feat: release OTP and Passkey Tools 0.1.0

2026-08-19 12:19:35 +02:00
commit f1cb2d7151
67 changed files with 12802 additions and 0 deletions
@@ -0,0 +1,61 @@
+import { expect, test } from "@playwright/test";
+
+test("runs from a nested path and keeps authentication material local", async ({
+  page,
+}) => {
+  const requests: string[] = [];
+  page.on("request", (request) => requests.push(request.url()));
+  await page.goto("/deep/nested/auth/");
+  await expect(page.getByText("Sensitive session · memory only")).toBeVisible();
+  await expect(
+    page.getByRole("heading", { name: "Credential parameters" }),
+  ).toBeVisible();
+  await page.getByLabel("Issuer").fill("Example");
+  await page.getByLabel("Account").fill("alice@example.test");
+  await expect(page.getByText("TOTP code")).toBeVisible();
+  await expect(page.locator(".qr svg")).toBeVisible();
+  expect(
+    requests.every((url) => new URL(url).origin === "http://127.0.0.1:4173"),
+  ).toBe(true);
+});
+
+test("computes an RFC OCRA vector and decodes client data", async ({
+  page,
+}) => {
+  await page.goto("/deep/nested/auth/");
+  await page.getByRole("button", { name: "OCRA challenge" }).click();
+  await page
+    .getByLabel("Base32 shared secret")
+    .fill("GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ");
+  await page.getByRole("button", { name: "Compute OCRA response" }).click();
+  await expect(page.getByText("237653")).toBeVisible();
+
+  await page.getByRole("button", { name: /WebAuthn \/ Passkeys/ }).click();
+  const client = btoa(
+    JSON.stringify({
+      type: "webauthn.get",
+      challenge: "YQ",
+      origin: "https://example.test",
+    }),
+  )
+    .replaceAll("+", "-")
+    .replaceAll("/", "_")
+    .replace(/=+$/u, "");
+  await page.getByLabel("Encoded input").fill(client);
+  await page.getByRole("button", { name: "Decode locally" }).click();
+  await expect(page.locator(".diagnostic-output")).toContainText(
+    "webauthn.get",
+  );
+});
+
+test("shared origin exposes inspection but not live credential creation", async ({
+  page,
+}) => {
+  await page.goto("/deep/nested/auth/");
+  await page.getByRole("button", { name: /WebAuthn \/ Passkeys/ }).click();
+  await page.getByRole("button", { name: "Live ceremony" }).click();
+  await expect(page.getByText("Inspect only")).toBeVisible();
+  await expect(
+    page.getByRole("button", { name: "Create test credential" }),
+  ).toBeDisabled();
+});