Archived
54 lines
2.9 KiB
JavaScript
54 lines
2.9 KiB
JavaScript
|
import test from 'node:test';
|
||
|
|
import assert from 'node:assert/strict';
|
||
|
|
import {readFile} from 'node:fs/promises';
|
||
|
|
import {captureAccount, fillAccount} from '../human-api.mjs';
|
||
|
|
|
||
|
|
test('popup is only the human vault v0 surface', async () => {
|
||
|
|
const html = await readFile(new URL('../popup.html', import.meta.url), 'utf8');
|
||
|
|
assert.match(html, /My vault/);
|
||
|
|
assert.match(html, /Save autofilled login/);
|
||
|
|
assert.match(html, /browser autofill this site's login/);
|
||
|
|
assert.match(html, /Lock vault/);
|
||
|
|
assert.match(html, /Settings/);
|
||
|
|
assert.doesNotMatch(html, /id="juice-panel"/);
|
||
|
|
assert.doesNotMatch(html, /id="human-username"/);
|
||
|
|
assert.doesNotMatch(html, /id="human-password"/);
|
||
|
|
assert.doesNotMatch(html, /<iframe/);
|
||
|
|
assert.ok(!html.includes('src="popup.mjs"'));
|
||
|
|
});
|
||
|
|
|
||
|
|
test('linking mints a capability without a host permission prompt', async () => {
|
||
|
|
const source = await readFile(new URL('../human-popup.mjs', import.meta.url), 'utf8');
|
||
|
|
const manifest = JSON.parse(await readFile(new URL('../manifest.json', import.meta.url)));
|
||
|
|
assert.match(source, /world: 'ISOLATED'/);
|
||
|
|
assert.match(source, /fetch\('\/api\/human-vault\/link'/);
|
||
|
|
assert.match(source, /\[VAULT_CAPABILITY\]/);
|
||
|
|
assert.doesNotMatch(source, /chrome\.permissions\.request/);
|
||
|
|
assert.equal(manifest.optional_host_permissions, undefined);
|
||
|
|
assert.deepEqual(manifest.host_permissions, ['https://teahub.xyz/*']);
|
||
|
|
});
|
||
|
|
|
||
|
|
test('capture and fill require one clear filled same-origin login form', () => {
|
||
|
|
const old = {location:globalThis.location,document:globalThis.document,window:globalThis.window,HTMLInputElement:globalThis.HTMLInputElement,Event:globalThis.Event};
|
||
|
|
const makeInput = (type,value) => ({
|
||
|
|
type,value,disabled:false,readOnly:false,form:null,
|
||
|
|
getClientRects:()=>[{}],dispatchEvent(){}
|
||
|
|
});
|
||
|
|
const user=makeInput('email','person@example.com'), password=makeInput('password','secret');
|
||
|
|
const form={action:'https://example.com/login',querySelectorAll:()=>[user,password]};
|
||
|
|
user.form=form;password.form=form;
|
||
|
|
globalThis.location={protocol:'https:',origin:'https://example.com',href:'https://example.com/login'};
|
||
|
|
globalThis.window={top:null};globalThis.window.top=globalThis.window;
|
||
|
|
globalThis.document={querySelectorAll:selector=>selector==='input[type="password"]'?[password]:[user,password]};
|
||
|
|
globalThis.HTMLInputElement=function(){};
|
||
|
|
globalThis.HTMLInputElement.prototype={};
|
||
|
|
Object.defineProperty(globalThis.HTMLInputElement.prototype,'value',{set(v){this._set=v},configurable:true});
|
||
|
|
globalThis.Event=class { constructor(type,opts){this.type=type;this.opts=opts} };
|
||
|
|
try {
|
||
|
|
assert.deepEqual(captureAccount('https://example.com'),{username:'person@example.com',password:'secret'});
|
||
|
|
assert.equal(captureAccount('https://other.example'),null);
|
||
|
|
assert.equal(fillAccount('https://example.com',{username:'u',password:'p'}),true);
|
||
|
|
} finally {
|
||
|
|
Object.assign(globalThis,old);
|
||
|
|
}
|
||
|
|
});
|