gitoria

18.7 KB

1. // tests/short-id-switch.mjs — THE SHORT-ID SWITCH GATE of gitoria.worldapi.org (mission 039, ident#23), all over HTTP, no browser:
2. // 1. the OLD ident (the pre-ident#23 build, a copy of its code: OLD_IDENT_DIR, default
3. // ident.worldapi.org/.scratch/pre-023-ident) + this app on a fresh store: alice (Default AND a second identity
4. // "Work") and bob log in and make data; alice's "Work" identity is deleted in ident afterwards;
5. // 2. both stop; the ident store and the app store are COPIED (the originals stay as they were);
6. // 3. the NEW ident (ident#23's dev build, a copy of ident.worldapi.org's code: NEW_IDENT_DIR) on the ident copy;
7. // 4. CONTROL: the app on an UNMIGRATED copy → alice comes back as a NEW user (why the migration is needed);
8. // 5. tools/migrate-short-ids.hl on the other copy, TWICE: counts; the second run changes nothing;
9. // 6. the app on the migrated copy with the new ident: alice's OLD app session still works; a fresh login through the
10. // new ident finds the SAME user with the SAME data; bob too; nobody sees the other's data.
11. // Ports 8724, 8725 (ident, app). Work dir .scratch/m039-switch (wiped at start). Every process started is stopped by PID.
12. // node tests/short-id-switch.mjs
14. import { spawn, execFileSync } from 'node:child_process';
15. import { cpSync, mkdirSync, readFileSync, rmSync, existsSync, writeFileSync } from 'node:fs';
16. import { dirname, join, resolve } from 'node:path';
17. import { fileURLToPath } from 'node:url';
18. import { copyIdent } from './identkit.mjs';
20. const HERE = dirname(fileURLToPath(import.meta.url));
21. const APP = resolve(HERE, '..');
22. const BIN = join(APP, 'bin/hybriel');
23. const PROJECTS = resolve(APP, '..');
24. const NEW_IDENT_DIR = process.env.NEW_IDENT_DIR || join(PROJECTS, 'ident.worldapi.org');
25. const OLD_IDENT_DIR = process.env.OLD_IDENT_DIR || join(PROJECTS, 'ident.worldapi.org/.scratch/pre-023-ident');
26. const IDENT_PORT = 8724, PORT = 8725;
27. const ID = `http://127.0.0.1:${IDENT_PORT}`;
28. const BASE = `http://127.0.0.1:${PORT}`;
29. const W = join(APP, '.scratch/m039-switch');
30. const J = JSON.stringify;
31. const sleep = (ms) => new Promise(r => setTimeout(r, ms));
32. const SHORT = /^[2-9a-hj-km-np-z]{5}$/;
33. const OLD = /^[0-9a-f]{32}$/;
35. let passed = 0, failed = 0;
36. const check = (name, ok, detail = '') => {
37. if (ok) { passed++; console.log(' ok ' + name); } else { failed++; console.log(' FAIL ' + name + (detail ? ' — ' + detail : '')); }
38. };
39. let log = '';
40. const procs = new Set();
41. function start(label, bin, args, cwd, env) {
42. log += `\n==== ${label}\n`;
43. const p = spawn(bin, args, { cwd, env: { ...process.env, ...env }, stdio: ['ignore', 'pipe', 'pipe'] });
44. p.stdout.on('data', d => log += d); p.stderr.on('data', d => log += d);
45. procs.add(p);
46. return p;
47. }
48. async function stop(p) {
49. if (!p) return;
50. try { p.kill('SIGTERM'); } catch {}
51. await new Promise(r => { if (p.exitCode !== null || p.signalCode !== null) return r(); p.once('exit', r); setTimeout(r, 3000); });
52. procs.delete(p);
53. }
54. async function up(url, what) {
55. for (let i = 0; i < 120; i++) { try { const r = await fetch(url, { redirect: 'manual' }); if (r.status < 500) return; } catch {} await sleep(250); }
56. throw new Error(what + ' did not come up\n' + log.slice(-3000));
57. }
59. // ---- ident (old or new code, on a given data dir; codes go to a mail sink — never real mail) -------------------
60. async function startIdentOn(codeDir, dataDir) {
61. mkdirSync(dataDir, { recursive: true });
62. const sink = join(dataDir, 'mail.txt');
63. if (!existsSync(sink)) writeFileSync(sink, '');
64. const p = start('ident ' + codeDir, join(codeDir, 'bin/hybriel'), ['project.hl'], codeDir, {
65. IDENT_PORT: String(IDENT_PORT), IDENT_STORAGE: join(dataDir, 'mpackdb'), IDENT_SESSIONS: join(dataDir, 'sessions') + '/',
66. IDENT_MAIL_SINK: sink, IDENT_IP_LIMIT: '1000', IDENT_IP_DAY_LIMIT: '1000', IDENT_WATCH: '0', HL_HOST: '127.0.0.1',
67. SMTP_HOST: '', SMTP_USER: '', SMTP_PASSWORD: '' });
68. await up(ID + '/', 'ident');
69. return { p, sink };
70. }
71. let iemitI = 0;
72. async function identEmit(event, payload, cookie) {
73. const r = await fetch(ID + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', ...(cookie ? { cookie } : {}) }, body: J({ t: 'emit', i: ++iemitI, event, payload }) });
74. const t = await r.text(); let j = null; try { j = JSON.parse(t); } catch {}
75. return { value: j && j.value, raw: t, setCookie: (r.headers.get('set-cookie') || '').split(';')[0] };
76. }
77. async function identSignIn(sink, email) {
78. const c = await fetch(ID + '/api/code', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J({ email }) });
79. if (c.status !== 200) throw new Error('ident code refused: ' + c.status);
80. const code = readFileSync(sink, 'utf8').trim().split('\n').filter(l => l.startsWith(email + ' ')).pop().split(' ')[1];
81. const v = await identEmit('verifyCode', [email, code, 'Europe/Vienna']);
82. if (!v.value || !v.value.account) throw new Error('ident sign-in failed: ' + v.raw);
83. return { email, cookie: v.setCookie, identities: v.value.identities };
84. }
85. // the selector's path: identities (as the app's page asks) → choose → one-time code
86. async function selectorCode(who, app, identityName = null) {
87. const l = await (await fetch(ID + '/api/selector/identities?key=' + app.key, { headers: { origin: BASE, cookie: who.cookie } })).json();
88. if (!l.identities || !l.identities.length) throw new Error('no identities: ' + J(l));
89. const pick = identityName ? l.identities.find(i => i.name === identityName) : l.identities[0];
90. if (!pick) throw new Error('no identity named ' + identityName + ': ' + J(l));
91. const c = await (await fetch(ID + '/api/selector/choose?key=' + app.key, { method: 'POST', headers: { origin: BASE, cookie: who.cookie, 'content-type': 'application/json' }, body: J({ identity: pick.id }) })).json();
92. if (!c.code) throw new Error('choose failed: ' + J(c));
93. return c.code;
94. }
96. // ---- the app -----------------------------------------------------------------------------------------------------
97. async function startApp(codeDir, store, app, extra = {}) {
98. const p = start('gitoria.worldapi.org on ' + store, join(codeDir, 'bin/hybriel'), ['project.hl'], codeDir, {
99. ...appEnv(store), HL_HOST: '127.0.0.1', IDENT_URL: ID, IDENT_EXCHANGE_URL: ID, IDENT_API_KEY: app.key, IDENT_API_SECRET: app.secret, ...extra });
100. await up(BASE + '/', 'gitoria.worldapi.org');
101. return p;
102. }
103. // the login button's / selector's landing: <app>/login/callback?ident_code= → the app's session cookie
104. async function appLogin(who, app, identityName = null, cookie = null) {
105. const code = await selectorCode(who, app, identityName);
106. const r = await fetch(BASE + '/login/callback?ident_code=' + code, { redirect: 'manual', headers: cookie ? { cookie } : {} });
107. const loc = r.headers.get('location') || '';
108. if (r.status !== 302 || loc.startsWith('/login/failed')) {
109. let why = r.status !== 302 ? (await r.text()).replace(/<(style|script)[\s\S]*?<\/(style|script)>/g, " ").replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim().slice(0, 200) : '';
110. const sc = (r.headers.get('set-cookie') || '').split(';')[0] || cookie;
111. if (r.status === 302) try { why = await (await fetch(BASE + '/login/failed', { headers: sc ? { cookie: sc } : {} })).text(); why = (why.match(/login failed[^<]*|ident refused[^<]*|that is not[^<]*/i) || [why.slice(0, 200)])[0]; } catch {}
112. return { error: 'login failed (' + r.status + ' → ' + loc + ') ' + why };
113. }
114. return { cookie: (r.headers.get('set-cookie') || '').split(';')[0] || cookie };
115. }
116. let aemitI = 0;
117. async function appEmit(cookie, event, payload) {
118. const r = await fetch(BASE + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', cookie }, body: J({ t: 'emit', i: ++aemitI, event, payload }) });
119. const t = await r.text(); let j = null; try { j = JSON.parse(t); } catch {}
120. return j && j.value !== undefined ? j.value : { error: 'no value: ' + t.slice(0, 300) };
121. }
122. const runTool = (store, app) => execFileSync(BIN, ['tools/migrate-short-ids.hl'], { cwd: APP, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
123. env: { ...process.env, ...appEnv(store), IDENT_EXCHANGE_URL: ID, IDENT_URL: ID, IDENT_API_KEY: app.key, IDENT_API_SECRET: app.secret } });
124. const counts = (out) => { const m = out.match(/users seen (\d+), mapped (\d+), already short (\d+), unmapped (\d+), conflicts (\d+), failed (\d+)/); return m ? m.slice(1).map(Number) : null; };
126. // ---- gitoria: what a user has — the display name, repos (owner), access tokens (user); checked through the faces and
127. // git's own push handshake (/<slug>.git/info/refs?service=git-receive-pack answers 200 only to a token of the OWNER) ----
128. import { request as httpRequest } from 'node:http';
129. const appEnv = (store) => ({ GITORIA_PORT: String(PORT), GITORIA_STORAGE: join(store, 'mpackdb'), GITORIA_SESSIONS: join(store, 'sessions') + '/', GITORIA_GIT: join(store, 'git'),
130. GITORIA_WATCH: '0', GITORIA_PUBLIC_URL: BASE, GITORIA_TICKETS_URL: 'http://127.0.0.1:1', GITORIA_SSH_SECRET: '' });
131. const prepareCode = async () => APP;
132. const firstEnv = async () => ({});
133. const laterEnv = async () => ({});
134. const toolExtra = async () => {};
135. const hostOf = (slug) => `${slug}.127.0.0.1:${PORT}`;
136. const pushAsk = (slug, token) => new Promise((res, rej) => {
137. const rq = httpRequest({ host: '127.0.0.1', port: PORT, path: `/${slug}.git/info/refs?service=git-receive-pack`, method: 'GET',
138. headers: { host: hostOf(slug), authorization: 'Basic ' + Buffer.from('x:' + token).toString('base64') } }, (r) => { r.resume(); r.on('end', () => res(r.statusCode)); });
139. rq.on('error', rej); rq.end();
140. });
141. async function makeData(ca, cb, cw) {
142. const out = {};
143. for (const [who, cookie, name, slug] of [['alice', ca, 'Alice', 'alice-m039'], ['bob', cb, 'Bob', 'bob-m039'], ['work', cw, 'Workname', null]]) {
144. const n = await appEmit(cookie, 'gitoriaSaveName', [name]);
145. const r = slug ? await appEmit(cookie, 'gitoriaCreate', [slug, 'repo of ' + name]) : null;
146. const t = await appEmit(cookie, 'gitoriaMakeToken', ['laptop']);
147. out[who] = { name, slug, token: t.token, nameOk: n && n.name === name && !n.error, repoOk: !slug || (r && !r.error) };
148. }
149. out.alice.other = out.bob.slug; out.bob.other = out.alice.slug;
150. const own = await pushAsk('alice-m039', out.alice.token), foreign = await pushAsk('alice-m039', out.bob.token);
151. check('old world: three users with names and tokens, two repos; the push handshake: owner\'s token 200, another\'s 403',
152. ['alice', 'bob', 'work'].every(w => out[w].nameOk && out[w].repoOk && /^gtr_/.test(out[w].token || '')) && own === 200 && foreign === 403, J([out, own, foreign]).slice(0, 600));
153. return out;
154. }
155. async function isNewEmptyUser(cookie) {
156. const n = await appEmit(cookie, 'gitoriaSaveName', ['Alice again']);
157. return n && !n.error && n.name === 'Alice again'; // a new user: no name yet
158. }
159. async function sameUser(label, cookie, who) {
160. const n = await appEmit(cookie, 'gitoriaSaveName', ['Someone else']);
161. const t = await appEmit(cookie, 'gitoriaMakeToken', ['after the switch']);
162. const fresh = t && t.token ? await pushAsk(who.slug, t.token) : 0;
163. const old = await pushAsk(who.slug, who.token);
164. const other = t && t.token ? await pushAsk(who.other, t.token) : 0;
165. check(label + ': the SAME user — name kept (' + who.name + '), a token made now may push to the OWN old repo (200), not to the other\'s (403), the old token still works',
166. n && /already set/.test(n.error || '') && fresh === 200 && old === 200 && other === 403, J([n, fresh, old, other]));
167. }
170. let identP = null, appP = null;
171. try {
172. rmSync(W, { recursive: true, force: true });
173. mkdirSync(W, { recursive: true });
174. const oldCode = join(W, 'ident-old-code'), newCode = join(W, 'ident-new-code');
175. copyIdent(OLD_IDENT_DIR, oldCode);
176. copyIdent(NEW_IDENT_DIR, newCode);
177. const oldIsOld = !readFileSync(join(oldCode, 'store.hl'), 'utf8').includes('shortId');
178. const newIsNew = readFileSync(join(newCode, 'project.hl'), 'utf8').includes('migrate-ids');
179. check('the old ident has no short ids, the new one has /api/migrate-ids', oldIsOld && newIsNew);
180. const CODE = await prepareCode();
182. // ---- 1. the OLD world -------------------------------------------------------------------------------------------
183. console.log('# 1. old ident + gitoria.worldapi.org, data made');
184. let id = await startIdentOn(oldCode, join(W, 'ident-data'));
185. identP = id.p;
186. const alice = await identSignIn(id.sink, '[email protected]');
187. const bob = await identSignIn(id.sink, '[email protected]');
188. const added = await identEmit('addIdentity', [{ identityName: 'Work' }], alice.cookie);
189. const work = added.value && added.value.identities ? added.value.identities.find(i => i.identityName === 'Work') : null;
190. const reg = await identEmit('appCreate', [{ name: 'gitoria.worldapi.org', origins: [BASE] }], alice.cookie);
191. if (!reg.value || !reg.value.secret) throw new Error('appCreate failed: ' + reg.raw);
192. const app = { key: reg.value.app.apiKey, secret: reg.value.secret };
193. writeFileSync(join(W, 'test-app-key.json'), J(app)); // the THROW-AWAY test app's key (for a by-hand rerun of the tool)
194. appP = await startApp(CODE, join(W, 'app-store'), app, await firstEnv());
195. const a1 = await appLogin(alice, app), b1 = await appLogin(bob, app);
196. const w1 = await appLogin(alice, app, 'Work');
197. check('old ident: alice, bob and alice\'s "Work" log in to gitoria.worldapi.org', !a1.error && !b1.error && !w1.error && work != null, J([a1.error, b1.error, w1.error]));
198. const before = await makeData(a1.cookie, b1.cookie, w1.cookie);
199. await stop(appP); appP = null;
200. const dropped = await identEmit('dropIdentity', [work.id], alice.cookie);
201. check('alice deletes her "Work" identity in ident (its app user becomes UNMAPPED)', dropped.value && !dropped.value.error, dropped.raw.slice(0, 200));
202. await stop(identP); identP = null;
204. // ---- 2. copies --------------------------------------------------------------------------------------------------
205. cpSync(join(W, 'ident-data'), join(W, 'ident-data-new'), { recursive: true });
206. cpSync(join(W, 'app-store'), join(W, 'app-store-control'), { recursive: true });
207. cpSync(join(W, 'app-store'), join(W, 'app-store-migrated'), { recursive: true });
209. // ---- 3. the NEW ident on the copy -------------------------------------------------------------------------------
210. console.log('# 2. new ident (ident#23) on a copy of the old ident store');
211. id = await startIdentOn(newCode, join(W, 'ident-data-new'));
212. identP = id.p;
213. const mig = await (await fetch(ID + '/api/migrate-ids', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J(app) })).json();
214. const olds = Object.keys(mig.ids || {});
215. check('new ident: migrate-ids maps 2 old ids (alice Default, bob) to short ids; the deleted identity is left out; not finished',
216. olds.length === 2 && olds.every(k => OLD.test(k)) && Object.values(mig.ids).every(v => SHORT.test(v)) && mig.finished === false, J(mig));
218. // ---- 4. CONTROL: unmigrated store ---------------------------------------------------------------------------------
219. console.log('# 3. control: the app on an UNMIGRATED copy');
220. appP = await startApp(CODE, join(W, 'app-store-control'), app, await laterEnv(mig));
221. const c1 = await appLogin(alice, app);
222. if (c1.error) check('control: login through the new ident fails or …', false, c1.error);
223. else check('control (not migrated): alice comes back as a NEW, EMPTY user — this is what the migration prevents', await isNewEmptyUser(c1.cookie, before), '');
224. await stop(appP); appP = null;
226. // ---- 5. the migration, twice --------------------------------------------------------------------------------------
227. console.log('# 4. tools/migrate-short-ids.hl on the other copy, twice');
228. const r1 = runTool(join(W, 'app-store-migrated'), app);
229. writeFileSync(join(W, 'migrate-run1.txt'), r1);
230. console.log(r1.trim().split('\n').map(l => ' | ' + l).join('\n'));
231. check('run 1: users seen 3, mapped 2, already short 0, unmapped 1 (deleted identity), conflicts 0, failed 0', J(counts(r1)) === J([3, 2, 0, 1, 0, 0]), J(counts(r1)));
232. const shorts = [...r1.matchAll(/MAPPED user \S+ → (\S+)/g)].map(m => m[1]).sort();
233. check('run 1: the users now hold exactly the short ids ident mapped', J(shorts) === J(Object.values(mig.ids).sort()), J([shorts, mig.ids]));
234. check('run 1 never prints the key or the secret', !r1.includes(app.secret) && !r1.includes(app.key));
235. const r2 = runTool(join(W, 'app-store-migrated'), app);
236. writeFileSync(join(W, 'migrate-run2.txt'), r2);
237. check('run 2 (idempotent): seen 3, mapped 0, already short 2, unmapped 1', J(counts(r2)) === J([3, 0, 2, 1, 0, 0]), J(counts(r2)));
238. await toolExtra(r1, r2, mig, app, alice);
239. const badSecret = (() => { try { runTool(join(W, 'app-store-migrated'), { key: app.key, secret: 'sk_' + '0'.repeat(48) }); return 'ran'; } catch (e) { return String(e.stdout || '') + String(e.stderr || ''); } })();
240. // the control copy: the app ran with the new ident BEFORE the migration and made a new user for alice's short id
241. const rc = (() => { try { return 'exit 0: ' + runTool(join(W, 'app-store-control'), app); } catch (e) { return String(e.stdout || '') + String(e.stderr || ''); } })();
242. writeFileSync(join(W, 'migrate-control.txt'), rc);
243. check('the tool on the control copy (app ran before the migration): alice = CONFLICT, left alone, exit non-zero',
244. J(counts(rc)) === J([4, 1, 1, 1, 1, 0]) && /CONFLICT user/.test(rc) && /CONFLICTS:/.test(rc) && !rc.startsWith('exit 0'), rc.slice(0, 400));
245. check('a wrong secret: the tool stops with ident\'s 401, changes nothing', /401/.test(badSecret), badSecret.slice(0, 300));
247. // ---- 6. the app on the migrated store ------------------------------------------------------------------------------
248. console.log('# 5. the app on the MIGRATED copy with the new ident');
249. appP = await startApp(CODE, join(W, 'app-store-migrated'), app, await laterEnv(mig));
250. await sameUser('alice, OLD app session (no new login)', a1.cookie, before.alice);
251. const a2 = await appLogin(alice, app);
252. check('alice logs in again through the new ident', !a2.error, a2.error);
253. if (!a2.error) await sameUser('alice, fresh login through the new ident', a2.cookie, before.alice, mig);
254. const b2 = await appLogin(bob, app);
255. check('bob logs in again through the new ident', !b2.error, b2.error);
256. if (!b2.error) await sameUser('bob, fresh login through the new ident', b2.cookie, before.bob, mig);
257. await stop(appP); appP = null;
258. const r3 = runTool(join(W, 'app-store-migrated'), app);
259. writeFileSync(join(W, 'migrate-run3.txt'), r3);
260. check('after the logins: still 3 users (no new one was made), all short or unmapped as before', J(counts(r3)) === J([3, 0, 2, 1, 0, 0]), J(counts(r3)));
261. await stop(identP); identP = null;
262. } catch (err) {
263. failed++; console.log(' FAIL (aborted) ' + (err.stack || err));
264. } finally {
265. for (const p of [...procs]) await stop(p);
266. mkdirSync(W, { recursive: true });
267. writeFileSync(join(W, 'servers.log'), log);
268. }
269. console.log(`\n${passed} passed, ${failed} failed`);
270. process.exit(failed ? 1 : 0);