Implement managed browser security, individual agents and observability

tests/header-gate-timeout.test.mjs

@@ -0,0 +1,38 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import vm from 'node:vm';
+import {readFileSync} from 'node:fs';
+import {createRequire} from 'node:module';
+const require=createRequire(import.meta.url);
+const source=readFileSync(new URL('../apps/browser/main.cjs',import.meta.url),'utf8');
+const hook=source.slice(source.indexOf("  browserSession.webRequest.onBeforeSendHeaders("),source.indexOf('  // Session request, header and permission gates'));
+function fixture({auditFails=false}={}){
+ let listener,completeScan;
+ const timers=[],callbacks=[],events=[];
+ const policy={expiresAt:new Date(Date.now()+60000).toISOString(),dlp:{maxBytes:65536,semantic:{enabled:false}},security:{yara:{enabled:false}}};
+ const context=vm.createContext({require:specifier=>require('../apps/browser/'+specifier.slice(2)),currentTabContext:()=>true,URL,Date,ready:true,policy,localInspector:null,
+  browserSession:{webRequest:{onBeforeSendHeaders(_filter,fn){listener=fn;}}},
+  developerAssetRequestAllowed:()=>false,tabs:{all:()=>[]},core:{destinationAllowed:()=>true,inspect:()=>({decision:'allow'})},
+  diagnosticSpan:(_name,_attrs,fn)=>fn(),audit:async(...args)=>{events.push(args);if(auditFails)throw Error('fixture persistence failure');},
+  scanEnterprise:()=>new Promise(resolve=>{completeScan=resolve;}),setTimeout:fn=>{timers.push(fn);return timers.length;},clearTimeout(){},
+ });
+ vm.runInContext(source.slice(source.indexOf('function agentRequestOwnerAllowed(source)'),source.indexOf('function actorDestinationAllowed')),context);
+ vm.runInContext(hook,context);
+ listener({url:'https://example.test/path',requestHeaders:{X:'public'},webContentsId:0,resourceType:'xhr'},response=>callbacks.push(response));
+ return {timers,callbacks,events,context,finish:()=>completeScan({decision:'allow',coverage:{complete:true}})};
+}
+const settle=async()=>{for(let n=0;n<8;n++)await Promise.resolve();};
+test('native header deadline cancels once, records static audit reason and refuses late scanner approval',async()=>{
+ const f=fixture();await settle();assert.equal(f.callbacks.length,0);
+ f.timers[0]();await settle();assert.equal(f.callbacks.length,1);assert.equal(f.callbacks[0].cancel,true);
+ assert.deepEqual(f.events,[['dlp.block','headers-inspection-timeout','example.test']]);
+ f.timers[0]();f.finish();await settle();assert.equal(f.callbacks.length,1);assert.equal(f.events.length,1);
+});
+test('audit failure cannot release a timed-out request or create unhandled rejection',async()=>{
+ const f=fixture({auditFails:true});await settle();f.timers[0]();await settle();f.finish();await settle();
+ assert.equal(f.callbacks.length,1);assert.equal(f.callbacks[0].cancel,true);assert.equal(f.events.length,1);
+});
+test('completed header approval is not later relabelled as a timeout',async()=>{
+ const f=fixture();await settle();f.finish();await settle();assert.equal(f.callbacks.length,1);assert.equal(f.callbacks[0].cancel,false);
+ f.timers[0]();await settle();assert.equal(f.callbacks.length,1);assert.equal(f.events.length,0);
+});