seamless-cli 0.2.0 → 0.4.0

package/verify/harness/mock-oidc.ts

@@ -0,0 +1,112 @@
+import { createHash, randomUUID } from 'crypto';
+import { createServer, IncomingMessage, Server, ServerResponse } from 'http';
+
+// Minimal OIDC identity provider for the OAuth conformance flow. The API only uses
+// the authorization code, the token exchange (PKCE), and userinfo (it does not
+// validate id_token signatures), so /authorize, /token, /userinfo is all we need.
+
+interface PendingCode {
+  codeChallenge?: string;
+  redirectUri: string;
+  profile: { sub: string; email: string };
+}
+
+const sha256Base64Url = (value: string): string =>
+  createHash('sha256').update(value).digest('base64url');
+
+function readBody(req: IncomingMessage): Promise<string> {
+  return new Promise((resolve) => {
+    let data = '';
+    req.on('data', (chunk) => (data += chunk));
+    req.on('end', () => resolve(data));
+  });
+}
+
+function sendJson(res: ServerResponse, status: number, body: unknown): void {
+  res.writeHead(status, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify(body));
+}
+
+export function startMockOidc(port: number): Server {
+  const codes = new Map<string, PendingCode>();
+  const tokens = new Map<string, { sub: string; email: string }>();
+
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? '/', `http://localhost:${port}`);
+
+    // Authorization endpoint: mint a code bound to the PKCE challenge + a fresh
+    // user, then redirect back to the app's redirect_uri with code + state.
+    if (req.method === 'GET' && url.pathname === '/authorize') {
+      const redirectUri = url.searchParams.get('redirect_uri');
+      if (!redirectUri) {
+        sendJson(res, 400, { error: 'invalid_request', error_description: 'missing redirect_uri' });
+        return;
+      }
+      const code = randomUUID();
+      codes.set(code, {
+        codeChallenge: url.searchParams.get('code_challenge') ?? undefined,
+        redirectUri,
+        profile: {
+          sub: `mock-${randomUUID()}`,
+          email: `oauth.${randomUUID().slice(0, 12)}@example.test`,
+        },
+      });
+      const location = new URL(redirectUri);
+      location.searchParams.set('code', code);
+      location.searchParams.set('state', url.searchParams.get('state') ?? '');
+      res.writeHead(302, { Location: location.toString() });
+      res.end();
+      return;
+    }
+
+    // Token endpoint: validate PKCE (S256), consume the code, issue an opaque token.
+    if (req.method === 'POST' && url.pathname === '/token') {
+      void readBody(req).then((raw) => {
+        const params = new URLSearchParams(raw);
+        const code = params.get('code') ?? '';
+        const pending = codes.get(code);
+        if (!pending) {
+          sendJson(res, 400, { error: 'invalid_grant' });
+          return;
+        }
+        codes.delete(code);
+        if (
+          pending.codeChallenge &&
+          sha256Base64Url(params.get('code_verifier') ?? '') !== pending.codeChallenge
+        ) {
+          sendJson(res, 400, { error: 'invalid_grant', error_description: 'PKCE mismatch' });
+          return;
+        }
+        const accessToken = randomUUID();
+        tokens.set(accessToken, pending.profile);
+        sendJson(res, 200, { access_token: accessToken, token_type: 'Bearer', expires_in: 3600 });
+      });
+      return;
+    }
+
+    // Userinfo endpoint: return the profile for the bearer access token.
+    if (req.method === 'GET' && url.pathname === '/userinfo') {
+      const token = (req.headers.authorization ?? '').replace(/^Bearer /, '');
+      const profile = tokens.get(token);
+      if (!profile) {
+        sendJson(res, 401, { error: 'invalid_token' });
+        return;
+      }
+      sendJson(res, 200, {
+        sub: profile.sub,
+        email: profile.email,
+        email_verified: true,
+        name: 'OAuth User',
+      });
+      return;
+    }
+
+    sendJson(res, 404, { error: 'not_found' });
+  });
+
+  // Bind on all interfaces so the API container can reach it via host.docker.internal;
+  // unref so it never keeps the Playwright process alive after the run.
+  server.listen(port, '0.0.0.0');
+  server.unref();
+  return server;
+}

package/verify/harness/package-lock.json

@@ -0,0 +1,93 @@
+{
+  "name": "seamless-verify-harness",
+  "version": "0.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "seamless-verify-harness",
+      "version": "0.0.0",
+      "devDependencies": {
+        "@playwright/test": "^1.49.0",
+        "typescript": "^5.9.3"
+      }
+    },
+    "node_modules/@playwright/test": {
+      "version": "1.61.1",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.61.1.tgz",
+      "integrity": "sha512-8nKv6+0RJSL9FE4jYOEGXnPeM/Hg12qZpmqzZjRh3qM0Y7c3z1mrOTfFLids72RDQYVh9WpLEfR5WdpNX4fkig==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.61.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/playwright": {
+      "version": "1.61.1",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.61.1.tgz",
+      "integrity": "sha512-DWnY5o3YbLWK4GovuAVwpqL+1VwGNdUGrRr++8j8PtQQzvAVZUIMjKQ90fY689sEJZJBbZVw1rXaOKSTitkzPQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.61.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.61.1",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.61.1.tgz",
+      "integrity": "sha512-h7Qlt6m4REp25qvIdvbDtVmD4LqVXfpRxhORv9L0jzETM05p4fuPJ3dKyuSXQxDSbXnmS79HAgi9589lGSpLkg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    }
+  }
+}

package/verify/harness/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "seamless-verify-harness",
+  "version": "0.0.0",
+  "private": true,
+  "description": "Playwright conformance harness driven by `seamless verify`.",
+  "scripts": {
+    "test": "playwright test",
+    "test:api": "playwright test --project=api"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.49.0",
+    "typescript": "^5.9.3"
+  }
+}

package/verify/harness/playwright.config.ts

@@ -0,0 +1,30 @@
+import { defineConfig, devices } from '@playwright/test';
+
+import { REACT_URL } from './lib/env';
+
+// One runner, multiple projects. `api` and `adapter` hit HTTP directly (no
+// browser); `react` drives chromium against the starter SPA. global-setup
+// health-gates the stack before any project runs.
+export default defineConfig({
+  testDir: '.',
+  globalSetup: './global-setup.ts',
+  timeout: 30_000,
+  expect: { timeout: 10_000 },
+  fullyParallel: false,
+  workers: 1,
+  reporter: [
+    ['list'],
+    ['./lib/matrixReporter.ts'],
+    ['junit', { outputFile: 'results/junit.xml' }],
+    ['html', { outputFolder: 'results/html', open: 'never' }],
+  ],
+  projects: [
+    { name: 'api', testMatch: /api\/.*\.spec\.ts$/ },
+    { name: 'adapter', testMatch: /adapter\/.*\.spec\.ts$/ },
+    {
+      name: 'react',
+      testMatch: /react\/.*\.spec\.ts$/,
+      use: { ...devices['Desktop Chrome'], baseURL: REACT_URL },
+    },
+  ],
+});

package/verify/harness/react/emailOtpLogin.spec.ts

@@ -0,0 +1,13 @@
+import { expect, test } from '../lib/fixtures';
+import { registerAndVerifyEmail } from '../lib/flows';
+import { signInWithEmailOtp } from '../lib/reactFlows';
+
+test.describe('email OTP login (react, browser)', { tag: '@login' }, () => {
+  test('sign in with an email one-time code -> authenticated home', async ({ page, actor }) => {
+    // Seed a verified user via the API, then sign in through the browser UI.
+    await registerAndVerifyEmail(actor.ctx, actor.email);
+
+    await signInWithEmailOtp(page, actor.email);
+    await expect(page.getByText('You are signed in')).toBeVisible();
+  });
+});

package/verify/harness/react/logout.spec.ts

@@ -0,0 +1,17 @@
+import { expect, test } from '../lib/fixtures';
+import { registerAndVerifyEmail } from '../lib/flows';
+import { signInWithEmailOtp } from '../lib/reactFlows';
+
+test.describe('logout (react, browser)', { tag: '@login' }, () => {
+  test('signing out from the account menu clears the session', async ({ page, actor }) => {
+    await registerAndVerifyEmail(actor.ctx, actor.email);
+    await signInWithEmailOtp(page, actor.email);
+
+    await page.getByRole('button', { name: 'Open account menu' }).click();
+    await page.getByRole('button', { name: 'Logout' }).click();
+
+    // Session cleared: authenticated home is gone and the auth form reappears.
+    await expect(page.getByText('You are signed in')).toBeHidden();
+    await expect(page.getByRole('heading', { name: 'Sign In' })).toBeVisible();
+  });
+});

package/verify/harness/react/magicLinkLogin.spec.ts

@@ -0,0 +1,29 @@
+import { expect, test } from '../lib/fixtures';
+import { registerAndVerifyEmail } from '../lib/flows';
+import { gotoSignIn, readCapturedCode } from '../lib/reactFlows';
+
+test.describe('magic link login (react, browser)', { tag: '@login' }, () => {
+  test('request a magic link, open it in a second tab -> original tab authenticates', async ({
+    page,
+    context,
+    actor,
+  }) => {
+    await registerAndVerifyEmail(actor.ctx, actor.email);
+
+    await gotoSignIn(page);
+    await page.locator('#identifier').fill(actor.email);
+    await page.getByRole('button', { name: 'Login', exact: true }).click();
+
+    await page.getByRole('button', { name: /Email Magic Link/ }).click();
+    await expect(page.getByRole('heading', { name: 'Check your email' })).toBeVisible();
+
+    // "Click" the emailed link in a second tab; the original tab completes via
+    // BroadcastChannel + polling (same device binding — same browser/adapter).
+    const token = await readCapturedCode(actor.email);
+    const linkTab = await context.newPage();
+    await linkTab.goto(`/verify-magiclink?token=${encodeURIComponent(token)}`);
+
+    await expect(page.getByText('You are signed in')).toBeVisible({ timeout: 15_000 });
+    await linkTab.close();
+  });
+});

package/verify/harness/react/oauth.spec.ts

@@ -0,0 +1,13 @@
+import { expect, test } from '../lib/fixtures';
+
+test.describe('OAuth login (react, browser)', { tag: '@oauth' }, () => {
+  test('continue with a provider -> IdP redirect -> signed in', async ({ page }) => {
+    await page.goto('/login');
+
+    // The provider button redirects to the (mock) IdP, which redirects back to
+    // /oauth/callback; the callback finishes the login and lands on the app.
+    await page.getByRole('button', { name: /Continue with Mock OIDC/ }).click();
+
+    await expect(page.getByText('You are signed in')).toBeVisible();
+  });
+});

package/verify/harness/react/passkeyLogin.spec.ts

@@ -0,0 +1,24 @@
+import { expect, test } from '../lib/fixtures';
+import {
+  addVirtualAuthenticator,
+  loginWithPasskey,
+  registerWithPasskey,
+} from '../lib/reactFlows';
+
+test.describe('passkey login (react, browser)', { tag: '@login' }, () => {
+  test('a registered passkey signs the user back in', async ({ page, context, actor }) => {
+    await addVirtualAuthenticator(context, page);
+
+    // Enroll a passkey, then sign out.
+    await registerWithPasskey(page, actor.email);
+    await expect(page.getByText('You are signed in')).toBeVisible();
+
+    await page.getByRole('button', { name: 'Open account menu' }).click();
+    await page.getByRole('button', { name: 'Logout' }).click();
+    await expect(page.getByText('You are signed in')).toBeHidden();
+
+    // Sign in with only the passkey (identifier -> the ceremony runs automatically).
+    await loginWithPasskey(page, actor.email);
+    await expect(page.getByText('You are signed in')).toBeVisible();
+  });
+});

package/verify/harness/react/passkeyRegister.spec.ts

@@ -0,0 +1,15 @@
+import { expect, test } from '../lib/fixtures';
+import { addVirtualAuthenticator, registerWithPasskey } from '../lib/reactFlows';
+
+test.describe('passkey registration (react, browser)', { tag: '@login' }, () => {
+  test('register, then enroll a passkey via a virtual authenticator -> signed in', async ({
+    page,
+    context,
+    actor,
+  }) => {
+    await addVirtualAuthenticator(context, page);
+
+    await registerWithPasskey(page, actor.email);
+    await expect(page.getByText('You are signed in')).toBeVisible();
+  });
+});

package/verify/harness/react/register.spec.ts

@@ -0,0 +1,18 @@
+import { expect, test } from '../lib/fixtures';
+import { enterOtp, readCapturedCode } from '../lib/reactFlows';
+
+test.describe('registration (react, browser)', { tag: '@login' }, () => {
+  test('register with just an email -> verify email OTP -> signed in', async ({ page, actor }) => {
+    await page.goto('/login');
+    await expect(page.getByRole('heading', { name: 'Create Account' })).toBeVisible();
+
+    await page.locator('#email').fill(actor.email);
+    await page.getByRole('button', { name: 'Register', exact: true }).click();
+
+    await expect(page.getByRole('heading', { name: 'Verify Your Email' })).toBeVisible();
+    await enterOtp(page, await readCapturedCode(actor.email));
+    await page.getByRole('button', { name: /Verify & Continue/ }).click();
+
+    await expect(page.getByText('You are signed in')).toBeVisible();
+  });
+});