@unotest/viewer 0.15.0 → 0.16.0

package/dist/server/session.d.ts

@@ -0,0 +1,59 @@
+/** What the current viewer session is allowed to do, as told by whoever
+ *  fronts the viewer (today: the unotest guard proxy).
+ *
+ *  The viewer authorizes NOTHING: it binds to localhost and trusts its
+ *  caller, so enforcement lives in the proxy in front of it. This payload
+ *  exists purely so the UI stops offering controls whose requests the
+ *  proxy will reject — which is why a capability can only be LOWERED from
+ *  the outside, never granted: a forged header buys the sender a smaller
+ *  UI and nothing else.
+ *
+ *  Capabilities are coarse and role-free on purpose. A proxy that invents
+ *  new roles maps them onto these flags; the viewer never learns the word
+ *  "admin" and needs no change when the role set grows (OCP). */
+interface ViewerCapabilities {
+    /** Start / abort runs, drive the debugger, control the app-under-test. */
+    readonly canRun: boolean;
+    /** Create, rename, delete, copy scenarios; save sources; edit variables. */
+    readonly canEditFiles: boolean;
+    /** Open the terminal panel (a PTY on the viewer's machine). */
+    readonly canTerminal: boolean;
+    /** Browse the host filesystem through the path picker. */
+    readonly canBrowseFs: boolean;
+}
+/** Who the fronting proxy says is looking, for display only — the viewer
+ *  never makes a decision out of these strings. */
+interface ViewerIdentity {
+    readonly user: string;
+    /** The proxy's own word for the role ("admin", "readonly", …). Shown
+     *  as-is in the status bar; never branched on. */
+    readonly role: string;
+    /** Environment the proxy routed this session to, when it has several. */
+    readonly env?: string;
+    /** Where to POST to end the session. Absent → no log-out affordance. */
+    readonly logoutUrl?: string;
+}
+interface ViewerSession {
+    readonly capabilities: ViewerCapabilities;
+    /** null when nothing fronts the viewer — plain localhost usage. */
+    readonly identity: ViewerIdentity | null;
+}
+declare const FULL_CAPABILITIES: ViewerCapabilities;
+/** The default answer: no proxy, no restrictions, nobody to name. */
+declare const STANDALONE_SESSION: ViewerSession;
+
+/** Wire format for {@link ViewerSession} between a fronting proxy and the
+ *  viewer server. Node-only (Buffer) — the browser bundle imports
+ *  `./session.ts` for the types and reads the decoded payload over HTTP,
+ *  never this module.
+ *
+ *  base64url rather than raw JSON: header values are latin-1 and a user
+ *  name with a non-ASCII character would otherwise corrupt the header. */
+declare const VIEWER_SESSION_HEADER = "x-unotest-viewer-session";
+declare function encodeViewerSession(session: ViewerSession): string;
+/** Returns null for anything that isn't a payload we recognise — absent,
+ *  truncated, forged. The caller then falls back to standalone defaults:
+ *  a broken header must not lock a local user out of their own viewer. */
+declare function decodeViewerSession(raw: string | undefined): ViewerSession | null;
+
+export { FULL_CAPABILITIES, STANDALONE_SESSION, VIEWER_SESSION_HEADER, type ViewerCapabilities, type ViewerIdentity, type ViewerSession, decodeViewerSession, encodeViewerSession };

package/dist/server/session.js

@@ -0,0 +1 @@
+const _0x63594=_0x7399;(function(_0x278f70,_0x4af471){const _0x157516={_0x2c99b7:0x110,_0x2e9647:0x10f,_0x4e91e6:0x116,_0xbfb373:0x112,_0x44ab9a:0x10b},_0x35a28f=_0x7399,_0x4df769=_0x278f70();while(!![]){try{const _0x2bfc2f=parseInt(_0x35a28f(_0x157516._0x2c99b7))/0x1*(-parseInt(_0x35a28f(0xff))/0x2)+parseInt(_0x35a28f(_0x157516._0x2e9647))/0x3+-parseInt(_0x35a28f(_0x157516._0x4e91e6))/0x4+parseInt(_0x35a28f(_0x157516._0xbfb373))/0x5*(-parseInt(_0x35a28f(0x111))/0x6)+-parseInt(_0x35a28f(0xfe))/0x7+-parseInt(_0x35a28f(_0x157516._0x44ab9a))/0x8*(-parseInt(_0x35a28f(0x10d))/0x9)+-parseInt(_0x35a28f(0x114))/0xa*(-parseInt(_0x35a28f(0x101))/0xb);if(_0x2bfc2f===_0x4af471)break;else _0x4df769['push'](_0x4df769['shift']());}catch(_0x527076){_0x4df769['push'](_0x4df769['shift']());}}}(_0x2bed,0xcb328));var __defProp=Object[_0x63594(0x103)],__name=(_0x2cfdfb,_0x4fd38f)=>__defProp(_0x2cfdfb,_0x63594(0x10c),{'value':_0x4fd38f,'configurable':!![]}),FULL_CAPABILITIES={'canRun':!![],'canEditFiles':!![],'canTerminal':!![],'canBrowseFs':!![]},STANDALONE_SESSION={'capabilities':FULL_CAPABILITIES,'identity':null},VIEWER_SESSION_HEADER='x-unotest-viewer-session';function encodeViewerSession(_0x531c7e){const _0x419b14={_0x2d038f:0xfc,_0x2ee2a6:0xfa,_0x4b9c24:0x104},_0x44604a=_0x63594;return Buffer[_0x44604a(_0x419b14._0x2d038f)](JSON[_0x44604a(0x107)](_0x531c7e),_0x44604a(_0x419b14._0x2ee2a6))[_0x44604a(0xf9)](_0x44604a(_0x419b14._0x4b9c24));}__name(encodeViewerSession,_0x63594(0x108));function decodeViewerSession(_0x154707){const _0x5329af={_0x34acdc:0x104},_0xd37f3=_0x63594;if(_0x154707===void 0x0||_0x154707==='')return null;let _0x159536;try{_0x159536=JSON[_0xd37f3(0x105)](Buffer['from'](_0x154707,_0xd37f3(_0x5329af._0x34acdc))['toString']('utf8'));}catch{return null;}if(typeof _0x159536!==_0xd37f3(0x10a)||_0x159536===null)return null;const {capabilities:_0x2278de,identity:_0x5b22ef}=_0x159536,_0x838a85=readCapabilities(_0x2278de);if(_0x838a85===null)return null;return{'capabilities':_0x838a85,'identity':readIdentity(_0x5b22ef)};}__name(decodeViewerSession,_0x63594(0x100));function _0x7399(_0x103817,_0x52bbcd){_0x103817=_0x103817-0xf8;const _0x2bedbd=_0x2bed();let _0x7399b0=_0x2bedbd[_0x103817];if(_0x7399['HUqrFc']===undefined){var _0x298e7b=function(_0x5d1c2b){const _0x45f4b7='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x2cfdfb='',_0x4fd38f='';for(let _0x531c7e=0x0,_0x154707,_0x159536,_0x2278de=0x0;_0x159536=_0x5d1c2b['charAt'](_0x2278de++);~_0x159536&&(_0x154707=_0x531c7e%0x4?_0x154707*0x40+_0x159536:_0x159536,_0x531c7e++%0x4)?_0x2cfdfb+=String['fromCharCode'](0xff&_0x154707>>(-0x2*_0x531c7e&0x6)):0x0){_0x159536=_0x45f4b7['indexOf'](_0x159536);}for(let _0x5b22ef=0x0,_0x838a85=_0x2cfdfb['length'];_0x5b22ef<_0x838a85;_0x5b22ef++){_0x4fd38f+='%'+('00'+_0x2cfdfb['charCodeAt'](_0x5b22ef)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x4fd38f);};_0x7399['UESECX']=_0x298e7b,_0x7399['KGWIeH']={},_0x7399['HUqrFc']=!![];}const _0x5820d7=_0x2bedbd[0x0],_0x34b3a7=_0x103817+_0x5820d7,_0x2896fc=_0x7399['KGWIeH'][_0x34b3a7];return!_0x2896fc?(_0x7399b0=_0x7399['UESECX'](_0x7399b0),_0x7399['KGWIeH'][_0x34b3a7]=_0x7399b0):_0x7399b0=_0x2896fc,_0x7399b0;}function readCapabilities(_0x32fbf2){const _0x4b9a0b={_0x23170f:0x113,_0x3f2374:0x109},_0xbda39a=_0x63594;if(typeof _0x32fbf2!=='object'||_0x32fbf2===null)return null;const _0x286579=_0x32fbf2,_0x10e910=__name(_0xe57fd9=>_0x286579[_0xe57fd9]===!![],_0xbda39a(0x10e));return{'canRun':_0x10e910('canRun'),'canEditFiles':_0x10e910(_0xbda39a(_0x4b9a0b._0x23170f)),'canTerminal':_0x10e910(_0xbda39a(0xfb)),'canBrowseFs':_0x10e910(_0xbda39a(_0x4b9a0b._0x3f2374))};}__name(readCapabilities,_0x63594(0xfd));function readIdentity(_0x119665){const _0xb9e1c4={_0x1b6007:0x10a,_0x1a4bae:0x102,_0x46643e:0x115,_0x1c3d20:0x102},_0x2d5280=_0x63594;if(typeof _0x119665!==_0x2d5280(_0xb9e1c4._0x1b6007)||_0x119665===null)return null;const _0x52ed6a=_0x119665,{user:_0x43383f,role:_0x88379d}=_0x52ed6a;if(typeof _0x43383f!==_0x2d5280(_0xb9e1c4._0x1a4bae)||typeof _0x88379d!=='string')return null;return{'user':_0x43383f,'role':_0x88379d,...typeof _0x52ed6a[_0x2d5280(0x115)]==='string'?{'env':_0x52ed6a[_0x2d5280(_0xb9e1c4._0x46643e)]}:{},...typeof _0x52ed6a['logoutUrl']===_0x2d5280(_0xb9e1c4._0x1c3d20)?{'logoutUrl':_0x52ed6a[_0x2d5280(0x106)]}:{}};}__name(readIdentity,_0x63594(0xf8));export{FULL_CAPABILITIES,STANDALONE_SESSION,VIEWER_SESSION_HEADER,decodeViewerSession,encodeViewerSession};function _0x2bed(){const _0xecb080=['zgvJB2rLvMLLD2vYu2vZC2LVBG','ndu4nZmZswncEfLh','C3rYAw5N','zgvMAw5LuhjVCgvYDhK','yMfZzty0DxjS','CgfYC2u','Bg9NB3v0vxjS','C3rYAw5NAwz5','zw5JB2rLvMLLD2vYu2vZC2LVBG','y2fUqNjVD3nLrNm','B2jQzwn0','mJiYnZC2wvD2tKvp','BMfTzq','ndiZs2XND0D1','zMXHzW','mJC2otq1DLzXsePJ','mwnXvwLWrG','mteYmK1UAwPuCq','ndqWodvns1jxteW','y2fUrwrPDezPBgvZ','ntCWzxnvAuLb','zw52','mJmYmZK0ohH2rKD3Ba','CMvHzeLKzw50Axr5','Dg9tDhjPBMC','DxrMoa','y2fUvgvYBwLUywW','zNjVBq','CMvHzenHCgfIAwXPDgLLCW','mte0odi0nvzIsKP2CW','mteWnde5nKX0r05rva'];_0x2bed=function(){return _0xecb080;};return _0x2bed();}