@things-factory/auth-ui 10.1.13 → 10.1.17

package/dist-client/pages/secrets-are-not-printed.test.js

@@ -0,0 +1,70 @@
+import { readdirSync, readFileSync, statSync } from 'fs';
+import { join } from 'path';
+/**
+ * No auth screen prints a credential into a plain input.
+ *
+ * Three of them did, from the moment the page loaded: the binding detail showed an access
+ * token and a refresh token, the appliance detail showed an access token, the application
+ * detail showed its client secret. `secret-field` replaced all four — masked, copyable
+ * without revealing, revealed only when the reader asks.
+ *
+ * This is worth a test rather than a habit because the wrong version is the natural one to
+ * write. A readonly input beside a copy button is what a credential looks like in every
+ * other admin console anyone has seen, it reviews cleanly, and nothing in the build objects.
+ *
+ * ⚠ Comments are stripped first — the prose here and in those screens names every field this
+ * searches for, explaining why they are absent.
+ */
+const SECRETS = ['appSecret', 'refreshToken', 'clientSecret', 'privateKey', 'accessToken'];
+const PAGES = join(__dirname);
+function tsFilesUnder(dir) {
+    return readdirSync(dir).flatMap(entry => {
+        const path = join(dir, entry);
+        if (statSync(path).isDirectory()) {
+            return tsFilesUnder(path);
+        }
+        return entry.endsWith('.ts') && !entry.endsWith('.test.ts') ? [path] : [];
+    });
+}
+function sourceOf(path) {
+    return readFileSync(path, 'utf-8')
+        .replace(/\/\*[\s\S]*?\*\//g, '')
+        .replace(/^[ \t]*\/\/.*$/gm, '')
+        .replace(/<!--[\s\S]*?-->/g, '');
+}
+describe('auth screens', () => {
+    it('never bind a credential into a plain input', () => {
+        const offenders = [];
+        for (const path of tsFilesUnder(PAGES)) {
+            const source = sourceOf(path);
+            for (const secret of SECRETS) {
+                /*
+                 * An `<input>` whose value expression ends at the secret's name. The trailing
+                 * boundary matters: `accessTokenUrl` is an endpoint, not a credential, and an
+                 * earlier version of this search flagged it.
+                 */
+                const bound = new RegExp(`<input[^>]*\\.value=\\$\\{[^}]*\\b${secret}\\b(?!Url)[^}]*\\}`);
+                if (bound.test(source)) {
+                    offenders.push(`${path.split('/pages/')[1]} — ${secret}`);
+                }
+            }
+        }
+        expect(offenders).toEqual([]);
+    });
+    it('still knows what it is looking for', () => {
+        /*
+         * A search that matches nothing passes whether the screens are clean or the pattern is
+         * broken. This proves the pattern finds the shape it is meant to find, so a green run
+         * above means the screens are clean rather than the regex is dead.
+         */
+        const sample = '<input id="x" type="text" .value=${app.appSecret} readonly />';
+        const bound = new RegExp(`<input[^>]*\\.value=\\$\\{[^}]*\\bappSecret\\b(?!Url)[^}]*\\}`);
+        expect(bound.test(sample)).toBe(true);
+    });
+    it('does not mistake an endpoint for a credential', () => {
+        const sample = '<input id="x" type="text" .value=${app.accessTokenUrl} readonly />';
+        const bound = new RegExp(`<input[^>]*\\.value=\\$\\{[^}]*\\baccessToken\\b(?!Url)[^}]*\\}`);
+        expect(bound.test(sample)).toBe(false);
+    });
+});
+//# sourceMappingURL=secrets-are-not-printed.test.js.map

package/dist-client/pages/secrets-are-not-printed.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-are-not-printed.test.js","sourceRoot":"","sources":["../../client/pages/secrets-are-not-printed.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAA;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B;;;;;;;;;;;;;;GAcG;AAEH,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,CAAC,CAAA;AAE1F,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAA;AAE7B,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAE7B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAED,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3E,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;SAC/B,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;SAChC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAA;AACpC,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,SAAS,GAAa,EAAE,CAAA;QAE9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;YAE7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B;;;;mBAIG;gBACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,qCAAqC,MAAM,oBAAoB,CAAC,CAAA;gBAEzF,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvB,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAA;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C;;;;WAIG;QACH,MAAM,MAAM,GAAG,+DAA+D,CAAA;QAC9E,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,+DAA+D,CAAC,CAAA;QAEzF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,oEAAoE,CAAA;QACnF,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,iEAAiE,CAAC,CAAA;QAE3F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { readdirSync, readFileSync, statSync } from 'fs'\nimport { join } from 'path'\n\n/**\n * No auth screen prints a credential into a plain input.\n *\n * Three of them did, from the moment the page loaded: the binding detail showed an access\n * token and a refresh token, the appliance detail showed an access token, the application\n * detail showed its client secret. `secret-field` replaced all four — masked, copyable\n * without revealing, revealed only when the reader asks.\n *\n * This is worth a test rather than a habit because the wrong version is the natural one to\n * write. A readonly input beside a copy button is what a credential looks like in every\n * other admin console anyone has seen, it reviews cleanly, and nothing in the build objects.\n *\n * ⚠ Comments are stripped first — the prose here and in those screens names every field this\n * searches for, explaining why they are absent.\n */\n\nconst SECRETS = ['appSecret', 'refreshToken', 'clientSecret', 'privateKey', 'accessToken']\n\nconst PAGES = join(__dirname)\n\nfunction tsFilesUnder(dir: string): string[] {\n  return readdirSync(dir).flatMap(entry => {\n    const path = join(dir, entry)\n\n    if (statSync(path).isDirectory()) {\n      return tsFilesUnder(path)\n    }\n\n    return entry.endsWith('.ts') && !entry.endsWith('.test.ts') ? [path] : []\n  })\n}\n\nfunction sourceOf(path: string): string {\n  return readFileSync(path, 'utf-8')\n    .replace(/\\/\\*[\\s\\S]*?\\*\\//g, '')\n    .replace(/^[ \\t]*\\/\\/.*$/gm, '')\n    .replace(/<!--[\\s\\S]*?-->/g, '')\n}\n\ndescribe('auth screens', () => {\n  it('never bind a credential into a plain input', () => {\n    const offenders: string[] = []\n\n    for (const path of tsFilesUnder(PAGES)) {\n      const source = sourceOf(path)\n\n      for (const secret of SECRETS) {\n        /*\n         * An `<input>` whose value expression ends at the secret's name. The trailing\n         * boundary matters: `accessTokenUrl` is an endpoint, not a credential, and an\n         * earlier version of this search flagged it.\n         */\n        const bound = new RegExp(`<input[^>]*\\\\.value=\\\\$\\\\{[^}]*\\\\b${secret}\\\\b(?!Url)[^}]*\\\\}`)\n\n        if (bound.test(source)) {\n          offenders.push(`${path.split('/pages/')[1]} — ${secret}`)\n        }\n      }\n    }\n\n    expect(offenders).toEqual([])\n  })\n\n  it('still knows what it is looking for', () => {\n    /*\n     * A search that matches nothing passes whether the screens are clean or the pattern is\n     * broken. This proves the pattern finds the shape it is meant to find, so a green run\n     * above means the screens are clean rather than the regex is dead.\n     */\n    const sample = '<input id=\"x\" type=\"text\" .value=${app.appSecret} readonly />'\n    const bound = new RegExp(`<input[^>]*\\\\.value=\\\\$\\\\{[^}]*\\\\bappSecret\\\\b(?!Url)[^}]*\\\\}`)\n\n    expect(bound.test(sample)).toBe(true)\n  })\n\n  it('does not mistake an endpoint for a credential', () => {\n    const sample = '<input id=\"x\" type=\"text\" .value=${app.accessTokenUrl} readonly />'\n    const bound = new RegExp(`<input[^>]*\\\\.value=\\\\$\\\\{[^}]*\\\\baccessToken\\\\b(?!Url)[^}]*\\\\}`)\n\n    expect(bound.test(sample)).toBe(false)\n  })\n})\n"]}