mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-10-04 22:49:41 +02:00
merge master into mobile-path-picker-preview
Only CLAUDE.md conflicted: master restructured it into the short-rule + docs/architecture-invariants.md pointer layout while this PR was open. Route counts reconciled against master's numbering (files 14 -> 16 for the two new filesystem endpoints, total ~197 -> ~199) and the path picker's detail moved into architecture-invariants under its own section.
This commit is contained in:
Codeman maintainer
@@ -79,6 +79,61 @@ describe('terminal link-provider regexes (shipped source)', () => {
|
||||
}
|
||||
});
|
||||
|
||||
it('urlPattern keeps query strings whole (a single & is part of the URL)', () => {
|
||||
// Excluding `&` truncated every real query string: a WordPress edit link
|
||||
// resolved to `?post=1479` and opened the wrong page, and Claude Code's OAuth
|
||||
// login URL (many `&` params) was not clickable at all.
|
||||
const url = shippedPattern('urlPattern');
|
||||
const strip = (u: string) => u.replace(/[.,;:!?)&]+$/, '');
|
||||
const cases: Array<[string, string]> = [
|
||||
[
|
||||
'updated in place: https://bio-hacking.blog/wp-admin/post.php?post=1479&action=edit',
|
||||
'https://bio-hacking.blog/wp-admin/post.php?post=1479&action=edit',
|
||||
],
|
||||
[
|
||||
'open https://claude.ai/oauth/authorize?code=true&client_id=abc&scope=user%3Ainference&state=xyz',
|
||||
'https://claude.ai/oauth/authorize?code=true&client_id=abc&scope=user%3Ainference&state=xyz',
|
||||
],
|
||||
['see https://x.com/a?b=1&c=2&d=3 ok', 'https://x.com/a?b=1&c=2&d=3'],
|
||||
// A lone trailing & is punctuation, not part of the target.
|
||||
['trailing https://x.com/a?b=1& next', 'https://x.com/a?b=1'],
|
||||
];
|
||||
for (const [line, want] of cases) {
|
||||
url.lastIndex = 0;
|
||||
const m = url.exec(line);
|
||||
expect(m, line).not.toBeNull();
|
||||
expect(strip(m![0]), line).toBe(want);
|
||||
}
|
||||
});
|
||||
|
||||
it('urlPattern still stops at the shell && operator', () => {
|
||||
// `&&` never appears inside a URL, so it must remain a boundary or a link
|
||||
// would swallow the next command.
|
||||
const url = shippedPattern('urlPattern');
|
||||
for (const line of ['curl https://x.com/api && echo done', 'curl https://x.com/api&&echo done']) {
|
||||
url.lastIndex = 0;
|
||||
expect(url.exec(line)![0], line).toBe('https://x.com/api');
|
||||
}
|
||||
});
|
||||
|
||||
it('extPattern links pasted image/PDF attachment paths', () => {
|
||||
// `.claude-images/paste-*.png` is what Codeman writes for a pasted screenshot;
|
||||
// without image extensions the path rendered as plain, unclickable text.
|
||||
const ext = shippedPattern('extPattern');
|
||||
const cases = [
|
||||
'/home/arkon/default/claudeman/.claude-images/paste-1785164958410-d11eb7d0.png',
|
||||
'/tmp/shot.jpeg',
|
||||
'/opt/app/report.pdf',
|
||||
'/home/a/diagram.svg',
|
||||
];
|
||||
for (const path of cases) {
|
||||
ext.lastIndex = 0;
|
||||
const m = ext.exec(`see ${path} here`);
|
||||
expect(m, path).not.toBeNull();
|
||||
expect(m![1], path).toBe(path);
|
||||
}
|
||||
});
|
||||
|
||||
it('cmdPattern arg group cannot match empty tokens (the exponential trigger)', () => {
|
||||
// structural guard: the dangerous construct is an empty-matchable token
|
||||
// inside a repeated group — `[^\s\/]*\s+` repeated. Check the pattern
|
||||
|
||||
@@ -0,0 +1,216 @@
|
||||
/**
|
||||
* CRUD + capability behaviour for /api/webviews.
|
||||
*
|
||||
* Uses app.inject() (no port) against a temp CODEMAN_DATA_DIR, so nothing touches
|
||||
* the developer's real ~/.codeman/webviews.json.
|
||||
*/
|
||||
|
||||
import { describe, it, expect, beforeEach, afterEach } from 'vitest';
|
||||
import Fastify, { type FastifyInstance } from 'fastify';
|
||||
import fastifyCookie from '@fastify/cookie';
|
||||
import fastifyWebsocket from '@fastify/websocket';
|
||||
import fs from 'node:fs/promises';
|
||||
import os from 'node:os';
|
||||
import path from 'node:path';
|
||||
import { registerWebviewRoutes } from '../../src/web/routes/webview-routes.js';
|
||||
import { installRouteErrorHandler } from '../../src/web/route-error-handler.js';
|
||||
import { webviewCapabilities } from '../../src/webview-capabilities.js';
|
||||
import { capabilityFromProxyPath } from '../../src/web/webview-proxy.js';
|
||||
|
||||
let app: FastifyInstance;
|
||||
let tmpDir: string;
|
||||
let savedDataDir: string | undefined;
|
||||
const broadcasts: Array<{ event: string; data: unknown }> = [];
|
||||
|
||||
beforeEach(async () => {
|
||||
tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'codeman-webviews-'));
|
||||
savedDataDir = process.env.CODEMAN_DATA_DIR;
|
||||
process.env.CODEMAN_DATA_DIR = tmpDir;
|
||||
broadcasts.length = 0;
|
||||
|
||||
app = Fastify({ logger: false });
|
||||
await app.register(fastifyCookie);
|
||||
// The proxy route declares a wsHandler, so the plugin must be present.
|
||||
await app.register(fastifyWebsocket);
|
||||
registerWebviewRoutes(app, {
|
||||
broadcast: (event: string, data: unknown) => broadcasts.push({ event, data }),
|
||||
} as never);
|
||||
installRouteErrorHandler(app);
|
||||
await app.ready();
|
||||
});
|
||||
|
||||
afterEach(async () => {
|
||||
await app.close();
|
||||
if (savedDataDir === undefined) delete process.env.CODEMAN_DATA_DIR;
|
||||
else process.env.CODEMAN_DATA_DIR = savedDataDir;
|
||||
await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
|
||||
});
|
||||
|
||||
const create = (payload: Record<string, unknown>) => app.inject({ method: 'POST', url: '/api/webviews', payload });
|
||||
|
||||
describe('GET /api/webviews', () => {
|
||||
it('starts empty and reports the frame budget the client must honour', async () => {
|
||||
const res = await app.inject({ method: 'GET', url: '/api/webviews' });
|
||||
expect(res.statusCode).toBe(200);
|
||||
const body = res.json();
|
||||
expect(body.success).toBe(true);
|
||||
expect(body.data.webviews).toEqual([]);
|
||||
expect(typeof body.data.maxLiveFrames).toBe('number');
|
||||
});
|
||||
});
|
||||
|
||||
describe('POST /api/webviews', () => {
|
||||
it('creates a dashboard that defaults to proxied and sandboxed', async () => {
|
||||
const res = await create({ name: 'Grafana', url: 'http://127.0.0.1:4000/' });
|
||||
expect(res.statusCode).toBe(200);
|
||||
const w = res.json().data;
|
||||
// Proxy + untrusted are the safe defaults and must not drift.
|
||||
expect(w.embedMode).toBe('proxy');
|
||||
expect(w.trusted).toBe(false);
|
||||
expect(w.id).toBeTruthy();
|
||||
});
|
||||
|
||||
it('broadcasts the change so other devices re-fetch', async () => {
|
||||
await create({ name: 'G', url: 'http://127.0.0.1:4000/' });
|
||||
expect(broadcasts.map((b) => b.event)).toContain('webview:changed');
|
||||
});
|
||||
|
||||
it('persists across a fresh read of the store', async () => {
|
||||
await create({ name: 'G', url: 'http://127.0.0.1:4000/' });
|
||||
const list = (await app.inject({ method: 'GET', url: '/api/webviews' })).json().data.webviews;
|
||||
expect(list).toHaveLength(1);
|
||||
expect(list[0].name).toBe('G');
|
||||
});
|
||||
|
||||
it('rejects URLs that are not plain http(s)', async () => {
|
||||
for (const url of ['javascript:alert(1)', 'file:///etc/passwd', 'data:text/html,x']) {
|
||||
const res = await create({ name: 'bad', url });
|
||||
expect(res.statusCode, url).toBe(400);
|
||||
expect(res.json().errorCode).toBe('INVALID_INPUT');
|
||||
}
|
||||
});
|
||||
|
||||
it('rejects URLs carrying embedded credentials', async () => {
|
||||
const res = await create({ name: 'bad', url: 'http://user:pass@host:4000/' });
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
|
||||
it('requires a name', async () => {
|
||||
expect((await create({ url: 'http://127.0.0.1:4000/' })).statusCode).toBe(400);
|
||||
expect((await create({ name: ' ', url: 'http://127.0.0.1:4000/' })).statusCode).toBe(400);
|
||||
});
|
||||
});
|
||||
|
||||
describe('PATCH /api/webviews/:id', () => {
|
||||
it('updates fields and revokes the outstanding capability', async () => {
|
||||
const id = (await create({ name: 'G', url: 'http://127.0.0.1:4000/' })).json().data.id;
|
||||
const opened = await app.inject({ method: 'POST', url: `/api/webviews/${id}/open` });
|
||||
const cap = capabilityFromProxyPath(opened.json().data.embedUrl)!;
|
||||
expect(webviewCapabilities.resolve(cap)).toBeDefined();
|
||||
|
||||
const res = await app.inject({
|
||||
method: 'PATCH',
|
||||
url: `/api/webviews/${id}`,
|
||||
payload: { url: 'http://127.0.0.1:4001/' },
|
||||
});
|
||||
expect(res.statusCode).toBe(200);
|
||||
expect(res.json().data.url).toBe('http://127.0.0.1:4001/');
|
||||
// A token minted against the OLD url must not survive the repoint.
|
||||
expect(webviewCapabilities.resolve(cap)).toBeUndefined();
|
||||
});
|
||||
|
||||
it('404s an unknown id', async () => {
|
||||
const res = await app.inject({ method: 'PATCH', url: '/api/webviews/nope', payload: { name: 'x' } });
|
||||
expect(res.statusCode).toBe(404);
|
||||
});
|
||||
|
||||
it('still validates the URL on update', async () => {
|
||||
const id = (await create({ name: 'G', url: 'http://127.0.0.1:4000/' })).json().data.id;
|
||||
const res = await app.inject({ method: 'PATCH', url: `/api/webviews/${id}`, payload: { url: 'file:///etc' } });
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
});
|
||||
|
||||
describe('DELETE /api/webviews/:id', () => {
|
||||
it('removes it and revokes its capability', async () => {
|
||||
const id = (await create({ name: 'G', url: 'http://127.0.0.1:4000/' })).json().data.id;
|
||||
const opened = await app.inject({ method: 'POST', url: `/api/webviews/${id}/open` });
|
||||
const cap = capabilityFromProxyPath(opened.json().data.embedUrl)!;
|
||||
|
||||
expect((await app.inject({ method: 'DELETE', url: `/api/webviews/${id}` })).statusCode).toBe(200);
|
||||
expect((await app.inject({ method: 'GET', url: '/api/webviews' })).json().data.webviews).toEqual([]);
|
||||
expect(webviewCapabilities.resolve(cap)).toBeUndefined();
|
||||
});
|
||||
|
||||
it('404s an unknown id', async () => {
|
||||
expect((await app.inject({ method: 'DELETE', url: '/api/webviews/nope' })).statusCode).toBe(404);
|
||||
});
|
||||
});
|
||||
|
||||
describe('POST /api/webviews/:id/open', () => {
|
||||
it('mints a same-origin embed path for a proxied dashboard', async () => {
|
||||
const id = (await create({ name: 'G', url: 'http://127.0.0.1:4000/' })).json().data.id;
|
||||
const data = (await app.inject({ method: 'POST', url: `/api/webviews/${id}/open` })).json().data;
|
||||
expect(data.embedUrl).toMatch(/^\/webview\/[A-Za-z0-9_-]{16,}\/$/);
|
||||
expect(capabilityFromProxyPath(data.embedUrl)).toBeTruthy();
|
||||
});
|
||||
|
||||
it('returns no embed path in direct mode, where the iframe uses the real URL', async () => {
|
||||
const id = (await create({ name: 'G', url: 'https://ok.example/', embedMode: 'direct' })).json().data.id;
|
||||
const data = (await app.inject({ method: 'POST', url: `/api/webviews/${id}/open` })).json().data;
|
||||
expect(data.embedUrl).toBeUndefined();
|
||||
expect(data.webview.url).toBe('https://ok.example/');
|
||||
});
|
||||
|
||||
it('reuses the capability across repeated opens instead of leaking one per click', async () => {
|
||||
const id = (await create({ name: 'G', url: 'http://127.0.0.1:4000/' })).json().data.id;
|
||||
const first = (await app.inject({ method: 'POST', url: `/api/webviews/${id}/open` })).json().data.embedUrl;
|
||||
const second = (await app.inject({ method: 'POST', url: `/api/webviews/${id}/open` })).json().data.embedUrl;
|
||||
expect(second).toBe(first);
|
||||
});
|
||||
|
||||
it('records lastOpenedAt', async () => {
|
||||
const id = (await create({ name: 'G', url: 'http://127.0.0.1:4000/' })).json().data.id;
|
||||
await app.inject({ method: 'POST', url: `/api/webviews/${id}/open` });
|
||||
const list = (await app.inject({ method: 'GET', url: '/api/webviews' })).json().data.webviews;
|
||||
expect(typeof list[0].lastOpenedAt).toBe('number');
|
||||
});
|
||||
|
||||
it('404s an unknown id', async () => {
|
||||
expect((await app.inject({ method: 'POST', url: '/api/webviews/nope/open' })).statusCode).toBe(404);
|
||||
});
|
||||
});
|
||||
|
||||
describe('proxy route', () => {
|
||||
it('refuses an unknown or expired capability', async () => {
|
||||
const res = await app.inject({ method: 'GET', url: `/webview/${'Z'.repeat(32)}/` });
|
||||
expect(res.statusCode).toBe(403);
|
||||
});
|
||||
|
||||
it('redirects the prefix without a trailing slash, so relative URLs resolve inside it', async () => {
|
||||
const cap = 'Y'.repeat(32);
|
||||
const res = await app.inject({ method: 'GET', url: `/webview/${cap}` });
|
||||
expect(res.statusCode).toBe(302);
|
||||
expect(res.headers.location).toBe(`/webview/${cap}/`);
|
||||
});
|
||||
});
|
||||
|
||||
describe('POST /api/webviews/probe', () => {
|
||||
it('reports an unreachable target as a normal answer, not a 500', async () => {
|
||||
// Port 1 is reserved and refuses instantly.
|
||||
const res = await app.inject({
|
||||
method: 'POST',
|
||||
url: '/api/webviews/probe',
|
||||
payload: { url: 'http://127.0.0.1:1/' },
|
||||
});
|
||||
expect(res.statusCode).toBe(200);
|
||||
const probe = res.json().data;
|
||||
expect(probe.reachable).toBe(false);
|
||||
expect(probe.recommendedMode).toBe('proxy');
|
||||
});
|
||||
|
||||
it('rejects an invalid URL up front', async () => {
|
||||
const res = await app.inject({ method: 'POST', url: '/api/webviews/probe', payload: { url: 'file:///etc' } });
|
||||
expect(res.statusCode).toBe(400);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,114 @@
|
||||
/**
|
||||
* @fileoverview Static and VM regressions for Codeman UI/xterm skin parity.
|
||||
*/
|
||||
|
||||
import { readFileSync } from 'node:fs';
|
||||
import { resolve } from 'node:path';
|
||||
import vm from 'node:vm';
|
||||
import { describe, expect, it, vi } from 'vitest';
|
||||
|
||||
const indexSource = readFileSync(resolve('src/web/public/index.html'), 'utf8');
|
||||
const stylesSource = readFileSync(resolve('src/web/public/styles.css'), 'utf8');
|
||||
const mobileStylesSource = readFileSync(resolve('src/web/public/mobile.css'), 'utf8');
|
||||
const terminalSource = readFileSync(resolve('src/web/public/terminal-ui.js'), 'utf8');
|
||||
|
||||
const LIGHT_SKINS = ['paper-gray', 'solarized-light', 'catppuccin-latte', 'rose-pine-dawn'] as const;
|
||||
|
||||
function hexRgb(hex: string): [number, number, number] {
|
||||
const normalized = hex.replace('#', '');
|
||||
if (!/^[0-9a-f]{6}$/i.test(normalized)) throw new Error(`Expected six-digit hex color, got ${hex}`);
|
||||
return [0, 2, 4].map((offset) => Number.parseInt(normalized.slice(offset, offset + 2), 16)) as [
|
||||
number,
|
||||
number,
|
||||
number,
|
||||
];
|
||||
}
|
||||
|
||||
function luminance(hex: string): number {
|
||||
const channels = hexRgb(hex).map((channel) => {
|
||||
const value = channel / 255;
|
||||
return value <= 0.04045 ? value / 12.92 : ((value + 0.055) / 1.055) ** 2.4;
|
||||
});
|
||||
return 0.2126 * channels[0] + 0.7152 * channels[1] + 0.0722 * channels[2];
|
||||
}
|
||||
|
||||
function contrastRatio(first: string, second: string): number {
|
||||
const [lighter, darker] = [luminance(first), luminance(second)].sort((a, b) => b - a);
|
||||
return (lighter + 0.05) / (darker + 0.05);
|
||||
}
|
||||
|
||||
function loadTerminalThemes() {
|
||||
const FakeCodemanApp = function () {} as unknown as { prototype: Record<string, (...args: unknown[]) => unknown> };
|
||||
const document = { documentElement: { dataset: { skin: 'paper-gray' } } };
|
||||
const window: Record<string, unknown> = {};
|
||||
vm.runInNewContext(terminalSource, { CodemanApp: FakeCodemanApp, document, window }, { filename: 'terminal-ui.js' });
|
||||
return {
|
||||
mixin: FakeCodemanApp.prototype,
|
||||
themes: window.CODEMAN_XTERM_THEMES as Record<string, Record<string, string>>,
|
||||
isLight: window.codemanCurrentSkinIsLight as (skin?: string) => boolean,
|
||||
};
|
||||
}
|
||||
|
||||
describe('Codeman light skins', () => {
|
||||
const terminal = loadTerminalThemes();
|
||||
|
||||
it('keeps the picker, pre-paint allowlist, CSS, and xterm palette in sync', () => {
|
||||
for (const skin of LIGHT_SKINS) {
|
||||
expect(indexSource).toContain(`value="${skin}"`);
|
||||
expect(indexSource).toContain(`'${skin}'`);
|
||||
expect(stylesSource).toContain(`html[data-skin="${skin}"]`);
|
||||
expect(stylesSource).toMatch(new RegExp(`html\\[data-skin="${skin}"\\] \\{[\\s\\S]*?color-scheme: light;`));
|
||||
expect(terminal.themes[skin]).toBeDefined();
|
||||
expect(terminal.isLight(skin)).toBe(true);
|
||||
}
|
||||
expect(terminal.isLight('daylight-blue')).toBe(false);
|
||||
});
|
||||
|
||||
it('provides readable dark-on-light terminal foregrounds', () => {
|
||||
for (const skin of LIGHT_SKINS) {
|
||||
const theme = terminal.themes[skin];
|
||||
expect(contrastRatio(theme.background, theme.foreground), skin).toBeGreaterThanOrEqual(4.5);
|
||||
}
|
||||
});
|
||||
|
||||
it('switches live terminals between light and dark contrast policies', () => {
|
||||
const main = { options: {} as Record<string, unknown>, rows: 24, refresh: vi.fn() };
|
||||
const teammate = { options: {} as Record<string, unknown>, rows: 12, refresh: vi.fn() };
|
||||
const refreshFont = vi.fn();
|
||||
const app = {
|
||||
terminal: main,
|
||||
teammateTerminals: new Map([['agent-1', { terminal: teammate }]]),
|
||||
_localEchoOverlay: { refreshFont },
|
||||
};
|
||||
|
||||
terminal.mixin.applyTerminalSkin.call(app, 'paper-gray');
|
||||
expect(main.options.minimumContrastRatio).toBe(4.5);
|
||||
expect(teammate.options.minimumContrastRatio).toBe(4.5);
|
||||
expect((main.options.theme as Record<string, string>).background).toBe('#f6f8fa');
|
||||
expect(refreshFont).toHaveBeenCalledTimes(1);
|
||||
|
||||
terminal.mixin.applyTerminalSkin.call(app, 'daylight-blue');
|
||||
expect(main.options.minimumContrastRatio).toBe(1);
|
||||
expect(teammate.options.minimumContrastRatio).toBe(1);
|
||||
expect((main.options.theme as Record<string, string>).background).toBe('#161b23');
|
||||
expect(refreshFont).toHaveBeenCalledTimes(2);
|
||||
});
|
||||
|
||||
it('themes stateful input and response surfaces instead of pinning dark colors', () => {
|
||||
expect(stylesSource).toContain('background: var(--bg-input);\n color: var(--text);');
|
||||
expect(stylesSource).toMatch(/#cjkInput \{[\s\S]*?background: var\(--bg-input\);[\s\S]*?color: var\(--text\);/);
|
||||
expect(stylesSource).toMatch(/\.response-viewer \{[\s\S]*?background: var\(--floating-bg\);/);
|
||||
expect(stylesSource).toMatch(/\.response-viewer-body pre \{[\s\S]*?background: var\(--bg-dark\);/);
|
||||
expect(stylesSource).toMatch(/\.response-viewer-body pre code \{[\s\S]*?color: var\(--text\);/);
|
||||
expect(stylesSource).toMatch(/\.file-preview-body \{[\s\S]*?background: var\(--bg-dark\);/);
|
||||
});
|
||||
|
||||
it('uses skin variables for the pre-paint skeleton and native controls', () => {
|
||||
expect(indexSource).toContain('background:var(--term-bg,#161b23)');
|
||||
expect(indexSource).toContain('background:var(--glass-bg,rgba(31,38,48,0.85))');
|
||||
expect(stylesSource).toContain('color-scheme: light;');
|
||||
expect(stylesSource).toContain('background: var(--floating-bg);');
|
||||
expect(mobileStylesSource).toContain(':is(.header, .toolbar, .keyboard-accessory-bar)');
|
||||
expect(mobileStylesSource).toContain(':is(.case-settings-popover-mobile, .mobile-case-picker-sheet)');
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,180 @@
|
||||
/**
|
||||
* The web-tab proxy is exempt from Codeman's cookie auth and its cross-site Origin
|
||||
* guard, because a sandboxed dashboard iframe is opaque-origin: it sends no session
|
||||
* cookie and its writes arrive with `Origin: null`. The capability in the path is
|
||||
* the credential instead.
|
||||
*
|
||||
* That exemption is the security-sensitive part of this feature, so these tests pin
|
||||
* its EDGES: it must apply to a live capability and to nothing else. A regression
|
||||
* here would be an unauthenticated hole into an agent-spawning API.
|
||||
*/
|
||||
|
||||
import { describe, it, expect, beforeEach, afterEach } from 'vitest';
|
||||
import Fastify, { type FastifyInstance } from 'fastify';
|
||||
import fastifyCookie from '@fastify/cookie';
|
||||
import { registerAuthMiddleware, registerHostGuard, registerSecurityHeaders } from '../src/web/middleware/auth.js';
|
||||
import { webviewCapabilities } from '../src/webview-capabilities.js';
|
||||
import type { HostPolicy } from '../src/web/network-auth-policy.js';
|
||||
|
||||
const POLICY: HostPolicy = { allowedHosts: [], allowLan: true };
|
||||
const PASSWORD = 'test-password';
|
||||
|
||||
let app: FastifyInstance;
|
||||
let capability: string;
|
||||
let savedPassword: string | undefined;
|
||||
|
||||
beforeEach(async () => {
|
||||
savedPassword = process.env.CODEMAN_PASSWORD;
|
||||
// The middleware reads this at registration time; auth is inert without it.
|
||||
process.env.CODEMAN_PASSWORD = PASSWORD;
|
||||
|
||||
capability = webviewCapabilities.mint('webview-under-test', undefined);
|
||||
|
||||
app = Fastify({ logger: false });
|
||||
await app.register(fastifyCookie);
|
||||
// Same order as server.ts (host guard → auth → security headers), so hook
|
||||
// interactions are exercised for real. The OPTIONS short-circuit lives in
|
||||
// registerSecurityHeaders and is part of what these tests pin.
|
||||
registerHostGuard(app, () => POLICY);
|
||||
registerAuthMiddleware(app, false);
|
||||
registerSecurityHeaders(app, false);
|
||||
|
||||
// Stand-ins for the real surfaces, so a reachable route means auth let it through.
|
||||
app.all('/webview/:cap/*', async () => ({ proxied: true }));
|
||||
app.all('/api/sessions', async () => ({ sensitive: true }));
|
||||
app.get('/', async () => 'app shell');
|
||||
app.get('/static/app.js', async () => 'asset');
|
||||
app.get('/webviewfoo/bar', async () => 'lookalike');
|
||||
await app.ready();
|
||||
});
|
||||
|
||||
afterEach(async () => {
|
||||
await app.close();
|
||||
webviewCapabilities.revokeWebview('webview-under-test');
|
||||
if (savedPassword === undefined) delete process.env.CODEMAN_PASSWORD;
|
||||
else process.env.CODEMAN_PASSWORD = savedPassword;
|
||||
});
|
||||
|
||||
describe('the exemption applies to a live capability', () => {
|
||||
it('lets an unauthenticated GET through on the proxy path', async () => {
|
||||
const res = await app.inject({ method: 'GET', url: `/webview/${capability}/static/app.js` });
|
||||
expect(res.statusCode).toBe(200);
|
||||
});
|
||||
|
||||
it('lets a write through despite Origin: null, which a sandboxed iframe always sends', async () => {
|
||||
const res = await app.inject({
|
||||
method: 'POST',
|
||||
url: `/webview/${capability}/login`,
|
||||
headers: { origin: 'null' },
|
||||
payload: {},
|
||||
});
|
||||
expect(res.statusCode).toBe(200);
|
||||
});
|
||||
|
||||
it('lets a CORS preflight reach the proxy instead of the global 204 short-circuit', async () => {
|
||||
// registerSecurityHeaders answers every OPTIONS with a bare 204, which carries
|
||||
// no Access-Control-Allow-Origin for the `null` origin a sandboxed frame sends.
|
||||
// The proxy must get the chance to answer with real CORS headers, or every
|
||||
// dashboard fetch fails its preflight.
|
||||
const res = await app.inject({
|
||||
method: 'OPTIONS',
|
||||
url: `/webview/${capability}/api/stats`,
|
||||
headers: { origin: 'null', 'access-control-request-method': 'GET' },
|
||||
});
|
||||
expect(res.statusCode).toBe(200); // reached the stand-in route, not the 204 hook
|
||||
});
|
||||
|
||||
it('still short-circuits OPTIONS everywhere else', async () => {
|
||||
// Authenticated, because the auth hook runs before the security-headers hook
|
||||
// and would otherwise 401 first. With credentials the 204 short-circuit is
|
||||
// reached, proving it is intact for every non-webview path.
|
||||
const res = await app.inject({
|
||||
method: 'OPTIONS',
|
||||
url: '/api/sessions',
|
||||
headers: {
|
||||
origin: 'null',
|
||||
'access-control-request-method': 'GET',
|
||||
authorization: 'Basic ' + Buffer.from(`admin:${PASSWORD}`).toString('base64'),
|
||||
},
|
||||
});
|
||||
expect(res.statusCode).toBe(204);
|
||||
expect(res.headers['access-control-allow-origin']).toBeUndefined();
|
||||
});
|
||||
|
||||
it('serves a root-absolute asset when the Referer identifies the dashboard', async () => {
|
||||
const res = await app.inject({
|
||||
method: 'GET',
|
||||
url: '/static/app.js',
|
||||
headers: { referer: `http://localhost/webview/${capability}/panel` },
|
||||
});
|
||||
expect(res.statusCode).toBe(200);
|
||||
});
|
||||
});
|
||||
|
||||
describe('the exemption does NOT widen anywhere else', () => {
|
||||
it('rejects an unauthenticated request with no capability at all', async () => {
|
||||
expect((await app.inject({ method: 'GET', url: '/static/app.js' })).statusCode).toBe(401);
|
||||
expect((await app.inject({ method: 'GET', url: '/' })).statusCode).toBe(401);
|
||||
});
|
||||
|
||||
it('rejects a well-formed but UNKNOWN capability', async () => {
|
||||
const res = await app.inject({ method: 'GET', url: `/webview/${'Z'.repeat(32)}/x` });
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
it('rejects a revoked capability immediately', async () => {
|
||||
webviewCapabilities.revokeWebview('webview-under-test');
|
||||
const res = await app.inject({ method: 'GET', url: `/webview/${capability}/x` });
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
it('does not match a lookalike prefix', async () => {
|
||||
expect((await app.inject({ method: 'GET', url: '/webviewfoo/bar' })).statusCode).toBe(401);
|
||||
});
|
||||
|
||||
it('NEVER exempts the Codeman API, even with a valid capability in the Referer', async () => {
|
||||
// This is the hole the Referer form would open if it were not path-fenced.
|
||||
const res = await app.inject({
|
||||
method: 'GET',
|
||||
url: '/api/sessions',
|
||||
headers: { referer: `http://localhost/webview/${capability}/panel` },
|
||||
});
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
it('does not let the Referer form carry a WRITE', async () => {
|
||||
const res = await app.inject({
|
||||
method: 'POST',
|
||||
url: '/static/app.js',
|
||||
headers: { referer: `http://localhost/webview/${capability}/panel`, origin: 'null' },
|
||||
payload: {},
|
||||
});
|
||||
// Blocked as cross-site by the Origin guard, or as unauthenticated. Either is fine;
|
||||
// what matters is that it is not 200.
|
||||
expect(res.statusCode).not.toBe(200);
|
||||
});
|
||||
|
||||
it('still blocks a genuinely cross-site write to the API', async () => {
|
||||
const res = await app.inject({
|
||||
method: 'POST',
|
||||
url: '/api/sessions',
|
||||
headers: { origin: 'https://evil.example' },
|
||||
payload: {},
|
||||
});
|
||||
expect(res.statusCode).toBe(403);
|
||||
});
|
||||
});
|
||||
|
||||
describe('authenticated access is unaffected', () => {
|
||||
const basic = 'Basic ' + Buffer.from(`admin:${PASSWORD}`).toString('base64');
|
||||
|
||||
it('normal Basic auth still reaches the app', async () => {
|
||||
const res = await app.inject({ method: 'GET', url: '/', headers: { authorization: basic } });
|
||||
expect(res.statusCode).toBe(200);
|
||||
});
|
||||
|
||||
it('a wrong password is still rejected', async () => {
|
||||
const wrong = 'Basic ' + Buffer.from('admin:nope').toString('base64');
|
||||
expect((await app.inject({ method: 'GET', url: '/', headers: { authorization: wrong } })).statusCode).toBe(401);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,493 @@
|
||||
/**
|
||||
* Pure helpers behind the web-tab reverse proxy (src/web/webview-proxy.ts).
|
||||
*
|
||||
* These cover the rewrites that make an un-embeddable dashboard embeddable, and
|
||||
* the containment checks that keep the proxy from becoming an open relay.
|
||||
*/
|
||||
|
||||
import { describe, it, expect } from 'vitest';
|
||||
import {
|
||||
buildDownstreamResponseHeaders,
|
||||
buildProxyCorsHeaders,
|
||||
buildUpstreamRequestHeaders,
|
||||
capabilityFromProxyPath,
|
||||
capabilityFromReferer,
|
||||
extractFrameAncestors,
|
||||
filterCookieHeader,
|
||||
isFramableCrossOrigin,
|
||||
isHtmlContentType,
|
||||
isValidWebviewUrl,
|
||||
parseWebviewUrl,
|
||||
proxyPrefixFor,
|
||||
resolveUpstreamUrl,
|
||||
rewriteHtml,
|
||||
rewriteLocation,
|
||||
rewriteSetCookie,
|
||||
runtimeUrlShim,
|
||||
stripFrameAncestors,
|
||||
upstreamWebSocketUrl,
|
||||
} from '../src/web/webview-proxy.js';
|
||||
|
||||
const CAP = 'A'.repeat(32);
|
||||
const PREFIX = `/webview/${CAP}/`;
|
||||
|
||||
describe('parseWebviewUrl', () => {
|
||||
it('accepts plain http and https', () => {
|
||||
expect(parseWebviewUrl('http://127.0.0.1:4000/')?.origin).toBe('http://127.0.0.1:4000');
|
||||
expect(parseWebviewUrl('https://dash.example.com/grafana')?.origin).toBe('https://dash.example.com');
|
||||
});
|
||||
|
||||
it('rejects non-http schemes', () => {
|
||||
for (const url of ['javascript:alert(1)', 'file:///etc/passwd', 'data:text/html,x', 'ftp://host/x']) {
|
||||
expect(parseWebviewUrl(url), url).toBeNull();
|
||||
}
|
||||
});
|
||||
|
||||
it('rejects embedded credentials, which would be forwarded and logged', () => {
|
||||
expect(parseWebviewUrl('http://user:pass@host:4000/')).toBeNull();
|
||||
expect(parseWebviewUrl('http://user@host:4000/')).toBeNull();
|
||||
});
|
||||
|
||||
it('rejects garbage and empty input', () => {
|
||||
expect(parseWebviewUrl('')).toBeNull();
|
||||
expect(parseWebviewUrl('not a url')).toBeNull();
|
||||
expect(isValidWebviewUrl('http://ok.example')).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
describe('resolveUpstreamUrl', () => {
|
||||
const saved = 'http://127.0.0.1:4000/grafana/d/abc?theme=dark';
|
||||
|
||||
it('serves the saved path+query for the landing page', () => {
|
||||
expect(resolveUpstreamUrl(saved, '', '')?.href).toBe('http://127.0.0.1:4000/grafana/d/abc?theme=dark');
|
||||
});
|
||||
|
||||
it('is ORIGIN-scoped, not path-scoped, so root-absolute assets resolve', () => {
|
||||
// The saved /grafana/d/abc path must NOT be prepended, or /public/x.js 404s.
|
||||
expect(resolveUpstreamUrl(saved, 'public/build/app.js', '')?.href).toBe(
|
||||
'http://127.0.0.1:4000/public/build/app.js'
|
||||
);
|
||||
});
|
||||
|
||||
it('carries the query string through', () => {
|
||||
expect(resolveUpstreamUrl(saved, 'api/data', '?from=now-6h')?.href).toBe(
|
||||
'http://127.0.0.1:4000/api/data?from=now-6h'
|
||||
);
|
||||
});
|
||||
|
||||
it('refuses to leave the upstream origin', () => {
|
||||
// Protocol-relative would jump host; traversal would climb out.
|
||||
expect(resolveUpstreamUrl(saved, '/evil.com/x', '')?.origin).toBe('http://127.0.0.1:4000');
|
||||
expect(resolveUpstreamUrl(saved, '//evil.com/x', '')).toBeNull();
|
||||
const climbed = resolveUpstreamUrl(saved, '../../../../etc/passwd', '');
|
||||
expect(climbed?.origin).toBe('http://127.0.0.1:4000');
|
||||
});
|
||||
|
||||
it('returns null for an unusable saved url', () => {
|
||||
expect(resolveUpstreamUrl('javascript:alert(1)', 'x', '')).toBeNull();
|
||||
});
|
||||
});
|
||||
|
||||
describe('capability extraction', () => {
|
||||
it('reads the capability out of a proxy path', () => {
|
||||
expect(capabilityFromProxyPath(`${PREFIX}static/app.js`)).toBe(CAP);
|
||||
expect(capabilityFromProxyPath(PREFIX)).toBe(CAP);
|
||||
expect(capabilityFromProxyPath(`/webview/${CAP}`)).toBe(CAP);
|
||||
});
|
||||
|
||||
it('does not match a lookalike prefix', () => {
|
||||
expect(capabilityFromProxyPath('/webviewfoo/bar')).toBeNull();
|
||||
expect(capabilityFromProxyPath('/api/webviews')).toBeNull();
|
||||
expect(capabilityFromProxyPath('/')).toBeNull();
|
||||
});
|
||||
|
||||
it('rejects capabilities of implausible shape', () => {
|
||||
expect(capabilityFromProxyPath('/webview/short/x')).toBeNull();
|
||||
expect(capabilityFromProxyPath('/webview/has spaces here and more/x')).toBeNull();
|
||||
expect(capabilityFromProxyPath('/webview/../../etc/x')).toBeNull();
|
||||
});
|
||||
|
||||
it('reads it from a Referer for the root-absolute asset fallback', () => {
|
||||
expect(capabilityFromReferer(`https://box.ts.net${PREFIX}page`)).toBe(CAP);
|
||||
expect(capabilityFromReferer('https://box.ts.net/')).toBeNull();
|
||||
expect(capabilityFromReferer('not a url')).toBeNull();
|
||||
expect(capabilityFromReferer(undefined)).toBeNull();
|
||||
});
|
||||
});
|
||||
|
||||
describe('CSP handling', () => {
|
||||
it('strips frame-ancestors and keeps every other directive', () => {
|
||||
const csp = "default-src 'self'; frame-ancestors 'none'; script-src 'unsafe-inline'";
|
||||
expect(stripFrameAncestors(csp)).toBe("default-src 'self'; script-src 'unsafe-inline'");
|
||||
});
|
||||
|
||||
it('leaves a policy without frame-ancestors alone', () => {
|
||||
expect(stripFrameAncestors("default-src 'self'")).toBe("default-src 'self'");
|
||||
});
|
||||
|
||||
it('does not confuse a similarly-named directive', () => {
|
||||
expect(stripFrameAncestors("frame-src 'self'; frame-ancestors 'none'")).toBe("frame-src 'self'");
|
||||
});
|
||||
|
||||
it('extracts the directive value for the probe', () => {
|
||||
expect(extractFrameAncestors("default-src 'self'; frame-ancestors https://a.com")).toBe('https://a.com');
|
||||
expect(extractFrameAncestors("default-src 'self'")).toBeUndefined();
|
||||
expect(extractFrameAncestors(undefined)).toBeUndefined();
|
||||
});
|
||||
});
|
||||
|
||||
describe('isFramableCrossOrigin', () => {
|
||||
it('honours X-Frame-Options', () => {
|
||||
expect(isFramableCrossOrigin('DENY', undefined)).toBe(false);
|
||||
expect(isFramableCrossOrigin('sameorigin', undefined)).toBe(false);
|
||||
expect(isFramableCrossOrigin(undefined, undefined)).toBe(true);
|
||||
});
|
||||
|
||||
it("treats frame-ancestors 'none' and 'self' as not cross-origin framable", () => {
|
||||
expect(isFramableCrossOrigin(undefined, "frame-ancestors 'none'")).toBe(false);
|
||||
expect(isFramableCrossOrigin(undefined, "frame-ancestors 'self'")).toBe(false);
|
||||
});
|
||||
|
||||
it('allows a wildcard or explicit host', () => {
|
||||
expect(isFramableCrossOrigin(undefined, 'frame-ancestors *')).toBe(true);
|
||||
expect(isFramableCrossOrigin(undefined, 'frame-ancestors https://codeman.example')).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
describe('rewriteLocation', () => {
|
||||
const requestUrl = new URL('http://127.0.0.1:4000/login');
|
||||
|
||||
it('maps a root-absolute redirect into the proxy prefix', () => {
|
||||
expect(rewriteLocation('/dashboard?x=1', requestUrl, CAP)).toBe(`${PREFIX}dashboard?x=1`);
|
||||
});
|
||||
|
||||
it('maps a same-origin absolute redirect', () => {
|
||||
expect(rewriteLocation('http://127.0.0.1:4000/home', requestUrl, CAP)).toBe(`${PREFIX}home`);
|
||||
});
|
||||
|
||||
it('leaves a CROSS-origin redirect alone rather than relaying it', () => {
|
||||
// Relaying would make this an open proxy for any host the upstream names.
|
||||
expect(rewriteLocation('https://evil.example/x', requestUrl, CAP)).toBe('https://evil.example/x');
|
||||
});
|
||||
|
||||
it('preserves the hash', () => {
|
||||
expect(rewriteLocation('/panel#row2', requestUrl, CAP)).toBe(`${PREFIX}panel#row2`);
|
||||
});
|
||||
});
|
||||
|
||||
describe('rewriteSetCookie', () => {
|
||||
it('rebases Path onto the proxy prefix and drops Domain', () => {
|
||||
const out = rewriteSetCookie('sid=abc; Path=/; Domain=dash.local; HttpOnly', CAP, true);
|
||||
expect(out).toContain('sid=abc');
|
||||
expect(out).toContain(`Path=${PREFIX}`);
|
||||
expect(out).not.toContain('Domain');
|
||||
expect(out).toContain('HttpOnly');
|
||||
});
|
||||
|
||||
it('adds a scoped Path when the upstream sent none', () => {
|
||||
expect(rewriteSetCookie('sid=abc; HttpOnly', CAP, true)).toContain(`Path=${PREFIX}`);
|
||||
});
|
||||
|
||||
it('drops Secure when Codeman itself is serving plain HTTP', () => {
|
||||
// A Secure cookie over http is silently discarded by the browser.
|
||||
expect(rewriteSetCookie('sid=abc; Path=/; Secure', CAP, false)).not.toMatch(/secure/i);
|
||||
expect(rewriteSetCookie('sid=abc; Path=/; Secure', CAP, true)).toMatch(/Secure/);
|
||||
});
|
||||
|
||||
it('keeps a nested upstream path under the prefix', () => {
|
||||
expect(rewriteSetCookie('sid=abc; Path=/admin', CAP, true)).toContain(`Path=${PREFIX}admin`);
|
||||
});
|
||||
});
|
||||
|
||||
describe('filterCookieHeader', () => {
|
||||
it("removes Codeman's own session cookie and keeps the dashboard's", () => {
|
||||
expect(filterCookieHeader('codeman_session=SECRET; dash=1; other=2', ['codeman_session'])).toBe('dash=1; other=2');
|
||||
});
|
||||
|
||||
it('returns undefined when nothing survives', () => {
|
||||
expect(filterCookieHeader('codeman_session=SECRET', ['codeman_session'])).toBeUndefined();
|
||||
expect(filterCookieHeader(undefined, ['codeman_session'])).toBeUndefined();
|
||||
});
|
||||
});
|
||||
|
||||
describe('buildUpstreamRequestHeaders', () => {
|
||||
const upstream = new URL('http://127.0.0.1:4000/panel');
|
||||
|
||||
it('NEVER forwards Codeman credentials to the dashboard', () => {
|
||||
const headers = buildUpstreamRequestHeaders(
|
||||
{ authorization: 'Basic CODEMANCREDS', cookie: 'codeman_session=SECRET; dash=1', accept: '*/*' },
|
||||
upstream,
|
||||
{ forwardCookies: false, sessionCookieName: 'codeman_session' }
|
||||
);
|
||||
expect(headers.authorization).toBeUndefined();
|
||||
expect(headers.cookie).toBeUndefined();
|
||||
expect(headers.accept).toBe('*/*');
|
||||
});
|
||||
|
||||
it('forwards the dashboard cookies but strips the session cookie in trusted mode', () => {
|
||||
const headers = buildUpstreamRequestHeaders({ cookie: 'codeman_session=SECRET; dash=1' }, upstream, {
|
||||
forwardCookies: true,
|
||||
sessionCookieName: 'codeman_session',
|
||||
});
|
||||
expect(headers.cookie).toBe('dash=1');
|
||||
expect(headers.authorization).toBeUndefined();
|
||||
});
|
||||
|
||||
it('presents Origin/Referer as if the browser talked to the dashboard directly', () => {
|
||||
const headers = buildUpstreamRequestHeaders({ origin: 'https://codeman.local' }, upstream, {
|
||||
forwardCookies: false,
|
||||
sessionCookieName: 'codeman_session',
|
||||
});
|
||||
expect(headers.origin).toBe('http://127.0.0.1:4000');
|
||||
expect(headers.referer).toBe('http://127.0.0.1:4000/panel');
|
||||
});
|
||||
|
||||
it('drops hop-by-hop and recomputed headers', () => {
|
||||
const headers = buildUpstreamRequestHeaders(
|
||||
{ host: 'codeman.local', connection: 'keep-alive', 'transfer-encoding': 'chunked', 'content-length': '5' },
|
||||
upstream,
|
||||
{ forwardCookies: false, sessionCookieName: 'codeman_session' }
|
||||
);
|
||||
expect(headers.host).toBeUndefined();
|
||||
expect(headers.connection).toBeUndefined();
|
||||
expect(headers['transfer-encoding']).toBeUndefined();
|
||||
expect(headers['content-length']).toBeUndefined();
|
||||
});
|
||||
});
|
||||
|
||||
describe('buildDownstreamResponseHeaders', () => {
|
||||
const requestUrl = new URL('http://127.0.0.1:4000/panel');
|
||||
const build = (entries: Array<[string, string]>, cookies: string[] = []) =>
|
||||
buildDownstreamResponseHeaders(entries, cookies, CAP, requestUrl, true);
|
||||
|
||||
it('strips the framing refusal, which is the whole point of the proxy', () => {
|
||||
const { headers } = build([
|
||||
['x-frame-options', 'DENY'],
|
||||
['content-type', 'text/html'],
|
||||
]);
|
||||
expect(headers['x-frame-options']).toBeUndefined();
|
||||
expect(headers['content-type']).toBe('text/html');
|
||||
});
|
||||
|
||||
it('drops content-encoding/length because undici already decoded the body', () => {
|
||||
// Forwarding these makes the browser try to gunzip plaintext.
|
||||
const { headers } = build([
|
||||
['content-encoding', 'gzip'],
|
||||
['content-length', '1234'],
|
||||
]);
|
||||
expect(headers['content-encoding']).toBeUndefined();
|
||||
expect(headers['content-length']).toBeUndefined();
|
||||
});
|
||||
|
||||
it('returns the upstream CSP minus frame-ancestors, and null when there was none', () => {
|
||||
expect(build([['content-security-policy', "default-src 'self'; frame-ancestors 'none'"]]).csp).toBe(
|
||||
"default-src 'self'"
|
||||
);
|
||||
expect(build([['content-type', 'text/css']]).csp).toBeNull();
|
||||
});
|
||||
|
||||
it('rewrites Location and Set-Cookie', () => {
|
||||
const { headers, setCookie } = build([['location', '/next']], ['sid=1; Path=/']);
|
||||
expect(headers.location).toBe(`${PREFIX}next`);
|
||||
expect(setCookie).toHaveLength(1);
|
||||
expect(setCookie[0]).toContain(`Path=${PREFIX}`);
|
||||
});
|
||||
});
|
||||
|
||||
describe('rewriteHtml', () => {
|
||||
it('injects <base> immediately after <head>', () => {
|
||||
const out = rewriteHtml('<html><head><title>x</title></head><body></body></html>', CAP);
|
||||
expect(out).toContain(`<head><base href="${PREFIX}">`);
|
||||
});
|
||||
|
||||
it('falls back to <html>, then to the very start, for malformed documents', () => {
|
||||
expect(rewriteHtml('<html><body>hi</body></html>', CAP)).toContain(`<html><base href="${PREFIX}">`);
|
||||
const bare = rewriteHtml('just text', CAP);
|
||||
expect(bare.startsWith(`<base href="${PREFIX}">`)).toBe(true);
|
||||
expect(bare.endsWith('just text')).toBe(true);
|
||||
});
|
||||
|
||||
it('does not add a second <base> when the page already has one', () => {
|
||||
const out = rewriteHtml('<html><head><base href="/x/"></head></html>', CAP);
|
||||
expect(out.match(/<base/g)).toHaveLength(1);
|
||||
});
|
||||
|
||||
it('still injects the runtime shim when the page ships its own <base>', () => {
|
||||
// The shim is the only layer that catches runtime-built URLs, so an early
|
||||
// return on an existing <base> would silently break those pages.
|
||||
const out = rewriteHtml('<html><head><base href="/x/"></head></html>', CAP);
|
||||
expect(out).toContain('<script>');
|
||||
expect(out).toContain(PREFIX);
|
||||
});
|
||||
|
||||
it('injects the shim into every rewritten document', () => {
|
||||
expect(rewriteHtml('<html><head></head></html>', CAP)).toContain('<script>');
|
||||
expect(rewriteHtml('just text', CAP)).toContain('<script>');
|
||||
});
|
||||
|
||||
it('rebases root-absolute src/href/action, which <base> cannot fix', () => {
|
||||
const out = rewriteHtml(
|
||||
`<head></head><body><script src="/static/app.js"></script><link href='/s.css'><form action="/login"></form></body>`,
|
||||
CAP
|
||||
);
|
||||
expect(out).toContain(`src="${PREFIX}static/app.js"`);
|
||||
expect(out).toContain(`href='${PREFIX}s.css'`);
|
||||
expect(out).toContain(`action="${PREFIX}login"`);
|
||||
});
|
||||
|
||||
it('leaves protocol-relative and absolute URLs alone', () => {
|
||||
const out = rewriteHtml('<head></head><script src="//cdn.example/x.js"></script><img src="https://a/b.png">', CAP);
|
||||
expect(out).toContain('src="//cdn.example/x.js"');
|
||||
expect(out).toContain('src="https://a/b.png"');
|
||||
});
|
||||
|
||||
it('is stable across repeated calls (no shared regex lastIndex)', () => {
|
||||
const html = '<head></head><script src="/a.js"></script>';
|
||||
expect(rewriteHtml(html, CAP)).toBe(rewriteHtml(html, CAP));
|
||||
});
|
||||
});
|
||||
|
||||
describe('buildProxyCorsHeaders', () => {
|
||||
it('echoes the opaque origin a sandboxed frame sends', () => {
|
||||
// Without this the browser rejects every dashboard fetch with an opaque
|
||||
// net::ERR_FAILED, while the page itself renders fine.
|
||||
const h = buildProxyCorsHeaders('null');
|
||||
expect(h['access-control-allow-origin']).toBe('null');
|
||||
expect(h.vary).toBe('Origin');
|
||||
});
|
||||
|
||||
it('omits allow-credentials for a null origin, which browsers reject together', () => {
|
||||
expect(buildProxyCorsHeaders('null')['access-control-allow-credentials']).toBeUndefined();
|
||||
});
|
||||
|
||||
it('allows credentials for a real origin (trusted mode)', () => {
|
||||
const h = buildProxyCorsHeaders('https://codeman.local');
|
||||
expect(h['access-control-allow-origin']).toBe('https://codeman.local');
|
||||
expect(h['access-control-allow-credentials']).toBe('true');
|
||||
});
|
||||
|
||||
it('echoes requested headers on a preflight', () => {
|
||||
expect(buildProxyCorsHeaders('null', 'content-type, x-token')['access-control-allow-headers']).toBe(
|
||||
'content-type, x-token'
|
||||
);
|
||||
expect(buildProxyCorsHeaders('null')['access-control-allow-headers']).toBe('*');
|
||||
});
|
||||
|
||||
it('emits nothing when the request carries no Origin', () => {
|
||||
expect(buildProxyCorsHeaders(undefined)).toEqual({});
|
||||
});
|
||||
});
|
||||
|
||||
describe('runtimeUrlShim', () => {
|
||||
const shim = runtimeUrlShim(PREFIX);
|
||||
const body = shim.replace(/^<script>/, '').replace(/<\/script>$/, '');
|
||||
|
||||
it('emits a parseable script', () => {
|
||||
expect(shim.startsWith('<script>')).toBe(true);
|
||||
expect(shim.endsWith('</script>')).toBe(true);
|
||||
expect(() => new Function(body)).not.toThrow();
|
||||
});
|
||||
|
||||
it('contains no bare </script> that would close the tag early', () => {
|
||||
expect(/<\/script>/i.test(body)).toBe(false);
|
||||
});
|
||||
|
||||
/**
|
||||
* Execute the shim against a fake window and return the patched globals, so the
|
||||
* rewrite logic is tested for real rather than by reading the source.
|
||||
*/
|
||||
function runShim(host = 'codeman.local') {
|
||||
const calls: string[] = [];
|
||||
const win: Record<string, unknown> = {
|
||||
fetch: (input: unknown) => {
|
||||
calls.push(String(typeof input === 'object' && input ? (input as { url: string }).url : input));
|
||||
return Promise.resolve();
|
||||
},
|
||||
XMLHttpRequest: function () {} as unknown as { prototype: Record<string, unknown> },
|
||||
WebSocket: class {
|
||||
url: string;
|
||||
constructor(u: string) {
|
||||
this.url = u;
|
||||
calls.push(u);
|
||||
}
|
||||
},
|
||||
EventSource: class {
|
||||
url: string;
|
||||
constructor(u: string) {
|
||||
this.url = u;
|
||||
calls.push(u);
|
||||
}
|
||||
},
|
||||
};
|
||||
(win.XMLHttpRequest as { prototype: Record<string, unknown> }).prototype = {
|
||||
open(_m: string, u: string) {
|
||||
calls.push(u);
|
||||
},
|
||||
};
|
||||
const location = { href: `https://${host}${PREFIX}page`, host };
|
||||
new Function('window', 'location', 'URL', 'Request', `with (window) { ${body} }`)(win, location, URL, undefined);
|
||||
return { win, calls };
|
||||
}
|
||||
|
||||
it('rewrites a ROOT-ABSOLUTE fetch, the case <base> cannot reach', () => {
|
||||
const { win, calls } = runShim();
|
||||
(win.fetch as (u: string) => void)('/api/carousel/job?id=1');
|
||||
expect(calls[0]).toBe(`${PREFIX}api/carousel/job?id=1`);
|
||||
});
|
||||
|
||||
it('leaves relative URLs alone (<base> already handles them)', () => {
|
||||
const { win, calls } = runShim();
|
||||
(win.fetch as (u: string) => void)('api/data');
|
||||
expect(calls[0]).toBe('api/data');
|
||||
});
|
||||
|
||||
it('does not double-prefix an already-proxied URL', () => {
|
||||
const { win, calls } = runShim();
|
||||
(win.fetch as (u: string) => void)(`${PREFIX}api/data`);
|
||||
expect(calls[0]).toBe(`${PREFIX}api/data`);
|
||||
});
|
||||
|
||||
it('leaves cross-origin URLs alone', () => {
|
||||
const { win, calls } = runShim();
|
||||
(win.fetch as (u: string) => void)('https://cdn.example/lib.js');
|
||||
expect(calls[0]).toBe('https://cdn.example/lib.js');
|
||||
});
|
||||
|
||||
it('rewrites a same-origin ABSOLUTE URL built from location', () => {
|
||||
const { win, calls } = runShim();
|
||||
(win.fetch as (u: string) => void)('https://codeman.local/api/data');
|
||||
expect(calls[0]).toBe(`https://codeman.local${PREFIX}api/data`);
|
||||
});
|
||||
|
||||
it('patches XMLHttpRequest.open', () => {
|
||||
const { win, calls } = runShim();
|
||||
const xhr = win.XMLHttpRequest as { prototype: { open: (m: string, u: string) => void } };
|
||||
xhr.prototype.open.call({}, 'GET', '/api/data');
|
||||
expect(calls[0]).toBe(`${PREFIX}api/data`);
|
||||
});
|
||||
|
||||
it('patches WebSocket and EventSource', () => {
|
||||
const { win, calls } = runShim();
|
||||
new (win.WebSocket as new (u: string) => unknown)('/live');
|
||||
new (win.EventSource as new (u: string) => unknown)('/events');
|
||||
expect(calls).toEqual([`${PREFIX}live`, `${PREFIX}events`]);
|
||||
});
|
||||
});
|
||||
|
||||
describe('misc helpers', () => {
|
||||
it('identifies HTML content types, parameters included', () => {
|
||||
expect(isHtmlContentType('text/html; charset=utf-8')).toBe(true);
|
||||
expect(isHtmlContentType('application/xhtml+xml')).toBe(true);
|
||||
expect(isHtmlContentType('application/json')).toBe(false);
|
||||
expect(isHtmlContentType(undefined)).toBe(false);
|
||||
});
|
||||
|
||||
it('maps http(s) to ws(s) for the socket leg', () => {
|
||||
expect(upstreamWebSocketUrl(new URL('http://h:4000/live'))).toBe('ws://h:4000/live');
|
||||
expect(upstreamWebSocketUrl(new URL('https://h/live'))).toBe('wss://h/live');
|
||||
});
|
||||
|
||||
it('builds the iframe prefix', () => {
|
||||
expect(proxyPrefixFor(CAP)).toBe(PREFIX);
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user