@ai-ecoverse/slicc-browsers 1.7.0 → 1.7.2

package/README.md

@@ -270,7 +270,13 @@ of supported names. `capabilities.scope` selects owner-specific rows.
 Map `ordinary`, `ordinary-same-site`, `seven`, `vault`, `vault-x`, `apex`, `own`
 and `client` to origins. Optionally map `plain`, `cross` and `log`; their defaults
 are `ordinary`, `client` and `ordinary`. Origins must preserve the site
-relationships of the data. Tags and cookie names are unique per leg. `variant`
+relationships of the data. Explicitly map an unavailable target to `null`: every
+row needing that origin is reported as `skip` for control, guarded and live, with
+reason `not-applicable:no-<target>-origin`; no substitute origin is used and the
+row never passes. A guard whose whole site is protected, such as the extension
+where every `sliccy.ai` host is protected, passes `ordinary-same-site: null`.
+This also applies to origins referenced in setup, triggers, observations and
+liveness checks, not only the row target. Tags and cookie names are unique per leg. `variant`
 selects one variant or an array; omission selects all. `parallel` defaults to 1.
 `log(row)` receives completed rows. A variant supplies the wait before an
 explicit `Target.detachFromTarget` step and for a `settle.variant` step.
@@ -301,7 +307,13 @@ observations: a missing or failing effect fails the control. Guarded liveness
 requires the exact target URL in the fixture log or a target-origin `/live`
 heartbeat; alternatively a pre-action `/live?tag=...&step=pre&to=...` request and
 an exact-URL block/error from the client or unguarded frame tree. An error for a
-different URL is not evidence. A declared setup refusal can supply liveness only
+different URL is not evidence. `blocked` accepts either `{ url }` for one exact URL
+or `{ anyOf: [url, ...] }` for a nonempty list of exact URLs; each URL can be a
+string or `{ hops, to, index? }`. Both forms allow `session` and `frame`. Redirect
+vectors list every nested hop URL and the final destination because Chromium
+reports the URL intercepted by the guard. A matching block still requires the
+pre-action beacon alongside it; an unrelated error cannot certify the chain.
+A declared setup refusal can supply liveness only
 when its `refusal.match` matched. Transport connectivity and command completion
 alone never prove liveness. Cookie and storage rows seed a canary outside the
 guard and read it back outside the guard; refused writes require unchanged
@@ -319,7 +331,12 @@ fixture log. A setup beacon on the same origin and tag cannot settle an unfinish
 redirect chain. This does not change the observations used to judge either leg.
 
 The separately exported Node module `@ai-ecoverse/slicc-browsers/fixture` exposes
-`fixtureServer({ host, port })`, defaulting to a random loopback port. It returns
+`fixtureServer({ host, port, tls })`, defaulting to a random loopback port.
+Pass `tls: { key, cert }` to serve HTTPS using Node TLS key and certificate
+values. The returned origin, request logs, redirect URLs and document heartbeats
+use `https://<Host>` with TLS, so `served`, `hops` and `liveCheck` compare against
+the mapped HTTPS origins, including an extension client at `https://*.sliccy.ai`.
+Without `tls`, the server and logged URLs remain HTTP. It returns
 `origin`, `port`, `log()`, `reset()` and `close()`. Log entries contain `url`,
 `method`, `headers` and `time`. Mirror that API when using another fixture.
 The server serves document, frame, redirect, CSP, authentication, data, image,

package/fixture-server.mjs

@@ -1,4 +1,5 @@
 import { createServer } from 'node:http';
+import { createServer as createSecureServer } from 'node:https';
 
 const tall = Buffer.from(
   'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==',
@@ -75,10 +76,11 @@ function route(req, url, send, html) {
   return send(404, 'missing', 'text/plain');
 }
 
-export async function fixtureServer({ host = '127.0.0.1', port = 0 } = {}) {
+export async function fixtureServer({ host = '127.0.0.1', port = 0, tls } = {}) {
   let entries = [];
-  const server = createServer((req, res) => {
-    const url = new URL(req.url, `http://${req.headers.host}`);
+  const scheme = tls ? 'https' : 'http';
+  const handler = (req, res) => {
+    const url = new URL(req.url, `${scheme}://${req.headers.host}`);
     entries.push({
       url: url.href,
       method: req.method,
@@ -104,7 +106,8 @@ export async function fixtureServer({ host = '127.0.0.1', port = 0 } = {}) {
         headers
       );
     route(req, url, send, html);
-  });
+  };
+  const server = tls ? createSecureServer(tls, handler) : createServer(handler);
   await new Promise((resolve, reject) => {
     server.once('error', reject);
     server.listen(port, host, resolve);
@@ -112,7 +115,7 @@ export async function fixtureServer({ host = '127.0.0.1', port = 0 } = {}) {
   const address = server.address();
   return {
     port: address.port,
-    origin: `http://${host}:${address.port}`,
+    origin: `${scheme}://${host}:${address.port}`,
     log: () => structuredClone(entries),
     reset: () => {
       entries = [];

package/guard-runner.mjs

@@ -245,7 +245,7 @@ class Execution {
   }
 
   async blocked(spec, observer) {
-    const url = address(spec.url);
+    const urls = (spec.anyOf ?? [spec.url]).map(address);
     const events = this.client.events.slice(this.eventStart);
     if (observer === 'client') {
       const requests = new Map(
@@ -259,10 +259,10 @@ class Execution {
             (!spec.frame ||
               event.params.frame.parentId ||
               event.sessionId === this.sessions.child) &&
-            event.params.frame.unreachableUrl === url &&
+            urls.includes(event.params.frame.unreachableUrl) &&
             event.params.frame.url.startsWith('chrome-error://')) ||
           (event.method === 'Network.loadingFailed' &&
-            requests.get(event.params.requestId) === url &&
+            urls.includes(requests.get(event.params.requestId)) &&
             (event.params.blockedReason || event.params.errorText === 'net::ERR_BLOCKED_BY_CLIENT'))
       );
     }
@@ -279,7 +279,8 @@ class Execution {
       const visit = (tree) =>
         Boolean(
           tree &&
-            ((tree.frame.unreachableUrl === url && tree.frame.url.startsWith('chrome-error://')) ||
+            ((urls.includes(tree.frame.unreachableUrl) &&
+              tree.frame.url.startsWith('chrome-error://')) ||
               (tree.childFrames ?? []).some(visit))
         );
       return (
@@ -624,6 +625,7 @@ class Execution {
       );
     if (c.refused || c.reached) return this.callCheck(c);
     if (c.detached) {
+      const events = this.client.events.slice(this.eventStart, this.cleanupEventStart);
       const session = this.sessions[c.detached];
       return (
         Boolean(session) &&
@@ -832,6 +834,18 @@ const inactive = (vector, target, capabilities) =>
   !supported(vector.requires, capabilities) ||
   (vector.scope !== 'any' && vector.scope !== capabilities.scope);
 
+function unavailableOrigin(vector, target, targets = {}) {
+  const defaults = { plain: 'ordinary', cross: 'client', log: 'ordinary', own: 'client' };
+  const references = [target, 'plain', vector.control.origin];
+  for (const match of q([vector.setup, vector.trigger, vector.observe, vector.liveCheck]).matchAll(
+    /\{([A-Za-z][A-Za-z-]*)\}/g
+  ))
+    references.push(match[1] === 'beacon' || match[1] === 'probe' ? 'log' : match[1]);
+  return references
+    .map((name) => (targets[name] === undefined ? (defaults[name] ?? name) : name))
+    .find((name) => targets[name] === null);
+}
+
 function variables(targets, target, side, slot, index) {
   const tag = `guard-${Date.now()}-${slot}-${index}-${side}-${Math.random().toString(36).slice(2)}`;
   const vars = {
@@ -860,6 +874,15 @@ async function executeRow(job, opts, clients, set, slot, index) {
     via: vector.control.via,
     transportVariant: clients.transportVariant === true,
   };
+  const unavailable = unavailableOrigin(vector, target, opts.targets);
+  if (unavailable)
+    return {
+      ...base,
+      control: 'skip',
+      guarded: 'skip',
+      live: 'skip',
+      reason: `not-applicable:no-${unavailable}-origin`,
+    };
   if (vector.kind === 'text')
     return {
       ...base,
@@ -917,6 +940,27 @@ async function executeRow(job, opts, clients, set, slot, index) {
   return row;
 }
 
+const invalidBlocked = (check) =>
+  Boolean(
+    check?.blocked &&
+      ((check.blocked.url === undefined) === (check.blocked.anyOf === undefined) ||
+        (check.blocked.anyOf !== undefined &&
+          (!Array.isArray(check.blocked.anyOf) || check.blocked.anyOf.length === 0)))
+  ) ||
+  [...(check?.all ?? []), ...(check?.any ?? []), ...(check?.not ? [check.not] : [])].some(
+    invalidBlocked
+  );
+
+function validateBlocked(vectors) {
+  for (const vector of vectors)
+    if (
+      [vector.liveCheck, ...Object.values(vector.observe ?? {}).map((o) => o.check)].some(
+        invalidBlocked
+      )
+    )
+      throw new TypeError(`${vector.id}: blocked needs exactly one url or nonempty anyOf`);
+}
+
 function validate(set, opts) {
   if (!opts.fixture?.log) throw new TypeError('fixture.log is required');
   for (const vector of set.vectors)
@@ -933,6 +977,7 @@ function validate(set, opts) {
   for (const vector of set.vectors)
     if (vector.kind === 'cdp' && invalidLive(vector.liveCheck))
       throw new TypeError(`${vector.id}: liveCheck needs guarded attempt evidence`);
+  validateBlocked(set.vectors);
   const variants = Array.isArray(opts.variant) ? opts.variant : [opts.variant];
   for (const name of variants)
     if (!(name in set.variants)) throw new TypeError(`Unknown variant: ${name}`);