248 lines
15 KiB
JavaScript
248 lines
15 KiB
JavaScript
/**
|
|
* Guarded consultation-only Form A browser regression.
|
|
* Run after an explicitly gated isolated-test build. Every Jotform request is
|
|
* fulfilled or aborted locally; no Jotform request is transmitted.
|
|
*/
|
|
import { randomBytes } from 'node:crypto';
|
|
import { encryptPortalStream, portalAlgorithm } from '../src/utils/portal-crypto.mjs';
|
|
import assert from 'node:assert/strict';
|
|
import fs from 'node:fs/promises';
|
|
import http from 'node:http';
|
|
import net from 'node:net';
|
|
import path from 'node:path';
|
|
import { spawn } from 'node:child_process';
|
|
import { fileURLToPath, pathToFileURL } from 'node:url';
|
|
import { setTimeout as delay } from 'node:timers/promises';
|
|
|
|
const root = fileURLToPath(new URL('../', import.meta.url));
|
|
const moduleName = process.env.PLAYWRIGHT_MODULE
|
|
? pathToFileURL(path.resolve(process.env.PLAYWRIGHT_MODULE)).href
|
|
: 'playwright';
|
|
const output = await fs.mkdtemp('/tmp/aia-service-portal-');
|
|
const routes = [
|
|
{ route: '/client-consultation', locale: 'en', drawer: false, screenshot: 'client-consultation' },
|
|
{ route: '/es/client-consultation', locale: 'es', drawer: false, screenshot: 'es-client-consultation' },
|
|
{ route: '/schedule-consultation', locale: 'en', drawer: false, screenshot: 'schedule-consultation' },
|
|
{ route: '/aba-therapy', locale: 'en', drawer: true, screenshot: 'aba-therapy' },
|
|
{ route: '/autism-evaluations', locale: 'en', drawer: true, screenshot: 'autism-evaluations' },
|
|
{ route: '/learner-social-club', locale: 'en', drawer: true, screenshot: 'learner-social-club' },
|
|
{ route: '/es/aba-therapy', locale: 'es', drawer: true, screenshot: 'es-aba-therapy' },
|
|
{ route: '/es/autism-evaluations', locale: 'es', drawer: true, screenshot: 'es-autism-evaluations' },
|
|
{ route: '/es/learner-social-club', locale: 'es', drawer: true, screenshot: 'es-learner-social-club' },
|
|
];
|
|
const widths = [320, 390, 768, 1440];
|
|
const evidence = { routes, widths, checks: 0, blocked: [], jotformAttempts: [], screenshots: [], fallbackChecks: [], status: 'failed' };
|
|
const reserve = net.createServer();
|
|
await new Promise((resolve, reject) => { reserve.once('error', reject); reserve.listen(0, '127.0.0.1', resolve); });
|
|
const port = reserve.address().port;
|
|
await new Promise((resolve) => reserve.close(resolve));
|
|
const origin = 'http://127.0.0.1:' + port;
|
|
let browser;
|
|
let preview;
|
|
|
|
function expectedUrl(locale) {
|
|
return 'https://form.jotform.com/262946078314059?formContext=consultation&language=' + locale;
|
|
}
|
|
|
|
try {
|
|
const { chromium } = await import(moduleName);
|
|
browser = await chromium.launch(process.env.CHROMIUM_EXECUTABLE
|
|
? { headless: true, executablePath: process.env.CHROMIUM_EXECUTABLE }
|
|
: { headless: true });
|
|
preview = spawn(process.execPath, ['node_modules/astro/bin/astro.mjs', 'preview', '--host', '127.0.0.1', '--port', String(port)], {
|
|
cwd: root,
|
|
env: { ...process.env, ASTRO_TELEMETRY_DISABLED: '1' },
|
|
stdio: 'ignore',
|
|
});
|
|
const reachable = () => new Promise((resolve) => {
|
|
const request = http.get(origin + '/', (response) => { response.resume(); resolve(response.statusCode === 200); });
|
|
request.setTimeout(500, () => request.destroy());
|
|
request.on('error', () => resolve(false));
|
|
});
|
|
for (let i = 0; i < 60 && !(await reachable()); i++) await delay(250);
|
|
assert.equal(await reachable(), true, 'Loopback preview did not become reachable');
|
|
|
|
|
|
const key = 'aia:service-inquiry:auto-suppressed-until';
|
|
const duration = 30 * 86400000;
|
|
const staffCode = randomBytes(24).toString('hex');
|
|
const managementCode = randomBytes(24).toString('hex');
|
|
const payload = { alg: portalAlgorithm, streams: [
|
|
await encryptPortalStream('fixture-staff', '<h2>Synthetic Staff</h2><p>Staff fixture only</p><a href="https://example.invalid/document">Synthetic resource</a><script>window.portalUnsafe=true</script><img src="https://example.invalid/image">', staffCode),
|
|
await encryptPortalStream('fixture-management', '<h2>Synthetic Management</h2><p>Management fixture only</p>', managementCode),
|
|
] };
|
|
const guard = async (context, inject = false) => {
|
|
await context.routeWebSocket('**/*', (socket) => { evidence.blocked.push({ method: 'WEBSOCKET' }); socket.close(); });
|
|
await context.route('**/*', async (route) => {
|
|
const req = route.request(), url = new URL(req.url());
|
|
if (url.origin === origin && ['GET', 'HEAD'].includes(req.method())) {
|
|
if (inject && url.pathname === '/employee-portal') {
|
|
const response = await route.fetch();
|
|
const html = (await response.text()).replace(/(<script[^>]*data-portal-payload[^>]*>)[\s\S]*?(<\/script>)/, '$1' + JSON.stringify(payload) + '$2');
|
|
return route.fulfill({ response, body: html });
|
|
}
|
|
return route.continue();
|
|
}
|
|
evidence.blocked.push({ method: req.method(), origin: url.origin, path: url.pathname });
|
|
if (url.origin === 'https://form.jotform.com') {
|
|
evidence.jotformAttempts.push({ method: req.method(), url: url.href });
|
|
return route.fulfill({ contentType: 'text/html', body: '<!doctype html><title>Local fixture</title><label>Fixture contact <input></label><button type="button">Fixture Submit</button>' });
|
|
}
|
|
return route.abort();
|
|
});
|
|
};
|
|
if (!process.argv.includes('--portal-only')) {
|
|
for (const width of widths) {
|
|
for (const target of routes.filter((r) => r.drawer)) {
|
|
const context = await browser.newContext({ viewport: { width, height: 844 }, serviceWorkers: 'block', reducedMotion: 'reduce' });
|
|
await guard(context);
|
|
const page = await context.newPage();
|
|
await page.clock.install({ time: new Date('2026-10-29T12:00:00Z') }); await page.clock.pauseAt(new Date('2026-10-29T12:00:01Z'));
|
|
await page.goto(origin + target.route, { waitUntil: 'domcontentloaded' });
|
|
const dialog = page.locator('[data-service-inquiry-drawer]');
|
|
const frame = dialog.locator('iframe');
|
|
const before = evidence.jotformAttempts.length;
|
|
assert.equal(await frame.getAttribute('src'), null);
|
|
await page.clock.runFor(3999);
|
|
assert.equal(await dialog.evaluate((d) => d.open), false);
|
|
await page.clock.runFor(100);
|
|
assert.equal(await dialog.evaluate((d) => d.open), true);
|
|
assert.equal(await frame.getAttribute('src'), expectedUrl(target.locale));
|
|
await page.waitForFunction(() => document.querySelector('iframe[data-jotform-iframe-frame]')?.src.includes('consultation'));
|
|
assert.equal(await page.locator('[data-service-inquiry-trigger]').count(), 1);
|
|
const heading = await dialog.locator('h2').textContent();
|
|
assert.ok(target.locale === 'es' ? /Conozca|preguntas/.test(heading) : /Explore|Questions/.test(heading));
|
|
assert.ok(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth + 1));
|
|
await page.screenshot({ path: path.join(output, target.screenshot + '-' + width + '.png'), fullPage: true });
|
|
evidence.screenshots.push(target.screenshot + '-' + width + '.png');
|
|
await page.keyboard.press('Escape');
|
|
await page.clock.runFor(100);
|
|
assert.equal(await dialog.evaluate((d) => d.open), false);
|
|
const expiry = await page.evaluate((k) => Number(localStorage.getItem(k)), key);
|
|
const now = await page.evaluate(() => Date.now());
|
|
assert.ok(expiry > now && expiry <= now + duration);
|
|
await page.clock.runFor(10000);
|
|
await page.locator('[data-service-inquiry-trigger]').focus();
|
|
await page.keyboard.press('Enter');
|
|
await page.clock.runFor(100);
|
|
assert.equal(await dialog.evaluate((d) => d.open), true);
|
|
assert.equal(await frame.count(), 1);
|
|
await page.locator('[data-service-inquiry-close]').click();
|
|
await page.clock.runFor(100);
|
|
assert.equal(await page.evaluate(() => document.activeElement?.hasAttribute('data-service-inquiry-trigger')), true);
|
|
const renewed = await page.evaluate((k) => Number(localStorage.getItem(k)), key);
|
|
assert.ok(renewed > expiry);
|
|
assert.ok(evidence.jotformAttempts.length <= before + 1);
|
|
evidence.checks++;
|
|
await context.close();
|
|
}
|
|
}
|
|
// Scroll wins, suppression crosses locale/service navigation, manual opening bypasses it.
|
|
const context = await browser.newContext({ serviceWorkers: 'block', reducedMotion: 'reduce' });
|
|
await guard(context);
|
|
const page = await context.newPage(); await page.clock.install({ time: new Date('2026-10-29T12:00:00Z') }); await page.clock.pauseAt(new Date('2026-10-29T12:00:01Z'));
|
|
await page.goto(origin + '/aba-therapy', { waitUntil: 'domcontentloaded' });
|
|
await page.evaluate(() => scrollTo({ top: (document.documentElement.scrollHeight - innerHeight) * .6, behavior: 'instant' }));
|
|
await page.clock.runFor(100);
|
|
assert.equal(await page.locator('dialog').evaluate((d) => d.open), true);
|
|
await page.keyboard.press('Escape'); await page.clock.runFor(100);
|
|
await page.goto(origin + '/es/learner-social-club', { waitUntil: 'domcontentloaded' });
|
|
await page.clock.runFor(5000);
|
|
await page.evaluate(() => scrollTo({ top: document.documentElement.scrollHeight, behavior: 'instant' })); await page.clock.runFor(100);
|
|
assert.equal(await page.locator('dialog').evaluate((d) => d.open), false);
|
|
assert.equal(await page.locator('dialog iframe').getAttribute('src'), null);
|
|
await page.locator('[data-service-inquiry-trigger]').click(); await page.clock.runFor(100);
|
|
assert.equal(await page.locator('dialog').evaluate((d) => d.open), true);
|
|
await page.keyboard.press('Escape'); await page.clock.runFor(100);
|
|
// A second page-load initialization disposes previous listeners without duplicating activation.
|
|
await page.evaluate(() => document.dispatchEvent(new Event('astro:page-load')));
|
|
await page.locator('[data-service-inquiry-trigger]').click(); await page.clock.runFor(100);
|
|
assert.equal(await page.locator('dialog iframe').count(), 1);
|
|
evidence.checks += 2;
|
|
await context.close();
|
|
|
|
for (const preference of ['expired', 'invalid', 'denied', 'editing', 'short', 'other-modal']) {
|
|
const ctx = await browser.newContext({ serviceWorkers: 'block', reducedMotion: 'reduce' }); await guard(ctx);
|
|
await ctx.addInitScript(({ preference, key }) => {
|
|
if (preference === 'expired') localStorage.setItem(key, '1');
|
|
if (preference === 'invalid') localStorage.setItem(key, 'broken');
|
|
if (preference === 'denied') Object.defineProperty(window, 'localStorage', { get() { throw new Error('Denied'); } });
|
|
}, { preference, key });
|
|
const p = await ctx.newPage(); await p.clock.install({ time: new Date('2026-10-29T12:00:00Z') }); await p.clock.pauseAt(new Date('2026-10-29T12:00:01Z')); await p.goto(origin + '/aba-therapy', { waitUntil: 'domcontentloaded' });
|
|
if (preference === 'editing') await p.evaluate(() => { const field = document.createElement('input'); document.body.prepend(field); field.focus(); });
|
|
if (preference === 'other-modal') await p.evaluate(() => { const d = document.createElement('dialog'); document.body.append(d); d.showModal(); });
|
|
if (preference === 'short') {
|
|
await p.evaluate(() => { document.querySelectorAll('main > :not([data-service-inquiry-drawer]), header, footer').forEach((e) => e instanceof HTMLElement && (e.style.display = 'none')); });
|
|
await p.clock.runFor(100);
|
|
assert.equal(await p.locator('[data-service-inquiry-drawer]').evaluate((d) => d.open), false);
|
|
}
|
|
await p.clock.runFor(4100);
|
|
assert.equal(await p.locator('[data-service-inquiry-drawer]').evaluate((d) => d.open), !['editing', 'other-modal'].includes(preference), preference);
|
|
evidence.checks++; await ctx.close();
|
|
}
|
|
const backContext = await browser.newContext({ serviceWorkers: 'block', reducedMotion: 'reduce' });
|
|
await guard(backContext);
|
|
const backPage = await backContext.newPage();
|
|
await backPage.goto(origin + '/aba-therapy', { waitUntil: 'domcontentloaded' });
|
|
await backPage.evaluate(() => {
|
|
window.dispatchEvent(new PageTransitionEvent('pagehide', { persisted: true }));
|
|
window.dispatchEvent(new PageTransitionEvent('pageshow', { persisted: true }));
|
|
});
|
|
assert.equal(await backPage.evaluate((storageKey) => localStorage.getItem(storageKey), key), null);
|
|
await backPage.locator('[data-service-inquiry-trigger]').click();
|
|
assert.equal(await backPage.locator('dialog iframe').getAttribute('src'), expectedUrl('en'));
|
|
evidence.checks++;
|
|
await backContext.close();
|
|
}
|
|
// Actual portal UI with synthetic encrypted response fixtures, never real private source.
|
|
for (const width of widths) {
|
|
const ctx = await browser.newContext({ viewport: { width, height: 844 }, serviceWorkers: 'block' }); await guard(ctx, true);
|
|
const p = await ctx.newPage(); await p.goto(origin + '/employee-portal');
|
|
assert.equal(await p.locator('meta[name="robots"]').getAttribute('content'), 'noindex,nofollow');
|
|
assert.equal(await p.locator('[data-portal-content]').isVisible(), false);
|
|
const input = p.locator('[data-portal-code]');
|
|
await input.fill('synthetic-incorrect'); await input.press('Enter');
|
|
await p.waitForFunction(() => document.querySelector('[data-portal-feedback]')?.textContent === 'Invalid Code');
|
|
assert.equal(await p.locator('[data-portal-content]').textContent(), '');
|
|
await input.fill(staffCode); await input.press('Enter');
|
|
await p.locator('[data-portal-content]').waitFor({ state: 'visible' });
|
|
assert.match(await p.locator('[data-portal-content]').textContent(), /Synthetic Staff/);
|
|
assert.doesNotMatch(await p.locator('[data-portal-content]').textContent(), /Management/);
|
|
assert.equal(await p.evaluate(() => window.portalUnsafe), undefined);
|
|
assert.equal(await p.locator('[data-portal-content] img, [data-portal-content] script').count(), 0);
|
|
assert.equal(await p.evaluate(() => document.activeElement?.hasAttribute('data-portal-content')), true);
|
|
assert.equal(await input.inputValue(), '');
|
|
assert.ok(await p.evaluate(() => document.documentElement.scrollWidth <= innerWidth + 1));
|
|
await p.screenshot({ path: path.join(output, 'portal-synthetic-' + width + '.png'), fullPage: true });
|
|
evidence.screenshots.push('portal-synthetic-' + width + '.png');
|
|
await p.reload(); assert.equal(await p.locator('[data-portal-content]').isVisible(), false);
|
|
await input.fill(managementCode); await input.press('Enter');
|
|
await p.locator('[data-portal-content]').waitFor({ state: 'visible' });
|
|
assert.match(await p.locator('[data-portal-content]').textContent(), /Synthetic Management/);
|
|
assert.doesNotMatch(await p.locator('[data-portal-content]').textContent(), /Staff fixture/);
|
|
evidence.checks++; await ctx.close();
|
|
}
|
|
for (const js of [false, true]) {
|
|
const ctx = await browser.newContext({ javaScriptEnabled: js, serviceWorkers: 'block' }); await guard(ctx);
|
|
const p = await ctx.newPage(); await p.goto(origin + '/employee-portal');
|
|
assert.equal(await p.locator('[data-portal-code]').isDisabled(), true);
|
|
assert.equal(await p.locator('[data-portal-content]').isVisible(), false);
|
|
if (!js) assert.ok(await p.locator('noscript').last().isVisible());
|
|
evidence.checks++; await ctx.close();
|
|
}
|
|
assert.equal(evidence.blocked.filter((r) => !['GET','HEAD'].includes(r.method)).length, 0);
|
|
evidence.status = 'passed';
|
|
} catch (error) {
|
|
evidence.error = error instanceof Error ? error.message : String(error);
|
|
throw error;
|
|
} finally {
|
|
await fs.writeFile(path.join(output, 'evidence.json'), JSON.stringify(evidence, null, 2));
|
|
if (preview && preview.exitCode === null) {
|
|
preview.kill('SIGTERM');
|
|
await Promise.race([new Promise((resolve) => preview.once('exit', resolve)), delay(3000)]);
|
|
if (preview.exitCode === null) preview.kill('SIGKILL');
|
|
}
|
|
await browser?.close();
|
|
console.log(JSON.stringify({ ...evidence, artifactDirectory: output }, null, 2));
|
|
}
|