first commit

scripts/managed-settings-smoke.mjs

@@ -0,0 +1,31 @@
+// Actual signed central publication and native browser IPC, isolated synthetic device.
+import assert from 'node:assert/strict';
+import {createRequire} from 'node:module';
+import {createServer} from 'node:http';
+import {mkdtempSync,mkdirSync,writeFileSync} from 'node:fs';
+import {tmpdir} from 'node:os';
+import {join} from 'node:path';
+import {spawn} from 'node:child_process';
+import {randomBytes} from 'node:crypto';
+import {createApp} from '../apps/server/app.mjs';
+import {openStore,digest} from '../apps/server/store.mjs';
+const electron=createRequire(import.meta.url)('electron');
+const temporary=mkdtempSync(join(tmpdir(),'safetynet-managed-settings-'));
+let store,management,sink,child;
+try{
+  const adminToken=randomBytes(32).toString('base64url'),code=randomBytes(32).toString('base64url');
+  sink=createServer((_req,res)=>{res.setHeader('content-type','text/html');res.end('<!doctype html><title>Managed settings fixture</title><h1>Public local test page</h1>');}).listen(0,'127.0.0.1');
+  await new Promise(resolve=>sink.once('listening',resolve));
+  store=openStore(join(temporary,'management.sqlite'));
+  const initial=store.get('policy');initial.browser.homeUrl=`http://127.0.0.1:${sink.address().port}`;initial.browser.allowedHosts=['127.0.0.1'];initial.browser.settings={visible:true,hiddenSections:['passwords','documentScan','agents'],lockedSections:['appearance'],appearance:{mode:'dark',accent:'violet',tabMode:'compact'}};store.put('policy',initial);
+  store.db.prepare('INSERT INTO enrollments VALUES(?,?,?)').run(digest(code),Date.now()+600000,'synthetic-settings-user');
+  const config={publicUrl:'http://127.0.0.1',secure:false,adminToken,requirePQManagement:true};
+  management=createApp(store,config).listen(0,'127.0.0.1');await new Promise(resolve=>management.once('listening',resolve));config.publicUrl=`http://127.0.0.1:${management.address().port}`;
+  const env={...process.env,SAFETYNET_SETTINGS_PROFILE:join(temporary,'browser'),SAFETYNET_SETTINGS_SERVER:config.publicUrl,SAFETYNET_SETTINGS_CODE:code,SAFETYNET_SETTINGS_ADMIN:adminToken};delete env.ELECTRON_RUN_AS_NODE;
+  child=spawn(electron,['scripts/managed-settings-smoke.cjs'],{windowsHide:true,stdio:'inherit',env});const timer=setTimeout(()=>child.kill(),100000);
+  const status=await new Promise(resolve=>{child.once('exit',code=>resolve(code??1));child.once('error',()=>resolve(1));});clearTimeout(timer);assert.equal(status,0,'Native managed settings proof failed');
+  const report={native:true,centralSignedPublication:true,plaintextPolicyRejected:true,lockedAppearanceDirectIPCRejected:true,hiddenSectionsDirectIPCRejected:true,globalSettingsHiddenRejected:true,liveUnlockApplied:true,vaultLockAlwaysAvailable:true,contentPersisted:false};
+  mkdirSync('artifacts',{recursive:true});writeFileSync('artifacts/managed-settings-proof.json',JSON.stringify(report,null,2));console.log(JSON.stringify(report));
+}finally{
+  child?.kill();for(const server of [management,sink])if(server){server.closeAllConnections();await new Promise(resolve=>server.close(resolve));}store?.db.close();
+}