oficina / home Public

Download this file

1	package home
2
3	import (
4	"net/http"
5	"strings"
6	"testing"
7	)
8
9	func TestDirectoryCatalogRequiresSigninAndDoesNotInventLaunchDestinations(t *testing.T) {
10	f := newMountedChooser(t)
11	// "/" answers the front page to a visitor with no session, and the
12	// catalogue only to a session that exists. The property under test is
13	// unchanged and is the second condition: the catalogue — team choosers,
14	// per-app entry paths — must never reach an anonymous request. What
15	// changed is the mechanism. This used to 303 to /auth/start, which sent
16	// every stranger who typed oficina.works to a sign-in form; it now
17	// renders the front page, so the assertion is on CONTENT rather than on
18	// a status code, which is the thing that actually matters.
19	anonymous := f.request("GET", "/", "", "", nil)
20	anonymousBody := anonymous.Body.String()
21	if anonymous.Code != 200 || !strings.Contains(anonymousBody, "office suite") {
22	t.Fatal("anonymous directory did not serve the front page", anonymous.Code, anonymous.Header())
23	}
24	for _, leak := range []string{"Choose a team", `href="/apps/`, docsEntryPath} {
25	if strings.Contains(anonymousBody, leak) {
26	t.Fatal("anonymous front page exposed catalogue", leak)
27	}
28	}
29	noStore(t, anonymous)
30	if len(anonymous.Result().Cookies()) != 0 {
31	t.Fatal("front page set a cookie on an anonymous request")
32	}
33	// A cookie that does not resolve must degrade to the front page, not to
34	// a redirect loop and not to a partial catalogue render.
35	tampered := f.request("GET", "/", "", "", &http.Cookie{Name: f.p.directory.sessions.CookieName(), Value: "not-a-token"})
36	if tampered.Code != 200 || !strings.Contains(tampered.Body.String(), "office suite") ||
37	strings.Contains(tampered.Body.String(), "Choose a team") {
38	t.Fatal("tampered cookie did not degrade to the front page", tampered.Code)
39	}
40
41	cookie := f.session(t, chooserPerson)
42	page := f.request("GET", "/", "", "", cookie)
43	if page.Code != 200 {
44	t.Fatal(page.Code)
45	}
46	noStore(t, page)
47	body := page.Body.String()
48	for _, name := range []string{"Docs", "Sheets", "Slides", "Calendar", "Calls", "Memoria", "Mail", "Files"} {
49	if !strings.Contains(body, ">"+name+"<") {
50	t.Fatal("missing app", name)
51	}
52	}
53	if strings.Count(body, "<a home-app ") != 6 || strings.Count(body, `href="/help/open-source"`) != 1 || !strings.Contains(body, `href="/apps/docs"`) || !strings.Contains(body, "Choose a team") || hasOtherScript(body) {
54	t.Fatal("catalog advertised unsupported launch", body)
55	}
56	if strings.Count(body, "Not connected to Oficina yet") != 0 || strings.Count(body, "Coming soon") != 0 || strings.Count(body, "Separate sign-in") != 2 {
57	t.Fatal("catalog readiness missing", body)
58	}
59	entry := f.request("GET", docsEntryPath, "", "", cookie)
60	if entry.Code != 200 || !strings.Contains(entry.Body.String(), "This account has no team with Docs available.") {
61	t.Fatal("catalog bypassed team selection", entry.Code)
62	}
63	}
64
65	func TestDirectoryCatalogPreviewKeepsDocsChooserPolicy(t *testing.T) {
66	f := newMountedChooser(t)
67	cfg := *f.p.directory.runtime
68	cfg.docsPreviewOrigin = "https://overnight-docs.bds.oncarlos.com"
69	app, err := NewRuntime(cfg, f.p.directory.db, quietLogger())
70	if err != nil {
71	t.Fatal(err)
72	}
73	f.handler = app.Router()
74	cookie := f.session(t, chooserPerson)
75	page := f.request("GET", "/?return_to=https://evil.example", "", "", cookie)
76	body := page.Body.String()
77	if page.Code != 200 || !strings.Contains(body, `href="https://overnight-docs.bds.oncarlos.com/signin"`) || !strings.Contains(body, "Open preview") || strings.Count(body, "Choose a team") != 5 || strings.Contains(body, "evil.example") || strings.Count(body, "<a home-app ") != 6 || strings.Count(body, `href="/help/open-source"`) != 1 {
78	t.Fatal("preview navigation incorrect", page.Code, body)
79	}
80	noStore(t, page)
81	// Spec shared-chrome §6.2(b): /apps/docs follows the preview too, to
82	// its root, rather than ending on "No teams available" (this test
83	// asserted the chooser until round 2).
84	entry := f.request("GET", docsEntryPath, "", "", cookie)
85	if entry.Code != 303 || entry.Header().Get("Location") != "https://overnight-docs.bds.oncarlos.com/" {
86	t.Fatal("preview entry", entry.Code, entry.Header().Get("Location"))
87	}
88	cfg.docsPreviewOrigin = "https://evil.example/path"
89	if _, err := NewRuntime(cfg, f.p.directory.db, quietLogger()); err != errExchangeConfig {
90	t.Fatal("constructor bypassed preview config validation", err)
91	}
92	}
93
94	func TestRuntimeDocsPreviewOriginIsOptionalAndStrict(t *testing.T) {
95	_, keys := runtimeEnv(t)
96	t.Setenv("HOME_ROLE", "directory")
97	t.Setenv("HOME_ASSERTION_KEYS", keys)
98	for _, origin := range []string{"", "https://overnight-docs.bds.oncarlos.com"} {
99	t.Setenv("HOME_DOCS_PREVIEW_ORIGIN", origin)
100	cfg, err := LoadRuntime("directory.db", quietLogger())
101	if err != nil || cfg.docsPreviewOrigin != origin {
102	t.Fatal("valid preview config refused", err)
103	}
104	}
105	for _, origin := range []string{
106	"http://docs.example", "//docs.example", "https://user@docs.example", "https://docs.example/", "https://docs.example/signin",
107	"https://docs.example?x=1", "https://docs.example#fragment", "https://docs.example?", "https://docs.example#",
108	"https://docs.example:443", "https://docs.example:8443", "https://DOCS.example", "HTTPS://docs.example",
109	"https://docs.example.", "https://127.0.0.1", "https://[::1]", " https://docs.example", "https://docs.example\n",
110	"https://docs%2eexample", "https://docs_example", "https://-docs.example", "https://docs..example", Origin, directoryOrigin,
111	} {
112	t.Setenv("HOME_DOCS_PREVIEW_ORIGIN", origin)
113	if _, err := LoadRuntime("directory.db", quietLogger()); err != errExchangeConfig {
114	t.Fatalf("invalid preview config accepted %q: %v", origin, err)
115	}
116	}
117	t.Setenv("HOME_DOCS_PREVIEW_ORIGIN", "https://overnight-docs.bds.oncarlos.com")
118	for _, role := range []string{"", "credential"} {
119	t.Setenv("HOME_ROLE", role)
120	if _, err := LoadRuntime("home.db", quietLogger()); err != errExchangeConfig {
121	t.Fatal("preview setting accepted outside directory", role, err)
122	}
123	}
124	}
125
126	func TestAppPreviewManifestIsClosedAndUnambiguous(t *testing.T) {
127	_, keys := runtimeEnv(t)
128	t.Setenv("HOME_ROLE", "directory")
129	t.Setenv("HOME_ASSERTION_KEYS", keys)
130	for _, raw := range []string{
131	`null`, `{}`, `[]`, `{"unknown":"https://unknown.example"}`, `{"Docs":"https://docs.example"}`,
132	`{"sheets":""}`, `{"sheets":"https://user@sheets.example"}`, `{"sheets":"https://sheets.example/path"}`,
133	`{"sheets":"https://sheets.example","sheets":"https://other.example"}`,
134	`{"sheets":"https://id.oficina.works"}`, `{"sheets":"https://oficina.works"}`,
135	} {
136	t.Setenv("HOME_APP_PREVIEW_ORIGINS", raw)
137	if _, err := LoadRuntime("directory.db", quietLogger()); err != errExchangeConfig {
138	t.Fatalf("accepted invalid app manifest %s: %v", raw, err)
139	}
140	}
141	t.Setenv("HOME_APP_PREVIEW_ORIGINS", `{"sheets":"https://sheets.example","memoria":"https://memoria.example"}`)
142	cfg, err := LoadRuntime("directory.db", quietLogger())
143	if err != nil || cfg.appPreviewOrigins["sheets"] != "https://sheets.example" {
144	t.Fatal("valid manifest refused", err)
145	}
146	t.Setenv("HOME_DOCS_PREVIEW_ORIGIN", "https://docs.example")
147	if _, err = LoadRuntime("directory.db", quietLogger()); err != nil {
148	t.Fatal("legacy Docs cannot coexist with other apps", err)
149	}
150	t.Setenv("HOME_APP_PREVIEW_ORIGINS", `{"docs":"https://docs.example"}`)
151	if _, err = LoadRuntime("directory.db", quietLogger()); err != errExchangeConfig {
152	t.Fatal("ambiguous Docs accepted", err)
153	}
154	t.Setenv("HOME_DOCS_PREVIEW_ORIGIN", "")
155	for _, role := range []string{"", "credential"} {
156	t.Setenv("HOME_ROLE", role)
157	if _, err = LoadRuntime("home.db", quietLogger()); err != errExchangeConfig {
158	t.Fatal("app manifest accepted on wrong role", role, err)
159	}
160	}
161	}
162
163	func TestConfiguredAppsLaunchOnlyOperatorDestinations(t *testing.T) {
164	f := newMountedChooser(t)
165	cfg := *f.p.directory.runtime
166	cfg.appPreviewOrigins = map[string]string{"sheets": "https://sheets.example", "memoria": "https://memoria.example"}
167	app, err := NewRuntime(cfg, f.p.directory.db, quietLogger())
168	if err != nil {
169	t.Fatal(err)
170	}
171	f.handler = app.Router()
172	page := f.request("GET", "/?app=slides&origin=https://attacker.example", "", "", f.session(t, chooserPerson))
173	body := page.Body.String()
174	if page.Code != 200 || strings.Count(body, "<a home-app ") != 6 || strings.Count(body, `href="/help/open-source"`) != 1 || !strings.Contains(body, `href="https://sheets.example/signin"`) || !strings.Contains(body, `href="https://memoria.example/signin"`) || !strings.Contains(body, `href="/apps/docs"`) || strings.Contains(body, "attacker.example") {
175	t.Fatal(page.Code, body)
176	}
177	noStore(t, page)
178	cfg.appPreviewOrigins["unknown"] = "https://unknown.example"
179	if _, err := NewRuntime(cfg, f.p.directory.db, quietLogger()); err != errExchangeConfig {
180	t.Fatal("constructor bypassed app manifest validation", err)
181	}
182	}
183
184	// TestAppEntryFollowsPreviewOrigins is spec shared-chrome §6.2(b): the
185	// switcher's tiles link to /apps/<slug>, so in a preview deployment that
186	// entry must reach the preview, as the catalog's own link does, instead
187	// of "No teams available". It goes to the preview's root, like the
188	// single-team redirect: the app's own guard decides whether to sign in.
189	// A preview is an operator choice, not a team route, so no directory
190	// session or team is needed to follow it.
191	func TestAppEntryFollowsPreviewOrigins(t *testing.T) {
192	f := newMountedChooser(t)
193	cfg := *f.p.directory.runtime
194	cfg.docsPreviewOrigin = "https://overnight-docs.bds.oncarlos.com"
195	cfg.appPreviewOrigins = map[string]string{"sheets": "https://sheets.example", "calls": "https://calls-preview.example"}
196	app, err := NewRuntime(cfg, f.p.directory.db, quietLogger())
197	if err != nil {
198	t.Fatal(err)
199	}
200	f.handler = app.Router()
201	cookie := f.session(t, chooserPerson)
202	for path, want := range map[string]string{
203	"/apps/docs": "https://overnight-docs.bds.oncarlos.com/",
204	"/apps/sheets": "https://sheets.example/",
205	"/apps/calls": "https://calls-preview.example/",
206	} {
207	for _, c := range []*http.Cookie{cookie, nil} {
208	r := f.request("GET", path, "", "", c)
209	noStore(t, r)
210	if r.Code != 303 || r.Header().Get("Location") != want {
211	t.Fatal(path, c != nil, r.Code, r.Header().Get("Location"))
212	}
213	}
214	// The entry still refuses any query, so nothing rides the hop.
215	if r := f.request("GET", path+"?return_to=/secret", "", "", cookie); r.Code != 404 {
216	t.Fatal(path, "query accepted", r.Code)
217	}
218	}
219	// An app without a preview keeps its team entry.
220	if r := f.request("GET", "/apps/slides", "", "", cookie); r.Code != 200 || !strings.Contains(r.Body.String(), "No teams available") {
221	t.Fatal("non-preview app changed", r.Code, r.Header().Get("Location"))
222	}
223	}
224