browser-commander 0.16.1 → 0.17.0

package/tests/unit/fingerprint/profile.test.js

@@ -0,0 +1,282 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+
+import {
+  FINGERPRINT_FIELD_MECHANISMS,
+  resolveFingerprintProfile,
+} from '../../../src/fingerprint/profile.js';
+
+const CHROME_UA =
+  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ' +
+  '(KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36';
+
+describe('fingerprint profile', () => {
+  it('returns an empty frozen profile for an empty input', () => {
+    const profile = resolveFingerprintProfile();
+
+    assert.deepEqual(profile, {});
+    assert.ok(Object.isFrozen(profile));
+  });
+
+  it('drops fields that were not supplied instead of filling in defaults', () => {
+    const profile = resolveFingerprintProfile({ locale: 'de-DE' });
+
+    assert.deepEqual(Object.keys(profile), ['locale']);
+  });
+
+  it('rejects an unknown field rather than silently ignoring it', () => {
+    assert.throws(
+      () => resolveFingerprintProfile({ hardwareConcurency: 8 }),
+      /unknown fingerprint profile field "hardwareConcurency"/u
+    );
+  });
+
+  it('rejects a profile that is not a plain object', () => {
+    for (const input of [null, [], 'profile', 42]) {
+      assert.throws(
+        () => resolveFingerprintProfile(input),
+        /fingerprint profile must be an object/u
+      );
+    }
+  });
+
+  it('derives acceptLanguage from languages when only languages is given', () => {
+    const profile = resolveFingerprintProfile({
+      languages: ['de-DE', 'de', 'en'],
+    });
+
+    assert.equal(profile.acceptLanguage, 'de-DE,de,en');
+    assert.deepEqual(profile.languages, ['de-DE', 'de', 'en']);
+  });
+
+  it('keeps an explicit acceptLanguage over the derived one', () => {
+    const profile = resolveFingerprintProfile({
+      languages: ['de-DE', 'de'],
+      acceptLanguage: 'fr-FR,fr',
+    });
+
+    assert.equal(profile.acceptLanguage, 'fr-FR,fr');
+  });
+
+  // Chrome splits acceptLanguage on commas without stripping q-values, so a
+  // q-value ends up inside a language tag and doubled in the header.
+  it('rejects q-values in acceptLanguage, which Chrome would misparse', () => {
+    assert.throws(
+      () => resolveFingerprintProfile({ acceptLanguage: 'de-DE,de;q=0.9' }),
+      /must be a plain comma-separated language list without q-values/u
+    );
+  });
+
+  it('derives client hints from a Chrome user agent', () => {
+    const profile = resolveFingerprintProfile({ userAgent: CHROME_UA });
+
+    assert.equal(profile.userAgentData.platform, 'Windows');
+    assert.equal(profile.userAgentData.architecture, 'x86');
+    assert.equal(profile.userAgentData.bitness, '64');
+    assert.equal(profile.userAgentData.mobile, false);
+    assert.ok(
+      profile.userAgentData.brands.some(
+        (entry) => entry.brand === 'Google Chrome' && entry.version === '140'
+      )
+    );
+  });
+
+  it('fills uaFullVersion from the Chrome entry of fullVersionList', () => {
+    const profile = resolveFingerprintProfile({
+      userAgentData: {
+        fullVersionList: [
+          { brand: 'Not=A?Brand', version: '24.0.0.0' },
+          { brand: 'Google Chrome', version: '140.0.7000.1' },
+        ],
+      },
+    });
+
+    assert.equal(profile.userAgentData.fullVersion, '140.0.7000.1');
+  });
+
+  it('keeps an explicit fullVersion instead of deriving one', () => {
+    const profile = resolveFingerprintProfile({
+      userAgentData: {
+        fullVersion: '99.1.2.3',
+        fullVersionList: [{ brand: 'Google Chrome', version: '140.0.0.0' }],
+      },
+    });
+
+    assert.equal(profile.userAgentData.fullVersion, '99.1.2.3');
+  });
+
+  it('lets an explicit userAgentData win over the one derived from the user agent', () => {
+    const profile = resolveFingerprintProfile({
+      userAgent: CHROME_UA,
+      userAgentData: { platform: 'macOS' },
+    });
+
+    assert.equal(profile.userAgentData.platform, 'macOS');
+  });
+
+  it('accepts every configurable field at once', () => {
+    const profile = resolveFingerprintProfile({
+      userAgent: CHROME_UA,
+      languages: ['de-DE', 'de'],
+      locale: 'de-DE',
+      timezoneId: 'Europe/Berlin',
+      platform: 'Win32',
+      vendor: 'Google Inc.',
+      hardwareConcurrency: 24,
+      deviceMemory: 32,
+      maxTouchPoints: 5,
+      doNotTrack: '1',
+      screen: {
+        width: 3840,
+        height: 2160,
+        availWidth: 3840,
+        availHeight: 2100,
+        colorDepth: 30,
+        pixelDepth: 30,
+      },
+      viewport: {
+        width: 1600,
+        height: 900,
+        deviceScaleFactor: 2,
+        mobile: false,
+      },
+      webgl: { unmaskedVendor: 'NVIDIA', unmaskedRenderer: 'RTX 4090' },
+      geolocation: { latitude: 52.52, longitude: 13.405, accuracy: 12 },
+      colorScheme: 'dark',
+      reducedMotion: 'reduce',
+      forcedColors: 'active',
+    });
+
+    assert.equal(profile.hardwareConcurrency, 24);
+    assert.equal(profile.deviceMemory, 32);
+    assert.equal(profile.screen.colorDepth, 30);
+    assert.equal(profile.viewport.deviceScaleFactor, 2);
+    assert.equal(profile.webgl.unmaskedRenderer, 'RTX 4090');
+    assert.equal(profile.geolocation.accuracy, 12);
+    assert.equal(profile.forcedColors, 'active');
+  });
+
+  it('rejects a hardwareConcurrency that is not a positive integer', () => {
+    for (const value of [0, -4, 2.5, '8']) {
+      assert.throws(
+        () => resolveFingerprintProfile({ hardwareConcurrency: value }),
+        /hardwareConcurrency must be a positive integer/u
+      );
+    }
+  });
+
+  it('allows maxTouchPoints to be zero but not negative', () => {
+    assert.equal(
+      resolveFingerprintProfile({ maxTouchPoints: 0 }).maxTouchPoints,
+      0
+    );
+    assert.throws(
+      () => resolveFingerprintProfile({ maxTouchPoints: -1 }),
+      /maxTouchPoints must be a non-negative integer/u
+    );
+  });
+
+  it('requires screen width and height to be given together', () => {
+    assert.throws(
+      () => resolveFingerprintProfile({ screen: { width: 1920 } }),
+      /screen.width and screen.height must be provided together/u
+    );
+  });
+
+  it('requires viewport width and height to be given together', () => {
+    assert.throws(
+      () => resolveFingerprintProfile({ viewport: { height: 900 } }),
+      /viewport.width and viewport.height must be provided together/u
+    );
+  });
+
+  it('rejects out-of-range coordinates', () => {
+    assert.throws(
+      () =>
+        resolveFingerprintProfile({
+          geolocation: { latitude: 91, longitude: 0 },
+        }),
+      /latitude must be between -90 and 90/u
+    );
+    assert.throws(
+      () =>
+        resolveFingerprintProfile({
+          geolocation: { latitude: 0, longitude: -181 },
+        }),
+      /longitude must be between -180 and 180/u
+    );
+  });
+
+  it('rejects an unsupported enum value', () => {
+    assert.throws(
+      () => resolveFingerprintProfile({ colorScheme: 'sepia' }),
+      /colorScheme must be one of light, dark, no-preference/u
+    );
+  });
+
+  it('rejects an empty languages array', () => {
+    assert.throws(
+      () => resolveFingerprintProfile({ languages: [] }),
+      /languages must not be empty/u
+    );
+  });
+
+  it('rejects a brand entry with a non-string version', () => {
+    assert.throws(
+      () =>
+        resolveFingerprintProfile({
+          userAgentData: { brands: [{ brand: 'Chromium', version: 140 }] },
+        }),
+      /userAgentData.brands\[0\].version must be a string/u
+    );
+  });
+
+  it('treats null the same as an omitted field', () => {
+    const profile = resolveFingerprintProfile({
+      locale: null,
+      screen: null,
+      webgl: null,
+    });
+
+    assert.deepEqual(profile, {});
+  });
+
+  it('copies arrays so a later mutation of the input cannot reach the profile', () => {
+    const languages = ['de-DE', 'de'];
+    const profile = resolveFingerprintProfile({ languages });
+    languages.push('en');
+
+    assert.deepEqual(profile.languages, ['de-DE', 'de']);
+  });
+
+  it('records a mechanism for every field the profile accepts', () => {
+    const everyField = resolveFingerprintProfile({
+      userAgent: CHROME_UA,
+      acceptLanguage: 'en-US,en',
+      languages: ['en-US', 'en'],
+      locale: 'en-US',
+      timezoneId: 'UTC',
+      platform: 'Win32',
+      vendor: 'Google Inc.',
+      hardwareConcurrency: 8,
+      deviceMemory: 8,
+      maxTouchPoints: 0,
+      doNotTrack: '1',
+      screen: { width: 1920, height: 1080 },
+      viewport: { width: 1280, height: 720 },
+      webgl: { unmaskedVendor: 'Intel' },
+      geolocation: { latitude: 0, longitude: 0 },
+      colorScheme: 'dark',
+      reducedMotion: 'reduce',
+      forcedColors: 'active',
+    });
+
+    for (const field of Object.keys(everyField)) {
+      assert.ok(
+        FINGERPRINT_FIELD_MECHANISMS[field] === 'browser' ||
+          FINGERPRINT_FIELD_MECHANISMS[field] === 'script',
+        `no mechanism recorded for "${field}"`
+      );
+    }
+  });
+});

package/tests/unit/scripts/check-pipeline-status.test.js

@@ -0,0 +1,133 @@
+/**
+ * The gate that makes a cancelled job visible.
+ *
+ * GitHub reports a job killed by its `timeout-minutes` as *cancelled*, not
+ * *failed*, and a run whose only casualty is a cancelled job is filed under
+ * `cancelled` as well - run 24045269874 of this repository is one such run on
+ * `main`. scripts/check-pipeline-status.sh is the only thing that looks at
+ * that, so these tests pin the four readings it has to get right: a failure is
+ * always an error, a cancellation off the default branch is a warning, a
+ * cancellation on the default branch is an error unless a newer run has already
+ * taken over the branch head.
+ *
+ * See docs/CI-TIMEOUT-BUDGETS.md.
+ */
+
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { describe, it } from 'node:test';
+
+import {
+  BASH_AVAILABLE,
+  REPO_ROOT,
+  repoPath,
+  runBashScript,
+} from '../../helpers/repo.js';
+
+const SCRIPT = repoPath('scripts/check-pipeline-status.sh');
+
+function runGate(needs, env = {}, options = {}) {
+  return runBashScript(SCRIPT, [], {
+    cwd: options.cwd,
+    env: { NEEDS_JSON: JSON.stringify(needs), ...env },
+  });
+}
+
+function results(map) {
+  return Object.fromEntries(
+    Object.entries(map).map(([job, result]) => [job, { result }])
+  );
+}
+
+describe('check-pipeline-status.sh', { skip: !BASH_AVAILABLE }, () => {
+  it('passes when every job succeeded or was legitimately skipped', () => {
+    const { status, output } = runGate(
+      results({ lint: 'success', release: 'skipped' }),
+      { IS_MAIN: 'true', RUN_SHA: 'abc', BRANCH_HEAD_SHA: 'abc' }
+    );
+
+    assert.equal(status, 0);
+    assert.match(
+      output,
+      /All required jobs succeeded or were legitimately skipped/
+    );
+  });
+
+  it('fails on a failed job and names it', () => {
+    const { status, output } = runGate(
+      results({ lint: 'failure', test: 'success' }),
+      { IS_MAIN: 'true', RUN_SHA: 'abc', BRANCH_HEAD_SHA: 'abc' }
+    );
+
+    assert.equal(status, 1);
+    assert.match(output, /::error::Pipeline failed\. Failing jobs: lint/);
+  });
+
+  it('only warns about a cancellation off the default branch', () => {
+    const { status, output } = runGate(results({ test: 'cancelled' }), {
+      IS_MAIN: 'false',
+      RUN_SHA: 'abc',
+      BRANCH_HEAD_SHA: 'abc',
+    });
+
+    assert.equal(status, 0);
+    assert.match(output, /::warning::Cancelled jobs: test/);
+  });
+
+  it('fails on a cancellation on the default branch head', () => {
+    const { status, output } = runGate(results({ test: 'cancelled' }), {
+      IS_MAIN: 'true',
+      RUN_SHA: 'abc',
+      BRANCH_HEAD_SHA: 'abc',
+    });
+
+    assert.equal(status, 1);
+    assert.match(output, /::error::Pipeline has cancelled jobs on main: test/);
+  });
+
+  it('only warns when a newer commit already superseded the run', () => {
+    const { status, output } = runGate(results({ test: 'cancelled' }), {
+      IS_MAIN: 'true',
+      RUN_SHA: 'abc',
+      BRANCH_HEAD_SHA: 'def',
+    });
+
+    assert.equal(status, 0);
+    assert.match(output, /This run tests abc; main is at def/);
+    assert.match(output, /::warning::Cancelled jobs: test/);
+  });
+
+  it('fails rather than guesses when the branch head cannot be resolved', () => {
+    // A missed supersede costs one noisy warning; a missed overrun on main
+    // costs a silent failure, so the unresolvable case has to be the loud one.
+    const directory = mkdtempSync(path.join(tmpdir(), 'pipeline-status-'));
+
+    try {
+      const { status, output } = runGate(
+        results({ test: 'cancelled' }),
+        { IS_MAIN: 'true', RUN_SHA: 'abc', BRANCH_HEAD_SHA: '' },
+        { cwd: directory }
+      );
+
+      assert.equal(status, 1);
+      assert.match(output, /assuming it is current/);
+      assert.match(output, /::error::Pipeline has cancelled jobs on main/);
+    } finally {
+      rmSync(directory, { force: true, recursive: true });
+    }
+  });
+
+  it('refuses to run without the job results', () => {
+    const result = spawnSync('bash', [SCRIPT], {
+      cwd: REPO_ROOT,
+      encoding: 'utf8',
+      env: { ...process.env, NEEDS_JSON: '' },
+    });
+
+    assert.notEqual(result.status, 0);
+    assert.match(result.stderr, /NEEDS_JSON is required/);
+  });
+});

package/tests/unit/scripts/check-web-archive.test.js

@@ -0,0 +1,191 @@
+/**
+ * The link checker used to fail pull requests for links that were not broken.
+ *
+ * Run 33959793880 is the reference case: lychee reported exactly one error, a
+ * `[502]` on a GitHub issue that answered 200 minutes later, and listed a
+ * healthy `[302]` redirect in a separate section. Both were reported as broken
+ * links with no archived copy, and the job failed. The fixture below is that
+ * report; the assertions pin each step of the decision that now keeps such a
+ * run green while still failing on a link that is really gone.
+ */
+
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+
+import {
+  classifyStatus,
+  extractRejectedLinks,
+  judge,
+} from '../../../../scripts/check-web-archive.mjs';
+
+// Verbatim shape of lychee/out.md from run 33959793880.
+const REPORT = `# Summary
+
+| Status         | Count |
+|----------------|-------|
+| 🔍 Total       | 170   |
+| 🔗 Unique      | 123   |
+| ✅ Successful  | 166   |
+| ⏳ Timeouts    | 0     |
+| 🔀 Redirected  | 1     |
+| 👻 Excluded    | 3     |
+| ❓ Unknown     | 0     |
+| 🚫 Errors      | 1     |
+| ⛔ Unsupported | 0     |
+
+## Errors per input
+
+### Errors in docs/case-studies/issue-53/README.md
+
+* [502] <https://github.com/microsoft/playwright/issues/35743> (at 94:99) | Rejected status code: 502 Bad Gateway
+
+## Redirects per input
+
+### Redirects in docs/case-studies/issue-33/README.md
+
+* https://docs.github.com/actions/security-guides/using-secrets-in-github-actions --[302]--> https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets
+`;
+
+describe('reading lychee’s report', () => {
+  it('takes the rejected links from the errors section only', () => {
+    assert.deepEqual(extractRejectedLinks(REPORT), [
+      {
+        url: 'https://github.com/microsoft/playwright/issues/35743',
+        status: '502',
+      },
+    ]);
+  });
+
+  it('never reports a redirect as broken', () => {
+    const urls = extractRejectedLinks(REPORT).map((link) => link.url);
+    assert.ok(
+      !urls.some((url) => url.startsWith('https://docs.github.com/')),
+      'a 302 listed under "Redirects per input" is a working link'
+    );
+  });
+
+  it('collects every input listed under the errors section', () => {
+    const report = [
+      '## Errors per input',
+      '',
+      '### Errors in a.md',
+      '',
+      '* [404] <https://example.com/gone> (at 1:1) | Not Found',
+      '',
+      '### Errors in b.md',
+      '',
+      '* [ERROR] <https://example.invalid/x> (at 2:2) | dns error',
+      '* [404] <https://example.com/gone> (at 3:3) | Not Found',
+      '',
+      '## Suggestions per input',
+      '',
+      '* [404] <https://example.com/not-an-error> (at 4:4)',
+      '',
+    ].join('\n');
+
+    assert.deepEqual(extractRejectedLinks(report), [
+      { url: 'https://example.com/gone', status: '404' },
+      { url: 'https://example.invalid/x', status: 'ERROR' },
+    ]);
+  });
+});
+
+describe('classifying a lychee status', () => {
+  it('treats a refusal to answer as saying nothing about the link', () => {
+    assert.equal(classifyStatus('429'), 'transient');
+    assert.equal(classifyStatus('500'), 'transient');
+    assert.equal(classifyStatus('502'), 'transient');
+    assert.equal(classifyStatus('503'), 'transient');
+  });
+
+  it('treats a 4xx answer as the resource being gone', () => {
+    assert.equal(classifyStatus('404'), 'gone');
+    assert.equal(classifyStatus('410'), 'gone');
+    assert.equal(classifyStatus('403'), 'gone');
+  });
+
+  it('keeps network-level failures out of both buckets', () => {
+    assert.equal(classifyStatus('ERROR'), 'unknown');
+    assert.equal(classifyStatus('TIMEOUT'), 'unknown');
+    assert.equal(classifyStatus('UNKNOWN'), 'unknown');
+  });
+});
+
+// Stubs for the two questions `judge` asks. Naming them keeps each case below
+// to the one thing it is about: what the second look said, and whether the
+// Wayback Machine had a copy.
+const answers = (status) => async () => ({ alive: status < 400, status });
+const unreachable = () => async () => ({ alive: false, status: null });
+
+const waybackNever = () => async () => {
+  throw new Error('the Wayback Machine must not be consulted here');
+};
+const waybackNothing = () => async () => ({
+  available: false,
+  archiveUrl: null,
+  timestamp: null,
+});
+const waybackHas = (timestamp, archiveUrl) => async () => ({
+  available: true,
+  archiveUrl,
+  timestamp,
+});
+
+const verdictFor = (link, recheckImpl, waybackImpl) =>
+  judge(link, { recheckImpl, waybackImpl });
+
+describe('judging one rejected link', () => {
+  const playwright = {
+    url: 'https://github.com/microsoft/playwright/issues/35743',
+    status: '502',
+  };
+  const gone = { url: 'https://example.com/gone', status: '404' };
+
+  it('clears a link that answers on the second look', async () => {
+    const verdict = await verdictFor(playwright, answers(200), waybackNever());
+    assert.equal(verdict.verdict, 'alive');
+  });
+
+  it('does not fail for a host that is down twice', async () => {
+    const verdict = await verdictFor(playwright, answers(503), waybackNever());
+    assert.equal(verdict.verdict, 'transient');
+  });
+
+  it('does not fail for a host that keeps rate-limiting the runner', async () => {
+    const verdict = await verdictFor(
+      { url: 'https://example.com/x', status: '429' },
+      answers(429),
+      waybackNever()
+    );
+    assert.equal(verdict.verdict, 'transient');
+  });
+
+  it('suggests the snapshot when a confirmed 404 is archived', async () => {
+    const verdict = await verdictFor(
+      gone,
+      answers(404),
+      waybackHas(
+        '20231015143022',
+        'https://web.archive.org/web/20231015143022/https://example.com/gone'
+      )
+    );
+    assert.equal(verdict.verdict, 'archived');
+    assert.equal(verdict.date, '2023-10-15');
+  });
+
+  it('fails on a confirmed 404 with no snapshot', async () => {
+    const verdict = await verdictFor(gone, answers(404), waybackNothing());
+    assert.equal(verdict.verdict, 'gone');
+  });
+
+  it('still fails on a domain that no longer resolves', async () => {
+    // A dead domain and a runner with no DNS look identical to lychee, so an
+    // unreachable host is not waved through the way a 5xx is.
+    const verdict = await verdictFor(
+      { url: 'https://example.invalid/x', status: 'ERROR' },
+      unreachable(),
+      waybackNothing()
+    );
+    assert.equal(verdict.verdict, 'gone');
+  });
+});