gitoria

22.9 KB

1. // tests/ssh.mjs — THE GATE OF GIT OVER SSH (ticket gitoria#7): the REAL sshd container (docker/sshd, built here) + the real ssh and git clients
2. // against this app; keys pasted in Chrome. (tests/push.mjs is the HTTPS gate; this is a copy of its set-up.)
3. // was: tests/push.mjs — THE GATE OF PUSH AND PULL (ticket gitoria#7). Its own gitoria server + its own ident (copy, mail sink),
4. // a real Chrome for everything visible (create a repo, the "add code" box, access tokens), and the REAL `git` binary for
5. // clone / push / fetch over HTTP against the repo address <slug>.gitoria.test (git's http.curloptResolve maps it to 127.0.0.1).
6. // node tests/push.mjs (GITORIA_GATE_PORT 8700, GITORIA_GATE_IDENT_PORT 8701, GITORIA_GATE_CHROME "8703-8707")
7. import { spawn, spawnSync } from 'node:child_process';
8. import { request as httpRequest, createServer } from 'node:http';
9. import { rmSync, mkdirSync, writeFileSync, existsSync, readFileSync } from 'node:fs';
10. import { dirname, join, resolve } from 'node:path';
11. import { fileURLToPath } from 'node:url';
12. import { randomBytes } from 'node:crypto';
13. import { launchBrowser } from './cdp.mjs';
14. import { startIdent } from './identkit.mjs';
16. if (!process.env.HL_CHROME && existsSync('/opt/google/chrome/chrome')) process.env.HL_CHROME = '/opt/google/chrome/chrome';
17. const HERE = dirname(fileURLToPath(import.meta.url));
18. const APP = resolve(HERE, '..');
19. const BIN = join(APP, 'bin/hybriel');
20. const PORT = Number(process.env.GITORIA_GATE_PORT || 8700);
21. const IDENT_PORT = Number(process.env.GITORIA_GATE_IDENT_PORT || 8701);
22. const PROXY = Number(process.env.GITORIA_GATE_PROXY || 8702);
23. const SSHPORT = Number(process.env.GITORIA_GATE_SSH_PORT || 8708);
24. const SECRET = 'gate-secret-' + Math.random().toString(16).slice(2);
25. const CONTAINER = 'gitoria-sshd-gate'; // stands in for nginx: buffers a chunked request body and sends it with a length
26. const [CH_FROM, CH_TO] = (process.env.GITORIA_GATE_CHROME || '8703-8707').split('-').map(Number);
27. const API = `http://127.0.0.1:${PORT}`;
28. const BASE = `http://gitoria.test:${PORT}`;
29. const IDENT_B = `http://ident.gitoria.test:${IDENT_PORT}`;
30. const REPO = (slug) => `http://${slug}.gitoria.test:${PORT}`;
31. const hreq = (method, path, host, headers = {}, body = null) => new Promise((res, rej) => {
32. const rq = httpRequest({ host: '127.0.0.1', port: PORT, path, method, headers: { host, ...headers } }, (r) => { let b = ''; r.setEncoding('utf8'); r.on('data', d => b += d); r.on('end', () => res({ status: r.statusCode, headers: r.headers, body: b })); });
33. rq.on('error', rej); if (body) { rq.setHeader('content-length', Buffer.byteLength(body)); rq.write(body); } rq.end();
34. });
35. process.env.HL_CHROME_ARGS = '--host-resolver-rules=MAP *.gitoria.test 127.0.0.1, MAP gitoria.test 127.0.0.1';
36. const SCRATCH = join(APP, '.scratch');
37. const STORE = join(SCRATCH, 'ssh-store');
38. const WORK = join(STORE, 'work');
39. const IDENT_DIR = process.env.GITORIA_GATE_IDENT_DIR || [resolve(APP, '../ident.worldapi.org'), '/media/STORAGE/projects/ident.worldapi.org'].find(d => existsSync(join(d, 'project.hl')));
40. rmSync(STORE, { recursive: true, force: true });
41. mkdirSync(WORK, { recursive: true });
43. let failures = 0, passes = 0;
44. function check(label, ok, detail = '') {
45. console.log(`${ok ? 'ok ' : 'FAIL'} ${label}${ok ? '' : ' — ' + detail}`);
46. if (ok) passes++; else failures++;
47. }
48. const sleep = (ms) => new Promise(r => setTimeout(r, ms));
49. const J = JSON.stringify;
50. let pageA = null;
51. let log = '', server = null, ident = null, proxy = null;
52. function startProxy() {
53. proxy = createServer((req, res) => {
54. const parts = []; req.on('data', d => parts.push(d));
55. req.on('end', () => {
56. const body = Buffer.concat(parts);
57. const headers = { ...req.headers }; delete headers['transfer-encoding']; headers['content-length'] = String(body.length);
58. const up = httpRequest({ host: '127.0.0.1', port: PORT, path: req.url, method: req.method, headers }, (r) => { res.writeHead(r.statusCode, r.headers); r.pipe(res); });
59. up.on('error', () => { res.writeHead(502); res.end(); });
60. up.end(body);
61. });
62. });
63. proxy.listen(PROXY, '127.0.0.1');
64. }
65. const browsers = [];
67. function startServer(extraEnv = {}) {
68. server = spawn(BIN, ['project.hl'], {
69. cwd: APP,
70. env: { ...process.env, GITORIA_PORT: String(PORT), GITORIA_STORAGE: join(STORE, 'mpackdb'), GITORIA_SESSIONS: join(STORE, 'sessions') + '/', GITORIA_WATCH: '0', GITORIA_GIT: join(STORE, 'git'),
71. GITORIA_PUBLIC_URL: BASE, IDENT_URL: IDENT_B, IDENT_EXCHANGE_URL: ident.base, GITORIA_TICKETS_URL: 'http://127.0.0.1:1', ...extraEnv },
72. stdio: ['ignore', 'pipe', 'pipe'],
73. });
74. server.stdout.on('data', d => log += d); server.stderr.on('data', d => log += d);
75. }
76. async function serverUp() {
77. for (let i = 0; i < 80; i++) { try { const r = await fetch(API + '/api/repos'); if (r.ok) return; } catch {} await sleep(250); }
78. throw new Error('gitoria did not come up\n' + log);
79. }
80. async function stopServer() {
81. if (!server) return;
82. try { server.kill('SIGTERM'); } catch {}
83. await new Promise(r => { if (server.exitCode !== null || server.signalCode !== null) return r(); server.once('exit', r); setTimeout(r, 3000); });
84. server = null;
85. }
86. function patient(page) {
87. const waitFor = page.waitFor.bind(page);
88. page.waitFor = (expr, o = {}) => waitFor(expr, { ...o, timeout: (o.timeout || 10000) * 3 });
89. const goto = page.goto.bind(page);
90. page.goto = (url, o = {}) => goto(url, { ...o, timeout: (o.timeout || 15000) * 3 });
91. return page;
92. }
93. const hydrated = (page) => page.waitFor('!!window.__hl && window.__hl.socket && window.__hl.socket.readyState === 1', { label: 'page hydrated' });
94. const txt = (page, sel) => page.evaluate(`(document.querySelector(${J(sel)}) || {}).textContent || null`);
95. const has = (page, sel) => page.evaluate(`!!document.querySelector(${J(sel)})`);
96. const noOverflow = (page) => page.evaluate('document.documentElement.scrollWidth <= window.innerWidth');
98. // the real git client. HOST = the repo address mapped to 127.0.0.1; credentials in the URL when given
99. const GIT_ENV = { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_CONFIG_NOSYSTEM: '1', HOME: WORK, LC_ALL: 'C' };
100. function git(cwd, args, slug, extra = {}) {
101. const pre = slug ? ['-c', `http.curloptResolve=${slug}.gitoria.test:${extra.port || PROXY}:127.0.0.1`] : [];
102. const { port: _p, ...envExtra } = extra;
103. // async: the proxy of this gate lives in this process, a blocking spawnSync would starve it
104. return new Promise((res) => {
105. const c = spawn('git', [...pre, '-c', 'user.name=Gate', '-c', '[email protected]', '-c', 'init.defaultBranch=main', ...args], { cwd, env: { ...GIT_ENV, ...envExtra } });
106. let out = ''; c.stdout.on('data', d => out += d); c.stderr.on('data', d => out += d);
107. const t = setTimeout(() => c.kill('SIGKILL'), 120000);
108. c.on('close', (code) => { clearTimeout(t); res({ code, out }); });
109. });
110. }
111. const urlOf = (slug, user, pass, port = PROXY) => `http://${user ? `${user}:${pass}@` : ''}${slug}.gitoria.test:${port}/${slug}.git`;
113. const KEYDIR = join(STORE, 'keys');
114. mkdirSync(KEYDIR, { recursive: true });
115. const newKey = (name, type = 'ed25519', extra = []) => {
116. spawnSync('ssh-keygen', ['-q', '-t', type, ...extra, '-N', '', '-C', name + '@gate', '-f', join(KEYDIR, name)]);
117. return { file: join(KEYDIR, name), pub: readFileSync(join(KEYDIR, name + '.pub'), 'utf8').trim() };
118. };
119. const sshCmd = (key) => `ssh -i ${key.file} -p ${SSHPORT} -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -o LogLevel=ERROR`;
120. const sgit = (cwd, args, key) => git(cwd, args, null, { GIT_SSH_COMMAND: sshCmd(key) });
121. const sshRaw = (key, cmd) => new Promise((res) => {
122. const c = spawn('sh', ['-c', `${sshCmd(key)} [email protected] ${cmd}`]);
123. let out = ''; c.stdout.on('data', d => out += d); c.stderr.on('data', d => out += d);
124. const t = setTimeout(() => c.kill('SIGKILL'), 30000);
125. c.on('close', (code) => { clearTimeout(t); res({ code, out }); });
126. });
127. const SURL = (slug) => `ssh://[email protected]:${SSHPORT}/${slug}.git`;
128. async function addKeyInChrome(A, name, pub) {
129. await A.evaluate(`(() => { const n = document.querySelector('#keyname'); n.value = ${J(name)}; n.dispatchEvent(new Event('input', { bubbles: true })); const t = document.querySelector('#keytext'); t.value = ${J(pub)}; t.dispatchEvent(new Event('input', { bubbles: true })); })()`);
130. await A.click('#keysave');
131. }
133. try {
134. ident = await startIdent({ identDir: IDENT_DIR, workDir: join(STORE, 'ident'), port: IDENT_PORT });
135. const alice = await ident.signIn('[email protected]');
136. const bob = await ident.signIn('[email protected]');
137. const APPKEY = await ident.registerApp(alice, 'gitoria (ssh gate)', [BASE]);
138. startServer({ IDENT_API_KEY: APPKEY.key, IDENT_API_SECRET: APPKEY.secret, GITORIA_SSH_SECRET: SECRET, GITORIA_SSH_PORT: String(SSHPORT) });
139. await serverUp();
140. // the sshd container: host network (reaches the app on 127.0.0.1), repos = this store's git folder
141. mkdirSync(join(STORE, 'git'), { recursive: true });
142. spawnSync('docker', ['rm', '-f', CONTAINER]);
143. const built = spawnSync('docker', ['build', '-q', '-t', 'gitoria-sshd-gate', join(APP, 'docker/sshd')], { encoding: 'utf8' });
144. check('sshd image builds', built.status === 0, built.stderr);
145. const started = spawnSync('docker', ['run', '-d', '--rm', '--name', CONTAINER, '--network', 'host', '-e', 'GITORIA_SSH_SECRET=' + SECRET, '-e', 'GITORIA_SSH_PORT=' + SSHPORT, '-e', 'GITORIA_URL=' + API, '-v', join(STORE, 'git') + ':/repos', 'gitoria-sshd-gate'], { encoding: 'utf8' });
146. check('sshd container starts', started.status === 0, started.stderr);
147. for (let i = 0; i < 40; i++) { const r = spawnSync('sh', ['-c', `ssh-keyscan -p ${SSHPORT} 127.0.0.1 2>/dev/null | grep -c ssh-`], { encoding: 'utf8' }); if (Number(r.stdout) > 0) break; await sleep(250); }
149. // ---- the internal endpoints: only with the secret, never through the proxy ------------------------------------
150. const H = `gitoria.test:${PORT}`;
151. check('internal: /__git/keys without the secret is 403', (await hreq('GET', '/__git/keys?type=ssh-ed25519&key=AAAAC3NzaC1lZDI1NTE5AAAAIx', H)).status === 403);
152. check('internal: /__git/keys with a wrong secret is 403', (await hreq('GET', '/__git/keys?type=ssh-ed25519&key=AAAAC3NzaC1lZDI1NTE5AAAAIx', H, { 'x-gitoria-secret': 'nope' })).status === 403);
153. check('internal: with the secret but through a proxy (X-Forwarded-For) is 403', (await hreq('GET', '/__git/access?user=x&slug=y&write=0', H, { 'x-gitoria-secret': SECRET, 'x-forwarded-for': '1.2.3.4' })).status === 403);
154. check('internal: an unknown key gets an empty answer', (await hreq('GET', '/__git/keys?type=ssh-ed25519&key=AAAAC3NzaC1lZDI1NTE5AAAAIx', H, { 'x-gitoria-secret': SECRET })).body === '');
156. // ---- alice in Chrome: log in, name, create a repo, add keys -----------------------------------------------------
157. const b = await launchBrowser({ debugPortRange: [CH_FROM, CH_TO] });
158. browsers.push(b);
159. const A = patient(await b.newPage());
160. pageA = A;
161. const [ck, cv] = alice.cookie.split('=');
162. await A.send('Network.enable');
163. await A.send('Network.setCookie', { name: ck, value: cv, url: IDENT_B + '/' });
164. await A.goto(BASE + '/');
165. await A.waitForSelector('#loginbutton');
166. await hydrated(A);
167. check('keys: signed out, the main page offers no key form', !(await has(A, '#keyform')));
168. await A.click('#loginbutton');
169. await A.waitForSelector('#chooselist', { timeout: 10000 });
170. await hydrated(A);
171. await A.click('#chooselist li:nth-child(1) .choose');
172. await A.waitForSelector('#nameform');
173. await hydrated(A);
174. await A.type('#displayname', 'alice');
175. await A.click('#namesave');
176. await A.waitFor('!document.querySelector("#nameform") && !!document.querySelector("#createform")', { label: 'named' });
177. await A.type('#slug', 'gamma');
178. await A.click('#createsave');
179. await A.waitForSelector('#created');
180. await A.waitFor('!!document.querySelector("#keyform")', { label: 'key form' });
181. check('keys: logged in, "You have no SSH keys yet"', await has(A, '#nokeys'));
183. const k1 = newKey('laptop');
184. await addKeyInChrome(A, 'laptop', 'this is not a key');
185. await A.waitFor('document.querySelector("#keyerror").textContent.length > 0', { label: 'error' });
186. check('keys: text that is not a key is refused with a reason', /not a public key/.test(await txt(A, '#keyerror')), await txt(A, '#keyerror'));
187. await addKeyInChrome(A, 'laptop', readFileSync(k1.file, 'utf8').split('\n').slice(0, 2).join('\n'));
188. await A.waitFor('/PRIVATE/.test(document.querySelector("#keyerror").textContent)', { label: 'private key error' });
189. check('keys: a PRIVATE key is refused and never stored', true);
190. await addKeyInChrome(A, 'laptop', 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIabc broken');
191. await A.waitFor('/not valid/.test(document.querySelector("#keyerror").textContent)', { label: 'invalid error' });
192. check('keys: a key with a broken body is refused', true);
193. const weak = newKey('weak', 'rsa', ['-b', '1024']);
194. await addKeyInChrome(A, 'weak', weak.pub);
195. await A.waitFor('/2048|not valid/.test(document.querySelector("#keyerror").textContent)', { label: 'weak error' });
196. check('keys: a 1024-bit RSA key is refused', true);
197. await addKeyInChrome(A, 'laptop', k1.pub);
198. await A.waitFor('document.querySelectorAll("#keylist li").length === 1', { label: 'key added' });
199. await sleep(400);
200. check('keys: the key is added and listed with name and SHA256 fingerprint', /laptop/.test(await txt(A, '#keylist')) && /SHA256:/.test(await txt(A, '#keylist')) && !(await txt(A, '#keyerror')), (await txt(A, '#keylist')) + ' / error: ' + (await txt(A, '#keyerror')));
201. const fp = spawnSync('ssh-keygen', ['-l', '-f', k1.file + '.pub'], { encoding: 'utf8' }).stdout.split(' ')[1];
202. check('keys: the shown fingerprint is the real one', (await txt(A, '#keylist')).includes(fp), fp);
203. await addKeyInChrome(A, 'again', k1.pub);
204. await A.waitFor('/already/.test(document.querySelector("#keyerror").textContent)', { label: 'dup' });
205. check('keys: the same key twice is refused', true);
206. const rsa = newKey('rsa', 'rsa', ['-b', '3072']);
207. await A.evaluate('document.querySelector("#keyerror").textContent = ""');
208. await addKeyInChrome(A, 'old-rsa', rsa.pub);
209. await A.waitFor('document.querySelectorAll("#keylist li").length === 2', { label: 'rsa added' });
210. check('keys: a 3072-bit RSA key is accepted', true);
212. // ---- the box on the (empty) repo's Code page (gitoria#20) ---------------------------------------------------------
213. await A.goto(REPO('gamma') + '/code');
214. await A.waitFor('!!document.querySelector("#addcode")');
215. check('box: the ssh clone command is on the repo page', (await txt(A, '#sshclonecommand')) === `git clone ssh://[email protected]:${SSHPORT}/gamma.git`, await txt(A, '#sshclonecommand'));
216. check('box: it links to the SSH keys on the main address', (await A.evaluate('document.querySelector("#tosshkeys").getAttribute("href")')) === BASE + '/#sshkeys');
218. // ---- real ssh + git ------------------------------------------------------------------------------------------------
219. const W = (n) => join(WORK, n);
220. let g = await sgit(WORK, ['clone', SURL('gamma'), 'first'], k1);
221. check('ssh git: cloning the empty repo works', g.code === 0 && /empty repository/.test(g.out), g.out);
222. writeFileSync(join(W('first'), 'README.md'), '# gamma\n\nPushed over **ssh**.\n');
223. writeFileSync(join(W('first'), 'big.bin'), randomBytes(3000000));
224. await git(W('first'), ['add', '.']); await git(W('first'), ['commit', '-qm', 'first over ssh']);
225. g = await sgit(W('first'), ['push', 'origin', 'main'], k1);
226. check('ssh git: the owner pushes (3 MB) with the key', g.code === 0 && /main -> main/.test(g.out), g.out);
227. g = await sgit(WORK, ['clone', SURL('gamma'), 'second'], rsa);
228. check('ssh git: the owner\'s RSA key clones the pushed commit', g.code === 0 && readFileSync(join(W('second'), 'big.bin')).equals(readFileSync(join(W('first'), 'big.bin'))), g.out);
229. writeFileSync(join(W('second'), 'more.txt'), 'more\n'); await git(W('second'), ['add', '.']); await git(W('second'), ['commit', '-qm', 'second']);
230. g = await sgit(W('second'), ['push', 'origin', 'main'], rsa);
231. check('ssh git: a push with the second key (fast-forward) works', g.code === 0, g.out);
232. g = await sgit(W('first'), ['pull', '--no-rebase', '--no-edit', 'origin', 'main'], k1);
233. check('ssh git: pull brings the new commit', g.code === 0 && existsSync(join(W('first'), 'more.txt')), g.out);
234. await A.goto(REPO('gamma') + '/');
235. await A.waitFor('/Pushed over/.test((document.querySelector("#homepage") || {}).textContent || "")', { label: 'readme after ssh push' });
236. check('pushed code: the Readme page shows what was pushed over ssh', true);
237. const bare = await git(WORK, ['--git-dir', join(STORE, 'git', 'gamma.git'), 'log', '--format=%s']);
238. check('pushed code: the bare repo holds both commits', bare.out.trim().split('\n').join(',') === 'second,first over ssh', bare.out);
240. // ---- what must NOT work ------------------------------------------------------------------------------------------
241. const stranger = newKey('stranger');
242. g = await sgit(WORK, ['clone', SURL('gamma'), 'nokey'], stranger);
243. check('ssh git: a key nobody added is refused', g.code !== 0 && /Permission denied|publickey/.test(g.out), g.out);
244. let r = await sshRaw(k1, 'ls /');
245. check('ssh: no shell — any other command is refused', r.code !== 0 && /only git clone, fetch and push/.test(r.out), J(r));
246. r = await sshRaw(k1, '');
247. check('ssh: an interactive login is refused too', r.code !== 0 && !/repos|bin/.test(r.out), J(r));
248. r = await sshRaw(k1, "\"git-upload-pack '../../etc'\"");
249. check('ssh: a path outside the repos is refused', r.code !== 0 && /no such repository/.test(r.out), J(r));
250. r = await sshRaw(k1, "\"git-upload-pack 'nope.git'\"");
251. check('ssh: an unknown repo is refused', r.code !== 0 && /no such repository/.test(r.out), J(r));
252. r = await sshRaw(k1, "\"git-upload-pack 'gamma.git; id'\"");
253. check('ssh: a command smuggled behind the repo name is refused', r.code !== 0 && !/uid=/.test(r.out), J(r));
254. const fwd = spawn('sh', ['-c', `${sshCmd(k1)} -o ExitOnForwardFailure=no -L 8709:127.0.0.1:${PORT} -N [email protected]`]);
255. await sleep(1500);
256. const viaTunnel = spawnSync('curl', ['-s', '-m', '5', '-o', '/dev/null', '-w', '%{http_code}', 'http://127.0.0.1:8709/api/repos'], { encoding: 'utf8' }).stdout;
257. fwd.kill();
258. check('ssh: no port forwarding through a key', viaTunnel !== '200', 'tunnel answered ' + viaTunnel);
260. // bob: a key of his own may read but not push to alice's repo
261. const bobCode = await ident.selectorCode(bob, APPKEY, BASE);
262. const bl = await fetch(API + '/login/callback?ident_code=' + bobCode, { redirect: 'manual' });
263. const bobCookie = (bl.headers.get('set-cookie') || '').split(';')[0];
264. await fetch(API + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', cookie: bobCookie }, body: J({ t: 'emit', i: 1, event: 'gitoriaSaveName', payload: ['bob'] }) });
265. const bobKey = newKey('bob');
266. const bk = await fetch(API + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', cookie: bobCookie }, body: J({ t: 'emit', i: 2, event: 'gitoriaAddKey', payload: ['bobs', bobKey.pub] }) });
267. const bkt = await bk.text();
268. check('keys: bob adds his own key (a face, own session)', !!(JSON.parse(bkt).value || {}).row, bkt);
269. g = await sgit(WORK, ['clone', SURL('gamma'), 'bobs'], bobKey);
270. check('ssh git: another user\'s key may read (public repo)', g.code === 0 && existsSync(join(W('bobs'), 'more.txt')), g.out);
271. writeFileSync(join(W('bobs'), 'evil.txt'), 'x\n'); await git(W('bobs'), ['add', '.']); await git(W('bobs'), ['commit', '-qm', 'evil']);
272. g = await sgit(W('bobs'), ['push', 'origin', 'main'], bobKey);
273. check('ssh git: another user\'s key may not push — only the owner may', g.code !== 0 && /only the owner/.test(g.out), g.out);
274. const bd = await fetch(API + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json', cookie: bobCookie }, body: J({ t: 'emit', i: 3, event: 'gitoriaAddKey', payload: ['stolen', k1.pub] }) });
275. const bdt = await bd.text();
276. check('keys: alice\'s key cannot be added again by bob', /already/.test(bdt), bdt);
277. const fk = await fetch(API + '/__hl/emit', { method: 'POST', headers: { 'content-type': 'application/json' }, body: J({ t: 'emit', i: 4, event: 'gitoriaAddKey', payload: ['x', stranger.pub, { user: { id: 'y' } }] }) });
278. const fkt = await fk.text();
279. const fkr = await sgit(WORK, ['ls-remote', SURL('gamma')], stranger);
280. check('keys: a forged session argument adds no key', fkr.code !== 0, fkt);
282. // remove a key: stops at once; the other one still works
283. await A.goto(BASE + '/');
284. await A.waitFor('document.querySelectorAll("#keylist li").length === 2', { label: 'keys after reload' });
285. await hydrated(A);
286. check('keys: the list survives a reload', (await txt(A, '#keylist')).includes('laptop'));
287. await A.evaluate('document.querySelector("#keylist li .removekey").click()');
288. await A.waitFor('document.querySelectorAll("#keylist li").length === 1', { label: 'one removed' });
289. const left = (await txt(A, '#keylist')).includes('laptop') ? 'laptop' : 'old-rsa';
290. g = await sgit(W('first'), ['ls-remote', 'origin'], rsa);
291. const g2 = await sgit(W('first'), ['ls-remote', 'origin'], k1);
292. check('keys: a removed key stops working at once, the other one still works', left === 'laptop' && g.code !== 0 && g2.code === 0, `left=${left} rsa=${g.code} laptop=${g2.code}`);
293. await A.click('#logout');
294. await A.waitFor('!document.querySelector("#keyform")', { label: 'key form gone at logout' });
295. check('keys: logout hides the key form', !(await has(A, '#keyform')) && !(await has(A, '.removekey')));
296. for (const [w, name] of [[390, 'phone'], [1280, 'wide']]) {
297. await A.send('Emulation.setDeviceMetricsOverride', { width: w, height: 900, deviceScaleFactor: 1, mobile: w < 600 });
298. await A.goto(REPO('gamma') + '/code');
299. await A.waitFor('!!document.querySelector("#crumbs")');
300. check(`layout ${w}px: the pushed repo's code page has no horizontal overflow`, await noOverflow(A));
301. const { data } = await A.send('Page.captureScreenshot', { format: 'png', captureBeyondViewport: true });
302. writeFileSync(join(SCRATCH, `ssh-${name}.png`), Buffer.from(data, 'base64'));
303. }
304. const problems = A.problems().filter(m => !/favicon|ERR_|Failed to load resource/.test(m.text));
305. check('browser: no console errors', problems.length === 0, problems.map(m => m.text).join(' | '));
306. check('server log: no error other than absorbed ones', !/error(?!: absorbed)/i.test(log.replace(/error absorbed[^\n]*/g, '')), log.split('\n').filter(l => /error/i.test(l)).slice(0, 5).join(' | '));
307. } catch (e) {
308. failures++;
309. console.log('FAIL gate crashed — ' + (e && e.stack || e));
310. if (pageA) { try { console.log('DOM: ' + (await pageA.evaluate('document.querySelector("#sshkeys") ? document.querySelector("#sshkeys").outerHTML.slice(0, 1500) : location.href'))); } catch {} }
311. console.log('sshd log: ' + spawnSync('docker', ['logs', '--tail', '30', CONTAINER], { encoding: 'utf8' }).stderr);
312. } finally {
313. for (const b of browsers) { try { await b.close(); } catch {} }
314. spawnSync('docker', ['rm', '-f', CONTAINER]);
315. await stopServer();
316. if (ident) await ident.stop();
317. writeFileSync(join(SCRATCH, 'ssh-server.log'), log);
318. console.log(`${passes} passed, ${failures} failed`);
319. process.exit(failures ? 1 : 0);
320. }