@unotest/viewer 0.15.0 → 0.17.0

package/dist/server/session.d.ts

@@ -0,0 +1,59 @@
+/** What the current viewer session is allowed to do, as told by whoever
+ *  fronts the viewer (today: the unotest guard proxy).
+ *
+ *  The viewer authorizes NOTHING: it binds to localhost and trusts its
+ *  caller, so enforcement lives in the proxy in front of it. This payload
+ *  exists purely so the UI stops offering controls whose requests the
+ *  proxy will reject — which is why a capability can only be LOWERED from
+ *  the outside, never granted: a forged header buys the sender a smaller
+ *  UI and nothing else.
+ *
+ *  Capabilities are coarse and role-free on purpose. A proxy that invents
+ *  new roles maps them onto these flags; the viewer never learns the word
+ *  "admin" and needs no change when the role set grows (OCP). */
+interface ViewerCapabilities {
+    /** Start / abort runs, drive the debugger, control the app-under-test. */
+    readonly canRun: boolean;
+    /** Create, rename, delete, copy scenarios; save sources; edit variables. */
+    readonly canEditFiles: boolean;
+    /** Open the terminal panel (a PTY on the viewer's machine). */
+    readonly canTerminal: boolean;
+    /** Browse the host filesystem through the path picker. */
+    readonly canBrowseFs: boolean;
+}
+/** Who the fronting proxy says is looking, for display only — the viewer
+ *  never makes a decision out of these strings. */
+interface ViewerIdentity {
+    readonly user: string;
+    /** The proxy's own word for the role ("admin", "readonly", …). Shown
+     *  as-is in the status bar; never branched on. */
+    readonly role: string;
+    /** Environment the proxy routed this session to, when it has several. */
+    readonly env?: string;
+    /** Where to POST to end the session. Absent → no log-out affordance. */
+    readonly logoutUrl?: string;
+}
+interface ViewerSession {
+    readonly capabilities: ViewerCapabilities;
+    /** null when nothing fronts the viewer — plain localhost usage. */
+    readonly identity: ViewerIdentity | null;
+}
+declare const FULL_CAPABILITIES: ViewerCapabilities;
+/** The default answer: no proxy, no restrictions, nobody to name. */
+declare const STANDALONE_SESSION: ViewerSession;
+
+/** Wire format for {@link ViewerSession} between a fronting proxy and the
+ *  viewer server. Node-only (Buffer) — the browser bundle imports
+ *  `./session.ts` for the types and reads the decoded payload over HTTP,
+ *  never this module.
+ *
+ *  base64url rather than raw JSON: header values are latin-1 and a user
+ *  name with a non-ASCII character would otherwise corrupt the header. */
+declare const VIEWER_SESSION_HEADER = "x-unotest-viewer-session";
+declare function encodeViewerSession(session: ViewerSession): string;
+/** Returns null for anything that isn't a payload we recognise — absent,
+ *  truncated, forged. The caller then falls back to standalone defaults:
+ *  a broken header must not lock a local user out of their own viewer. */
+declare function decodeViewerSession(raw: string | undefined): ViewerSession | null;
+
+export { FULL_CAPABILITIES, STANDALONE_SESSION, VIEWER_SESSION_HEADER, type ViewerCapabilities, type ViewerIdentity, type ViewerSession, decodeViewerSession, encodeViewerSession };

package/dist/server/session.js

@@ -0,0 +1 @@
+const _0x23e6d6=_0x56a8;(function(_0x58f3ff,_0x1b70a0){const _0x2db3aa={_0x517407:0x80,_0x28caf0:0x82,_0x3c18af:0x85,_0x2f4547:0x87,_0x4dca8a:0x83},_0x34bad3=_0x56a8,_0x5a1d5d=_0x58f3ff();while(!![]){try{const _0x4352a8=parseInt(_0x34bad3(0x7e))/0x1*(-parseInt(_0x34bad3(0x7d))/0x2)+parseInt(_0x34bad3(_0x2db3aa._0x517407))/0x3+parseInt(_0x34bad3(0x77))/0x4*(-parseInt(_0x34bad3(0x8a))/0x5)+parseInt(_0x34bad3(_0x2db3aa._0x28caf0))/0x6*(-parseInt(_0x34bad3(_0x2db3aa._0x3c18af))/0x7)+parseInt(_0x34bad3(0x8b))/0x8+-parseInt(_0x34bad3(_0x2db3aa._0x2f4547))/0x9+parseInt(_0x34bad3(_0x2db3aa._0x4dca8a))/0xa;if(_0x4352a8===_0x1b70a0)break;else _0x5a1d5d['push'](_0x5a1d5d['shift']());}catch(_0x3f7fa8){_0x5a1d5d['push'](_0x5a1d5d['shift']());}}}(_0x2765,0x7fca6));function _0x56a8(_0x294de2,_0x10a63f){_0x294de2=_0x294de2-0x77;const _0x27655b=_0x2765();let _0x56a822=_0x27655b[_0x294de2];if(_0x56a8['OCDGAd']===undefined){var _0x5d3727=function(_0x8d8a5a){const _0x649a13='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x31e334='',_0x42733a='';for(let _0x45f273=0x0,_0x5d2047,_0x370f6f,_0x56b41f=0x0;_0x370f6f=_0x8d8a5a['charAt'](_0x56b41f++);~_0x370f6f&&(_0x5d2047=_0x45f273%0x4?_0x5d2047*0x40+_0x370f6f:_0x370f6f,_0x45f273++%0x4)?_0x31e334+=String['fromCharCode'](0xff&_0x5d2047>>(-0x2*_0x45f273&0x6)):0x0){_0x370f6f=_0x649a13['indexOf'](_0x370f6f);}for(let _0x20d5c7=0x0,_0x33501a=_0x31e334['length'];_0x20d5c7<_0x33501a;_0x20d5c7++){_0x42733a+='%'+('00'+_0x31e334['charCodeAt'](_0x20d5c7)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x42733a);};_0x56a8['HlhDBJ']=_0x5d3727,_0x56a8['yZZxuE']={},_0x56a8['OCDGAd']=!![];}const _0x3174ee=_0x27655b[0x0],_0x1ce93b=_0x294de2+_0x3174ee,_0x49ec9a=_0x56a8['yZZxuE'][_0x1ce93b];return!_0x49ec9a?(_0x56a822=_0x56a8['HlhDBJ'](_0x56a822),_0x56a8['yZZxuE'][_0x1ce93b]=_0x56a822):_0x56a822=_0x49ec9a,_0x56a822;}var __defProp=Object[_0x23e6d6(0x89)],__name=(_0x31e334,_0x42733a)=>__defProp(_0x31e334,'name',{'value':_0x42733a,'configurable':!![]}),FULL_CAPABILITIES={'canRun':!![],'canEditFiles':!![],'canTerminal':!![],'canBrowseFs':!![]},STANDALONE_SESSION={'capabilities':FULL_CAPABILITIES,'identity':null},VIEWER_SESSION_HEADER=_0x23e6d6(0x79);function encodeViewerSession(_0x45f273){const _0x11d7d5={_0x240f1a:0x7b,_0x3f10fa:0x8c},_0x459d26=_0x23e6d6;return Buffer['from'](JSON['stringify'](_0x45f273),_0x459d26(_0x11d7d5._0x240f1a))[_0x459d26(0x86)](_0x459d26(_0x11d7d5._0x3f10fa));}__name(encodeViewerSession,_0x23e6d6(0x7c));function decodeViewerSession(_0x5d2047){const _0x3d5ceb={_0x25d26f:0x8c,_0x30d8ca:0x7b},_0x38b405=_0x23e6d6;if(_0x5d2047===void 0x0||_0x5d2047==='')return null;let _0x370f6f;try{_0x370f6f=JSON['parse'](Buffer[_0x38b405(0x7a)](_0x5d2047,_0x38b405(_0x3d5ceb._0x25d26f))[_0x38b405(0x86)](_0x38b405(_0x3d5ceb._0x30d8ca)));}catch{return null;}if(typeof _0x370f6f!==_0x38b405(0x84)||_0x370f6f===null)return null;const {capabilities:_0x56b41f,identity:_0x20d5c7}=_0x370f6f,_0x33501a=readCapabilities(_0x56b41f);if(_0x33501a===null)return null;return{'capabilities':_0x33501a,'identity':readIdentity(_0x20d5c7)};}__name(decodeViewerSession,_0x23e6d6(0x78));function readCapabilities(_0x512f83){const _0x1f5e15={_0x449987:0x84,_0x463ba2:0x7f},_0x14752e=_0x23e6d6;if(typeof _0x512f83!==_0x14752e(_0x1f5e15._0x449987)||_0x512f83===null)return null;const _0x20e4b0=_0x512f83,_0xebab5c=__name(_0x3c48b1=>_0x20e4b0[_0x3c48b1]===!![],'flag');return{'canRun':_0xebab5c(_0x14752e(_0x1f5e15._0x463ba2)),'canEditFiles':_0xebab5c(_0x14752e(0x88)),'canTerminal':_0xebab5c(_0x14752e(0x8e)),'canBrowseFs':_0xebab5c(_0x14752e(0x81))};}__name(readCapabilities,'readCapabilities');function readIdentity(_0x38064e){const _0x4463c8={_0x5841ad:0x84,_0x129b84:0x8f},_0xf87761=_0x23e6d6;if(typeof _0x38064e!==_0xf87761(_0x4463c8._0x5841ad)||_0x38064e===null)return null;const _0x480346=_0x38064e,{user:_0x27ad65,role:_0x76eb00}=_0x480346;if(typeof _0x27ad65!=='string'||typeof _0x76eb00!==_0xf87761(0x8d))return null;return{'user':_0x27ad65,'role':_0x76eb00,...typeof _0x480346['env']===_0xf87761(0x8d)?{'env':_0x480346['env']}:{},...typeof _0x480346[_0xf87761(0x8f)]===_0xf87761(0x8d)?{'logoutUrl':_0x480346[_0xf87761(_0x4463c8._0x129b84)]}:{}};}__name(readIdentity,'readIdentity');export{FULL_CAPABILITIES,STANDALONE_SESSION,VIEWER_SESSION_HEADER,decodeViewerSession,encodeViewerSession};function _0x2765(){const _0x36ec87=['nte2mJG1nNjht0zisG','yMfZzty0DxjS','C3rYAw5N','y2fUvgvYBwLUywW','Bg9NB3v0vxjS','nJG0qLrZCfDb','zgvJB2rLvMLLD2vYu2vZC2LVBG','Ec11BM90zxn0lxzPzxDLCI1ZzxnZAw9U','zNjVBq','DxrMoa','zw5JB2rLvMLLD2vYu2vZC2LVBG','mKjxuvv4Eq','mZi2mdy1rMf5v1zy','y2fUuNvU','mZaYnJa4mNr5tKDtDW','y2fUqNjVD3nLrNm','nde0wNrSAM5N','mtGWntaYmhPVqxjzDG','B2jQzwn0','mtuWnZfeyKf3AMO','Dg9tDhjPBMC','mJq1mtm0oe9fwfHIyq','y2fUrwrPDezPBgvZ','zgvMAw5LuhjVCgvYDhK','mty0otv2q3rMsfu'];_0x2765=function(){return _0x36ec87;};return _0x2765();}