girder 5.0.19.dev60__tar.gz → 5.0.19.dev76__tar.gz

{girder-5.0.19.dev60 → girder-5.0.19.dev76}/.circleci/config.yml

@@ -175,6 +175,11 @@ jobs:
   web-test:
     executor: py3-mongo
     resource_class: large
+    parameters:
+      browser:
+        description: "Playwright project / browser to run the web tests against"
+        type: enum
+        enum: [chromium, firefox]
     steps:
       - checkout:
           path: girder
@@ -188,20 +193,26 @@ jobs:
       - build-plugins
       - run:
           name: Install playwright browser dependencies
-          command: npm run install-browsers
+          command: npx playwright install --with-deps << parameters.browser >>
           working_directory: girder/girder/web
       - run:
-          name: Test @girder/core
-          command: npm run test
+          name: Test @girder/core (<< parameters.browser >>)
+          command: npm run test -- --project=<< parameters.browser >>
           working_directory: girder/girder/web
           environment:
             PLAYWRIGHT_WORKERS: 4
+            GIRDER_TEST_COVERAGE_DIR: ../../build/test/coverage/<< parameters.browser >>
+            GIRDER_TEST_COVERAGE_FILE: cobertura-coverage.xml
       - store_artifacts:
           path: girder/girder/web/coverage/report
-          destination: coverage
+          destination: coverage-<< parameters.browser >>
       - store_artifacts:
           path: girder/girder/web/test-results
-          destination: test-results
+          destination: test-results-<< parameters.browser >>
+      - persist_to_workspace:
+          root: /home/circleci/project
+          paths:
+            - girder/build/test/coverage/<< parameters.browser >>
 
   integration-test:
     executor: machine
@@ -316,7 +327,7 @@ jobs:
           working_directory: girder
       - run:
           name: Upload coverage
-          command: ./codecov --disable search pycov gcov --root girder --required --file build/test/coverage/py_coverage.xml build/test/coverage/cobertura-coverage.xml
+          command: ./codecov --disable search pycov gcov --root girder --required --file build/test/coverage/py_coverage.xml build/test/coverage/chromium/cobertura-coverage.xml build/test/coverage/firefox/cobertura-coverage.xml
           working_directory: girder
 
   dockers:
@@ -424,6 +435,14 @@ workflows:
             tags:
               only: /^v[0-9]+.*/
       - web-test:
+          name: web-test-chromium
+          browser: chromium
+          filters:
+            tags:
+              only: /^v[0-9]+.*/
+      - web-test:
+          name: web-test-firefox
+          browser: firefox
           filters:
             tags:
               only: /^v[0-9]+.*/
@@ -435,7 +454,8 @@ workflows:
           requires:
             - server-pytest-test
             - server-legacy-test
-            - web-test
+            - web-test-chromium
+            - web-test-firefox
             - integration-test
           filters:
             tags:

{girder-5.0.19.dev60 → girder-5.0.19.dev76}/.pre-commit-config.yaml

@@ -62,6 +62,7 @@ repos:
     rev: v0.0.18
     hooks:
       - id: circleci-config-validate
+        files: ^\.circleci/.*\.yml$
   - repo: https://github.com/asottile/pyupgrade
     rev: v3.21.2
     hooks:

{girder-5.0.19.dev60/girder.egg-info → girder-5.0.19.dev76}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: girder
-Version: 5.0.19.dev60
+Version: 5.0.19.dev76
 Summary: Web-based data management platform
 Home-page: https://girder.readthedocs.org
 Author: Kitware, Inc.

girder-5.0.19.dev76/girder/utility/_hash_state.py

@@ -0,0 +1,261 @@
+# Utility for saving and restoring the internal state of a hash object
+# so that checksums can be streamed without having to remain in memory.
+# Inspired by http://code.activestate.com/recipes/
+# 578479-save-and-restore-sha-512-internal-state/
+
+import binascii
+import ctypes
+import hashlib
+import ssl
+import sys
+
+_ver = sys.version_info
+_free_threaded = hasattr(sys, '_is_gil_enabled') and not sys._is_gil_enabled()
+_WORD = ctypes.sizeof(ctypes.c_void_p)
+
+# This is the offset to the EVP_MD_CTX structure in CPython's _hashopenssl.c
+# EVPObject.  It changed for Python 3.8 in
+# https://github.com/python/cpython/pull/16023 and again for the free-threaded
+# builds in 3.14 (which add two words to the object header) and for all builds
+# in 3.15 (which add one word).  These values are only used as a fallback on
+# platforms where we cannot safely auto-detect the layout.
+if _free_threaded:
+    _HASHLIB_EVP_STRUCT_OFFSET = 5 if _ver >= (3, 15) else 4
+else:
+    _HASHLIB_EVP_STRUCT_OFFSET = 3 if _ver >= (3, 15) else 2
+
+# Number of pointer-sized words to scan when auto-detecting the layout of
+# CPython's _hashlib.HASH object and the OpenSSL EVP_MD_CTX structure it
+# references.  The digest state has never been stored inline in the hash
+# object (since CPython 2.7.13), so it is always reachable via two levels of
+# pointers: the hash object points to an EVP_MD_CTX, which points to the
+# state data.
+_HASHLIB_OBJECT_SCAN_WORDS = 10
+_EVP_MD_CTX_SCAN_WORDS = 16
+
+# Minimum plausible heap address; anything smaller is not a real pointer.
+_MIN_VALID_ADDRESS = 0x1000
+
+# Auto-detected offsets, in units of words: (offset of the EVP_MD_CTX pointer
+# within the hash object, offset of the state data pointer within the
+# EVP_MD_CTX).  Set once the first hash object has been inspected and reused
+# for all subsequent objects, since the layout is the same for every hash
+# algorithm within a single interpreter build.
+_STATE_OFFSETS = None
+
+
+def _readPointer(address):
+    return ctypes.cast(address, ctypes.POINTER(ctypes.c_void_p))[0]
+
+
+def _getReadableAddressRanges():
+    """
+    Get the readable memory ranges of the current process, used to validate
+    candidate pointers before dereferencing them.
+
+    :returns: A list of (start, end) address tuples, or None if the platform
+        does not provide the information (in which case hardcoded offsets are
+        used instead).
+    """
+    try:
+        with open('/proc/self/maps') as mapsFile:
+            ranges = []
+            for line in mapsFile:
+                fields = line.split()
+                if 'r' not in fields[1]:
+                    continue
+                start, end = fields[0].split('-')
+                ranges.append((int(start, 16), int(end, 16)))
+            return ranges
+    except (OSError, IndexError, ValueError):
+        return None
+
+
+def _isValidAddress(ranges, address, size):
+    """
+    Check that an address range is safe to read without segfaulting.
+    """
+    if not address or address < _MIN_VALID_ADDRESS:
+        return False
+    return any(start <= address and address + size <= end for start, end in ranges)
+
+
+def _locateStateDataAddress(hashObject, initVectorFirstWord, stateSize):
+    """
+    Find the address of the internal hash state of a hash object.
+
+    When possible, this is done by scanning the hash object for a pointer to
+    an OpenSSL EVP_MD_CTX and scanning that for a pointer to memory that
+    begins with the algorithm's initialization vector.  This avoids depending
+    on hardcoded struct offsets, which CPython has repeatedly changed (see
+    the fallback offsets below the imports).  On platforms where memory
+    ranges cannot be enumerated, the hardcoded offsets are used instead.
+
+    :param hashObject: A hashlib hash object backed by OpenSSL
+        (_hashlib.HASH).
+    :param initVectorFirstWord: The first eight bytes of the digest state of a
+        freshly initialized hash object of this algorithm.
+    :param stateSize: The size in bytes of the digest state.
+    :return: The address of the digest state, or None if it could not be
+        located.
+    """
+    global _STATE_OFFSETS
+    objectAddress = id(hashObject)
+
+    if _STATE_OFFSETS is not None:
+        objectOffset, ctxOffset = _STATE_OFFSETS
+        ctxAddress = _readPointer(objectAddress + objectOffset * _WORD)
+        return _readPointer(ctxAddress + ctxOffset * _WORD)
+
+    ranges = _getReadableAddressRanges()
+    if ranges is None:
+        # Platforms without /proc/self/maps, such as macOS and Windows.
+        ctxAddress = _readPointer(objectAddress + _HASHLIB_EVP_STRUCT_OFFSET * _WORD)
+        if ssl._OPENSSL_API_VERSION < (3, 0):
+            # OpenSSL 1.x
+            return _readPointer(ctxAddress + 3 * _WORD)
+        # OpenSSL 3.x
+        return _readPointer(ctxAddress + 7 * _WORD)
+
+    for objectOffset in range(2, _HASHLIB_OBJECT_SCAN_WORDS):
+        ctxAddress = _readPointer(objectAddress + objectOffset * _WORD)
+        if not _isValidAddress(ranges, ctxAddress, _EVP_MD_CTX_SCAN_WORDS * _WORD):
+            continue
+        for ctxOffset in range(_EVP_MD_CTX_SCAN_WORDS):
+            stateAddress = _readPointer(ctxAddress + ctxOffset * _WORD)
+            if not _isValidAddress(ranges, stateAddress, stateSize):
+                continue
+            if ctypes.cast(
+                stateAddress, ctypes.POINTER(ctypes.c_char)
+            )[:8] == initVectorFirstWord:
+                _STATE_OFFSETS = (objectOffset, ctxOffset)
+                return stateAddress
+    return None
+
+
+def _getStateDataPointer(hashObject, hashInfo):
+    """
+    Get a pointer to the internal hash state of a hash object.
+
+    :param hashObject: A hashlib hash object.
+    :param hashInfo: The _HashInfo instance describing the hash algorithm.
+    :return: A ctypes pointer to the internal hash state.
+    :rtype: ctypes.POINTER(ctypes.c_char)
+    """
+    stateAddress = _locateStateDataAddress(
+        hashObject, hashInfo.initVectorFirstWord, hashInfo.stateSize)
+    if stateAddress is None:
+        raise RuntimeError(
+            'Could not locate the internal state of the %s hash object. This module '
+            'requires a CPython build with OpenSSL-backed hashlib.' % hashInfo.name)
+    return ctypes.cast(stateAddress, ctypes.POINTER(ctypes.c_char))
+
+
+_HASH_INFOS = {}
+
+
+class _HashInfo:
+    def __init__(self, type, stateSize, initVectorFirstWord):
+        self.type = type
+        self.stateSize = stateSize
+        self.initVectorFirstWord = initVectorFirstWord
+
+        # Instantiate to get the name and do a sanity check
+        instance = self.type()
+        self.name = instance.name
+
+        stateDataPointer = _getStateDataPointer(instance, self)
+        assert stateDataPointer[:8] == initVectorFirstWord
+
+        _HASH_INFOS[self.name] = self
+
+
+_HashInfo(
+    type=hashlib.md5,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/md5/md5.h#L100
+    stateSize=92,
+    # Found empirically
+    initVectorFirstWord=b'\x01\x23\x45\x67\x89\xab\xcd\xef'
+)
+_HashInfo(
+    type=hashlib.sha1,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha/sha.h#L100
+    stateSize=96,
+    # Found empirically
+    initVectorFirstWord=b'\x01\x23\x45\x67\x89\xab\xcd\xef'
+)
+_HashInfo(
+    type=hashlib.sha224,
+    # Uses the same struct as sha256
+    stateSize=112,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha256.c#L22
+    initVectorFirstWord=b'\xd8\x9e\x05\xc1\x07\xd5\x7c\x36'
+)
+_HashInfo(
+    type=hashlib.sha256,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha/sha.h#L135
+    stateSize=112,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha/sha256.c#L33
+    initVectorFirstWord=b'\x67\xe6\x09\x6a\x85\xae\x67\xbb'
+)
+_HashInfo(
+    type=hashlib.sha384,
+    # Uses the same struct as sha512
+    stateSize=216,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha/sha512.c#L64
+    initVectorFirstWord=b'\xd8\x9e\x05\xc1\x5d\x9d\xbb\xcb'
+)
+_HashInfo(
+    type=hashlib.sha512,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha/sha.h#L182
+    stateSize=216,
+    # github.com/openssl/openssl/blob/OpenSSL_1_0_1f/crypto/sha/sha512.c#L80
+    initVectorFirstWord=b'\x08\xc9\xbc\xf3\x67\xe6\x09\x6a'
+)
+
+
+def serialize(hashObject):
+    """
+    Serializes the internal state of the hash object passed in. Calling
+    restore() on the serialized value afterward will return an equivalent
+    hash object to the one passed.
+
+    :param hashObject: The hash object to serialize.
+    :type hashObject: _hashlib.HASH
+    :returns: A binary string representing the serialized state.
+    """
+    hashInfo = _HASH_INFOS[hashObject.name]
+    stateDataPointer = _getStateDataPointer(hashObject, hashInfo)
+    return stateDataPointer[:hashInfo.stateSize]
+
+
+def restore(oldStateData, hashName):
+    """
+    Unserializes a hash object from a binary string created by the
+    serialize() method in this module.
+
+    :param oldStateData: The serialized state.
+    :type oldStateData: binary string
+    :param hashName: The name of the hash algorithm type.
+    :type hashName: str
+    :returns: A hash object in the same state as the one that serialize()
+              was called on.
+    """
+    hashInfo = _HASH_INFOS[hashName]
+    assert len(oldStateData) == hashInfo.stateSize
+
+    hashObject = hashInfo.type()
+    stateDataPointer = _getStateDataPointer(hashObject, hashInfo)
+
+    for i, byte in enumerate(oldStateData):
+        stateDataPointer[i] = byte
+
+    return hashObject
+
+
+def serializeHex(hashObject):
+    return binascii.b2a_hex(serialize(hashObject))
+
+
+def restoreHex(oldHexStateData, hashName):
+    return restore(binascii.a2b_hex(oldHexStateData), hashName)

{girder-5.0.19.dev60 → girder-5.0.19.dev76}/girder/web/tests/playwright-teardown.ts

@@ -33,7 +33,7 @@ export default async (_config: PlaywrightTestConfig) => {
 
   report.execute(context);
 
-  const outputDir = '../../build/test/coverage';
+  const outputDir = process.env.GIRDER_TEST_COVERAGE_DIR || '../../build/test/coverage';
   await fs.mkdir(outputDir, { recursive: true });
   const contextXml = libReport.createContext({
     dir: outputDir,
@@ -41,7 +41,7 @@ export default async (_config: PlaywrightTestConfig) => {
     coverageMap,
   });
   const xmlReport = reports.create('cobertura', {
-    file: 'cobertura-coverage.xml',
+    file: process.env.GIRDER_TEST_COVERAGE_FILE || 'cobertura-coverage.xml',
     skipEmpty: false,
   });
   xmlReport.execute(contextXml);

girder-5.0.19.dev76/girder/web/tests/spec/plugin_autojoin.spec.ts

@@ -0,0 +1,100 @@
+import { expect, Page, test } from '@playwright/test';
+
+import { setupServer } from '../server';
+import { createUser, waitForIdlePage } from '../util';
+
+/**
+ * Ported from 3.x-maintenance: plugins/autojoin/plugin_tests/autojoinSpec.js
+ * Tests for the Auto Join plugin's configuration page and its effect on new
+ * users.
+ */
+
+/**
+ * Navigate to the groups list page.
+ */
+async function gotoGroupsPage(page: Page) {
+    await page.locator('a.g-nav-link[g-target="groups"]').click();
+    await expect(page.locator('.g-group-search-form .g-search-field')).toBeVisible();
+}
+
+/**
+ * Create a private group and wait for its page to load. Assumes the user is
+ * logged in.
+ */
+async function createGroup(page: Page, name: string) {
+    await gotoGroupsPage(page);
+    await expect(page.locator('.g-group-create-button')).toBeVisible();
+    await page.locator('.g-group-create-button').click();
+    await expect(page.locator('#g-name')).toBeVisible();
+    await page.locator('#g-name').fill(name);
+    await page.locator('.g-save-group').click();
+    await waitForIdlePage(page);
+    await expect(page.locator('.g-group-name')).toHaveText(name);
+}
+
+/**
+ * Navigate to the Auto Join plugin configuration page.
+ */
+async function gotoAutojoinConfig(page: Page) {
+    await page.locator('a.g-nav-link[g-target="admin"]').click();
+    await page.locator('.g-plugins-config').click();
+    const configLink = page.locator('.g-plugin-list-item[data-name="autojoin"] a.g-plugin-config-link');
+    await expect(configLink).toBeVisible();
+    await configLink.click();
+    // Wait for the group collection to populate the group select.
+    await expect(page.locator('#g-autojoin-group > option')).toHaveCount(4);
+}
+
+/**
+ * Fill out and submit the "add rule" row of the Auto Join configuration page.
+ */
+async function addRule(page: Page, pattern: string, groupName: string, level: string) {
+    await page.locator('#g-autojoin-pattern').fill(pattern);
+    await page.locator('#g-autojoin-group').selectOption({ label: groupName });
+    await page.locator('#g-autojoin-level').selectOption(level);
+    await page.locator('#g-autojoin-add').click();
+}
+
+test.describe('Test the auto join plugin', () => {
+    setupServer();
+
+    test('configure auto join rules', async ({ page }) => {
+        await createUser(page, 'admin', 'admin@girder.test', 'Joe', 'Admin', 'password');
+
+        await createGroup(page, 'group1');
+        await createGroup(page, 'group2');
+        await createGroup(page, 'group3');
+
+        await gotoAutojoinConfig(page);
+
+        await addRule(page, '@girder1.test', 'group1', '2');
+        await addRule(page, '@girder2.test', 'group2', '1');
+        await addRule(page, '@girder2.test', 'group3', '0');
+
+        await expect(page.locator('.g-autojoin-container tbody tr')).toHaveCount(3);
+        await expect(page.locator('.g-autojoin-container')).toContainText('@girder1.test');
+        await expect(page.locator('.g-autojoin-container')).toContainText('@girder2.test');
+
+        await page.locator('#g-autojoin-save').click();
+        await expect(page.locator('#g-alerts-container')).toContainText('Settings saved');
+        await waitForIdlePage(page);
+    });
+
+    test('auto join a user whose email matches the girder2 rule', async ({ page }) => {
+        await createUser(page, 'user1', 'user1@girder2.test', 'Joe', 'User', 'password');
+
+        await gotoGroupsPage(page);
+        await expect(page.locator('.g-group-title', { hasText: 'group1' })).toHaveCount(0);
+        await expect(page.locator('.g-group-title', { hasText: 'group2' })).toHaveCount(1);
+        await expect(page.locator('.g-group-title', { hasText: 'group3' })).toHaveCount(1);
+    });
+
+    test('auto join a user whose email matches the girder1 rule', async ({ page }) => {
+        await createUser(page, 'user2', 'user2@girder1.test', 'Joe', 'User', 'password');
+
+        await gotoGroupsPage(page);
+        await expect(page.locator('.g-group-title', { hasText: 'group1' })).toHaveCount(1);
+        await expect(page.locator('.g-group-title', { hasText: 'group2' })).toHaveCount(0);
+        await expect(page.locator('.g-group-title', { hasText: 'group3' })).toHaveCount(0);
+    });
+});

girder-5.0.19.dev76/girder/web/tests/spec/plugin_hashsum_download.spec.ts

@@ -0,0 +1,74 @@
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+import { Page, expect, test } from '@playwright/test';
+
+import { setupServer } from '../server';
+import { createUser, upload, waitForIdlePage } from '../util';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+/**
+ * Make a REST request from within the page context and await its result.
+ */
+async function asyncRestRequest(page: Page, opts: Record<string, unknown>) {
+    return await page.evaluate((requestOpts) => {
+        return new Promise((resolve, reject) => {
+            // @ts-ignore - window.girder is available at runtime
+            window.girder.rest.restRequest(requestOpts).done((resp: unknown) => {
+                resolve(resp);
+            }).fail((resp: unknown) => {
+                reject(resp);
+            });
+        });
+    }, opts);
+}
+
+test.describe('Test the hashsum download front-end', () => {
+    setupServer();
+
+    test('verify presence of key file', async ({ page }) => {
+        await createUser(page, 'admin');
+        await page.locator('#g-app-header-container').getByText('admin').click();
+        await page.locator('a.g-my-folders').click();
+        await page.getByRole('link', { name: ' Private ' }).click();
+        await upload(page, path.join(__dirname, 'data', 'ten_byte_file.txt'));
+
+        await page.getByRole('link', { name: ' ten_byte_file.txt' }).click();
+        await page.getByTitle('Show info').click();
+        await expect(page.locator('input.g-hash-textbox').first()).toHaveValue('ff3245abe317049ed1b8aa7aa2f4c4dcb8bf86f083ed67eb26b43e2fbe3ba8fdf759f9e2f46fcf2a06c2dfeddf0cedcd41a68034cd618b880785b34f759d1a69')
+    });
+});
+
+test.describe('Test the hashsum download configuration page', () => {
+    setupServer();
+
+    test('enable automatic checksum computation', async ({ page }) => {
+        await createUser(page, 'admin');
+
+        // Navigate to the plugin's admin settings page.
+        await page.locator('a.g-nav-link[g-target="admin"]').click();
+        await page.locator('.g-plugins-config').click();
+        const configLink = page.locator('.g-plugin-list-item[data-name="hashsum_download"] a.g-plugin-config-link');
+        await expect(configLink).toBeVisible();
+        await configLink.click();
+
+        const autoCompute = page.locator('#g-hashsum-download-auto-compute');
+        await expect(autoCompute).toBeVisible();
+        await expect(autoCompute).not.toBeChecked();
+        await autoCompute.check();
+
+        await page.locator('#g-hashsum-download-config-form input[type="submit"]').click();
+        await expect(page.locator('#g-alerts-container')).toContainText('Settings saved');
+        await waitForIdlePage(page);
+
+        // Verify that the setting was persisted on the server.
+        const settings = await asyncRestRequest(page, {
+            url: '/system/setting',
+            method: 'GET',
+            data: { list: JSON.stringify(['hashsum_download.auto_compute']) },
+        }) as Record<string, unknown>;
+        expect(settings['hashsum_download.auto_compute']).toBe(true);
+    });
+});

girder-5.0.19.dev76/girder/web/tests/spec/plugin_homepage.spec.ts

@@ -0,0 +1,118 @@
+import { Locator, Page, expect, test } from '@playwright/test';
+
+import { setupServer } from '../server';
+import { createUser, login, logout } from '../util';
+
+/**
+ * Ported from 3.x-maintenance: plugins/homepage/plugin_tests/homepageSpec.js
+ * Tests for the Homepage plugin's configuration page and its effect on the
+ * front page.
+ */
+
+const markdown =
+    'It\'s very easy to make some words **bold** and other words *italic* with ' +
+    'Markdown. You can even [link to Girder!](https://girder.readthedocs.io/)';
+
+/**
+ * Assert that the given container renders the expected markdown content.
+ */
+async function expectMarkdown(container: Locator) {
+    await expect(container.locator('p')).toContainText("It's very easy");
+    await expect(container.locator('strong')).toContainText('bold');
+    await expect(container.locator('em')).toContainText('italic');
+    await expect(container.locator('a[href="https://girder.readthedocs.io/"]')).toContainText('link to Girder!');
+}
+
+/**
+ * Navigate to the Homepage plugin configuration page.
+ */
+async function gotoHomepageConfig(page: Page) {
+    await page.locator('a.g-nav-link[g-target="admin"]').click();
+    await page.locator('.g-plugins-config').click();
+    const configLink = page.locator('.g-plugin-list-item[data-name="homepage"] a.g-plugin-config-link');
+    await expect(configLink).toBeVisible();
+    await configLink.click();
+    await expect(page.locator('.g-homepage-container')).toBeVisible();
+}
+
+/**
+ * Navigate back to the front page via the app title.
+ */
+async function gotoFrontPage(page: Page) {
+    await page.locator('.g-app-title').click();
+}
+
+/**
+ * Save the homepage configuration form and wait for the success alert.
+ */
+async function saveHomepageConfig(page: Page) {
+    await page.locator('#g-homepage-form input[type="submit"]').click();
+    await expect(page.locator('#g-alerts-container')).toContainText('Settings saved');
+}
+
+test.describe('Test the homepage front-end', () => {
+    setupServer();
+
+    test('exercise homepage markdown customization', async ({ page }) => {
+        await createUser(page, 'admin', 'admin@girder.test', 'Mark', 'Down', 'password');
+
+        await gotoHomepageConfig(page);
+
+        // Write markdown and verify the preview renders it.
+        await page.locator('.g-homepage-container textarea.g-markdown-text').fill(markdown);
+        await page.locator('.g-homepage-container a.g-preview-link').click();
+        await expectMarkdown(page.locator('.g-homepage-container .g-markdown-preview'));
+
+        await saveHomepageConfig(page);
+
+        // The front page body is completely replaced by the rendered markdown.
+        await gotoFrontPage(page);
+        await expectMarkdown(page.locator('#g-app-body-container'));
+    });
+
+    test('set, preview, and save welcome text and branding', async ({ page }) => {
+        await login(page, 'admin', 'password');
+
+        await gotoHomepageConfig(page);
+
+        // Clear the full-page markdown so the branding settings are used.
+        await page.locator('.g-homepage-container textarea.g-markdown-text').fill('');
+        await page.locator('.g-homepage-container a.g-preview-link').click();
+        await expect(page.locator('.g-homepage-container .g-markdown-preview')).toHaveText('Nothing to show');
+
+        // Set header, subheader, and welcome text.
+        await page.locator('#g-homepage-header').fill('Header');
+        await page.locator('#g-homepage-subheader').fill('Subheader');
+        const welcomeText = page.locator('.g-homepage-welcome-text-container textarea.g-markdown-text');
+        await welcomeText.fill(markdown);
+        await page.locator('.g-homepage-welcome-text-container a.g-preview-link').click();
+        await expectMarkdown(page.locator('.g-homepage-welcome-text-container .g-markdown-preview'));
+
+        await saveHomepageConfig(page);
+
+        // The branded front page shows the configured header/subheader and the
+        // welcome text rendered as markdown.
+        await gotoFrontPage(page);
+        await expect(page.locator('.g-frontpage-title')).toHaveText('Header');
+        await expect(page.locator('.g-frontpage-subtitle')).toHaveText('Subheader');
+        await expectMarkdown(page.locator('.g-frontpage-welcome-text-content'));
+    });
+
+    test('settings persist after reload and are visible anonymously', async ({ page }) => {
+        await login(page, 'admin', 'password');
+
+        // Configure the full-page markdown replacement.
+        await gotoHomepageConfig(page);
+        await page.locator('.g-homepage-container textarea.g-markdown-text').fill(markdown);
+        await saveHomepageConfig(page);
+
+        // Re-open the config page and verify the markdown was persisted.
+        await gotoHomepageConfig(page);
+        await expect(page.locator('.g-homepage-container textarea.g-markdown-text')).toHaveValue(markdown);
+
+        // Log out and verify the markdown still renders to anonymous users.
+        await logout(page);
+        await gotoFrontPage(page);
+        await expectMarkdown(page.locator('#g-app-body-container'));
+    });
+});