116 lines
4.1 KiB
JavaScript
116 lines
4.1 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { chromium } from "playwright-core";
|
|
|
|
const password = process.env.E2E_PASSWORD;
|
|
assert.ok(password, "E2E_PASSWORD must be set");
|
|
|
|
async function completeKeycloakLogin(page) {
|
|
for (let attempt = 1; attempt <= 2; attempt += 1) {
|
|
await page.locator("#username").fill(
|
|
process.env.E2E_USERNAME ?? "regular-user",
|
|
);
|
|
await page.locator("#password").fill(password);
|
|
await page.locator("#kc-login").click();
|
|
await page.waitForLoadState("domcontentloaded");
|
|
|
|
if (page.url() === "http://localhost:8082/") {
|
|
return;
|
|
}
|
|
if (attempt === 1) {
|
|
await page.goto(
|
|
"http://localhost:8082/oauth2/authorization/keycloak",
|
|
);
|
|
await page.waitForURL(/localhost:8080/u);
|
|
}
|
|
}
|
|
throw new Error(`Keycloak login did not return to AP2: ${page.url()}`);
|
|
}
|
|
|
|
const browser = await chromium.launch({
|
|
executablePath: process.env.CHROME_BIN ?? "/usr/bin/google-chrome",
|
|
headless: true,
|
|
args: ["--no-sandbox"],
|
|
});
|
|
|
|
try {
|
|
const context = await browser.newContext();
|
|
const page = await context.newPage();
|
|
|
|
await page.goto("http://localhost:8082");
|
|
await page.locator("#login").click();
|
|
await page.waitForURL(/localhost:8080/u);
|
|
await completeKeycloakLogin(page);
|
|
|
|
const boundaryResponsePromise = page.waitForResponse((response) =>
|
|
response.url().endsWith("/token/boundary"),
|
|
);
|
|
await page.locator("#inspect").click();
|
|
const boundaryResponse = await boundaryResponsePromise;
|
|
assert.equal(boundaryResponse.status(), 200);
|
|
const boundary = await boundaryResponse.json();
|
|
|
|
assert.equal(boundary.accessTokenStored, true);
|
|
assert.equal(boundary.refreshTokenStored, true);
|
|
assert.equal(boundary.browserReceivesRefreshToken, false);
|
|
assert.equal(JSON.stringify(boundary).includes("refresh_token"), false);
|
|
|
|
const accessResponsePromise = page.waitForResponse((response) =>
|
|
response.url().endsWith("/token/access"),
|
|
);
|
|
const resourceResponsePromise = page.waitForResponse(
|
|
(response) =>
|
|
response.url() === "http://localhost:8081/api/me" &&
|
|
response.request().method() === "GET",
|
|
);
|
|
await page.locator("#call-api").click();
|
|
|
|
const accessResponse = await accessResponsePromise;
|
|
assert.equal(accessResponse.status(), 200);
|
|
assert.match(accessResponse.headers()["cache-control"], /no-store/u);
|
|
const accessHandoff = await accessResponse.json();
|
|
assert.deepEqual(
|
|
Object.keys(accessHandoff).sort(),
|
|
["access_token", "expires_at", "token_type"],
|
|
);
|
|
assert.equal(accessHandoff.token_type, "Bearer");
|
|
assert.equal(typeof accessHandoff.access_token, "string");
|
|
assert.ok(accessHandoff.access_token.length > 100);
|
|
assert.equal(JSON.stringify(accessHandoff).includes("refresh_token"), false);
|
|
|
|
const [, payload] = accessHandoff.access_token.split(".");
|
|
const claims = JSON.parse(
|
|
Buffer.from(payload, "base64url").toString("utf8"),
|
|
);
|
|
const audience = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
|
|
assert.ok(audience.includes("keycloak-pattern-api"));
|
|
|
|
const resourceResponse = await resourceResponsePromise;
|
|
assert.equal(resourceResponse.status(), 200);
|
|
const resource = await resourceResponse.json();
|
|
assert.equal(resource.username, "regular-user");
|
|
assert.ok(resource.audience.includes("keycloak-pattern-api"));
|
|
await page.locator("#result").getByText('"resourceApiStatus": 200').waitFor();
|
|
|
|
const cookies = await context.cookies("http://localhost:8082/");
|
|
const sessionCookie = cookies.find((cookie) => cookie.name === "AP2_SESSION");
|
|
assert.ok(sessionCookie);
|
|
assert.equal(sessionCookie.httpOnly, true);
|
|
assert.equal(sessionCookie.sameSite, "Lax");
|
|
|
|
const storage = await page.evaluate(() => ({
|
|
localStorage: Object.values(localStorage),
|
|
sessionStorage: Object.values(sessionStorage),
|
|
}));
|
|
assert.equal(JSON.stringify(storage).includes("refresh_token"), false);
|
|
assert.equal(
|
|
JSON.stringify(storage).includes(accessHandoff.access_token),
|
|
false,
|
|
);
|
|
|
|
console.log(
|
|
"pattern2 verified: server refresh custody, access-only handoff, direct browser resource call",
|
|
);
|
|
} finally {
|
|
await browser.close();
|
|
}
|