Harden Windows DLP enforcement and Electron runtime packaging

tests/controlled-login-admin.test.mjs

@@ -0,0 +1,6 @@
+import test from 'node:test';import assert from 'node:assert/strict';import {createRequire} from 'node:module';import {ControlledSubmissionSchema} from '../packages/core/credential-policy.mjs';const {validateCredentialRuleDraft}=createRequire(import.meta.url)('../apps/server/public/controlled-login-admin.js');const row=()=>({id:'login',actionUrl:'https://login.example/signin',usernameField:'username',passwordField:'password'});
+test('typed login editor roundtrips exact canonical metadata accepted by central schema',()=>{const value=[row(),{...row(),id:'other',actionUrl:'https://other.example/post',usernameField:'user[email]'}];const result=validateCredentialRuleDraft(value);assert.deepEqual(ControlledSubmissionSchema.parse({enabled:true,forms:result}).forms,value);assert.notEqual(result[0],value[0]);});
+test('typed login validation rejects ambiguous destinations and secret-bearing extras without echoing values',()=>{for(const rules of [[{...row(),password:'PRIVATE_SECRET'}],[{...row(),actionUrl:'https://u:[email protected]/post'}],[{...row(),actionUrl:'http://login.example/'}],[{...row(),actionUrl:'https://login.example/post?code=PRIVATE_SECRET'}],[row(),{...row(),id:'other'}],[{...row(),usernameField:'password'}],Array.from({length:33},row)]){assert.throws(()=>validateCredentialRuleDraft(rules),error=>!error.message.includes('PRIVATE_SECRET'));assert.throws(()=>ControlledSubmissionSchema.parse({forms:rules}));}});
+
+import vm from 'node:vm';import {readFileSync} from 'node:fs';
+test('typed rows preserve reviewed targets, enforce auditor read-only and edit draft through actual field events',()=>{class Element{constructor(){this.children=[];this.listeners={};this.value='';this.checked=false;this.disabled=false;this.dataset={};}append(...nodes){this.children.push(...nodes);}replaceChildren(...nodes){this.children=nodes;}addEventListener(type,fn){this.listeners[type]=fn;}}const nodes=new Map(),get=id=>{if(!nodes.has(id))nodes.set(id,new Element());return nodes.get(id);};const original={passwordManager:{enabled:true,controlledSubmission:{enabled:true,forms:[row()]}}};let revision=0;const ctx=vm.createContext({document:{createElement:()=>new Element()},$:get,URL,structuredClone,fill(p){get('vault-submit-forms').value=JSON.stringify(p.passwordManager.controlledSubmission.forms);},draft:()=>({passwordManager:{...original.passwordManager,controlledSubmission:{enabled:get('vault-controlled-submit').checked,forms:JSON.parse(get('vault-submit-forms').value)}}}),applyOperatorPermissions(){},independentApprovalRequired:true,policy:null,currentPrincipal:null,updateDraftStatus(){revision++;}});vm.runInContext(readFileSync(new URL('../apps/server/public/controlled-login-admin.js',import.meta.url),'utf8'),ctx);ctx.fill(original);ctx.applyOperatorPermissions({permissions:['policy.read']});assert.equal(get('vault-rule-add').disabled,true);let box=get('vault-rule-editor').children[0];assert.equal(box.children[1].children.every(label=>label.children[0].disabled),true);ctx.applyOperatorPermissions({permissions:['policy.prepare']});box=get('vault-rule-editor').children[0];const action=box.children[1].children[1].children[0];action.value='https://login.example/new';action.listeners.input();assert.equal(JSON.parse(get('vault-submit-forms').value)[0].actionUrl,'https://login.example/new');assert.equal(original.passwordManager.controlledSubmission.forms[0].actionUrl,row().actionUrl);assert.ok(revision>0);get('vault-submit-forms').value='[{"unknown":"PRIVATE_STAGED"}]';get('vault-submit-forms').listeners.change();assert.equal(get('vault-rule-add').disabled,true);action.value='https://login.example/discard';action.listeners.input();assert.equal(get('vault-submit-forms').value,'[{"unknown":"PRIVATE_STAGED"}]');get('vault-submit-forms').value=JSON.stringify([row()]);get('vault-submit-forms').listeners.change();box=get('vault-rule-editor').children[0];get('vault-controlled-submit').checked=true;assert.equal(ctx.draft().passwordManager.controlledSubmission.forms[0].id,'login');box.children[2].listeners.click();assert.throws(()=>ctx.draft(),/at least one/);});