browser-commander 0.19.0 → 0.21.0

package/tests/unit/browser/migration/cookies.test.js

@@ -0,0 +1,94 @@
+import assert from 'node:assert';
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+
+import {
+  DBSC_BOUND_COOKIE_NAMES,
+  isDbscBoundCookie,
+  migrateCookies,
+} from '../../../../src/browser/migration/cookies.js';
+
+import { useTempDirectories } from '../../../helpers/temp-directory.js';
+
+const makeTempDir = useTempDirectories('bc-cookies-');
+
+describe('isDbscBoundCookie', () => {
+  it('flags rotating Google session-token cookies', () => {
+    for (const name of DBSC_BOUND_COOKIE_NAMES) {
+      assert.equal(
+        isDbscBoundCookie({ name, domain: '.google.com' }),
+        true,
+        name
+      );
+    }
+    assert.equal(
+      isDbscBoundCookie({ name: 'SID', domain: '.google.com' }),
+      false
+    );
+    assert.equal(
+      isDbscBoundCookie({ name: '__Secure-1PSIDTS', domain: '.example.com' }),
+      false
+    );
+  });
+});
+
+describe('migrateCookies', () => {
+  it('dedupes across domain filters and tags DBSC-bound cookies', async () => {
+    const calls = [];
+    const readCookies = async ({ domainFilter }) => {
+      calls.push(domainFilter);
+      if (domainFilter === 'google.com') {
+        return [
+          { name: '__Secure-1PSIDTS', domain: '.google.com', path: '/' },
+          { name: 'SID', domain: '.google.com', path: '/' },
+        ];
+      }
+      return [{ name: 'session', domain: '.example.com', path: '/' }];
+    };
+
+    const report = await migrateCookies({
+      browser: 'chrome',
+      domains: ['google.com', 'example.com'],
+      readCookies,
+    });
+
+    assert.deepEqual(calls, ['google.com', 'example.com']);
+    assert.equal(report.cookies.length, 3);
+    assert.equal(report.migrated, 3);
+    assert.equal(report.skipped.length, 1);
+    assert.equal(report.skipped[0].reason, 'dbsc-bound');
+  });
+
+  it('warns when the source has a DBSC registration database', async () => {
+    const sourceProfileDir = await makeTempDir();
+    await mkdir(path.join(sourceProfileDir, 'Network'), { recursive: true });
+    await writeFile(
+      path.join(sourceProfileDir, 'Network', 'DeviceBoundSessions'),
+      'x'
+    );
+
+    const report = await migrateCookies({
+      browser: 'chrome',
+      sourceProfileDir,
+      readCookies: async () => [
+        { name: 'a', domain: '.example.com', path: '/' },
+      ],
+    });
+
+    assert.equal(report.warnings.length, 1);
+    assert.equal(report.warnings[0].reason, 'dbsc-registration-present');
+  });
+
+  it('passes ignoreDecryptionErrors to the reader', async () => {
+    let seen;
+    await migrateCookies({
+      browser: 'chrome',
+      readCookies: async (options) => {
+        seen = options;
+        return [];
+      },
+    });
+    assert.equal(seen.ignoreDecryptionErrors, true);
+  });
+});

package/tests/unit/browser/migration/extensions.test.js

@@ -0,0 +1,104 @@
+import assert from 'node:assert';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+
+import {
+  migrateExtensions,
+  selectMigratableExtensions,
+} from '../../../../src/browser/migration/extensions.js';
+import {
+  migrateBetween,
+  readProfileJson,
+  writeProfileJson,
+} from '../../../helpers/migration-fixtures.js';
+import { useTempDirectories } from '../../../helpers/temp-directory.js';
+
+const makeTempDir = useTempDirectories('bc-ext-');
+
+async function writeExtension(profileDir, id, version) {
+  const dir = path.join(profileDir, 'Extensions', id, version);
+  await mkdir(dir, { recursive: true });
+  await writeFile(
+    path.join(dir, 'manifest.json'),
+    JSON.stringify({ name: id, version, manifest_version: 3 })
+  );
+}
+
+describe('selectMigratableExtensions', () => {
+  it('excludes policy-installed and component extensions', () => {
+    const { eligible, excluded } = selectMigratableExtensions({
+      user: { location: 1 },
+      component: { location: 5 },
+      policy: { location: 7 },
+      external: { location: 10 },
+    });
+    assert.deepEqual(eligible, ['user']);
+    assert.equal(excluded.length, 3);
+    assert.ok(
+      excluded.every((e) => e.reason === 'policy-or-component-extension')
+    );
+  });
+});
+
+describe('migrateExtensions', () => {
+  it('copies eligible extension files and warns about the MAC', async () => {
+    const source = await makeTempDir();
+    const target = await makeTempDir();
+    await writeExtension(source, 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', '1.0');
+    await writeExtension(source, 'cccccccccccccccccccccccccccccccc', '2.0');
+    await writeProfileJson(source, 'Secure Preferences', {
+      extensions: {
+        settings: {
+          aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa: { location: 1, manifest: {} },
+          cccccccccccccccccccccccccccccccc: { location: 5 },
+        },
+      },
+    });
+
+    const report = await migrateBetween(migrateExtensions, source, target);
+
+    assert.equal(report.migrated, 1);
+    assert.ok(
+      report.skipped.some(
+        (s) =>
+          s.item === 'cccccccccccccccccccccccccccccccc' &&
+          s.reason === 'policy-or-component-extension'
+      )
+    );
+    assert.equal(report.warnings[0].reason, 'mac-will-not-validate');
+
+    const copied = await readFile(
+      path.join(
+        target,
+        'Extensions',
+        'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+        '1.0',
+        'manifest.json'
+      ),
+      'utf8'
+    );
+    assert.match(copied, /manifest_version/);
+
+    const targetSecure = await readProfileJson(target, 'Secure Preferences');
+    assert.ok(
+      targetSecure.extensions.settings.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    );
+  });
+
+  it('falls back to the directory listing without Secure Preferences', async () => {
+    const source = await makeTempDir();
+    const target = await makeTempDir();
+    await writeExtension(source, 'dddddddddddddddddddddddddddddddd', '1.0');
+
+    const report = await migrateBetween(migrateExtensions, source, target);
+    assert.equal(report.migrated, 1);
+  });
+
+  it('reports nothing when there is no Extensions directory', async () => {
+    const source = await makeTempDir();
+    const target = await makeTempDir();
+    const report = await migrateBetween(migrateExtensions, source, target);
+    assert.deepEqual(report, { migrated: 0, skipped: [], warnings: [] });
+  });
+});

package/tests/unit/browser/migration/firefox-nss.test.js

@@ -0,0 +1,113 @@
+import assert from 'node:assert';
+import { writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+
+import BetterSqlite3 from 'better-sqlite3';
+
+import {
+  decodeDerElement,
+  decodeDerSequence,
+  oidToString,
+} from '../../../../src/browser/migration/firefox-der.js';
+import {
+  PrimaryPasswordError,
+  decryptFirefoxField,
+  recoverFirefoxKeyFromDatabase,
+} from '../../../../src/browser/migration/firefox-nss.js';
+import {
+  buildKey4Database,
+  encodeLoginField,
+} from '../../../fixtures/firefox-nss-fixtures.mjs';
+import { useTempDirectories } from '../../../helpers/temp-directory.js';
+
+const makeTempDir = useTempDirectories('bc-nss-');
+
+// Build a key4.db, open it read-only as the migration does, and hand it to
+// `check` together with the fixture's `loginKey`.
+async function withKey4Database(options, check) {
+  const fixture = buildKey4Database({ dir: await makeTempDir(), ...options });
+  const db = new BetterSqlite3(fixture.key4Path, { readonly: true });
+  try {
+    check(db, fixture);
+  } finally {
+    db.close();
+  }
+}
+
+describe('firefox-der', () => {
+  it('decodes a nested SEQUENCE and OID', () => {
+    // SEQUENCE { OID 1.2.840.113549.1.5.13, OCTET STRING 0x01 0x02 }
+    const oid = Buffer.from([
+      0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x05, 0x0d,
+    ]);
+    const octet = Buffer.from([0x04, 0x02, 0x01, 0x02]);
+    const seq = Buffer.concat([
+      Buffer.from([0x30, oid.length + octet.length]),
+      oid,
+      octet,
+    ]);
+    const decoded = decodeDerElement(seq);
+    const [oidElement, octetElement] = decodeDerSequence(decoded.content);
+    assert.equal(oidToString(oidElement.content), '1.2.840.113549.1.5.13');
+    assert.deepEqual([...octetElement.content], [0x01, 0x02]);
+  });
+});
+
+describe('recoverFirefoxKeyFromDatabase', () => {
+  it('recovers the 3DES login key via PBES2 with no primary password', async () => {
+    await withKey4Database({}, (db, { loginKey }) => {
+      const recovered = recoverFirefoxKeyFromDatabase(db);
+      assert.deepEqual(recovered, loginKey);
+    });
+  });
+
+  it('round-trips a login field decryption', async () => {
+    await withKey4Database({}, (db) => {
+      const recovered = recoverFirefoxKeyFromDatabase(db);
+      const encoded = encodeLoginField({
+        key: recovered,
+        plaintext: 'super-secret',
+      });
+      assert.equal(decryptFirefoxField(encoded, recovered), 'super-secret');
+    });
+  });
+
+  it('throws PrimaryPasswordError when the wrong password is supplied', async () => {
+    const primaryPassword = Buffer.from('correct horse');
+    await withKey4Database({ primaryPassword }, (db) => {
+      assert.throws(
+        () => recoverFirefoxKeyFromDatabase(db, Buffer.from('wrong')),
+        PrimaryPasswordError
+      );
+    });
+  });
+
+  it('recovers with the correct primary password', async () => {
+    const primaryPassword = Buffer.from('correct horse');
+    await withKey4Database({ primaryPassword }, (db, { loginKey }) => {
+      assert.deepEqual(
+        recoverFirefoxKeyFromDatabase(db, primaryPassword),
+        loginKey
+      );
+    });
+  });
+
+  it('reports a helpful error when metadata is missing', async () => {
+    const dir = await makeTempDir();
+    const key4Path = path.join(dir, 'key4.db');
+    const db = new BetterSqlite3(key4Path);
+    db.exec('CREATE TABLE metadata (id TEXT, item1 BLOB, item2 BLOB)');
+    db.close();
+    await writeFile(path.join(dir, 'marker'), 'x');
+    const readonly = new BetterSqlite3(key4Path, { readonly: true });
+    try {
+      assert.throws(
+        () => recoverFirefoxKeyFromDatabase(readonly),
+        /no password metadata/
+      );
+    } finally {
+      readonly.close();
+    }
+  });
+});

package/tests/unit/browser/migration/firefox.test.js

@@ -0,0 +1,139 @@
+import assert from 'node:assert';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+
+import {
+  migrateFirefoxBookmarks,
+  migrateFirefoxPasswords,
+  readFirefoxCookies,
+  reportFirefoxHistory,
+} from '../../../../src/browser/migration/firefox.js';
+import { deriveChromiumCookieKey } from '../../../../src/browser/browser-cookie-crypto.js';
+import {
+  assertNothingMigrated,
+  readMigratedLogins,
+  readProfileJson,
+  writeFirefoxCookies,
+  writeFirefoxLogins,
+  writeFirefoxPlaces,
+} from '../../../helpers/migration-fixtures.js';
+import { useTempDirectories } from '../../../helpers/temp-directory.js';
+
+const makeTempDir = useTempDirectories('bc-ff-');
+
+describe('readFirefoxCookies', () => {
+  it('reads and maps cookies, applying the domain filter', async () => {
+    const dir = await makeTempDir();
+    await writeFirefoxCookies(dir, [
+      { name: 'a', value: '1', host: '.example.com', secure: true },
+      { name: 'b', value: '2', host: '.other.com' },
+    ]);
+    const all = await readFirefoxCookies({ profileDir: dir });
+    assert.equal(all.length, 2);
+    const filtered = await readFirefoxCookies({
+      profileDir: dir,
+      domains: ['example.com'],
+    });
+    assert.equal(filtered.length, 1);
+    assert.equal(filtered[0].domain, '.example.com');
+    assert.equal(filtered[0].secure, true);
+  });
+
+  it('returns an empty list when there is no cookies.sqlite', async () => {
+    const dir = await makeTempDir();
+    assert.deepEqual(await readFirefoxCookies({ profileDir: dir }), []);
+  });
+});
+
+describe('migrateFirefoxBookmarks', () => {
+  it('converts places bookmarks into a Chrome Bookmarks document', async () => {
+    const source = await makeTempDir();
+    const target = await makeTempDir();
+    writeFirefoxPlaces(source);
+    const report = await migrateFirefoxBookmarks({
+      profileDir: source,
+      targetProfileDir: target,
+    });
+    assert.equal(report.migrated, 2);
+    const doc = await readProfileJson(target, 'Bookmarks');
+    assert.equal(
+      doc.roots.bookmark_bar.children[0].url,
+      'https://toolbar.example/'
+    );
+    assert.equal(doc.roots.other.children[0].url, 'https://menu.example/');
+  });
+});
+
+describe('reportFirefoxHistory', () => {
+  it('counts places history and reports it as not migrated', async () => {
+    const source = await makeTempDir();
+    writeFirefoxPlaces(source);
+    const report = await reportFirefoxHistory({ profileDir: source });
+    assertNothingMigrated(report, 'firefox-history-schema-incompatible');
+    assert.match(report.warnings[0].detail, /2 history entries/);
+  });
+});
+
+describe('migrateFirefoxPasswords', () => {
+  it('decrypts logins and re-encrypts them into a Chrome Login Data', async () => {
+    const source = await makeTempDir();
+    const target = await makeTempDir();
+    const { key4Path } = await writeFirefoxLogins(source, {
+      entries: [
+        {
+          hostname: 'https://a.example',
+          username: 'alice',
+          password: 'secret-A',
+        },
+      ],
+    });
+    assert.equal(key4Path, path.join(source, 'key4.db'));
+
+    const targetKey = deriveChromiumCookieKey('target-pass', 'linux');
+    const report = await migrateFirefoxPasswords({
+      profileDir: source,
+      targetProfileDir: target,
+      platform: 'linux',
+      targetKey,
+      targetPrefix: 'v11',
+    });
+    assert.equal(report.migrated, 1);
+
+    const [login] = readMigratedLogins(target, targetKey);
+    assert.equal(login.username, 'alice');
+    assert.equal(login.password, 'secret-A');
+  });
+
+  // Each case leaves the source unable to yield passwords in a different way.
+  for (const { title, reason, writeSource } of [
+    {
+      title: 'reports primary-password-set when the key is locked',
+      reason: 'primary-password-set',
+      writeSource: (source) =>
+        writeFirefoxLogins(source, {
+          primaryPassword: Buffer.from('locked'),
+          entries: [
+            { hostname: 'https://a.example', username: 'a', password: 'b' },
+          ],
+        }),
+    },
+    {
+      title: 'reports source-missing when there is no logins.json',
+      reason: 'source-missing',
+      writeSource: async () => {},
+    },
+  ]) {
+    it(title, async () => {
+      const source = await makeTempDir();
+      const target = await makeTempDir();
+      await writeSource(source);
+      const report = await migrateFirefoxPasswords({
+        profileDir: source,
+        targetProfileDir: target,
+        platform: 'linux',
+        targetKey: deriveChromiumCookieKey('t', 'linux'),
+      });
+      assertNothingMigrated(report, reason);
+    });
+  }
+});

package/tests/unit/browser/migration/history.test.js

@@ -0,0 +1,48 @@
+import assert from 'node:assert';
+import { stat } from 'node:fs/promises';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+
+import { migrateHistory } from '../../../../src/browser/migration/history.js';
+import {
+  assertNothingMigrated,
+  assertSourceUnchanged,
+  migrateBetween,
+  writeChromiumHistory,
+} from '../../../helpers/migration-fixtures.js';
+import { useTempDirectories } from '../../../helpers/temp-directory.js';
+
+const makeTempDir = useTempDirectories('bc-history-');
+
+describe('migrateHistory', () => {
+  it('snapshots History into the target and reports the URL count', async () => {
+    const source = await makeTempDir();
+    const target = await makeTempDir();
+    writeChromiumHistory(source, 5);
+
+    const report = await migrateBetween(migrateHistory, source, target);
+
+    assert.equal(report.migrated, 1);
+    await stat(path.join(target, 'History'));
+    const warning = report.warnings.find((w) => w.reason === 'snapshot-copied');
+    assert.ok(warning);
+    assert.match(warning.detail, /5 history URLs/);
+  });
+
+  it('never writes to the source database', async () => {
+    const source = await makeTempDir();
+    const target = await makeTempDir();
+    const historyPath = writeChromiumHistory(source, 2);
+
+    await assertSourceUnchanged(historyPath, () =>
+      migrateBetween(migrateHistory, source, target)
+    );
+  });
+
+  it('reports a skip when there is no History database', async () => {
+    const source = await makeTempDir();
+    const target = await makeTempDir();
+    const report = await migrateBetween(migrateHistory, source, target);
+    assertNothingMigrated(report, 'source-missing');
+  });
+});

package/tests/unit/browser/migration/index.test.js

@@ -0,0 +1,117 @@
+// feature-parity: migration.profile
+import assert from 'node:assert';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+
+import {
+  ALL_DATA_CLASSES,
+  migrateProfile,
+} from '../../../../src/browser/migration/index.js';
+import { deriveChromiumCookieKey } from '../../../../src/browser/browser-cookie-crypto.js';
+import {
+  readMigratedLogins,
+  writeFirefoxCookies,
+  writeFirefoxLogins,
+  writeFirefoxPlaces,
+} from '../../../helpers/migration-fixtures.js';
+import { useTempDirectories } from '../../../helpers/temp-directory.js';
+
+const makeTempDir = useTempDirectories('bc-orch-');
+
+describe('migrateProfile', () => {
+  it('validates required options', async () => {
+    await assert.rejects(
+      () => migrateProfile({ to: '/tmp/x' }),
+      /from\.browser/
+    );
+    await assert.rejects(
+      () => migrateProfile({ from: { browser: 'chrome' } }),
+      /target directory/
+    );
+  });
+
+  it('migrates a Firefox source and returns the documented report shape', async () => {
+    const source = await makeTempDir();
+    const target = await makeTempDir();
+    await writeFirefoxCookies(source, [
+      { name: 'a', value: '1', host: '.example.com' },
+    ]);
+    writeFirefoxPlaces(source, { withMenuBookmark: false });
+    await writeFirefoxLogins(source, {
+      entries: [
+        { hostname: 'https://a.example', username: 'alice', password: 'pw' },
+      ],
+    });
+
+    const targetKey = deriveChromiumCookieKey('target-pass', 'linux');
+    const report = await migrateProfile({
+      from: { browser: 'firefox', userDataDir: source },
+      to: target,
+      platform: 'linux',
+      keys: { targetKey, targetPrefix: 'v11' },
+    });
+
+    // Exact report shape.
+    assert.deepEqual(
+      Object.keys(report.migrated).sort(),
+      [...ALL_DATA_CLASSES].sort()
+    );
+    assert.equal(report.source.browser, 'firefox');
+    assert.equal(report.target, target);
+    assert.ok(Array.isArray(report.skipped));
+    assert.ok(Array.isArray(report.warnings));
+
+    assert.equal(report.migrated.cookies, 1);
+    assert.equal(report.migrated.bookmarks, 1);
+    assert.equal(report.migrated.passwords, 1);
+    // Firefox history cannot be migrated into Chrome's schema.
+    assert.equal(report.migrated.history, 0);
+    assert.equal(report.migrated.preferences, 0);
+    assert.equal(report.migrated.extensions, 0);
+
+    // Cookies are returned for CDP seeding, not written to disk.
+    assert.equal(report.cookies[0].domain, '.example.com');
+
+    assert.equal(readMigratedLogins(target, targetKey)[0].password, 'pw');
+  });
+
+  it('honours the include filter', async () => {
+    const source = await makeTempDir();
+    const target = await makeTempDir();
+    writeFirefoxPlaces(source, { withMenuBookmark: false });
+    await writeFirefoxCookies(source, [
+      { name: 'a', value: '1', host: '.example.com' },
+    ]);
+
+    const report = await migrateProfile({
+      from: { browser: 'firefox', userDataDir: source },
+      to: target,
+      include: ['bookmarks'],
+      platform: 'linux',
+    });
+    assert.equal(report.migrated.bookmarks, 1);
+    assert.equal(report.migrated.cookies, 0);
+    await assert.rejects(() => readFile(path.join(target, 'Login Data')));
+  });
+
+  it('skips passwords with a warning when no target key is available on Windows', async () => {
+    const source = await makeTempDir();
+    const target = await makeTempDir();
+    writeFirefoxPlaces(source, { withMenuBookmark: false });
+
+    const report = await migrateProfile({
+      from: { browser: 'firefox', userDataDir: source },
+      to: target,
+      include: ['passwords'],
+      platform: 'win32',
+    });
+    assert.equal(report.migrated.passwords, 0);
+    assert.ok(
+      report.skipped.some(
+        (s) => s.type === 'passwords' && s.reason === 'target-key-unavailable'
+      )
+    );
+    assert.equal(report.warnings[0].reason, 'target-key-unavailable');
+  });
+});