32 lines
3.0 KiB
JavaScript
32 lines
3.0 KiB
JavaScript
// Actual signed central publication and native browser IPC, isolated synthetic device.
|
|
import assert from 'node:assert/strict';
|
|
import {createRequire} from 'node:module';
|
|
import {createServer} from 'node:http';
|
|
import {mkdtempSync,mkdirSync,writeFileSync} from 'node:fs';
|
|
import {tmpdir} from 'node:os';
|
|
import {join} from 'node:path';
|
|
import {spawn} from 'node:child_process';
|
|
import {randomBytes} from 'node:crypto';
|
|
import {createApp} from '../apps/server/app.mjs';
|
|
import {openStore,digest} from '../apps/server/store.mjs';
|
|
const electron=createRequire(import.meta.url)('electron');
|
|
const temporary=mkdtempSync(join(tmpdir(),'safetynet-managed-settings-'));
|
|
let store,management,sink,child;
|
|
try{
|
|
const adminToken=randomBytes(32).toString('base64url'),code=randomBytes(32).toString('base64url');
|
|
sink=createServer((_req,res)=>{res.setHeader('content-type','text/html');res.end('<!doctype html><title>Managed settings fixture</title><h1>Public local test page</h1>');}).listen(0,'127.0.0.1');
|
|
await new Promise(resolve=>sink.once('listening',resolve));
|
|
store=openStore(join(temporary,'management.sqlite'));
|
|
const initial=store.get('policy');initial.browser.homeUrl=`http://127.0.0.1:${sink.address().port}`;initial.browser.allowedHosts=['127.0.0.1'];initial.browser.settings={visible:true,hiddenSections:['passwords','documentScan','agents'],lockedSections:['appearance'],appearance:{mode:'dark',accent:'violet',tabMode:'compact'}};store.put('policy',initial);
|
|
store.db.prepare('INSERT INTO enrollments VALUES(?,?,?)').run(digest(code),Date.now()+600000,'synthetic-settings-user');
|
|
const config={publicUrl:'http://127.0.0.1',secure:false,adminToken,requirePQManagement:true};
|
|
management=createApp(store,config).listen(0,'127.0.0.1');await new Promise(resolve=>management.once('listening',resolve));config.publicUrl=`http://127.0.0.1:${management.address().port}`;
|
|
const env={...process.env,SAFETYNET_SETTINGS_PROFILE:join(temporary,'browser'),SAFETYNET_SETTINGS_SERVER:config.publicUrl,SAFETYNET_SETTINGS_CODE:code,SAFETYNET_SETTINGS_ADMIN:adminToken};delete env.ELECTRON_RUN_AS_NODE;
|
|
child=spawn(electron,['scripts/managed-settings-smoke.cjs'],{windowsHide:true,stdio:'inherit',env});const timer=setTimeout(()=>child.kill(),100000);
|
|
const status=await new Promise(resolve=>{child.once('exit',code=>resolve(code??1));child.once('error',()=>resolve(1));});clearTimeout(timer);assert.equal(status,0,'Native managed settings proof failed');
|
|
const report={native:true,centralSignedPublication:true,plaintextPolicyRejected:true,lockedAppearanceDirectIPCRejected:true,hiddenSectionsDirectIPCRejected:true,globalSettingsHiddenRejected:true,liveUnlockApplied:true,vaultLockAlwaysAvailable:true,contentPersisted:false};
|
|
mkdirSync('artifacts',{recursive:true});writeFileSync('artifacts/managed-settings-proof.json',JSON.stringify(report,null,2));console.log(JSON.stringify(report));
|
|
}finally{
|
|
child?.kill();for(const server of [management,sink])if(server){server.closeAllConnections();await new Promise(resolve=>server.close(resolve));}store?.db.close();
|
|
}
|