@omega.js/desktop 0.50.0 → 0.52.0

package/dist/test/suites/build/sentry.test.js

@@ -63,15 +63,20 @@ module.exports = defineCases({
       // in the sibling `package` key.
       name: 'the bundle bake folds the app version into the config the renderer hands the client',
       run: (ctx) => {
-        const { composeBuildConfig } = require(path.join(FRAMEWORK_ROOT, 'src', 'gulp', 'tasks', 'bundle.js'));
+        const { composeBuildConfig, buildFacts } = require(path.join(FRAMEWORK_ROOT, 'src', 'gulp', 'tasks', 'bundle.js'));
 
-        const packaged = composeBuildConfig({ brand: { id: 'paperloom' } }, null, { version: '3.1.4' });
+        const pkg = { version: '3.1.4' };
+        const mode = { environment: 'production', build: true, publish: false };
+        const packaged = composeBuildConfig({ brand: { id: 'paperloom' } }, buildFacts({ pkg, mode, dev: null }));
         ctx.expect(packaged.version).toBe('3.1.4');
         ctx.expect(packaged.brand.id).toBe('paperloom');
         ctx.expect(packaged.dev).toBeUndefined();
 
         // A dev build carries the resolved local-stack map beside it (#300).
-        const local = composeBuildConfig({ brand: { id: 'paperloom' } }, { ports: { auth: 9099 } }, { version: '3.1.4' });
+        const local = composeBuildConfig(
+          { brand: { id: 'paperloom' } },
+          buildFacts({ pkg, mode: { ...mode, environment: 'development', build: false }, dev: { ports: { auth: 9099 } } }),
+        );
         ctx.expect(local.version).toBe('3.1.4');
         ctx.expect(local.dev.ports.auth).toBe(9099);
       },

package/dist/test/suites/build/setup-scripts.test.js

@@ -72,6 +72,9 @@ module.exports = defineCases({
             const written = JSON.parse(contents);
             ctx.expect(written.scripts.build).toBe('omega build');
             ctx.expect(written.private).toBe(true);
+            // Every OMEGA target states its license when it states none of its
+            // own (#884): npm's word for closed-source commercial code
+            ctx.expect(written.license).toBe('UNLICENSED');
             ctx.expect(written.main).toBe('dist/main.bundle.js');
             ctx.expect(contents).toContain('\n  "name": "staged-app"');
           });

package/dist/test/suites/build/sign-windows.test.js

@@ -14,7 +14,7 @@ module.exports = defineCases({
   description: 'sign-windows — signtool command construction + retry policy',
   tests: [
     {
-      name: 'this suite can never sign for real: every signWithRetry call injects its exec',
+      name: 'this suite can never sign for real: every call that reaches signtool injects its exec',
       run: (ctx) => {
         // The box runs this lane too. `signWithRetry` shells out to signtool by
         // DEFAULT, so a case that forgets `exec:` would drive the real EV token
@@ -22,13 +22,17 @@ module.exports = defineCases({
         // lives in sign-windows-e2e.test.js, gated. This pins the invariant.
         const fs = require('fs');
         const source = fs.readFileSync(__filename, 'utf8');
-        // The needle is assembled so this case's own text is not one of its hits.
-        const calls = source.split(`signWithRetry${'('}`).slice(1);
-        ctx.expect(calls.length).toBeGreaterThan(0);
-        for (const call of calls) {
-          const body = call.slice(0, call.indexOf('});'));
-          if (!body.includes('exec:')) {
-            throw new Error(`a signWithRetry call in this suite does not inject exec — it would run the real signtool:\n${body.slice(0, 200)}`);
+        // Both entry points reach signtool: the retry wrapper directly, and the
+        // signing loop through it plus its own verify call.
+        for (const entry of ['signWithRetry', 'signWithSigntool']) {
+          // The needle is assembled so this case's own text is not one of its hits.
+          const calls = source.split(`${entry}${'('}`).slice(1);
+          ctx.expect(calls.length).toBeGreaterThan(0);
+          for (const call of calls) {
+            const body = call.slice(0, call.indexOf('});'));
+            if (!body.includes('exec:')) {
+              throw new Error(`a ${entry} call in this suite does not inject exec, it would run the real signtool:\n${body.slice(0, 200)}`);
+            }
           }
         }
       },
@@ -143,6 +147,59 @@ module.exports = defineCases({
           .toBe('"signtool" verify /pa "C:\\out\\App.exe"');
       },
     },
+    {
+      name: 'a signed artifact prints the proof line in the mac shape, after verify passes (#918)',
+      run: async (ctx) => {
+        // The mac lane ends with `Stapled and verified: ...` (hooks/notarize.js).
+        // Windows runs the same kind of proof (`signtool verify /pa`, a failure
+        // aborts the job), so it says so in the same shape, naming the check it
+        // ran. Driven here through the injected signtool: the ORDER (sign, then
+        // verify, THEN the line) is what makes the line true.
+        const os = require('os');
+        const jetpack = require('fs-jetpack');
+
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'omega-sign-proof-'));
+        const inDir = path.join(tmp, 'release');
+        const outDir = path.join(inDir, 'signed');
+        const target = path.join(inDir, 'App-windows.msi');
+        // .msi on purpose: it needs no latest.yml, so the loop is the whole test.
+        jetpack.write(target, 'unsigned bytes');
+
+        const commands = [];
+        const lines = [];
+        const fakeLogger = {
+          log:   (m) => lines.push(String(m)),
+          warn:  (m) => lines.push(String(m)),
+          error: (m) => lines.push(String(m)),
+        };
+
+        const origToken = process.env.WIN_EV_TOKEN_PATH;
+        const origPassword = process.env.WIN_CSC_KEY_PASSWORD;
+        try {
+          // Thumbprint mode with no PIN: SafeNet owns it, so no console-lock check.
+          process.env.WIN_EV_TOKEN_PATH = 'f'.repeat(40);
+          delete process.env.WIN_CSC_KEY_PASSWORD;
+
+          await signWindows.signWithSigntool([target], inDir, outDir, {
+            exec:   (cmd) => { commands.push(cmd); return Promise.resolve('Successfully signed'); },
+            logger: fakeLogger,
+          });
+        } finally {
+          if (origToken === undefined) delete process.env.WIN_EV_TOKEN_PATH; else process.env.WIN_EV_TOKEN_PATH = origToken;
+          if (origPassword === undefined) delete process.env.WIN_CSC_KEY_PASSWORD; else process.env.WIN_CSC_KEY_PASSWORD = origPassword;
+          jetpack.remove(tmp);
+        }
+
+        ctx.expect(commands.length).toBe(2);
+        ctx.expect(commands[0]).toContain(' sign /sha1 ');
+        ctx.expect(commands[1]).toContain('verify /pa');
+        // The proof line is the LAST thing this file's turn prints, and it names
+        // the check as well as the artifact: mac punctuation, basename, period.
+        ctx.expect(lines[lines.length - 1]).toBe('Signed and verified: signtool verify /pa accepts App-windows.msi.');
+        // The old line claimed only a signature, which is what sent the owner asking.
+        ctx.expect(lines.some((line) => line.includes('Signed: '))).toBe(false);
+      },
+    },
     {
       name: 'WIN_EV_TOKEN_PATH is the ONE cert-reference key — WIN_CSC_LINK is not read',
       run: (ctx) => {
@@ -309,5 +366,32 @@ module.exports = defineCases({
         ctx.expect(signWindows.isTransientSignFailure(new Error('The specified network password is not correct'))).toBe(false);
       },
     },
+    {
+      name: 'a terminated attempt reads as transient, so the next one gets a fresh PIN watcher',
+      run: async (ctx) => {
+        // The wording is execWithLimit's (exec-with-limit.test.js proves the
+        // mechanism); here it only matters that nothing classifies it as final.
+        const limitError = new Error('signtool produced no verdict within 180s and was terminated');
+        ctx.expect(signWindows.isTransientSignFailure(limitError)).toBe(true);
+        ctx.expect(signWindows.SIGN_TIME_LIMIT_MS).toBe(3 * 60 * 1000);
+
+        let watchers = 0;
+        let calls = 0;
+        let threw;
+        try {
+          await signWindows.signWithRetry('signtool sign ...', {
+            file:  'App.exe',
+            exec:  () => { calls += 1; throw limitError; },
+            sleep: () => Promise.resolve(),
+            emit:  () => {},
+            startUnlock: () => { watchers += 1; return { stop: () => {} }; },
+          });
+        } catch (e) { threw = e; }
+
+        ctx.expect(calls).toBe(3);
+        ctx.expect(watchers).toBe(3);
+        ctx.expect(threw.message).toMatch(/no verdict within 180s/);
+      },
+    },
   ],
 });

package/dist/test/suites/build/test-stealth.test.js

@@ -2,13 +2,15 @@
 // invisible and non-intrusive". Consumed by window-manager (stealth surfacing),
 // main.js (macOS app-activation suppression), and the test harness.
 //
-// Build layer runs in plain Node, so the env-var contract (OMEGA_TEST_MODE /
+// Build layer runs in plain Node, so the env-var contract (OMEGA_ENVIRONMENT,
+// the ONE environment input since
+// [#817](https://github.com/Omega-JS-Stack/omega/issues/817), plus
 // OMEGA_TEST_SHOW) is exercised directly with save/restore around each case.
 
 const isTestStealth = require('../../../utils/test-stealth.js');
 const defineCases = require('../../../vendor/devkit/test/define-cases.js');
 
-// Run fn with OMEGA_TEST_MODE / OMEGA_TEST_SHOW set to the given values (undefined = unset),
+// Run fn with OMEGA_ENVIRONMENT / OMEGA_TEST_SHOW set to the given values (undefined = unset),
 // restoring the real environment afterwards so other build suites are unaffected.
 function withEnv(vars, fn) {
   const saved = {};
@@ -41,7 +43,7 @@ module.exports = defineCases({
     {
       name: 'true in testing mode without OMEGA_TEST_SHOW',
       run: (ctx) => {
-        withEnv({ OMEGA_TEST_MODE: 'true', OMEGA_TEST_SHOW: undefined }, () => {
+        withEnv({ OMEGA_ENVIRONMENT: 'testing', OMEGA_TEST_SHOW: undefined }, () => {
           ctx.expect(isTestStealth()).toBe(true);
         });
       },
@@ -49,7 +51,7 @@ module.exports = defineCases({
     {
       name: 'OMEGA_TEST_SHOW=1 opts out even in testing mode',
       run: (ctx) => {
-        withEnv({ OMEGA_TEST_MODE: 'true', OMEGA_TEST_SHOW: '1' }, () => {
+        withEnv({ OMEGA_ENVIRONMENT: 'testing', OMEGA_TEST_SHOW: '1' }, () => {
           ctx.expect(isTestStealth()).toBe(false);
         });
       },
@@ -57,24 +59,28 @@ module.exports = defineCases({
     {
       name: 'false outside testing mode regardless of OMEGA_TEST_SHOW',
       run: (ctx) => {
-        withEnv({ OMEGA_TEST_MODE: undefined, OMEGA_TEST_SHOW: undefined, OMEGA_BUILD_MODE: undefined, NODE_ENV: 'development' }, () => {
+        withEnv({ OMEGA_ENVIRONMENT: 'development', OMEGA_TEST_SHOW: undefined }, () => {
+          ctx.expect(isTestStealth()).toBe(false);
+        });
+        withEnv({ OMEGA_ENVIRONMENT: 'production', OMEGA_TEST_SHOW: '1' }, () => {
           ctx.expect(isTestStealth()).toBe(false);
         });
       },
     },
     {
-      name: 'a provided manager is authoritative over the env fallback',
+      name: 'a provided manager answers from the config IT was baked with',
       run: (ctx) => {
-        // Build-time Manager carries the same mode-helpers mixin as the runtime
-        // Managers — config.em.environment overrides the env detection.
+        // The build-time Manager carries the same mixin as the runtime Managers,
+        // and since #817 they all read the ONE input: the process variable, or
+        // the baked `config.environment` when the process has none.
         const Manager = require('../../../build.js');
-        withEnv({ OMEGA_TEST_MODE: undefined, OMEGA_TEST_SHOW: undefined }, () => {
+        withEnv({ OMEGA_ENVIRONMENT: undefined, OMEGA_TEST_SHOW: undefined }, () => {
           const testing = new Manager();
-          testing.config = { em: { environment: 'testing' } };
+          testing.config = { environment: 'testing' };
           ctx.expect(isTestStealth(testing)).toBe(true);
 
           const production = new Manager();
-          production.config = { em: { environment: 'production' } };
+          production.config = { environment: 'production' };
           ctx.expect(isTestStealth(production)).toBe(false);
         });
       },

package/dist/test/suites/build/url-helpers.test.js

@@ -69,14 +69,15 @@ const NO_ENV = {
 module.exports = defineCases({
   type: 'group', // independent tests; run all even on failure
   layer: 'build',
-  description: 'utils/url-helpers: every local helper resolves env → baked dev.ports → classic',
+  description: 'utils/url-helpers: every local helper resolves env, then the baked dev.ports, then throws',
   tests: [
     {
-      name: 'exports { attachTo, getApiUrl, localPort }',
+      name: 'exports { attachTo, getApiUrl, localPort, requiredPort }',
       run: (ctx) => {
         ctx.expect(typeof helpers.attachTo).toBe('function');
         ctx.expect(typeof helpers.getApiUrl).toBe('function');
         ctx.expect(typeof helpers.localPort).toBe('function');
+        ctx.expect(typeof helpers.requiredPort).toBe('function');
       },
     },
     {
@@ -107,11 +108,19 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'neither channel → the classic hosting port 5002',
+      // The classic 5002 used to answer here (#834). It is gone: a dev build
+      // always bakes the resolved map, so neither channel answering means the
+      // artifact is broken, and a wrong API base is a silent connection refusal
+      // or a hit on a neighbouring project's stack.
+      name: 'neither channel → a throw naming the port and the bundle task',
       run: (ctx) => {
         withEnv(NO_ENV, () => {
-          ctx.expect(helpers.getApiUrl.call(fakeManager('testing'))).toBe('http://localhost:5002');
-          ctx.expect(helpers.getApiUrl.call(fakeManager('development'))).toBe('http://localhost:5002');
+          for (const environment of ['testing', 'development']) {
+            ctx.expect(() => helpers.getApiUrl.call(fakeManager(environment)))
+              .toThrow(/dev port for `hosting`/);
+            ctx.expect(() => helpers.getApiUrl.call(fakeManager(environment)))
+              .toThrow(/bundle task/);
+          }
         });
       },
     },
@@ -163,11 +172,11 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'getFunctionsUrl: neither channel → the classic functions port 5001',
+      name: 'getFunctionsUrl: neither channel → a throw naming the port (#834)',
       run: (ctx) => {
         withEnv(NO_ENV, () => {
-          ctx.expect(helpers.getFunctionsUrl.call(fakeManager('development')))
-            .toBe('http://localhost:5001/demo-app/us-central1');
+          ctx.expect(() => helpers.getFunctionsUrl.call(fakeManager('development')))
+            .toThrow(/dev port for `functions`/);
         });
       },
     },
@@ -200,10 +209,11 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'getWebsiteUrl: neither channel → the classic dev origin https://localhost:4000',
+      name: 'getWebsiteUrl: neither channel → a throw naming the port (#834)',
       run: (ctx) => {
         withEnv(NO_ENV, () => {
-          ctx.expect(helpers.getWebsiteUrl.call(fakeManager('development'))).toBe('https://localhost:4000');
+          ctx.expect(() => helpers.getWebsiteUrl.call(fakeManager('development')))
+            .toThrow(/dev port for `website`/);
         });
       },
     },
@@ -228,12 +238,18 @@ module.exports = defineCases({
       },
     },
     {
-      // The lockstep the renderer bundle forces: url-helpers rides the browser
-      // bundle, so it cannot require @omega.js/config (fs/net/json5) and mirrors
-      // the constant instead. This Node-side case is what keeps the copy honest.
-      name: 'CLASSIC_DEV_ORIGIN is in lockstep with @omega.js/config',
+      // There is no lockstep copy to keep honest any more (#834): the classic
+      // numbers live ONLY in @omega.js/config, the bundle task bakes them into
+      // the artifact as the floor of the resolved map, and this module reads
+      // that map. A copy here would be the exact defect the issue closed.
+      name: 'no classic constants live in this module (#834)',
       run: (ctx) => {
-        ctx.expect(helpers.CLASSIC_DEV_ORIGIN).toBe(require('../../../vendor/config/index.js').CLASSIC_DEV_ORIGIN);
+        ctx.expect(helpers.CLASSIC_DEV_ORIGIN).toBe(undefined);
+        const source = require('fs').readFileSync(require.resolve('../../../utils/url-helpers.js'), 'utf8');
+        const code = source.split('\n').filter((line) => !line.trim().startsWith('//')).join('\n');
+        for (const classic of ['4000', '5001', '5002', '9099']) {
+          ctx.expect(code.includes(classic)).toBe(false);
+        }
       },
     },
     {
@@ -244,7 +260,7 @@ module.exports = defineCases({
         withEnv(NO_ENV, () => {
           // getAuthUrl calls `this.getWebsiteUrl()`, which attachTo() supplies on a
           // real Manager — hand the stand-in the same helper.
-          const manager = fakeManager('development');
+          const manager = fakeManager('development', { website: 4000 });
           manager.getWebsiteUrl = helpers.getWebsiteUrl;
           const url = new URL(helpers.getAuthUrl.call(manager));
           ctx.expect(url.origin).toBe('https://localhost:4000');
@@ -274,8 +290,12 @@ module.exports = defineCases({
           withBridgeManager(fakeManager('testing', { auth: 9109 }), () => {
             ctx.expect(clientBridge._authEmulatorPort()).toBe(9109);
           });
+          // The classic 9099 used to answer here (#834): nothing identity-checks
+          // what holds that port, so a neighbouring project's emulator read as
+          // an auth mystery instead of a port problem.
           withBridgeManager(fakeManager('testing'), () => {
-            ctx.expect(clientBridge._authEmulatorPort()).toBe(9099);
+            ctx.expect(() => clientBridge._authEmulatorPort()).toThrow(/dev port for `auth`/);
+            ctx.expect(() => clientBridge._authEmulatorPort()).toThrow(/bundle task/);
           });
         });
         withEnv({ OMEGA_AUTH_PORT: '9119' }, () => {