62 lines
2.2 KiB
TypeScript
62 lines
2.2 KiB
TypeScript
import { expect, test } from "@playwright/test";
|
|
|
|
test("runs from a nested path and keeps authentication material local", async ({
|
|
page,
|
|
}) => {
|
|
const requests: string[] = [];
|
|
page.on("request", (request) => requests.push(request.url()));
|
|
await page.goto("/deep/nested/auth/");
|
|
await expect(page.getByText("Sensitive session · memory only")).toBeVisible();
|
|
await expect(
|
|
page.getByRole("heading", { name: "Credential parameters" }),
|
|
).toBeVisible();
|
|
await page.getByLabel("Issuer").fill("Example");
|
|
await page.getByLabel("Account").fill("alice@example.test");
|
|
await expect(page.getByText("TOTP code")).toBeVisible();
|
|
await expect(page.locator(".qr svg")).toBeVisible();
|
|
expect(
|
|
requests.every((url) => new URL(url).origin === "http://127.0.0.1:4173"),
|
|
).toBe(true);
|
|
});
|
|
|
|
test("computes an RFC OCRA vector and decodes client data", async ({
|
|
page,
|
|
}) => {
|
|
await page.goto("/deep/nested/auth/");
|
|
await page.getByRole("button", { name: "OCRA challenge" }).click();
|
|
await page
|
|
.getByLabel("Base32 shared secret")
|
|
.fill("GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ");
|
|
await page.getByRole("button", { name: "Compute OCRA response" }).click();
|
|
await expect(page.getByText("237653")).toBeVisible();
|
|
|
|
await page.getByRole("button", { name: /WebAuthn \/ Passkeys/ }).click();
|
|
const client = btoa(
|
|
JSON.stringify({
|
|
type: "webauthn.get",
|
|
challenge: "YQ",
|
|
origin: "https://example.test",
|
|
}),
|
|
)
|
|
.replaceAll("+", "-")
|
|
.replaceAll("/", "_")
|
|
.replace(/=+$/u, "");
|
|
await page.getByLabel("Encoded input").fill(client);
|
|
await page.getByRole("button", { name: "Decode locally" }).click();
|
|
await expect(page.locator(".diagnostic-output")).toContainText(
|
|
"webauthn.get",
|
|
);
|
|
});
|
|
|
|
test("shared origin exposes inspection but not live credential creation", async ({
|
|
page,
|
|
}) => {
|
|
await page.goto("/deep/nested/auth/");
|
|
await page.getByRole("button", { name: /WebAuthn \/ Passkeys/ }).click();
|
|
await page.getByRole("button", { name: "Live ceremony" }).click();
|
|
await expect(page.getByText("Inspect only")).toBeVisible();
|
|
await expect(
|
|
page.getByRole("button", { name: "Create test credential" }),
|
|
).toBeDisabled();
|
|
});
|