Implement managed browser security, individual agents and observability

tests/request-source.test.mjs

@@ -0,0 +1,26 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createRequire} from 'node:module';
+const require=createRequire(import.meta.url),{requestSourceCurrent}=require('../apps/browser/request-source.cjs'),{createTabRegistry}=require('../apps/browser/tab-registry.cjs');
+function fixture(){
+ let url='https://old.example/',destroyed=false;
+ const contents={id:7,isDestroyed:()=>destroyed,getURL:()=>url},registry=createTabRegistry({createView:()=>({webContents:contents,setVisible(){}})}),source=registry.create();
+ source.guarded=true;registry.resume(1);const token=registry.context(source.id,{foreground:false});
+ const input={details:{webContentsId:7,resourceType:'mainFrame',method:'GET'},source,token,registry,currentDocument:t=>registry.current(t)};
+ return {input,registry,source,setURL:value=>url=value,destroy:()=>destroyed=true};
+}
+test('top-level empty GET retains native ownership across the old document revision and URL transition',()=>{
+ const f=fixture();f.registry.navigation(f.source.id);f.setURL('https://new.example/');
+ assert.equal(f.registry.current(f.input.token),false);assert.equal(requestSourceCurrent(f.input),true);
+});
+test('POST, XHR, worker and body-bearing requests retain exact document generation checks',()=>{
+ for(const change of [{method:'POST'},{resourceType:'xhr'},{resourceType:'other'},{uploadData:[{bytes:Buffer.from('data')}]},{method:'HEAD'}]){
+  const f=fixture();Object.assign(f.input.details,change);f.registry.navigation(f.source.id);assert.equal(requestSourceCurrent(f.input),false);
+ }
+});
+test('top-level GET cannot substitute, remove, destroy or unguard its native owner',()=>{
+ const f=fixture();f.source.guarded=false;assert.equal(requestSourceCurrent(f.input),false);f.source.guarded=true;f.destroy();assert.equal(requestSourceCurrent(f.input),false);
+ const g=fixture();g.input.registry={fromContents:()=>({view:g.source.view,guarded:true})};assert.equal(requestSourceCurrent(g.input),false);
+ const h=fixture();h.input.source={...h.source,view:{webContents:{isDestroyed:()=>false}}};assert.equal(requestSourceCurrent(h.input),false);
+ const missing=fixture();missing.input.token=null;assert.equal(requestSourceCurrent(missing.input),false);
+});