@oneuptime/common 12.0.12 → 12.0.14

package/Tests/Types/TextRandomGeneration.test.ts

@@ -0,0 +1,211 @@
+import Text from "../../Types/Text";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * GHSA-5cr8-vph4-3hrf, CWE-330.
+ *
+ * Text.generateRandomNumber is what mints notification-channel verification
+ * codes. It used to draw from the literal string "12134567890" using
+ * Math.random, which is wrong twice over: the alphabet has "1" in it twice so
+ * the digits are not equally likely, and Math.random is a non-cryptographic
+ * PRNG whose state is recoverable from its own output.
+ *
+ * Neither property can be observed by looking at one value, which is why they
+ * survived. The tests below observe them the only ways available: by counting
+ * a large sample for bias, and by watching which source the generator actually
+ * pulls from.
+ */
+describe("Text random generation", () => {
+  describe("generateRandomNumber", () => {
+    it("emits only digits, at the requested length", () => {
+      for (let length: number = 1; length <= 12; length++) {
+        const value: string = Text.generateRandomNumber(length);
+
+        expect(value).toHaveLength(length);
+        expect(value).toMatch(/^[0-9]+$/);
+      }
+    });
+
+    it("defaults to ten characters", () => {
+      expect(Text.generateRandomNumber()).toHaveLength(10);
+    });
+
+    /*
+     * The direct regression. With the old alphabet the digit "1" appeared
+     * twice in an eleven-character string, so it came up 2/11 of the time
+     * against 1/11 for every other digit — and "8" appeared once, like the
+     * rest, only because the typo happened to leave it in.
+     *
+     * 60,000 digits puts the expected count per digit at 6,000 with a
+     * standard deviation of about 73. The old generator produced ~10,909 ones
+     * and ~5,454 of everything else, so the bound below is enormously loose
+     * for a fair generator and enormously tight for the broken one.
+     */
+    it("draws every digit with equal probability", () => {
+      const sampleSize: number = 10000;
+      const digitsPerSample: number = 6;
+      const counts: Record<string, number> = {};
+
+      for (let i: number = 0; i < sampleSize; i++) {
+        for (const digit of Text.generateRandomNumber(digitsPerSample)) {
+          counts[digit] = (counts[digit] || 0) + 1;
+        }
+      }
+
+      const totalDigits: number = sampleSize * digitsPerSample;
+      const expectedPerDigit: number = totalDigits / 10;
+
+      /*
+       * Every digit must actually appear — "8" was reachable before, but a
+       * future typo in the alphabet would show up here.
+       */
+      expect(Object.keys(counts).sort()).toEqual([
+        "0",
+        "1",
+        "2",
+        "3",
+        "4",
+        "5",
+        "6",
+        "7",
+        "8",
+        "9",
+      ]);
+
+      for (const digit of Object.keys(counts)) {
+        const count: number = counts[digit] as number;
+
+        /*
+         * Six sigma either way: a fair generator fails this about once in
+         * 500 million runs, the old one fails it every time.
+         */
+        expect(count).toBeGreaterThan(expectedPerDigit * 0.9);
+        expect(count).toBeLessThan(expectedPerDigit * 1.1);
+      }
+    });
+
+    /*
+     * Leading zeros are part of the code space. Dropping them — by going
+     * through a number, say — would quietly remove a tenth of it.
+     */
+    it("can produce codes with leading zeros", () => {
+      let sawLeadingZero: boolean = false;
+
+      for (let i: number = 0; i < 500; i++) {
+        if (Text.generateRandomNumber(6).startsWith("0")) {
+          sawLeadingZero = true;
+          break;
+        }
+      }
+
+      expect(sawLeadingZero).toBe(true);
+    });
+
+    /*
+     * The other half of CWE-330. Math.random is seeded per process and its
+     * internal state can be recovered from a handful of outputs, after which
+     * every future value is known exactly — no guessing required. Asserting
+     * on the SOURCE is the only way to pin this: any specific output is a
+     * legal output of either generator.
+     */
+    it("does not fall back to Math.random when a CSPRNG is available", () => {
+      const mathRandomSpy: jest.SpyInstance = jest.spyOn(Math, "random");
+
+      try {
+        for (let i: number = 0; i < 100; i++) {
+          Text.generateRandomNumber(6);
+        }
+
+        expect(mathRandomSpy).not.toHaveBeenCalled();
+      } finally {
+        mathRandomSpy.mockRestore();
+      }
+    });
+
+    it("takes its bytes from crypto.getRandomValues", () => {
+      const getRandomValuesSpy: jest.SpyInstance = jest.spyOn(
+        globalThis.crypto,
+        "getRandomValues",
+      );
+
+      try {
+        Text.generateRandomNumber(6);
+
+        expect(getRandomValuesSpy).toHaveBeenCalled();
+      } finally {
+        getRandomValuesSpy.mockRestore();
+      }
+    });
+
+    it("produces a different value practically every time", () => {
+      const seen: Set<string> = new Set<string>();
+
+      for (let i: number = 0; i < 1000; i++) {
+        seen.add(Text.generateRandomNumber(10));
+      }
+
+      /*
+       * Ten digits, a thousand draws: collisions are vanishingly unlikely,
+       * and a stuck generator would collapse this to 1.
+       */
+      expect(seen.size).toBe(1000);
+    });
+  });
+
+  describe("generateRandomText", () => {
+    it("emits only letters, at the requested length", () => {
+      for (let length: number = 1; length <= 40; length += 7) {
+        const value: string = Text.generateRandomText(length);
+
+        expect(value).toHaveLength(length);
+        expect(value).toMatch(/^[A-Za-z]+$/);
+      }
+    });
+
+    it("defaults to ten characters", () => {
+      expect(Text.generateRandomText()).toHaveLength(10);
+    });
+
+    it("does not fall back to Math.random when a CSPRNG is available", () => {
+      const mathRandomSpy: jest.SpyInstance = jest.spyOn(Math, "random");
+
+      try {
+        for (let i: number = 0; i < 100; i++) {
+          Text.generateRandomText(20);
+        }
+
+        expect(mathRandomSpy).not.toHaveBeenCalled();
+      } finally {
+        mathRandomSpy.mockRestore();
+      }
+    });
+
+    /*
+     * Both alphabets have 52 characters, which does NOT divide 256 — so
+     * `byte % 52` would be biased towards the first 48 letters. The rejection
+     * sampling is what removes that, and this is the test that would notice
+     * if somebody "simplified" it away.
+     */
+    it("draws every letter with roughly equal probability", () => {
+      const counts: Record<string, number> = {};
+      const totalCharacters: number = 52 * 2000;
+
+      for (let i: number = 0; i < 2000; i++) {
+        for (const character of Text.generateRandomText(52)) {
+          counts[character] = (counts[character] || 0) + 1;
+        }
+      }
+
+      expect(Object.keys(counts)).toHaveLength(52);
+
+      const expectedPerCharacter: number = totalCharacters / 52;
+
+      for (const character of Object.keys(counts)) {
+        const count: number = counts[character] as number;
+
+        expect(count).toBeGreaterThan(expectedPerCharacter * 0.85);
+        expect(count).toBeLessThan(expectedPerCharacter * 1.15);
+      }
+    });
+  });
+});

package/Tests/UI/Components/Button.test.tsx

@@ -9,7 +9,7 @@ import "@testing-library/jest-dom";
 import { fireEvent, render, screen } from "@testing-library/react";
 import IconProp from "../../../Types/Icon/IconProp";
 import React from "react";
-import { describe, expect, jest } from "@jest/globals";
+import { afterEach, describe, expect, jest } from "@jest/globals";
 
 describe("Button", () => {
   test("it should render correctly with title and icon", () => {
@@ -479,3 +479,177 @@ describe("Button disabled behaviour", () => {
     expect(handleClick).not.toBeCalled();
   });
 });
+
+describe("Button motion", () => {
+  /*
+   * Hover/focus colour changes ease in instead of snapping. The classes are
+   * appended once at the shared point every variant funnels through, so every
+   * style must carry them.
+   */
+  test.each(ALL_BUTTON_STYLES)(
+    "%s carries the shared colour-transition classes",
+    (_name: string, buttonStyle: ButtonStyleType) => {
+      expect(renderButton({ buttonStyle })).toHaveClass(
+        "transition-colors",
+        "duration-150",
+        "ease-out",
+      );
+    },
+  );
+});
+
+describe("Button link focus rings", () => {
+  /*
+   * LINK and SECONDARY_LINK used to have no ring at all, leaving keyboard
+   * users with no focus indicator on text links. focus-visible (rather than
+   * focus:) so mouse clicks do not flash a ring.
+   */
+  const LINK_STYLES: Array<[string, ButtonStyleType]> = [
+    ["LINK", ButtonStyleType.LINK],
+    ["SECONDARY_LINK", ButtonStyleType.SECONDARY_LINK],
+  ];
+
+  test.each(LINK_STYLES)(
+    "%s carries a focus-visible ring",
+    (_name: string, buttonStyle: ButtonStyleType) => {
+      expect(renderButton({ buttonStyle })).toHaveClass(
+        "focus:outline-none",
+        "focus-visible:ring-2",
+        "focus-visible:ring-indigo-500",
+        "focus-visible:ring-offset-2",
+      );
+    },
+  );
+});
+
+interface ListenerCall {
+  handler: unknown;
+}
+
+type FindKeydownCallsFunction = (
+  spy: ReturnType<typeof jest.spyOn>,
+) => Array<ListenerCall>;
+
+const findKeydownCalls: FindKeydownCallsFunction = (
+  spy: ReturnType<typeof jest.spyOn>,
+): Array<ListenerCall> => {
+  const calls: Array<Array<unknown>> = spy.mock.calls as unknown as Array<
+    Array<unknown>
+  >;
+
+  return calls
+    .filter((call: Array<unknown>): boolean => {
+      return call[0] === "keydown";
+    })
+    .map((call: Array<unknown>): ListenerCall => {
+      return { handler: call[1] };
+    });
+};
+
+describe("Button shortcut listener lifecycle", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  /*
+   * The regression this suite exists for: the shortcut effect had no
+   * dependency array and its cleanup passed a NEW arrow function to
+   * removeEventListener, which therefore never matched the one that was
+   * added — every render leaked a live window keydown listener.
+   */
+  test("unmount removes the same keydown handler that was added", () => {
+    const addSpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+      window,
+      "addEventListener",
+    );
+    const removeSpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+      window,
+      "removeEventListener",
+    );
+
+    const { unmount } = render(
+      <Button dataTestId="test-id" shortcutKey={ShortcutKey.Settings} />,
+    );
+
+    const adds: Array<ListenerCall> = findKeydownCalls(addSpy);
+
+    expect(adds).toHaveLength(1);
+    expect(findKeydownCalls(removeSpy)).toHaveLength(0);
+
+    unmount();
+
+    const removes: Array<ListenerCall> = findKeydownCalls(removeSpy);
+
+    expect(removes).toHaveLength(1);
+    /*
+     * removeEventListener only detaches when the handler identity matches the
+     * add; counting calls alone would let the old always-leaking cleanup pass.
+     */
+    expect(removes[0]?.handler).toBe(adds[0]?.handler);
+  });
+
+  test("re-rendering with the same props does not stack extra listeners", () => {
+    const addSpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+      window,
+      "addEventListener",
+    );
+
+    const { rerender } = render(
+      <Button dataTestId="test-id" shortcutKey={ShortcutKey.Settings} />,
+    );
+
+    rerender(
+      <Button dataTestId="test-id" shortcutKey={ShortcutKey.Settings} />,
+    );
+    rerender(
+      <Button dataTestId="test-id" shortcutKey={ShortcutKey.Settings} />,
+    );
+
+    expect(findKeydownCalls(addSpy)).toHaveLength(1);
+  });
+
+  test("a button without a shortcut registers no keydown listener", () => {
+    const addSpy: ReturnType<typeof jest.spyOn> = jest.spyOn(
+      window,
+      "addEventListener",
+    );
+
+    render(<Button dataTestId="test-id" />);
+
+    expect(findKeydownCalls(addSpy)).toHaveLength(0);
+  });
+
+  test("the shortcut key pressed on the page body fires onClick", () => {
+    const handleClick: () => void = jest.fn();
+
+    render(
+      <Button
+        dataTestId="test-id"
+        shortcutKey={ShortcutKey.Settings}
+        onClick={handleClick}
+      />,
+    );
+
+    fireEvent.keyDown(document.body, { key: "s" });
+
+    expect(handleClick).toHaveBeenCalledTimes(1);
+  });
+
+  test("the shortcut stops firing after unmount", () => {
+    const handleClick: () => void = jest.fn();
+
+    const { unmount } = render(
+      <Button
+        dataTestId="test-id"
+        shortcutKey={ShortcutKey.Settings}
+        onClick={handleClick}
+      />,
+    );
+
+    unmount();
+
+    fireEvent.keyDown(document.body, { key: "s" });
+
+    expect(handleClick).not.toBeCalled();
+  });
+});