claude-aws-mfa 1.1.0 → 1.2.1

package/test/dialog-html.test.ts

@@ -1,5 +1,32 @@
 import { describe, test, expect } from "bun:test";
-import { buildHtml, FIELDS, FIELD_PATTERNS } from "../src/dialog-html";
+import { buildHtml, buildErrorHtml, FIELDS, FIELD_PATTERNS } from "../src/dialog-html";
+
+describe("profile banner", () => {
+  const profile = { name: "work", path: "~/.claude-profiles/work" };
+
+  test("is shown for the default profile too, never blank", () => {
+    for (const html of [buildHtml({}), buildErrorHtml("boom")]) {
+      expect(html).toContain('class="profile"');
+      expect(html).toContain("<b>default</b>");
+      expect(html).toContain("~/.claude");
+    }
+  });
+
+  test("names the profile in both the credential and error dialogs", () => {
+    for (const html of [buildHtml({}, profile), buildErrorHtml("boom", profile)]) {
+      expect(html).toContain('class="profile"');
+      expect(html).toContain("<b>work</b>");
+      expect(html).toContain("~/.claude-profiles/work");
+    }
+  });
+
+  test("escapes the profile name and path", () => {
+    const html = buildHtml({}, { name: '<img src=x onerror="alert(1)">', path: "/a&b" });
+    expect(html).not.toContain("<img src=x");
+    expect(html).toContain("&lt;img");
+    expect(html).toContain("/a&amp;b");
+  });
+});
 
 describe("buildHtml", () => {
   const config = {
@@ -161,3 +188,28 @@ describe("buildHtml", () => {
     expect(html).toContain("currentMode()");
   });
 });
+
+describe("buildErrorHtml", () => {
+  test("produces valid HTML with doctype", () => {
+    const html = buildErrorHtml("Something went wrong");
+    expect(html).toStartWith("<!DOCTYPE html>");
+    expect(html).toContain("</html>");
+  });
+
+  test("includes the message text", () => {
+    const html = buildErrorHtml("STS AssumeRole failed: AccessDenied");
+    expect(html).toContain("STS AssumeRole failed: AccessDenied");
+  });
+
+  test("has an OK button", () => {
+    const html = buildErrorHtml("error");
+    expect(html).toContain("_ok()");
+  });
+
+  test("escapes HTML special characters in the message", () => {
+    const html = buildErrorHtml('<script>alert(1)</script> & "quoted"');
+    expect(html).not.toContain("<script>alert(1)</script>");
+    expect(html).toContain("&lt;script&gt;");
+    expect(html).toContain("&amp;");
+  });
+});

package/test/gui-screenshot.test.ts

@@ -41,7 +41,10 @@ describe.skipIf(!process.env.GUI_TEST)("GUI screenshot tests", () => {
     typeof import("node-screenshots").Window
   > | null = null;
 
+  let titles: string[] = [];
+
   beforeAll(async () => {
+    const start = Date.now();
     windowModule = await import("node-screenshots");
 
     mkdirSync(SCREENSHOT_DIR, { recursive: true });
@@ -52,28 +55,42 @@ describe.skipIf(!process.env.GUI_TEST)("GUI screenshot tests", () => {
       stderr: "inherit",
     });
 
-    // Poll for the window to appear (up to 20s).
-    // Window.all() may throw if the window manager hasn't registered
-    // EWMH atoms yet (e.g. _NET_CLIENT_LIST_STACKING on Linux), so
-    // we catch and retry.
-    const deadline = Date.now() + 20_000;
+    // Poll for the window to appear. The budget is 90s rather than a snug
+    // multiple of the ~8s a warm runner takes: on Windows the first WebView2
+    // launch on a fresh image bootstraps its runtime and user-data folder
+    // before any window exists, which is what made this test flaky in CI.
+    // Waiting longer costs nothing when the window shows up on schedule.
+    //
+    // Window.all() may throw if the window manager hasn't registered EWMH
+    // atoms yet (e.g. _NET_CLIENT_LIST_STACKING on Linux), so we catch and
+    // retry.
+    const deadline = Date.now() + 90_000;
     while (Date.now() < deadline) {
       try {
         const windows = windowModule.Window.all();
-        const match = windows.find((w) => {
-          try { return w.title()?.includes("Claude AWS MFA"); }
-          catch { return false; }
+        titles = windows.map((w) => {
+          try { return w.title() ?? ""; } catch { return ""; }
         });
-        if (match) {
-          foundWindow = match;
+        const i = titles.findIndex((t) => t.includes("Claude AWS MFA"));
+        if (i >= 0) {
+          foundWindow = windows[i]!;
           break;
         }
       } catch {
         // Window.all() not yet available — WM still initializing
       }
+      // A dead launcher will never produce a window; stop and let the
+      // "app launches without error" assertion report the exit code.
+      if (proc.exitCode !== null) break;
       await Bun.sleep(500);
     }
-  }, 30_000);
+    if (!foundWindow) {
+      // Without this a failure is a bare `null` — no way to tell "window never
+      // opened" from "opened under a title we didn't match".
+      console.log(`No matching window after ${Math.round((Date.now() - start) / 1000)}s.`);
+      console.log(`Launcher exitCode: ${proc.exitCode}. Visible titles: ${JSON.stringify(titles)}`);
+    }
+  }, 120_000);
 
   afterAll(() => {
     proc?.kill();

package/test/index.test.ts

@@ -11,6 +11,11 @@ describe("parseFlags", () => {
     expect(flags.cacheSession).toBeUndefined();
     expect(flags.autoMfa).toBeUndefined();
     expect(flags.singleInstanceLock).toBeUndefined();
+    expect(flags.noUi).toBe(false);
+  });
+
+  test("parses --no-ui", () => {
+    expect(parseFlags([...base, "--no-ui"]).noUi).toBe(true);
   });
 
   test("parses --setup", () => {

package/test/setup.test.ts

@@ -0,0 +1,59 @@
+import { describe, test, expect, afterEach } from "bun:test";
+import { mkdtempSync, rmSync, symlinkSync, writeFileSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { getCredentialExportCommand } from "../src/credential-export";
+import { bin } from "../package.json";
+
+const BIN_NAME = Object.keys(bin)[0];
+
+describe("getCredentialExportCommand", () => {
+  const origArgv = Bun.argv;
+  const origWhich = Bun.which;
+  let tmpDir: string;
+
+  afterEach(() => {
+    Bun.argv = origArgv;
+    Bun.which = origWhich;
+    if (tmpDir) rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  test("uses the bare bin name when it resolves via PATH to this same script (bin invoked directly)", () => {
+    tmpDir = mkdtempSync(join(tmpdir(), "claude-aws-mfa-setup-test-"));
+    const scriptTarget = join(tmpDir, "index.ts");
+    writeFileSync(scriptTarget, "");
+    // Mirrors real installed-bin behavior: the shim on PATH is a symlink whose
+    // target Bun resolves into Bun.argv[1].
+    const shim = join(tmpDir, BIN_NAME);
+    symlinkSync(scriptTarget, shim);
+
+    Bun.argv = [process.execPath, scriptTarget];
+    Bun.which = ((cmd: string) => (cmd === BIN_NAME ? shim : null)) as typeof Bun.which;
+
+    expect(getCredentialExportCommand()).toBe(BIN_NAME);
+  });
+
+  test("falls back to an explicit bun+script invocation when not resolvable via PATH", () => {
+    tmpDir = mkdtempSync(join(tmpdir(), "claude-aws-mfa-setup-test-"));
+    const scriptTarget = join(tmpDir, "index.ts");
+    writeFileSync(scriptTarget, "");
+
+    Bun.argv = [process.execPath, scriptTarget];
+    Bun.which = (() => null) as typeof Bun.which;
+
+    expect(getCredentialExportCommand()).toBe(`${process.execPath} ${scriptTarget}`);
+  });
+
+  test("falls back when PATH resolves the bin name to a different install", () => {
+    tmpDir = mkdtempSync(join(tmpdir(), "claude-aws-mfa-setup-test-"));
+    const scriptTarget = join(tmpDir, "index.ts");
+    const otherInstall = join(tmpDir, "other-index.ts");
+    writeFileSync(scriptTarget, "");
+    writeFileSync(otherInstall, "");
+
+    Bun.argv = [process.execPath, scriptTarget];
+    Bun.which = ((cmd: string) => (cmd === BIN_NAME ? otherInstall : null)) as typeof Bun.which;
+
+    expect(getCredentialExportCommand()).toBe(`${process.execPath} ${scriptTarget}`);
+  });
+});