project: 'x' })).status === 400);
346. check('api: an unknown state is refused (400)', (await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'nope' })).status === 400);
347. check('api: an empty comment is refused (400)', (await api('POST', PT('ident.worldapi.org', 1) + '/comments', { text: ' ' })).status === 400);
348. check('api: filter by project', (await api('GET', '/api/tickets?project=antcolony')).json.tickets.length === 2 && (await api('GET', '/api/projects/antcolony/tickets')).json.tickets.length === 2);
349. check('api: filter by project + state on the per-project list', (await api('GET', '/api/projects/alpha/tickets?state=in-progress')).json.tickets.map(t => t.number).join() === '1');
350. const projects = await api('GET', '/api/projects');
351. const imported = (await api('GET', '/api/tickets')).json.tickets.filter(t => t.source);
352. check('import: hard-wrapped lines are joined (no line break left in the five)', imported.length === 5 && imported.every(t => !t.summary.includes('\n')));
353. check('api: projects (creation order) and states', J(projects.json.projects) === J(['alpha', 'beta.example.org', 'gamma', 'antcolony', 'tickets.worldapi.org', 'ident.worldapi.org', 'gitoria.worldapi.org']) && projects.json.states.length === 7, J(projects.json));
355. // ---- the API is strict (ticket #10): every refused body writes NOTHING ----------------
356. const rawPost = async (path, raw, auth = 'Bearer ' + TOKEN) => {
357. const r = await fetch(BASE + path, { method: 'POST', headers: { 'content-type': 'application/json', ...(auth ? { authorization: auth } : {}) }, body: raw });
358. let json = null; try { json = await r.clone().json(); } catch {}
359. return { status: r.status, json, text: json ? '' : await r.text() };
360. };
361. const strictCases = [
362. // [path, raw body, expected status, expected `field` (null = none), error must include]
363. ['/api/tickets', J({ project: 'x', subject: 's', bogus: '1' }), 400, 'bogus', "unknown field 'bogus'"],
364. ['/api/tickets', J({ project: 'x', subject: 's', Subject: 't' }), 400, 'Subject', "unknown field 'Subject'"],
365. ['/api/tickets', J({ project: 'x' }), 400, 'subject', "field 'subject' is required"],
366. ['/api/tickets', J({ subject: 's' }), 400, 'project', "field 'project' is required"],
367. ['/api/tickets', J({ project: 'x', subject: ' ' }), 400, 'subject', "field 'subject' must not be empty"],
368. ['/api/tickets', J({ project: '', subject: 's' }), 400, 'project', "field 'project' must not be empty"],
369. ['/api/tickets', J({ project: 'x', subject: 5 }), 400, 'subject', "field 'subject' must be a string"],
370. ['/api/tickets', J({ project: 'x', subject: 's', summary: null }), 400, 'summary', "field 'summary' must be a string"],
371. ['/api/tickets', J({ project: 'a b', subject: 's' }), 400, 'project', 'no such project'],
372. // ticket #7: NO free author any more — the author is the token's user; a body naming one is refused
373. ['/api/tickets', J({ project: 'x', subject: 's', author: ['a'] }), 400, 'author', "no field 'author' any more"],
374. ['/api/tickets', J({ project: 'x', subject: 's', author: 'gate' }), 400, 'author', "no field 'author' any more: the author is the user of your API token"],
375. ['/api/tickets', J({ project: 'x', subject: 's', summary: 'y', author: ' ' }), 400, 'author', "no field 'author' any more"],
376. ['/api/tickets/2/comments', J({ text: 'x', author: 'creator' }), 400, 'author', "no field 'author' any more"],
377. ['/api/tickets/2/comments', J({ text: 'x', author: '' }), 400, 'author', "no field 'author' any more"],
378. ['/api/tickets/2/state', J({ state: 'in progress', author: 'creator' }), 400, 'author', "no field 'author' any more"],
379. ['/api/tickets/2/state', J({ state: 'confirmed', text: 'n', author: ' ' }), 400, 'author', "no field 'author' any more"],
380. ['/api/tickets', J([1, 2]), 400, '', 'must be a JSON object'],
381. ['/api/tickets', J('text'), 400, '', 'must be a JSON object'],
382. ['/api/tickets', '', 400, '', 'must be a JSON object'],
383. ['/api/tickets/2/comments', J({ text: 'hi', state: 'open' }), 400, 'state', "unknown field 'state'"],
384. ['/api/tickets/2/comments', J({}), 400, 'text', "field 'text' is required"],
385. ['/api/tickets/2/comments', J({ text: ' ' }), 400, 'text', "field 'text' must not be empty"],
386. ['/api/tickets/2/comments', J({ text: { a: 1 } }), 400, 'text', "field 'text' must be a string"],
387. ['/api/tickets/2/comments', J({ text: true }), 400, 'text', "field 'text' must be a string"],
388. ['/api/tickets/2/comments', J({ text: 'x', author: 7 }), 400, 'author', "no field 'author' any more"],
389. ['/api/tickets/2/state', J({ state: 'open', note: 'x' }), 400, 'note', "unknown field 'note'"],
390. ['/api/tickets/2/state', J({ text: 'x' }), 400, 'state', "field 'state' is required"],
391. ['/api/tickets/2/state', J({ state: '' }), 400, 'state', "field 'state' must not be empty"],
392. ['/api/tickets/2/state', J({ state: 3 }), 400, 'state', "field 'state' must be a string"],
393. ['/api/tickets/2/state', J({ state: 'nope' }), 400, 'state', 'unknown state'],
394. ['/api/tickets/2/state', J({ state: 'open' }), 400, 'state', 'already open'],
395. ['/api/tickets/99/comments', J({ text: 'x' }), 404, null, 'no such ticket'],
396. // ticket #38: the slug is the project name, so a new name must be URL-safe; the per-project form is as strict
397. ['/api/tickets', J({ project: 'a#b', subject: 's' }), 400, 'project', 'no such project'],
398. ['/api/tickets', J({ project: 'ä', subject: 's' }), 400, 'project', 'no such project'],
399. ['/api/projects/beta.example.org/tickets/1/comments', J({ text: 'x', author: 'a' }), 400, 'author', "no field 'author' any more"],
400. ['/api/projects/beta.example.org/tickets/1/comments', J({ text: 'x', bogus: '1' }), 400, 'bogus', "unknown field 'bogus'"],
401. ['/api/projects/beta.example.org/tickets/1/state', J({ state: 'open' }), 400, 'state', 'already open'],
402. ['/api/projects/beta.example.org/tickets/1/state', J({ state: 5 }), 400, 'state', "field 'state' must be a string"],
403. ['/api/projects/beta.example.org/tickets', J({ subject: 's', author: 'a' }), 400, 'author', "no field 'author' any more"],
404. ['/api/projects/beta.example.org/tickets/9/comments', J({ text: 'x' }), 404, null, 'no such ticket'],
405. ['/api/projects/beta.example.org/tickets/x/comments', J({ text: 'x' }), 404, null, 'no such ticket'],
406. ];
407. for (const [path, raw, want, field, says] of strictCases) {
408. const r = await rawPost(path, raw);
409. const ok = r.status === want && r.json && typeof r.json.error === 'string' && r.json.error.includes(says) && (field === null || r.json.field === field);
410. check(`strict: POST ${path} ${raw || '(empty)'} → ${want}${field ? ' naming ' + field : ''}`, ok, r.status + ' ' + J(r.json) + r.text);
411. }
412. // invalid JSON (ticket #15): refused by jsoncheck.hl BEFORE JSON.parse → 400 { error },
413. // no source path (workaround for hybriel #12: an uncaught JSON.parse answered 500 + api.hl:31:9)
414. const badJsonCases = [
415. ['/api/tickets', '{"project":"x",', 15], ['/api/tickets', '{bad', 1], ['/api/tickets', "{'project':'x'}", 1],
416. ['/api/tickets', '{"project":"x","subject":"s","summary":"a",}', 43], ['/api/tickets', '[1 2]', 3],
417. ['/api/tickets/2/comments', '{"text":"x","n":"a"} trailing', 21], ['/api/tickets/2/comments', '{"text":"\\x","n":"a"}', 10],
418. ['/api/tickets/2/state', '{"state":01}', 10], ['/api/tickets/2/state', '['.repeat(70), 64], ['/api/tickets/2/state', ' ', 3],
419. // LONE \u surrogate escapes: hl's JSON.parse still refuses them (would be a 500) → refused by the check
420. // (a valid pair parses since hybriel#15, mission 036: see the two checks below)
421. ['/api/tickets/2/comments', '{"text":"\\ud800"}', 10], ['/api/tickets/2/comments', '{"text":"\\udc00"}', 10],
422. ['/api/tickets/2/comments', '{"text":"\\ud83dx"}', 10], ['/api/tickets/2/comments', '{"text":"\\ud83d\\u0041"}', 10],
423. ];
424. for (const [path, raw, at] of badJsonCases) {
425. const r = await rawPost(path, raw);
426. const ok = r.status === 400 && r.json && J(Object.keys(r.json)) === J(['error']) && r.json.error === 'invalid JSON at character ' + at && !/\.hl|\//.test(r.json.error);
427. check(`strict: invalid JSON POST ${path} ${raw.length > 40 ? raw.slice(0, 40) + '…' : raw} → 400 at ${at}, no source path`, ok, r.status + ' ' + J(r.json) + r.text);
428. }
429. // valid but unusual JSON is NOT mistaken for invalid (escapes, unicode, numbers, nesting) → normal field errors
430. const oddValid = await rawPost('/api/tickets/2/comments', '{ "text" : "q\\"b\\\\s\\/\\u00e9\\n", "n": [-1.5e+3, 0, true, null, {"x":[]}] }');
431. check('strict: valid unusual JSON passes the check (→ unknown field n, not invalid JSON)', oddValid.status === 400 && oddValid.json && oddValid.json.field === 'n', oddValid.status + ' ' + J(oddValid.json) + oddValid.text);
432. const pairOnly = await rawPost('/api/tickets/2/comments', '{"text":"\\ud83d\\ude00","n":"a"}');
433. check('strict: a valid \\u surrogate pair passes the check (hybriel#15 → unknown field n, not invalid JSON)', pairOnly.status === 400 && pairOnly.json && pairOnly.json.field === 'n', pairOnly.status + ' ' + J(pairOnly.json) + pairOnly.text);
434. const escaped = await rawPost('/api/tickets/3/comments', '{"text":"q\\"b\\\\s\\/\\u00e9 \u{1F600} end \\ud83d\\ude00"}');
435. check('strict: a comment with JSON escapes (\\" \\\\ \\/ \\u00e9 \\ud83d\\ude00) and a raw emoji is stored decoded (201)', escaped.status === 201 && escaped.json.event.text === 'q"b\\s/\u00e9 \u{1F600} end \u{1F600}', escaped.status + ' ' + J(escaped.json) + escaped.text);
436. const afterStrict = await api('GET', '/api/tickets');
437. check('strict: the refused requests wrote nothing (same ticket count, old #2 = beta.example.org #1 has one event)', afterStrict.json.tickets.length === TOTAL && (await api('GET', '/api/tickets/2')).json.events.length === 1 && (await api('GET', PT('beta.example.org', 1))).json.events.length === 1, J(afterStrict.json.tickets.map(t => t.ref)));
438. check('strict: GET /api/inbox refuses POST (405)', (await rawPost('/api/inbox', '{}')).status === 405);
440. // ---- ticket #7: API writes need a valid token — 401 BEFORE the body is looked at ----------
441. const before401 = J((await api('GET', '/api/tickets')).json.tickets.map(t => [t.ref, t.events]));
442. const authCases = [
443. // [path, raw body, Authorization header (null = none), label]
444. ['/api/tickets', J({ project: 'x', subject: 's' }), null, 'no token'],
445. ['/api/projects/alpha/tickets', J({ subject: 's' }), null, 'no token'],
446. ['/api/tickets/2/comments', J({ text: 'x' }), null, 'no token'],
447. ['/api/projects/alpha/tickets/1/comments', J({ text: 'x' }), null, 'no token'],
448. ['/api/tickets/2/state', J({ state: 'in progress' }), null, 'no token'],
449. ['/api/projects/alpha/tickets/1/state', J({ state: 'on hold' }), null, 'no token'],
450. ['/api/tickets/2/comments', J({ text: 'x' }), 'Bearer tkt_' + '0'.repeat(48), 'an unknown token'],
451. ['/api/tickets/2/comments', J({ text: 'x' }), 'Bearer ' + TOKEN + '0', 'a token with one character more'],
452. ['/api/tickets/2/comments', J({ text: 'x' }), 'Bearer ' + TOKEN.slice(0, -1), 'a token with one character less'],
453. ['/api/tickets/2/comments', J({ text: 'x' }), TOKEN, 'the token without "Bearer"'],
454. ['/api/tickets/2/comments', J({ text: 'x' }), 'Basic ' + TOKEN, 'Basic instead of Bearer'],
455. ['/api/tickets/2/comments', J({ text: 'x' }), 'Bearer ', 'an empty Bearer'],
456. ['/api/tickets/2/comments', '{bad', null, 'no token + invalid JSON (auth first)'],
457. ['/api/tickets/2/comments', J({ text: 'x', author: 'creator' }), null, 'no token + an author field (auth first)'],
458. ];
459. for (const [path, raw, auth, label] of authCases) {
460. const r = await rawPost(path, raw, auth);
461. check(`auth: POST ${path} with ${label} → 401`, r.status === 401 && r.json && /Authorization: Bearer/.test(r.json.error), r.status + ' ' + J(r.json) + r.text);
462. }
463. check('auth: the refused writes wrote nothing', J((await api('GET', '/api/tickets')).json.tickets.map(t => [t.ref, t.events])) === before401);
464. const anonRead = await fetch(BASE + '/api/tickets/1');
465. check('auth: reading needs no token (GET without Authorization → 200)', anonRead.status === 200);
467. // ---- local time (ticket #10): Europe/Vienna, storage stays epoch ms -----------------------
468. const vienna = new Intl.DateTimeFormat('sv-SE', { timeZone: 'Europe/Vienna', year: 'numeric', month: '2-digit', day: '2-digit', hour: '2-digit', minute: '2-digit', hourCycle: 'h23' });
469. const lt = spawnSync(BIN, ['tests/localtime.hl'], { cwd: APP, encoding: 'utf8', timeout: 30000 });
470. const ltLines = (lt.stdout || '').trim().split('\n').filter(Boolean);
471. const ltBad = ltLines.filter(l => { const [ms, ...rest] = l.split(' '); return vienna.format(new Date(Number(ms))) !== rest.join(' '); });
472. check('time: localtime.hl matches Intl Europe/Vienna on DST edges 2000–2100', ltLines.length === 11 && ltBad.length === 0, J(ltBad) + (lt.stderr || ''));
473. const t2 = (await api('GET', PT('ident.worldapi.org', 1))).json;
474. check('time: API rows render updatedMs / createdMs in Vienna time', t2.ticket.updated === vienna.format(new Date(t2.ticket.updatedMs)) && t2.events[0].when === vienna.format(new Date(t2.events[0].createdMs)), J([t2.ticket.updated, t2.ticket.updatedMs, t2.events[0].when]));
476. // ---- two viewers ------------------------------------------------------------------
477. A = await launchBrowser({ debugPortRange: range(process.env.TICKETS_GATE_CHROME_A, '8620-8629') });
478. B = await launchBrowser({ debugPortRange: range(process.env.TICKETS_GATE_CHROME_B, '8630-8639') });
479. const a = patient(await A.newPage());
480. const b = patient(await B.newPage());
482. // SSR of the list
483. await a.goto(BASE + '/');
484. await a.waitForSelector('#tickets li');
485. await connected(a, 'A connected');
486. check('list: SSR shows every ticket (migrated + new + imported)', (await texts(a, '#tickets li')).length === TOTAL, J(await texts(a, '#tickets li')));
487. check('list: every row has a state badge, a #ref link and its project', await a.evaluate(`Array.from(document.querySelectorAll('#tickets li')).every(li => li.querySelector('ticket-state') && /^#\\d+/.test(li.querySelector('a.subject').textContent) && li.querySelector('ticket-meta a'))`));
488. check('list: every ticket link is /<project>/<number> of its row (ticket #25)', await a.evaluate(`Array.from(document.querySelectorAll('#tickets li')).every(li => li.querySelector('a.subject').getAttribute('href') === '/' + li.querySelector('ticket-meta a').textContent + '/' + li.querySelector('ticket-ref').textContent.slice(1))`));
489. check('list: the project filter offers all seven projects', (await texts(a, '#projectfilter a')).length === 8, J(await texts(a, '#projectfilter a')));
490. check('list: palette — accent is purple #c586c0, danger #f44747', await a.evaluate(`(() => { const cs = getComputedStyle(document.documentElement); return cs.getPropertyValue('--color-accent').trim() === '#c586c0' && getComputedStyle(document.querySelector('.brand')).color === 'rgb(197, 134, 192)' && getComputedStyle(document.body).backgroundColor === 'rgb(25, 30, 35)'; })()`), await a.evaluate(`getComputedStyle(document.querySelector('.brand')).color + ' ' + getComputedStyle(document.body).backgroundColor`));
491. check('list: danger token resolves to #f44747', await a.evaluate(`(() => { const s = document.createElement('span'); s.style.color = 'var(--color-danger)'; document.body.append(s); const c = getComputedStyle(s).color; s.remove(); return c; })()`) === 'rgb(244, 71, 71)');
493. // filters by real clicks (client-side navigation)
494. await clickNav(a, '#projectfilter a[href="/project/antcolony"]', 'location.pathname === "/project/antcolony" && document.querySelectorAll("#tickets li").length === 2', 'project filter');
495. check('filter: project antcolony shows its two tickets', J(await texts(a, '#tickets ticket-meta a')) === J(['antcolony', 'antcolony']), J(await texts(a, '#tickets ticket-meta a')));
496. check('filter: the chosen project is marked selected', (await a.text('#projectfilter a.selected')) === 'antcolony');
497. await clickNav(a, '#statefilter a[href="/project/antcolony/state/progress"]', 'location.pathname === "/project/antcolony/state/progress" && !!document.querySelector("#empty")', 'state filter');
498. check('filter: project + state "progress" is empty (nothing in progress yet)', (await texts(a, '#tickets li')).length === 0);
499. await clickNav(a, '#statefilter a[href="/project/antcolony"]', 'document.querySelectorAll("#tickets li").length === 2', 'state filter cleared');
500. check('filter: clearing the state keeps the project', (await a.evaluate('location.pathname')) === '/project/antcolony');
501. await a.goto(BASE + '/state/open');
502. await a.waitForSelector('#tickets li');
503. const OPEN = (await api('GET', '/api/tickets?state=open')).json.tickets.length;
504. check('filter: /state/open by URL (SSR) shows every open ticket', (await texts(a, '#tickets li')).length === OPEN, OPEN);
506. // ---- a migrated ticket in the browser: the old URL redirects, a real click opens the new one
507. await a.goto(BASE + '/tickets/4');
508. await a.waitForSelector('#subject');
509. check('legacy: the old URL /tickets/4 lands on /alpha/3 (redirect in the browser)', (await a.evaluate('location.pathname')) === '/alpha/3' && (await a.text('#subject')) === 'Legacy alpha three' && (await a.text('#ref')) === '#3', await a.evaluate('location.href'));
510. check('legacy: the page says "formerly #4"', (await a.text('#oldref')) === 'formerly #4', await a.text('#oldref'));
511. check('legacy: its history holds the created event and both API comments, in order', J(await texts(a, '#events li event-text')) === J(['via the old number', 'via the project number']) && (await texts(a, '#events li')).length === 3, J(await texts(a, '#events li')));
512. await a.goto(BASE + '/project/alpha');
513. await a.waitForSelector('#tickets li');
514. await connected(a, 'A on alpha');
515. await clickNav(a, '#tickets a.subject[href="/alpha/1"]', 'location.pathname === "/alpha/1" && !!document.querySelector("#events li")', 'click alpha #1');
516. check('legacy: a real click on a list row opens /alpha/1 (old #1, history in order)', (await a.text('#subject')) === 'Legacy alpha one' && (await a.text('#oldref')) === 'formerly #1' && J(await texts(a, '#events li event-text')) === J(['legacy comment on one', 'started']), J(await texts(a, '#events li')));
517. await a.goto(BASE + '/gamma/1');
518. await a.waitForSelector('#subject');
519. check('numbers: a new ticket has no "formerly"', (await a.text('#ref')) === '#1' && !(await a.evaluate('!!document.querySelector("#oldref")')));
520. await a.goto(BASE + '/alpha/99');
521. await a.waitForSelector('#gone');
522. check('numbers: an unknown number shows "no such ticket"', (await a.text('#gone')).includes('no such ticket'));
523. await a.goto(BASE + '/gamma');
524. await a.waitForSelector('#tickets li');
525. check('numbers: /<slug> lists that project', (await texts(a, '#tickets li')).length === 2 && (await a.text('#heading')) === 'gamma');
527. // ---- ticket #25: short URLs /<slug>, /<slug>/<number>; every old page URL answers 301; hl:web's own urls stay its own
528. const SHORT_SSR = [['/gamma', 'id="heading">gamma<'], ['/gamma/1', 'first of a new project'], ['/beta.example.org/2', 'Legacy beta two'], ['/alpha/3', 'Legacy alpha three']];
529. for (const [path, want] of SHORT_SSR) {
530. const r = await fetch(BASE + path, { redirect: 'manual' });
531. const body = await r.text();
532. check(`short (#25): GET ${path} → 200, the page itself (SSR)`, r.status === 200 && body.includes(want), r.status + ' ' + body.slice(0, 200));
533. }
534. for (const [from, to] of [['/projects/gamma', '/gamma'], ['/projects/gamma/1', '/gamma/1'], ['/projects/gamma/tickets/2', '/gamma/2'], ['/projects/beta.example.org/tickets/2', '/beta.example.org/2'], ['/projects/alpha/3', '/alpha/3'], ['/tickets/5', '/beta.example.org/2']]) {
535. const r = await fetch(BASE + from, { redirect: 'manual' });
536. check(`short (#25): old ${from} → 301 Location ${to}`, r.status === 301 && r.headers.get('location') === to, r.status + ' ' + r.headers.get('location'));
537. }
538. for (const from of ['/projects/nope', '/projects/nope/1', '/projects/gamma/99', '/projects/gamma/tickets/99', '/projects/gamma/tickets/x', '/projects/gamma/%0d%0aSet-Cookie:x']) {
539. const r = await fetch(BASE + from, { redirect: 'manual' });
540. check(`short (#25): old ${from} names nothing → 404, no Location`, r.status === 404 && !r.headers.get('location'), r.status + ' ' + r.headers.get('location'));
541. }
542. const ssrNope = await (await fetch(BASE + '/nope')).text();
543. check('short (#25): /nope (no such project) → the page says so', /no such project|nope/i.test(ssrNope) && ssrNope.includes('id="heading">nope<'), ssrNope.slice(0, 200));
544. // hl:web appends its own urls AFTER the app's routes; /:projectSlug/:ticketNumber must not answer them (project.hl moves it last)
545. for (const [path, type] of [['/__hl/app.css', 'text/css'], ['/__hl/hl-runtime.js', 'text/javascript'], ['/__hl/sw.js', 'text/javascript'], ['/__hl/manifest.webmanifest', 'application/manifest+json'], ['/__hl/web/client.js', 'text/javascript'], ['/components/ticket.hl', 'text/javascript'], ['/components/ticket_list.hl', 'text/javascript'], ['/components/main.hl', 'text/javascript']]) {
546. const r = await fetch(BASE + path);
547. const body = await r.text();
548. check(`short (#25): hl:web's ${path} is still its own (${type}, no page)`, r.status === 200 && (r.headers.get('content-type') || '').startsWith(type) && !body.startsWith('<!doctype'), r.status + ' ' + r.headers.get('content-type'));
549. }
550. const em = await fetch(BASE + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J({ t: 'emit', i: 1, event: 'nosuchface', payload: [] }) });
551. check('short (#25): POST /__hl/emit is still hl:web\'s carrier (JSON ack)', em.status === 200 && /"ok":false/.test(await em.text()));
552. // in the browser: an old link lands on the short URL; the project link on the ticket page is a CLIENT navigation to /<slug>
553. await a.goto(BASE + '/projects/gamma/tickets/1');
554. await a.waitForSelector('#subject');
555. check('short (#25): Chrome on /projects/gamma/tickets/1 lands on /gamma/1', (await a.evaluate('location.pathname')) === '/gamma/1' && (await a.text('#subject')) === 'first of a new project', await a.evaluate('location.href'));
556. await connected(a, 'A on /gamma/1');
557. await a.evaluate('window.__w083 = 1');
558. check('short (#25): the ticket page links its project as /gamma', (await a.evaluate('document.querySelector("#project").getAttribute("href")')) === '/gamma');
559. await clickNav(a, '#project', 'location.pathname === "/gamma" && document.querySelectorAll("#tickets li").length === 2', 'click the project');
560. check('short (#25): a click on the project → /gamma, its list, without a reload', (await a.evaluate('window.__w083')) === 1 && (await a.text('#heading')) === 'gamma');
561. await clickNav(a, '#tickets a.subject[href="/gamma/2"]', 'location.pathname === "/gamma/2" && !!document.querySelector("#subject")', 'click gamma #2');
562. check('short (#25): … and a click on a row → /gamma/2, without a reload', (await a.evaluate('window.__w083')) === 1 && (await a.text('#subject')) === 'second of gamma');
563. // reserved slugs: no project may be named like a path the app answers itself
564. for (const slug of ['api', 'Inbox', '__hl', 'components', 'projects', 'tickets', 'login.js', 'my', 'assets', 'sign-in']) {
565. const r = await api('POST', '/api/projects', { title: 'Reserved ' + slug, slug });
566. check(`short (#25): a new project with the slug ${slug} → 400 reserved`, r.status === 400 && r.json.field === 'slug' && /reserved/.test(r.json.error), J(r));
567. }
568. const toRes = await api('POST', '/api/projects/gamma', { slug: 'inbox' });
569. check('short (#25): changing a slug to a reserved one → 400, gamma keeps its slug', toRes.status === 400 && /reserved/.test(toRes.json.error) && (await api('GET', '/api/projects/gamma')).json.project.slug === 'gamma', J(toRes));
570. check('short (#25): no project was made by the refusals', !(await api('GET', '/api/projects')).json.projects.some(p => /reserved|^api$|^inbox$/i.test(p)));
571. // every first segment a route of project.hl answers is a reserved slug (a new route must add its name)
572. const routeHeads = [...readFileSync(join(APP, 'project.hl'), 'utf8').matchAll(/pattern = "\/([^/":]+)/g)].map(m => m[1]);
573. const reservedSrc = readFileSync(join(APP, 'lib/projects.hl'), 'utf8').match(/static reservedSlugs = \[([^\]]*)\]/);
574. const reserved = reservedSrc ? [...reservedSrc[1].matchAll(/'([^']*)'/g)].map(m => m[1]) : [];
575. const missingHeads = [...new Set([...routeHeads, '__hl', 'components'])].filter(h => !reserved.includes(h));
576. check(`short (#25): every first path segment of project.hl's routes (${new Set(routeHeads).size}) + __hl + components is reserved`, routeHeads.length > 10 && missingHeads.length === 0, J(missingHeads));
578. // ---- old events keep their authors (ticket #7) --------------------------------------------
579. await a.goto(BASE + '/projects/alpha/1');
580. await a.waitForSelector('#events li');
581. check('legacy: old events show their stored authors (creator, worker, worker)', J(await texts(a, '#events event-head strong')) === J(['creator', 'worker', 'worker']), J(await texts(a, '#events event-head strong')));
583. // ---- signed out: reading only (ticket #7) --------------------------------------------------
584. const IDENT1 = '/projects/ident.worldapi.org/1';
585. await a.goto(BASE + IDENT1);
586. await a.waitForSelector('#events li');
587. await connected(a, 'A on ident #1 (signed out)');
588. check('signed out: the ticket page shows the history, a login hint and NO write forms', (await texts(a, '#events li')).length === 1 && !!(await a.evaluate('!!document.querySelector("#loginhint")')) && !(await a.evaluate('!!document.querySelector("#commentform") || !!document.querySelector("#stateform")')));
589. check('signed out: top right the selector ("choose ident") and "Log in with ident"', await a.evaluate(`(() => { const s = document.querySelector('#selector'); const r = s && s.shadowRoot; const btn = document.querySelector('#loginbutton'); const hb = document.querySelector('application-header').getBoundingClientRect(); const sb = s.getBoundingClientRect(); return !!r && /choose/.test(r.querySelector('#choose').textContent) && !s.hasAttribute('logged-in') && !!btn && sb.right > hb.right - 400; })()`));
590. check('signed out: the login button goes to ident /login with the app key and the callback', (await a.evaluate('document.querySelector("#loginbutton").getAttribute("href")')) === `${ident.base}/login?key=${APPKEY.key}&return=${encodeURIComponent(BASE + '/login/callback')}`, await a.evaluate('document.querySelector("#loginbutton").getAttribute("href")'));
591. check('signed out: the selector is restyled to tickets\' accent (purple)', await a.evaluate(sh('getComputedStyle(r.querySelector("#choose")).backgroundColor')) === 'rgb(197, 134, 192)');
592. let anonCookie = (await a.cookies([BASE])).filter(c => c.name === 'hlsid').map(c => 'hlsid=' + c.value)[0];
593. const anonTry = await temit('commentOn', [(await api('GET', PT('ident.worldapi.org', 1))).json.ticket.id, 'anonymous'], anonCookie);
594. check('signed out: a web write (the face, with the browser\'s own cookie) is refused', anonTry.value && /log in with ident/.test(anonTry.value.error), anonTry.raw);
595. for (const [w, h, name] of [[390, 844, 'phone'], [1280, 900, 'desktop']]) {
596. await viewport(a, w, h);
597. check(`layout ${name} ${w}px: signed-out header (selector + login button) has no horizontal overflow`, await noOverflow(a));
598. await shot(a, `${name}-signedout`);
599. }
600. await viewport(a, 1280, 900);
602. // ---- A = alice (the creator): sign in to ident, then the SELECTOR on tickets ---------------
603. await identSignIn(a, '[email protected]');
604. await a.goto(BASE + IDENT1);
605. await a.waitForSelector('#events li');
606. await connected(a, 'A on ident #1');
607. await a.evaluate('window.__loginMarker = 1');
608. await shClick(a, '#choose');
609. await a.waitFor(sh(`r.querySelectorAll('[part~="identity"]').length > 0`), { label: 'selector list' });
610. check('selector: lists alice\'s identity', J(await a.evaluate(sh(`[...r.querySelectorAll('[part~="identity"]')].map(b => b.textContent)`))) === J(['Default']));
611. await shClick(a, '[part~="identity"]', 'Default');
612. await a.waitForSelector('#nameform', { timeout: 10000 });
613. check('selector login: no reload, the host set logged-in, the name prompt appears', (await a.evaluate('window.__loginMarker')) === 1 && await a.evaluate('document.querySelector("#selector").hasAttribute("logged-in") && document.querySelector("#selector").loggedIn === true') && /logged in with/.test(await a.evaluate(sh('r.querySelector("#status").textContent'))));
614. check('selector login: still no write forms before the name', !(await a.evaluate('!!document.querySelector("#commentform")')));
615. for (const [w, h, name] of [[390, 844, 'phone'], [1280, 900, 'desktop']]) {
616. await viewport(a, w, h);
617. check(`layout ${name} ${w}px: name prompt has no horizontal overflow`, await noOverflow(a));
618. await shot(a, `${name}-name`);
619. }
620. await viewport(a, 1280, 900);
621. await a.type('#displayname', 'alice');
622. await a.click('#namesave');
623. await a.waitFor('!document.querySelector("#nameform") && !!document.querySelector("#memberhint")', { label: 'A named, no role yet: a member hint, no forms' });
624. check('name: saved; no role yet → a role hint, no comment form; top right shows "alice"', (await a.evaluate('window.__loginMarker')) === 1 && (await a.text('#whoami')) === 'alice' && !(await a.evaluate('!!document.querySelector("#commentform")')));
625. // ticket #20: the admin (the gate user, the creator) gives alice a role in every project; the page follows live
626. const grant = async (name, role) => { for (const slug of (await api('GET', '/api/projects')).json.projects) { const g = await api('POST', `/api/projects/${slug}/members`, { user: name, role }); if (g.status !== 200 && g.status !== 201) throw new Error('grant failed ' + slug + ' ' + J(g)); } };
627. await grant('alice', 'admin');
628. await a.goto(BASE + IDENT1);
629. await a.waitFor('!!document.querySelector("#commentform")', { label: 'A: the forms appear after alice got a role' });
630. await connected(a, 'A on ident #1 with a role');
631. await a.evaluate('window.__loginMarker = 1');
632. check('roles: alice made admin → the comment form appears (page reloaded), no member hint', !(await a.evaluate('!!document.querySelector("#memberhint")')));
633. for (const [w, h, name] of [[390, 844, 'phone'], [1280, 900, 'desktop']]) {
634. await viewport(a, w, h);
635. check(`layout ${name} ${w}px: logged-in header has no horizontal overflow`, await noOverflow(a));
636. await shot(a, `${name}-loggedin`);
637. }
638. await viewport(a, 1280, 900);
639. const aliceCookie = (await a.cookies([BASE])).filter(c => c.name === 'hlsid').map(c => 'hlsid=' + c.value)[0];
640. const aliceHtml = await (await fetch(BASE + '/', { headers: { cookie: aliceCookie } })).text();
641. const ALICE_UID = (/\\?"user\\?":\{\\?"id\\?":\\?"([0-9a-z]{12})/.exec(aliceHtml) || [])[1];
642. check('session: the page knows alice\'s tickets user id, NEVER her identity id', /^[0-9a-z]{12}$/.test(ALICE_UID || '') && !aliceHtml.includes(ALICE_ID), ALICE_UID);
644. // ---- B = bob: sign in to ident, then the LOGIN BUTTON ---------------------------------------
645. await identSignIn(b, '[email protected]');
646. await b.goto(BASE + '/');
647. await b.waitForSelector('#loginbutton');
648. await b.click('#loginbutton');
649. await b.waitForSelector('#chooselist', { timeout: 10000 });
650. check('button: tickets → ident /signin/<rid> (choose an identity)', (await b.evaluate('location.href')).startsWith(ident.base + '/signin/'));
651. await connectedIdent(b);
652. await b.click('#chooselist li:nth-child(1) .choose');
653. await b.waitFor(`location.href === ${J(BASE + '/')} && !!document.querySelector('#nameform')`, { timeout: 10000, label: 'B back with the name prompt' });
654. check('button: back on tickets (/login/callback → /), logged in, asked for a name', await b.evaluate('document.querySelector("#selector").classList.contains("in")') && !(await b.evaluate('!!document.querySelector("#newticket")')));
655. await connected(b, 'B on / after the button login');
656. await b.type('#displayname', 'bob');
657. await b.click('#namesave');
658. await b.waitFor('!document.querySelector("#nameform") && !!document.querySelector("#rolehint")', { label: 'B named' });
659. check('button: bob named (no role yet: a role hint, no new-ticket form)', (await b.text('#whoami')) === 'bob' && !(await b.evaluate('!!document.querySelector("#newticket")')));
660. await grant('bob', 'edit');
661. await b.goto(BASE + '/');
662. await b.waitFor('!!document.querySelector("#newticket")', { label: 'B: the new-ticket form appears with the role edit' });
663. await connected(b, 'B on / with a role');
664. check('roles: bob made edit → the new-ticket form appears', (await b.text('#whoami')) === 'bob');
665. const bobCookie = (await b.cookies([BASE])).filter(c => c.name === 'hlsid').map(c => 'hlsid=' + c.value)[0];
667. // ---- the ticket page, two viewers ---------------------------------------------------
668. await b.goto(BASE + IDENT1);
669. await b.waitForSelector('#events li');
670. await connected(b, 'B on ident #1');
671. await sleep(300);
672. check('ticket: subject, ref, project, state', (await a.text('#subject')) === 'Rebuild ident in Hybriel: email OTP login' && (await a.text('#ref')) === '#1' && (await a.text('#project')) === 'ident.worldapi.org' && (await a.text('#state')) === 'open', [await a.text('#subject'), await a.text('#ref'), await a.text('#project'), await a.text('#state')].join(' | '));
673. check('ticket: the imported summary is one paragraph (hard wraps joined)', await a.evaluate(`!document.querySelector('#summary').textContent.includes('\\n') && document.querySelector('#summary').textContent.startsWith('Login for all worldapi apps (tickets, gitoria, …). Only email one-time codes, no passwords. Built on hl:webex;')`), await a.text('#summary'));
674. check('time: the ticket page shows Vienna time (opened / updated / history)', await a.evaluate(`[document.querySelector('ticket-view header time').textContent, document.querySelector('#updated').textContent, document.querySelector('#events li time').textContent]`).then(v => J(v) === J([t2.ticket.created, t2.ticket.updated, t2.events[0].when]) && t2.ticket.created === vienna.format(new Date(t2.events[0].createdMs))), J(t2.ticket));
675. check('ticket: history starts with the import event (by the token\'s user "gate")', (await texts(a, '#events li')).length === 1 && (await a.text('#events li')).includes('gate opened the ticket'), await a.text('#events li'));
677. // A comments (real typing into the form, real click) → B sees it without reload
678. check('ticket: no author field (ticket #7: the author is the logged-in user)', await a.evaluate('!document.querySelector("#author") && !document.querySelector("input[name=author]")'));
679. await type(a, '#commenttext', 'first comment from A\nsecond line');
680. await a.click('#commentsend');
681. await a.waitFor('document.querySelectorAll("#events li").length === 2', { label: 'A sees its comment' });
682. check('comment: appended in the writing browser, author = the login (alice)', (await a.text('#events li:last-child')).includes('alice commented') && (await a.text('#events li:last-child event-text')) === 'first comment from A\nsecond line', await a.text('#events li:last-child'));
683. check('comment: the textarea was cleared', await a.evaluate('document.querySelector("#commenttext").value === ""'));
684. await b.waitFor('document.querySelectorAll("#events li").length === 2', { label: 'B got the comment live' });
685. check('live: B sees A\'s comment without a reload', (await b.text('#events li:last-child event-text')) === 'first comment from A\nsecond line');
686. // hybriel 64527baa+: a face taking `session` answers with a sync of the session-derived members — a list must
687. // not get the new row twice (gitoria's keys/tokens did). Settle, then count.
688. await sleep(600);
689. for (const [p, who] of [[a, 'A'], [b, 'B']]) check(`once: ${who} shows A's comment exactly once (2 history rows)`, (await texts(p, '#events li')).length === 2 && (await texts(p, '#events li event-text')).filter(t => t === 'first comment from A\nsecond line').length === 1, J(await texts(p, '#events li')));
690. check('live: B did not reload (no navigation entry)', await b.evaluate('performance.getEntriesByType("navigation").length === 1 && performance.getEntriesByType("navigation")[0].type === "navigate"'));
691. await b.evaluate('window.__gateMarker = 42'); // survives only if B never reloads
693. // ---- ticket #20: the new states, the roles, projects with members, the inbox (browser + API) ------------------
694. // A (alice, admin) moves ident #1 to "review": B follows live; the ticket is assigned to the project's first admin (the gate user)
695. check('shell: no inbox count yet (nothing assigned to bob)', !(await b.evaluate('!!document.querySelector("#inboxcount")')));
696. check('state: the choices are the new state names', J((await texts(a, '#newstate option')).sort()) === J(['canceled', 'done', 'pending', 'progress', 'reopened', 'review']), J(await texts(a, '#newstate option')));
697. await choose(a, '#newstate', 'review');
698. await type(a, '#statenote', 'please test');
699. await a.click('#statesend');
700. await a.waitFor('document.querySelector("#state").textContent === "review"', { label: 'A state changed' });
701. check('state: A shows the new state and a state event with the note', (await a.text('#events li:nth-last-child(2)')).includes('alice changed the state') && (await a.text('#events li:nth-last-child(2) ticket-state')) === 'review' && (await a.text('#events li:nth-last-child(2) event-text')) === 'please test' && (await a.text('#events li:last-child')).includes('assigned the ticket to gate'), await a.text('#events li:last-child'));
702. await sleep(600);
703. check('once: A shows the state change exactly once', (await texts(a, '#events li')).filter(t => t.includes('alice changed the state')).length === 1, J(await texts(a, '#events li')));
704. await b.waitFor('document.querySelector("#state").textContent === "review"', { label: 'B state live' });
705. check('live: B\'s state badge followed, no reload', (await b.evaluate('document.querySelector("#state").className')) === 'review' && (await b.evaluate('window.__gateMarker')) === 42);
706. const inboxOf = async (tok) => { const r = await fetch(BASE + '/api/inbox', { headers: { authorization: 'Bearer ' + tok } }); let json = null; try { json = await r.json(); } catch {} return { status: r.status, json }; };
707. const inbox0 = await inboxOf(TOKEN);
708. check('inbox: the gate user (first admin) has ident #1 in review, only tickets assigned to them', inbox0.status === 200 && inbox0.json.review.some(t => t.subject === 'Rebuild ident in Hybriel: email OTP login') && [...inbox0.json.review, ...inbox0.json.pending].every(t => t.assignee === 'gate'), J(inbox0.json).slice(0, 400));
709. const oldNames = await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'awaiting creator' });
710. check('states: the old name "awaiting creator" is an alias of review (already there → 400 "already")', oldNames.status === 400 && /already review/.test(oldNames.json.error), J(oldNames));
711. const aliasBack = await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'in progress' });
712. check('states: "in progress" is an alias of progress (201)', aliasBack.status === 201 && aliasBack.json.ticket.state === 'progress', J(aliasBack).slice(0, 300));
713. await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'open' });
715. // roles: bob = use → comment + open ⇄ review, nothing else (web and API)
716. let aliceTok0 = null;
717. const bobTok = (await temit('tokenCreate', ['bob gate'], bobCookie)).value.token;
718. await api('POST', '/api/projects/ident.worldapi.org/members', { user: 'bob', role: 'use' });
719. await b.goto(BASE + IDENT1);
720. await b.waitForSelector('#stateform');
721. await connected(b, 'B on ident #1 as use');
722. check('roles: bob (use) sees only review in the state choices (ticket is open)', J(await texts(b, '#newstate option')) === J(['review']), J(await texts(b, '#newstate option')));
723. const useDone = await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'done' }, bobTok);
724. const useReview = await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'review' }, bobTok);
725. const useNew = await api('POST', '/api/projects/ident.worldapi.org/tickets', { subject: 'use may not' }, bobTok);
726. const useSettings = await api('POST', '/api/projects/ident.worldapi.org/members', { user: 'bob', role: 'admin' }, bobTok);
727. const useComment = await api('POST', PT('ident.worldapi.org', 1) + '/comments', { text: 'a use member comments' }, bobTok);
728. check('roles: use → done 403, review 201, new ticket 403, members 403, comment 201', [useDone.status, useReview.status, useNew.status, useSettings.status, useComment.status].join() === '403,201,403,403,201', J([useDone, useNew, useSettings]).slice(0, 500));
729. await b.goto(BASE + '/projects/ident.worldapi.org/settings');
730. await b.waitForSelector('#notadmin');
731. check('roles: the settings page of a non-admin says so and has no forms', !(await b.evaluate('!!document.querySelector("#detailsform")')));
732. await api('POST', '/api/projects/ident.worldapi.org/members', { user: 'bob', role: 'edit' });
733. const editAssign = await api('POST', PT('ident.worldapi.org', 1) + '/assign', { assignee: 'bob' }, bobTok);
734. check('roles: edit may assign (201) and move to any state', editAssign.status === 201 || editAssign.status === 200, J(editAssign).slice(0, 300));
735. const editPending = await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'pending' }, bobTok);
736. check('roles: edit → pending 201; "on hold" is an alias of pending', editPending.status === 201 && editPending.json.ticket.state === 'pending', J(editPending).slice(0, 300));
737. // the inbox page of bob: pending and review, only what is assigned to him
738. await b.goto(BASE + '/inbox');
739. await b.waitForSelector('#pendingbox');
740. await connected(b, 'B inbox');
741. check('inbox: bob has ident #1 under pending, review is empty', (await texts(b, '#pending li a.subject')).length === 1 && (await b.text('#pending li a.subject')).includes('Rebuild ident') && !!(await b.evaluate('!!document.querySelector("#reviewempty")')), J(await texts(b, '#pendingbox')));
742. await api('POST', PT('ident.worldapi.org', 1) + '/state', { state: 'review' }, bobTok);
743. await b.waitFor('document.querySelectorAll("#review li").length === 1 && document.querySelectorAll("#pending li").length === 0', { label: 'inbox follows the state change live' });
744. check('inbox: the ticket moved from pending to review live, header count 1', (await b.text('#inboxcount')) === '1');
745. aliceTok0 = (await temit('tokenCreate', ['alice #20'], aliceCookie)).value.token;
746. check('inbox: alice (admin, nothing assigned) has an empty inbox', (await inboxOf(aliceTok0)).json.review.length === 0);
748. // a new project by hand: title → slug proposed, admin can change it; old slugs keep working
749. await a.goto(BASE + '/new-project');
750. await a.waitForSelector('#projectform');
751. await connected(a, 'A on /new-project');
752. await type(a, '#projecttitle', 'My Project');
753. await a.waitFor('document.querySelector("#projectslug").value === "my-project"', { label: 'slug proposed' });
754. check('project: the slug my-project is proposed from the title', (await a.evaluate('document.querySelector("#projectslug").value')) === 'my-project');
755. await a.click('#projectcreate');
756. await a.waitForSelector('#created');
757. const mp = await api('GET', '/api/projects/my-project');
758. check('project: created; alice is its first admin; it has no tickets', mp.status === 200 && mp.json.project.title === 'My Project' && J(mp.json.members.map(m => [m.name, m.role])) === J([['alice', 'admin']]), J(mp.json).slice(0, 400));
759. await a.goto(BASE + '/projects/my-project/settings');
760. await a.waitForSelector('#detailsform');
761. await connected(a, 'A on settings');
762. await type(a, '#setslug', 'my-proj');
763. await type(a, '#setdescription', 'The **first** project.');
764. await a.click('#detailssave');
765. await a.waitFor('!!document.querySelector("#savemessage") && document.querySelector("#savemessage").textContent.length > 0', { label: 'saved' });
766. const mp2 = await api('GET', '/api/projects/my-proj');
767. const mpOld = await api('GET', '/api/projects/my-project');
768. check('project: the slug changed, the description is kept, the old slug still resolves', mp2.status === 200 && mp2.json.project.description === 'The **first** project.' && mpOld.status === 200 && mpOld.json.project.slug === 'my-proj', J([mp2.json.project, mpOld.status]).slice(0, 400));
769. const oldSlugMoved = await fetch(BASE + '/projects/my-project', { redirect: 'manual' });
770. check('short (#25): /projects/<old slug> → 301 to /<current slug>', oldSlugMoved.status === 301 && oldSlugMoved.headers.get('location') === '/my-proj', oldSlugMoved.status + ' ' + oldSlugMoved.headers.get('location'));
771. await a.goto(BASE + '/my-project');
772. await a.waitForSelector('#heading');
773. check('project: the old address still opens the project page', (await a.text('#heading')) === 'My Project' || (await a.text('#heading')).includes('My Project'), await a.text('#heading'));
774. // members in the settings page: add bob as use; remove; the last admin cannot go
775. await a.goto(BASE + '/projects/my-proj/settings');
776. await a.waitForSelector('#addform');
777. await connected(a, 'A on settings again');
778. await type(a, '#addref', 'bob');
779. await choose(a, '#addrole', 'use');
780. await a.click('#addsave');
781. await a.waitFor('document.querySelectorAll("#members li").length === 2', { label: 'bob added' });
782. await sleep(600);
783. check('once: the settings page lists bob exactly once (2 members)', (await texts(a, '#members li')).length === 2 && (await texts(a, '#members li .membername')).filter(t => t === 'bob').length === 1, J(await texts(a, '#members li')));
784. check('members: bob added as use in the settings page', J((await api('GET', '/api/projects/my-proj')).json.members.map(m => [m.name, m.role])) === J([['alice', 'admin'], ['bob', 'use']]));
785. const lastAdmin = await api('POST', '/api/projects/my-proj/members', { user: 'alice', role: 'use' }, aliceTok0);
786. check('members: the last admin cannot be demoted (400)', lastAdmin.status === 400 && /at least one admin/.test(lastAdmin.json.error), J(lastAdmin));
787. const badRole = await api('POST', '/api/projects/my-proj/members', { user: 'bob', role: 'boss' }, aliceTok0);
788. check('members: an unknown role is refused (400)', badRole.status === 400 && badRole.json.field === 'role', J(badRole));
789. const rm = await api('POST', '/api/projects/my-proj/members/remove', { user: 'bob' }, aliceTok0);
790. check('members: an admin removes a member (200)', rm.status === 200 && rm.json.members.length === 1, J(rm).slice(0, 300));
792. // an invite link through ident
793. const inv = await api('POST', '/api/projects/my-proj/invites', { role: 'use' }, aliceTok0);
794. check('invite: an admin gets an ident invite link for the role use', inv.status === 201 && /^https?:\/\//.test(inv.json.url || ''), J(inv).slice(0, 400));
795. // carol opens the link, chooses her identity at ident → ident sends her back to tickets with the invite id → she is a member
796. const carol = await ident.signIn('[email protected]');
797. const invPage = await fetch(inv.json.url, { redirect: 'manual' });
798. const rid = (invPage.headers.get('location') || '').split('/').pop();
799. const chosen = await ident.emit('chooseIdentity', [rid, carol.identities[0].id], carol.cookie);
800. const back = chosen.value && chosen.value.url ? await fetch(chosen.value.url.replace(/^https?:\/\/[^/]+/, BASE), { redirect: 'manual' }) : { status: 0, headers: new Headers() };
801. const carolCookie = (back.headers.get('set-cookie') || '').split(';')[0];
802. const carolFace = await temit('saveDisplayName', ['carol'], carolCookie);
803. const mp3 = (await api('GET', '/api/projects/my-proj')).json;
804. check('invite: carol follows the link, picks an identity at ident, is sent back → member with the role use', invPage.status === 302 && back.status === 302 && J(mp3.members.map(m => [m.name, m.role]).filter(x => x[0] === 'carol' || x[1] === 'use')) === J([['carol', 'use']]), J([invPage.status, chosen.raw.slice(0, 200), back.status, mp3.members]).slice(0, 600));
805. const invBob = await api('POST', '/api/projects/my-proj/invites', { role: 'use' }, bobTok);
806. check('invite: a non-admin gets 403', invBob.status === 403, J(invBob).slice(0, 200));
808. // the new pages fit the screen (phone and desktop), with the project's data on them
809. for (const [path, sel, name] of [['/projects/my-proj/settings', '#addform', 'settings'], ['/new-project', '#projectform', 'new-project'], ['/my-proj', '#heading', 'project']]) {
810. await a.goto(BASE + path);
811. await a.waitForSelector(sel);
812. await connected(a, 'A on ' + path);
813. for (const [w, h, dev] of [[390, 844, 'phone'], [1280, 900, 'desktop']]) {
814. await viewport(a, w, h);
815. check(`layout ${dev} ${w}px: ${name} page has no horizontal overflow`, await noOverflow(a));
816. await shot(a, `${dev}-${name}`);
817. }
818. }
819. await viewport(a, 1280, 900);
820. await b.goto(BASE + '/inbox');
821. await b.waitForSelector('#pendingbox');
822. for (const [w, h, dev] of [[390, 844, 'phone'], [1280, 900, 'desktop']]) {
823. await viewport(b, w, h);
824. check(`layout ${dev} ${w}px: inbox page has no horizontal overflow`, await noOverflow(b));
825. }
826. await viewport(b, 1280, 900);
828. // ---- the browsers said nothing bad (checked BEFORE ident goes down, ticket #11) ------------------
829. const problems = [...a.problems(), ...b.problems()].map(m => m.text).filter(t => !/favicon/.test(t));
830. check('console: no errors or warnings in either browser', problems.length === 0, J(problems).slice(0, 800));
831. // ---- ident down: a login fails politely, the server keeps serving ----------------------------
832. // TICKET #11: no page may be loading while ident stops (a tickets page loads ident's
833. // selector.js → ERR_CONNECTION_REFUSED in the console). Both browsers park on about:blank
834. // first and stay there; the phase is checked with fetch only, and the console again after.
835. for (const p of [a, b]) { await p.goto('about:blank'); }
836. await sleep(300);
837. const quietBefore = [...a.problems(), ...b.problems()].length;
838. await ident.stop();
839. const down = await fetch(BASE + '/login/callback?ident_code=' + 'cd'.repeat(24), { headers: { cookie: GATE_COOKIE }, redirect: 'manual' });
840. const downText = await down.text();
841. const downFace = await temit('identLogin', ['cd'.repeat(24)], GATE_COOKIE);
842. check('ident down: /login/callback → 400 "ident did not answer" (no 500, no source path)', down.status === 400 && /ident did not answer/.test(downText) && !/\.hl/.test(downText), down.status + ' ' + downText.slice(0, 300));
843. check('ident down: the selector face answers "ident did not answer", the server keeps serving', downFace.value && downFace.value.error === 'ident did not answer' && (await fetch(BASE + '/')).status === 200, downFace.raw);
845. const lateProblems = [...a.problems(), ...b.problems()].slice(quietBefore).map(m => m.text);
846. check('console: nothing new while ident was down (the browsers were parked, #11)', lateProblems.length === 0, J(lateProblems).slice(0, 800));
848. // ---- THE INSTALLABLE APP (mission 046): manifest, icons, service worker, offline shell ----------------
849. // Its own fresh Chrome C (no worker from A/B), at the END because it stops the server: the offline reload must
850. // not reach the server even through the service worker (the CDP offline emulation is the page's, and it is what
851. // makes navigator.onLine false for the shell's note). ident is already down here (its selector.js fails to load).
852. const home = await (await fetch(BASE + '/')).text();
853. const mhref = (home.match(/<link rel="manifest" href="([^"]+)"/) || [])[1];
854. check('pwa: the page head links the manifest, the apple-touch-icon, the favicon and the theme colour (the header darker)', !!mhref && /<link rel="apple-touch-icon" href="\/icons\/apple-touch-icon.png">/.test(home) && /<link rel="icon" href="\/icons\/icon.svg">/.test(home) && /<meta name="theme-color" content="rgb\(15, 20, 25\)">/.test(home), J([mhref, (home.match(/<link rel="(icon|apple-touch-icon)"[^>]*>|<meta name="theme-color"[^>]*>/g) || [])]));
855. const mres = await fetch(BASE + (mhref || '/__hl/manifest.webmanifest'));
856. let man = {}; try { man = await mres.json(); } catch {}
857. check('pwa: the manifest is served as a web manifest: name tickets, start_url /, display standalone, theme rgb(15, 20, 25)', /manifest\+json/.test(mres.headers.get('content-type') || '') && man.name === 'tickets' && man.start_url === '/' && man.display === 'standalone' && man.theme_color === 'rgb(15, 20, 25)' && man.background_color === 'rgb(25, 30, 35)', J(man).slice(0, 400));
858. const pngSize = async (src) => { const r = await fetch(BASE + src); const buf = Buffer.from(await r.arrayBuffer()); return r.ok && /image\/png/.test(r.headers.get('content-type') || '') && buf.readUInt32BE(0) === 0x89504e47 ? buf.readUInt32BE(16) : 0; };
859. const iconOk = [];
860. for (const ic of man.icons || []) iconOk.push(ic.type === 'image/png' && await pngSize(ic.src) === Number(ic.sizes.split('x')[0]));
861. check('pwa: every manifest icon is a real PNG of its declared size (192 and 512, any and maskable)', iconOk.length === 4 && iconOk.every(Boolean) && ['any', 'maskable'].every(p => (man.icons || []).some(i => i.sizes === '512x512' && i.purpose === p)), J(man.icons));
862. const fav = await fetch(BASE + '/favicon.ico');
863. const favBuf = Buffer.from(await fav.arrayBuffer());
864. const svg = await fetch(BASE + '/icons/icon.svg');
865. check('pwa: apple-touch-icon is a 180px PNG, /favicon.ico an icon file, /icons/icon.svg an SVG', await pngSize('/icons/apple-touch-icon.png') === 180 && fav.ok && /icon/.test(fav.headers.get('content-type') || '') && favBuf.readUInt32LE(0) === 0x00010000 && svg.ok && /svg/.test(svg.headers.get('content-type') || '') && /<svg/.test(await svg.text()));
867. C = await launchBrowser({ debugPortRange: range(process.env.TICKETS_GATE_CHROME_C, '8640-8649') });
868. const c = patient(await C.newPage());
869. await viewport(c, 390, 844);
870. await c.goto(BASE + '/');
871. await c.waitForSelector('#tickets li');
872. await connected(c, 'C connected');
873. await c.waitFor('navigator.serviceWorker.getRegistration().then(r => !!(r && r.active))', { label: 'service worker active' });
874. await c.waitFor('!!navigator.serviceWorker.controller', { label: 'the worker controls the page' });
875. check('pwa: a service worker is registered for the whole app and controls the page', await c.evaluate(`navigator.serviceWorker.getRegistration().then(r => !!r && new URL(r.scope).pathname === '/' && /\\/__hl\\/sw\\.js/.test(r.active.scriptURL))`));
876. const inst = await c.send('Page.getInstallabilityErrors');
877. check('pwa: Chrome reports no installability error', (inst.installabilityErrors || []).length === 0, J(inst));
878. const online = await c.evaluate(`[!!document.querySelector('#offline'), document.querySelectorAll('#tickets li').length]`);
879. check('pwa: online the shell shows no offline note', online[0] === false && online[1] === TOTAL, J(online));
880. const cProblems = c.problems().map(m => m.text).filter(t => !/favicon/.test(t) && !t.includes(':' + IDENT_PORT) && !/Failed to load resource/.test(t));
881. check('pwa: no console errors in the installed app (ident is down: its selector.js is not counted)', cProblems.length === 0, J(cProblems).slice(0, 600));
882. await sleep(1500);
883. await shot(c, 'pwa-phone-online');
885. // OFFLINE: the network of the page is cut AND the server is gone; `/` reloads from the worker's cache
886. await stopTickets();
887. await c.setOffline(true);
888. await c.goto(BASE + '/');
889. await c.waitForSelector('#tickets li');
890. await c.waitFor('!!document.querySelector("#offline")', { label: 'the offline note' });
891. const off = await c.evaluate(`[document.querySelector('application-header .brand').textContent, document.querySelector('#offline').textContent, document.querySelectorAll('#tickets li').length, getComputedStyle(document.querySelector('#offline')).display]`);
892. check('pwa: offline reload of / shows the shell (header), the last loaded list and says it is offline', off[0] === 'tickets' && /You are offline/.test(off[1]) && off[2] === TOTAL && off[3] !== 'none', J(off));
893. await sleep(300);
894. await shot(c, 'pwa-phone-offline');
895. check('layout phone 390px: the offline shell has no horizontal overflow', await noOverflow(c));
896. await c.goto(BASE + '/inbox');
897. await c.waitForSelector('main[data-hl-offline]');
898. check('pwa: offline a page that is not kept (/inbox) gets "Unavailable offline"', /Unavailable offline/.test(await c.text('main')), await c.text('main'));
899. await c.goto(BASE + '/');
900. await c.waitForSelector('#offline');
901. await c.setOffline(false);
902. await c.waitFor('!document.querySelector("#offline")', { label: 'the note goes when the network is back' });
903. check('pwa: the offline note goes when the browser is online again', true);
904. } catch (e) {
905. check('gate ran to the end', false, e.stack || String(e));
906. } finally {
907. for (const br of [A, B, C]) { if (br) { try { await br.close(); } catch {} } }
908. await stopTickets();
909. if (ident) { await ident.stop(); writeFileSync(join(SCRATCH, 'gate-ident.log'), ident.log()); }
910. exchProxy.close();
911. writeFileSync(join(SCRATCH, 'gate-server.log'), log);
912. }
913. console.log(`\n${passes} passed, ${failures} failed`);
914. process.exit(failures ? 1 : 0);