ike-weblca-html 2.2.20 → 2.2.21

package/tests/run-tests.js

@@ -0,0 +1,489 @@
+const assert = require('assert')
+const fs = require('fs')
+const path = require('path')
+const babel = require('@babel/core')
+
+function loadSourceModule(relativePath) {
+  const filename = path.resolve(__dirname, '..', relativePath)
+  const source = fs.readFileSync(filename, 'utf8')
+  const transformed = babel.transformSync(source, {
+    babelrc: false,
+    configFile: false,
+    filename,
+    presets: [
+      [
+        require.resolve('@babel/preset-env'),
+        { targets: { node: '14.20.1' }, modules: 'commonjs' },
+      ],
+    ],
+  })
+  const loadedModule = { exports: {} }
+  const evaluate = new Function('module', 'exports', transformed.code)
+  evaluate(loadedModule, loadedModule.exports)
+  return loadedModule.exports
+}
+
+function createWindow({ origin, parentOrigin }) {
+  const listeners = new Map()
+  const parentMessages = []
+  const frames = []
+  const windowObject = {
+    location: { origin },
+    document: {
+      referrer: parentOrigin ? `${parentOrigin}/database` : '',
+      querySelectorAll(selector) {
+        if (selector !== 'iframe') return []
+        return frames
+      },
+    },
+    addEventListener(type, listener) {
+      const typeListeners = listeners.get(type) || []
+      typeListeners.push(listener)
+      listeners.set(type, typeListeners)
+    },
+    removeEventListener(type, listener) {
+      const typeListeners = listeners.get(type) || []
+      listeners.set(
+        type,
+        typeListeners.filter((item) => item !== listener)
+      )
+    },
+    async emit(type, event) {
+      const typeListeners = listeners.get(type) || []
+      await Promise.all(typeListeners.map((listener) => listener(event)))
+    },
+  }
+
+  if (parentOrigin) {
+    windowObject.parent = {
+      postMessage(message, targetOrigin) {
+        parentMessages.push({ message, targetOrigin })
+      },
+    }
+    windowObject.top = windowObject.parent
+  } else {
+    windowObject.parent = windowObject
+    windowObject.top = windowObject
+  }
+
+  return {
+    windowObject,
+    parentMessages,
+    addFrameSource(source, src) {
+      frames.push({ contentWindow: source, src })
+    },
+  }
+}
+
+const tests = []
+
+function test(name, run) {
+  tests.push({ name, run })
+}
+
+const bridge = loadSourceModule('src/js/HeaderAuthBridge.js')
+
+test('父页面只向受信任 iframe 返回不含 token 的认证快照', async () => {
+  const { windowObject, addFrameSource } = createWindow({
+    origin: 'https://www.weblca.net',
+  })
+  const trustedMessages = []
+  const dynamicProjectMessages = []
+  const untrustedMessages = []
+  const spoofedMessages = []
+  const dispose = bridge.installParentAuthBridge({
+    windowObject,
+    getAuthState: async () => ({
+      loggedIn: true,
+      token: 'Bearer secret-must-not-leak',
+      userSummary: { userName: '测试用户', userId: 'user-1' },
+      messageCount: 3,
+    }),
+  })
+
+  await windowObject.emit('message', {
+    origin: 'https://evil.example',
+    source: {
+      postMessage(message, targetOrigin) {
+        untrustedMessages.push({ message, targetOrigin })
+      },
+    },
+    data: { type: bridge.AUTH_REQUEST, requestId: 'untrusted-request' },
+  })
+
+  await windowObject.emit('message', {
+    origin: 'https://www.efootprint.net',
+    source: {
+      postMessage(message, targetOrigin) {
+        spoofedMessages.push({ message, targetOrigin })
+      },
+    },
+    data: { type: bridge.AUTH_REQUEST, requestId: 'spoofed-request' },
+  })
+
+  const trustedSource = {
+    postMessage(message, targetOrigin) {
+      trustedMessages.push({ message, targetOrigin })
+    },
+  }
+  addFrameSource(trustedSource, 'https://www.efootprint.net/database')
+  await windowObject.emit('message', {
+    origin: 'https://www.efootprint.net',
+    source: trustedSource,
+    data: { type: bridge.AUTH_REQUEST, requestId: 'trusted-request' },
+  })
+
+  const dynamicProjectSource = {
+    postMessage(message, targetOrigin) {
+      dynamicProjectMessages.push({ message, targetOrigin })
+    },
+  }
+  addFrameSource(
+    dynamicProjectSource,
+    'https://unlisted-product.customer-example.org/embedded-page'
+  )
+  await windowObject.emit('message', {
+    origin: 'https://unlisted-product.customer-example.org',
+    source: dynamicProjectSource,
+    data: { type: bridge.AUTH_REQUEST, requestId: 'dynamic-request' },
+  })
+
+  assert.strictEqual(untrustedMessages.length, 0)
+  assert.strictEqual(spoofedMessages.length, 0)
+  assert.strictEqual(trustedMessages.length, 1)
+  assert.strictEqual(dynamicProjectMessages.length, 1)
+  assert.strictEqual(
+    dynamicProjectMessages[0].targetOrigin,
+    'https://unlisted-product.customer-example.org'
+  )
+  assert.strictEqual(trustedMessages[0].targetOrigin, 'https://www.efootprint.net')
+  assert.deepStrictEqual(trustedMessages[0].message, {
+    type: bridge.AUTH_RESPONSE,
+    requestId: 'trusted-request',
+    authState: {
+      loggedIn: true,
+      userSummary: { userName: '测试用户', userId: 'user-1' },
+      messageCount: 3,
+    },
+  })
+
+  dispose()
+})
+
+test('iframe Header 只接受真实父页面返回的对应认证响应', async () => {
+  const { windowObject, parentMessages } = createWindow({
+    origin: 'https://www.efootprint.net',
+    parentOrigin: 'https://www.weblca.net',
+  })
+  const receivedStates = []
+  const connection = bridge.connectIframeHeaderAuth({
+    windowObject,
+    onAuthState: (authState) => receivedStates.push(authState),
+  })
+
+  assert.strictEqual(parentMessages.length, 1)
+  assert.strictEqual(parentMessages[0].targetOrigin, 'https://www.weblca.net')
+  assert.strictEqual(parentMessages[0].message.type, bridge.AUTH_REQUEST)
+  const requestId = parentMessages[0].message.requestId
+
+  await windowObject.emit('message', {
+    origin: 'https://fake.weblca.net',
+    source: windowObject.parent,
+    data: {
+      type: bridge.AUTH_RESPONSE,
+      requestId,
+      authState: { loggedIn: true },
+    },
+  })
+  await windowObject.emit('message', {
+    origin: 'https://www.weblca.net',
+    source: {},
+    data: {
+      type: bridge.AUTH_RESPONSE,
+      requestId,
+      authState: { loggedIn: true },
+    },
+  })
+  await windowObject.emit('message', {
+    origin: 'https://www.weblca.net',
+    source: windowObject.parent,
+    data: {
+      type: bridge.AUTH_RESPONSE,
+      requestId,
+      authState: {
+        loggedIn: true,
+        userSummary: { userName: '父页面用户' },
+        messageCount: 5,
+      },
+    },
+  })
+
+  assert.deepStrictEqual(receivedStates, [
+    {
+      loggedIn: true,
+      userSummary: { userName: '父页面用户' },
+      messageCount: 5,
+    },
+  ])
+
+  connection.dispose()
+})
+
+test('未预先列出的父项目也使用 referrer 的精确 origin 完成认证握手', async () => {
+  const { windowObject, parentMessages } = createWindow({
+    origin: 'https://embedded.customer-example.org',
+    parentOrigin: 'https://portal.customer-example.org',
+  })
+  const receivedStates = []
+  const connection = bridge.connectIframeHeaderAuth({
+    windowObject,
+    onAuthState: (authState) => receivedStates.push(authState),
+  })
+
+  assert.strictEqual(connection.connected, false)
+  assert.strictEqual(parentMessages.length, 1)
+  assert.strictEqual(
+    parentMessages[0].targetOrigin,
+    'https://portal.customer-example.org'
+  )
+  const requestId = parentMessages[0].message.requestId
+
+  await windowObject.emit('message', {
+    origin: 'https://portal.customer-example.org',
+    source: windowObject.parent,
+    data: {
+      type: bridge.AUTH_RESPONSE,
+      requestId,
+      authState: { loggedIn: true, userSummary: { userName: '动态项目用户' } },
+    },
+  })
+
+  assert.strictEqual(receivedStates.length, 1)
+  assert.strictEqual(receivedStates[0].userSummary.userName, '动态项目用户')
+  assert.strictEqual(connection.connected, true)
+  connection.dispose()
+})
+
+test('iframe Header 的导航和退出动作只发送给已验证父页面', async () => {
+  const { windowObject, parentMessages } = createWindow({
+    origin: 'https://www.efootprint.net',
+    parentOrigin: 'https://www.weblca.net',
+  })
+  const connection = bridge.connectIframeHeaderAuth({
+    windowObject,
+    onAuthState() {},
+  })
+
+  const requestId = parentMessages[0].message.requestId
+  await windowObject.emit('message', {
+    origin: 'https://www.weblca.net',
+    source: windowObject.parent,
+    data: {
+      type: bridge.AUTH_RESPONSE,
+      requestId,
+      authState: { loggedIn: true },
+    },
+  })
+
+  connection.navigate('https://www.weblca.net/content/selfCenter')
+  connection.logout()
+
+  assert.strictEqual(parentMessages.length, 3)
+  assert.deepStrictEqual(parentMessages[1], {
+    message: {
+      type: bridge.NAVIGATE_REQUEST,
+      url: 'https://www.weblca.net/content/selfCenter',
+    },
+    targetOrigin: 'https://www.weblca.net',
+  })
+  assert.deepStrictEqual(parentMessages[2], {
+    message: { type: bridge.LOGOUT_REQUEST },
+    targetOrigin: 'https://www.weblca.net',
+  })
+
+  connection.dispose()
+})
+
+test('父页面只执行受信任 iframe 发出的平台内导航和退出动作', async () => {
+  const { windowObject, addFrameSource } = createWindow({
+    origin: 'https://www.weblca.net',
+  })
+  const navigations = []
+  let logoutCount = 0
+  const dispose = bridge.installParentAuthBridge({
+    windowObject,
+    getAuthState: () => ({ loggedIn: true }),
+    onNavigate: (url) => navigations.push(url),
+    onLogout: () => {
+      logoutCount += 1
+    },
+  })
+  const source = { postMessage() {} }
+  addFrameSource(source, 'https://www.efootprint.net/database')
+
+  await windowObject.emit('message', {
+    origin: 'https://evil.example',
+    source,
+    data: {
+      type: bridge.NAVIGATE_REQUEST,
+      url: 'https://www.weblca.net/content/selfCenter',
+    },
+  })
+  await windowObject.emit('message', {
+    origin: 'https://www.efootprint.net',
+    source,
+    data: {
+      type: bridge.NAVIGATE_REQUEST,
+      url: 'https://evil.example/phishing',
+    },
+  })
+  await windowObject.emit('message', {
+    origin: 'https://www.efootprint.net',
+    source,
+    data: {
+      type: bridge.NAVIGATE_REQUEST,
+      url: 'https://www.weblca.net/content/selfCenter',
+    },
+  })
+  await windowObject.emit('message', {
+    origin: 'https://www.efootprint.net',
+    source,
+    data: { type: bridge.LOGOUT_REQUEST },
+  })
+
+  assert.deepStrictEqual(navigations, [
+    'https://www.weblca.net/content/selfCenter',
+  ])
+  assert.strictEqual(logoutCount, 1)
+
+  dispose()
+})
+
+test('没有认证响应的旧父项目仍保留 wildcard navigate 兼容消息', () => {
+  const { windowObject, parentMessages } = createWindow({
+    origin: 'https://legacy-child.unknown.example',
+    parentOrigin: 'https://legacy-parent.unknown.example',
+  })
+  const url = 'https://www.weblca.net/content/selfCenter'
+  const connection = bridge.connectIframeHeaderAuth({
+    windowObject,
+    onAuthState() {},
+  })
+
+  const mode = bridge.navigateWithParentFallback({
+    windowObject,
+    connection,
+    url,
+  })
+
+  assert.strictEqual(mode, 'legacy')
+  assert.strictEqual(windowObject.location.href, url)
+  assert.strictEqual(parentMessages.length, 2)
+  assert.strictEqual(parentMessages[0].message.type, bridge.AUTH_REQUEST)
+  assert.strictEqual(
+    parentMessages[0].targetOrigin,
+    'https://legacy-parent.unknown.example'
+  )
+  assert.deepStrictEqual(parentMessages[1], {
+    message: { type: 'navigate', url },
+    targetOrigin: '*',
+  })
+  connection.dispose()
+})
+
+test('父页面从 Cookie 生成 Header 所需的最小认证快照', () => {
+  const cookieValues = {
+    token: 'Bearer parent-token',
+    userInfo: JSON.stringify({
+      userName: 'Cookie 用户',
+      relationId: 'relation-1',
+      profileImg: 'https://images.example/avatar.png',
+      accountCount: 2,
+      groupCount: 3,
+      datasetCount: 4,
+      materialCount: 5,
+      messageCount: 6,
+      token: 'Bearer nested-token-must-not-leak',
+      roles: ['admin'],
+    }),
+  }
+  const authState = bridge.readCookieAuthState({
+    get(key) {
+      return cookieValues[key]
+    },
+  })
+
+  assert.deepStrictEqual(authState, {
+    loggedIn: true,
+    userSummary: {
+      userName: 'Cookie 用户',
+      relationId: 'relation-1',
+      profileImg: 'https://images.example/avatar.png',
+      accountCount: 2,
+      groupCount: 3,
+      datasetCount: 4,
+      materialCount: 5,
+    },
+    messageCount: 6,
+  })
+})
+
+test('iframe Header 收到认证快照后立即更新登录展示数据', () => {
+  let updateCount = 0
+  const header = {
+    isLoggedIn: false,
+    userSummary: null,
+    userName: '',
+    userId: '',
+    userAvatar: '',
+    userStats: {},
+    messageCount: 0,
+    requestUpdate() {
+      updateCount += 1
+    },
+  }
+
+  bridge.applyAuthStateToHeader(header, {
+    loggedIn: true,
+    userSummary: {
+      realName: '响应式用户',
+      userId: 'user-2',
+      avatar: 'https://images.example/user-2.png',
+      accountCount: 7,
+      groupCount: 8,
+      datasetCount: 9,
+      materialCount: 10,
+    },
+    messageCount: 11,
+  })
+
+  assert.strictEqual(header.isLoggedIn, true)
+  assert.strictEqual(header.userName, '响应式用户')
+  assert.strictEqual(header.userId, 'user-2')
+  assert.strictEqual(header.userAvatar, 'https://images.example/user-2.png')
+  assert.deepStrictEqual(header.userStats, {
+    account: 7,
+    group: 8,
+    database: 9,
+    databank: 10,
+  })
+  assert.strictEqual(header.messageCount, 11)
+  assert.strictEqual(updateCount, 1)
+})
+
+async function main() {
+  let failed = 0
+  for (const item of tests) {
+    try {
+      await item.run()
+      console.log(`PASS ${item.name}`)
+    } catch (error) {
+      failed += 1
+      console.error(`FAIL ${item.name}`)
+      console.error(error && error.stack ? error.stack : error)
+    }
+  }
+  if (failed > 0) process.exitCode = 1
+}
+
+main()