feat(portal): reuse unlock code for protected downloads
This commit is contained in:
DeCentN2Madness authored and 
AIAMarketing committed
1 parent
475dd3379b
commit
596246f20a
9 files changed
+268
-13
No files matched your search
@@ -16,6 +16,8 @@ import { setTimeout as delay } from 'node:timers/promises';
|
||||
|
||||
const forms = process.argv.find(a => a.startsWith('--forms='))?.split('=')[1] ?? 'live';
|
||||
assert.ok(['live', 'off', 'mock'].includes(forms));
|
||||
const browserName = process.argv.find(a => a.startsWith('--browser='))?.split('=')[1] ?? 'chromium';
|
||||
assert.ok(['chromium', 'firefox'].includes(browserName));
|
||||
const root = fileURLToPath(new URL('../', import.meta.url));
|
||||
const moduleName = process.env.PLAYWRIGHT_MODULE
|
||||
? pathToFileURL(path.resolve(process.env.PLAYWRIGHT_MODULE)).href
|
||||
@@ -33,7 +35,7 @@ const routes = [
|
||||
{ route: '/es/learner-social-club', locale: 'es', drawer: true, screenshot: 'es-learner-social-club' },
|
||||
];
|
||||
const widths = [320, 390, 768, 1440];
|
||||
const evidence = { forms, routes, widths, checks: 0, blocked: [], jotformAttempts: [], screenshots: [], fallbackChecks: [], status: 'failed' };
|
||||
const evidence = { forms, browserName, routes, widths, checks: 0, blocked: [], jotformAttempts: [], resourceRequests: [], screenshots: [], fallbackChecks: [], status: 'failed' };
|
||||
const reserve = net.createServer();
|
||||
await new Promise((resolve, reject) => { reserve.once('error', reject); reserve.listen(0, '127.0.0.1', resolve); });
|
||||
const port = reserve.address().port;
|
||||
@@ -47,9 +49,11 @@ function expectedUrl(locale) {
|
||||
}
|
||||
|
||||
try {
|
||||
const { chromium } = await import(moduleName);
|
||||
browser = await chromium.launch(process.env.CHROMIUM_EXECUTABLE
|
||||
? { headless: true, executablePath: process.env.CHROMIUM_EXECUTABLE }
|
||||
const drivers = await import(moduleName);
|
||||
const driver = drivers[browserName];
|
||||
const executablePath = browserName === 'chromium' ? process.env.CHROMIUM_EXECUTABLE : process.env.FIREFOX_EXECUTABLE;
|
||||
browser = await driver.launch(executablePath
|
||||
? { headless: true, executablePath }
|
||||
: { headless: true });
|
||||
evidence.browser = browser.version();
|
||||
preview = spawn(process.execPath, ['node_modules/astro/bin/astro.mjs', 'preview', '--host', '127.0.0.1', '--port', String(port)], {
|
||||
@@ -73,14 +77,31 @@ try {
|
||||
const styledFixture = '<section><h2>Synthetic Directory</h2><h3>Operational reports</h3><p><a class="hs-button arbitrary-legacy-class" style="position:fixed" onclick="window.portalUnsafe=true" href="https://example.invalid/report">Synthetic report</a></p><ul><li>Synthetic list item</li></ul><table><caption>Fixture directory</caption><thead><tr><th scope="col">Role</th><th scope="col">Contact</th></tr></thead><tbody><tr><td>Fixture role</td><td><a href="mailto:fixture@example.invalid">Fixture email</a></td></tr></tbody></table><p><a style="background-color:#ffbd59" href="https://example.invalid/second">Second fixture report</a></p><p><a class="unrecognized-report-legacy" href="https://example.invalid/third">Operations Monthly Lineup Report - PM</a></p><a href="javascript:alert(1)">Unsafe destination</a><iframe src="https://example.invalid/frame"></iframe><form action="https://example.invalid/post"><input></form></section>';
|
||||
const staffTemplates = '<section><h2>Management Templates</h2><ul><li><div><a href="https://example.invalid/check-in">Client Check-In & Check-Out</a></div></li><li><div><a href="https://example.invalid/employee-performance">Employee Performance Template</a></div></li><li><div><a href="https://example.invalid/employee-availability">Employee Availability Template</a></div></li></ul></section><section><h2>Other Staff Resources</h2><p><a href="https://example.invalid/resource">General staff resource</a></p><p><a href="mailto:staff@example.invalid">Staff email</a></p></section>';
|
||||
const payload = { alg: portalAlgorithm, streams: [
|
||||
await encryptPortalStream('fixture-staff', '<h2>Synthetic Staff</h2><p>Staff fixture only</p><a href="https://example.invalid/document">Synthetic resource</a><script>window.portalUnsafe=true</script><img src="https://example.invalid/image">' + styledFixture + staffTemplates, staffCode),
|
||||
await encryptPortalStream('fixture-management', '<h2>Synthetic Management</h2><p>Management fixture only</p>' + styledFixture, managementCode),
|
||||
await encryptPortalStream('b', '<h2>Synthetic Staff</h2><p>Staff fixture only</p><a href="/staff-resources/staff-guide.pdf">Download staff guide</a><script>window.portalUnsafe=true</script><img src="https://example.invalid/image">' + styledFixture + staffTemplates, staffCode),
|
||||
await encryptPortalStream('a', '<h2>Synthetic Management</h2><p>Management fixture only</p><a class="hs-button" href="/management-resources/management-guide.pdf">Download management guide</a>' + styledFixture, managementCode),
|
||||
] };
|
||||
const expectedAuthorization = {
|
||||
staff: 'Basic ' + Buffer.from('staff:' + staffCode, 'utf8').toString('base64'),
|
||||
management: 'Basic ' + Buffer.from('management:' + managementCode, 'utf8').toString('base64'),
|
||||
};
|
||||
const guard = async (context, inject = false) => {
|
||||
await context.routeWebSocket('**/*', (socket) => { evidence.blocked.push({ method: 'WEBSOCKET' }); socket.close(); });
|
||||
await context.route('**/*', async (route) => {
|
||||
const req = route.request(), url = new URL(req.url());
|
||||
if (url.origin === origin && ['GET', 'HEAD'].includes(req.method())) {
|
||||
const resource = /^\/(staff|management)-resources\/(staff|management)-guide\.pdf$/.exec(url.pathname);
|
||||
if (resource) {
|
||||
const role = resource[1];
|
||||
const authorized = req.headers().authorization === expectedAuthorization[role];
|
||||
evidence.resourceRequests.push({ role, authorized });
|
||||
if (!authorized) return route.fulfill({ status: 401, headers: { 'www-authenticate': `Basic realm="AIA ${role} resources"`, 'cache-control': 'private, no-store' } });
|
||||
return route.fulfill({
|
||||
status: 200,
|
||||
contentType: 'application/pdf',
|
||||
headers: { 'content-disposition': `attachment; filename="${role}-guide.pdf"`, 'cache-control': 'private, no-store' },
|
||||
body: `%PDF-1.7\nSynthetic ${role} document\n`,
|
||||
});
|
||||
}
|
||||
if (inject && url.pathname === '/employee-portal') {
|
||||
const response = await route.fetch();
|
||||
const html = (await response.text()).replace(/(<script[^>]*data-portal-payload[^>]*>)[\s\S]*?(<\/script>)/, '$1' + JSON.stringify(payload) + '$2');
|
||||
@@ -327,14 +348,14 @@ try {
|
||||
await input.fill(staffCode); await input.press('Enter');
|
||||
await p.locator('[data-portal-content]').waitFor({ state: 'visible' });
|
||||
assert.match(await p.locator('[data-portal-content]').textContent(), /Synthetic Staff/);
|
||||
assert.doesNotMatch(await p.locator('[data-portal-content]').textContent(), /Management/);
|
||||
assert.doesNotMatch(await p.locator('[data-portal-content]').textContent(), /Synthetic Management|Management fixture only/);
|
||||
assert.equal(await p.evaluate(() => window.portalUnsafe), undefined);
|
||||
assert.equal(await p.locator('[data-portal-content] img, [data-portal-content] script').count(), 0);
|
||||
assert.equal(await p.evaluate(() => document.activeElement?.hasAttribute('data-portal-content')), true);
|
||||
assert.equal(await input.inputValue(), '');
|
||||
const checkPresentation = async (staff = false) => {
|
||||
const content = p.locator('[data-portal-content]');
|
||||
assert.equal(await content.locator('.portal-resource-button').count(), staff ? 8 : 3);
|
||||
assert.equal(await content.locator('.portal-resource-button').count(), staff ? 8 : 4);
|
||||
assert.equal(await content.locator('[style], [onclick], .arbitrary-legacy-class, .unrecognized-report-legacy, iframe, form, input').count(), 0);
|
||||
assert.equal(await content.locator('a[href^="javascript:"]').count(), 0);
|
||||
assert.equal(await content.locator('th[scope="col"]').count(), 2);
|
||||
@@ -346,7 +367,7 @@ try {
|
||||
assert.equal(await content.locator('li').first().evaluate(e => getComputedStyle(e, '::marker').color), 'rgb(255, 189, 89)');
|
||||
assert.equal(await content.locator('h2').first().evaluate(e => getComputedStyle(e).color), 'rgb(37, 64, 128)');
|
||||
assert.ok(await content.locator('h2').first().evaluate(e => parseFloat(getComputedStyle(e).fontSize) >= 28));
|
||||
assert.equal(await content.locator('.portal-contact-link').evaluate(e => getComputedStyle(e).color), 'rgb(169, 70, 0)');
|
||||
assert.equal(await content.locator('.portal-contact-link').first().evaluate(e => getComputedStyle(e).color), 'rgb(169, 70, 0)');
|
||||
await button.focus();
|
||||
assert.equal(await button.evaluate(e => getComputedStyle(e).outlineStyle), 'solid');
|
||||
assert.equal(await button.evaluate(e => getComputedStyle(e).outlineWidth), '3px');
|
||||
@@ -361,6 +382,20 @@ try {
|
||||
assert.equal(columns, width >= 768 ? 2 : 1, 'staff templates follow responsive column count');
|
||||
assert.equal(await staffContent.getByRole('link', { name: 'General staff resource' }).getAttribute('class'), 'portal-resource-button');
|
||||
assert.equal(await staffContent.getByRole('link', { name: 'Staff email' }).getAttribute('class'), 'portal-contact-link');
|
||||
assert.equal(await p.evaluate(async (url) => (await fetch(url)).status, origin + '/staff-resources/staff-guide.pdf'), 401);
|
||||
const staffLink = staffContent.getByRole('link', { name: 'Download staff guide' });
|
||||
const staffDownload = p.waitForEvent('download');
|
||||
await staffLink.click();
|
||||
assert.equal((await staffDownload).suggestedFilename(), 'staff-guide.pdf');
|
||||
await p.waitForFunction(() => document.querySelector('[data-portal-download-feedback]')?.textContent === 'Downloaded staff-guide.pdf.');
|
||||
assert.equal(p.url(), origin + '/employee-portal');
|
||||
const beforeCrossRole = evidence.resourceRequests.length;
|
||||
await staffLink.evaluate((link) => { link.href = '/management-resources/management-guide.pdf'; });
|
||||
await staffLink.click();
|
||||
await p.waitForFunction(() => document.querySelector('[data-portal-download-feedback]')?.textContent?.includes('not available from this portal'));
|
||||
assert.equal(evidence.resourceRequests.length, beforeCrossRole, 'staff credential is not sent to management resources');
|
||||
assert.deepEqual(await p.evaluate(() => ({ local: { ...localStorage }, session: { ...sessionStorage } })), { local: {}, session: {} });
|
||||
assert.equal(p.url().includes(staffCode), false);
|
||||
assert.ok(await p.evaluate(() => document.documentElement.scrollWidth <= innerWidth + 1));
|
||||
await p.screenshot({ path: path.join(output, 'portal-synthetic-' + width + '.png'), fullPage: true });
|
||||
evidence.screenshots.push('portal-synthetic-' + width + '.png');
|
||||
@@ -370,6 +405,18 @@ try {
|
||||
assert.match(await p.locator('[data-portal-content]').textContent(), /Synthetic Management/);
|
||||
assert.doesNotMatch(await p.locator('[data-portal-content]').textContent(), /Staff fixture/);
|
||||
await checkPresentation();
|
||||
assert.equal(await p.evaluate(async (url) => (await fetch(url)).status, origin + '/management-resources/management-guide.pdf'), 401);
|
||||
const managementLink = p.getByRole('link', { name: 'Download management guide' });
|
||||
const managementDownload = p.waitForEvent('download');
|
||||
await managementLink.click();
|
||||
assert.equal((await managementDownload).suggestedFilename(), 'management-guide.pdf');
|
||||
await p.waitForFunction(() => document.querySelector('[data-portal-download-feedback]')?.textContent === 'Downloaded management-guide.pdf.');
|
||||
const beforeManagementCrossRole = evidence.resourceRequests.length;
|
||||
await managementLink.evaluate((link) => { link.href = '/staff-resources/staff-guide.pdf'; });
|
||||
await managementLink.click();
|
||||
await p.waitForFunction(() => document.querySelector('[data-portal-download-feedback]')?.textContent?.includes('not available from this portal'));
|
||||
assert.equal(evidence.resourceRequests.length, beforeManagementCrossRole, 'management credential is not sent to staff resources');
|
||||
assert.equal(p.url().includes(managementCode), false);
|
||||
assert.equal(await p.locator('[data-portal-content] ul.portal-template-grid').count(), 0, 'management view retains original layout');
|
||||
await p.screenshot({ path: path.join(output, 'portal-management-synthetic-' + width + '.png'), fullPage: true });
|
||||
evidence.screenshots.push('portal-management-synthetic-' + width + '.png');
|
||||
|
||||
@@ -10,6 +10,13 @@ import { decryptPortalStream, encryptPortalStream, validatePortalPayload, portal
|
||||
import { collectResource, resourceReferences, rewriteResources } from './portal-resources.mjs';
|
||||
import { isFormACompletion } from '../src/utils/jotform-completion.ts';
|
||||
import { portalLinkPresentation } from '../src/utils/portal-presentation.ts';
|
||||
import {
|
||||
PortalDownloadError,
|
||||
fetchProtectedPortalResource,
|
||||
portalDownloadErrorMessage,
|
||||
portalRoleForStreamId,
|
||||
protectedPortalResource,
|
||||
} from '../src/utils/portal-download.mjs';
|
||||
import { applyRoleMappings, approvedMapping, summarizeMappings } from './portal-production.mjs';
|
||||
|
||||
test('completion envelope requires an exact approved origin, active frame window and string Form A ID', () => {
|
||||
@@ -48,6 +55,59 @@ test('portal presentation translates only explicit button tokens/brand fills and
|
||||
assert.equal(portalLinkPresentation([], '', 'tel:'), 'portal-contact-link');
|
||||
});
|
||||
|
||||
test('portal downloads use only the validated role and an in-memory authorization header', async () => {
|
||||
assert.equal(portalRoleForStreamId('b'), 'staff');
|
||||
assert.equal(portalRoleForStreamId('a'), 'management');
|
||||
assert.equal(portalRoleForStreamId('fixture-staff'), undefined);
|
||||
const origin = 'https://www.azinstitute4autism.com';
|
||||
const staff = protectedPortalResource('/staff-resources/staff-guide.pdf', origin);
|
||||
const management = protectedPortalResource('/management-resources/management-guide.pdf', origin);
|
||||
assert.deepEqual(staff, {
|
||||
role: 'staff', filename: 'staff-guide.pdf',
|
||||
url: origin + '/staff-resources/staff-guide.pdf',
|
||||
});
|
||||
assert.equal(protectedPortalResource('/staff-resources/nested/file.pdf', origin), undefined);
|
||||
assert.equal(protectedPortalResource('/staff-resources/file.pdf?code=forbidden', origin), undefined);
|
||||
assert.equal(protectedPortalResource('https://other.invalid/staff-resources/file.pdf', origin), undefined);
|
||||
|
||||
const code = 'synthetic browser memory only';
|
||||
let captured;
|
||||
const result = await fetchProtectedPortalResource(staff, { role: 'staff', code }, async (url, options) => {
|
||||
captured = { url, options };
|
||||
return new Response('synthetic document', {
|
||||
headers: { 'content-disposition': 'attachment; filename="approved-name.pdf"' },
|
||||
});
|
||||
});
|
||||
assert.equal(captured.url, staff.url);
|
||||
assert.equal(captured.url.includes(code), false);
|
||||
assert.equal(captured.options.method, 'GET');
|
||||
assert.equal(captured.options.credentials, 'omit');
|
||||
assert.equal(captured.options.cache, 'no-store');
|
||||
assert.equal(captured.options.redirect, 'error');
|
||||
assert.equal(captured.options.referrerPolicy, 'no-referrer');
|
||||
assert.match(captured.options.headers.Authorization, /^Basic /);
|
||||
assert.equal(result.filename, 'approved-name.pdf');
|
||||
assert.equal(await result.blob.text(), 'synthetic document');
|
||||
|
||||
for (const [resource, credential] of [
|
||||
[management, { role: 'staff', code }],
|
||||
[staff, { role: 'management', code }],
|
||||
]) {
|
||||
let called = false;
|
||||
await assert.rejects(
|
||||
fetchProtectedPortalResource(resource, credential, async () => { called = true; return new Response(); }),
|
||||
(error) => error instanceof PortalDownloadError && error.code === 'role',
|
||||
);
|
||||
assert.equal(called, false, 'cross-role credentials are never transmitted');
|
||||
}
|
||||
await assert.rejects(
|
||||
fetchProtectedPortalResource(staff, { role: 'staff', code }, async () => new Response('', { status: 401 })),
|
||||
(error) => error instanceof PortalDownloadError && error.code === 'unauthorized',
|
||||
);
|
||||
assert.match(portalDownloadErrorMessage(new PortalDownloadError('unauthorized')), /session could not authorize/);
|
||||
assert.match(portalDownloadErrorMessage(new PortalDownloadError('role')), /not available from this portal/);
|
||||
});
|
||||
|
||||
test('staff template presentation follows sanitized headings, not original HubSpot classes', async () => {
|
||||
const renderer = await fs.readFile('src/scripts/employee-portal.ts', 'utf8');
|
||||
const css = await fs.readFile('src/components/pages/EmployeePortal.astro', 'utf8');
|
||||
|
||||
Reference in new issue
Block a user