blomios/NodecastV2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix safe login submission, mobile fullscreen, and OIDC discovery

Browse Source
This commit is contained in:
Technomancer702
2026-10-13 18:31:48 -07:00
parent b85b160013
commit ce122eb34b
16 changed files with 479 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

170
test/login-fullscreen.test.js Normal file
View File

@ -0,0 +1,170 @@
const test = require('node:test');
const assert = require('node:assert/strict');
const fs = require('node:fs');
const path = require('node:path');
const http = require('node:http');
const vm = require('node:vm');
function fullscreenFixture(name) {
const window = {}, document = { querySelector: () => player.container };
const helper = { exports: {} };
vm.runInNewContext(fs.readFileSync(path.join(__dirname, '../public/js/components/PlayerFullscreen.js'), 'utf8'), {
module: helper, console: { error() {} }, document
});
const file = name === 'VideoPlayer' ? 'components/VideoPlayer.js' : 'pages/WatchPage.js';
vm.runInNewContext(fs.readFileSync(path.join(__dirname, '../public/js', file), 'utf8'), {
window, document, PlayerFullscreen: helper.exports
});
const player = Object.create(window[name].prototype);
player.container = {}; player.video = {};
return { player, document };
}
for (const name of ['VideoPlayer', 'WatchPage']) {
test(`${name} supports standard, prefixed and native-video fullscreen without invoking disabled APIs`, async () => {
const scenarios = [
{ doc: { fullscreenEnabled: true }, container: 'requestFullscreen', expected: 'standard' },
{ doc: { fullscreenEnabled: false, webkitFullscreenEnabled: true }, container: 'webkitRequestFullscreen', expected: 'prefixed' },
{ doc: { fullscreenEnabled: false, webkitFullscreenEnabled: false }, native: true, expected: 'native' },
{ doc: {}, native: true, expected: 'native' },
{ doc: { fullscreenElement: {} }, exit: 'exitFullscreen', expected: 'exit' },
{ doc: { webkitFullscreenElement: {} }, exit: 'webkitExitFullscreen', expected: 'exit' },
{ doc: {}, nativeExit: true, expected: 'exit-native' }
];
for (const scenario of scenarios) {
const { player, document } = fullscreenFixture(name), calls = [];
Object.assign(document, scenario.doc);
if (scenario.container) player.container[scenario.container] = () => { calls.push(scenario.expected); return Promise.resolve(); };
if (scenario.exit) document[scenario.exit] = () => { calls.push('exit'); };
if (scenario.native) {
player.container.requestFullscreen = () => { throw Error('Disabled element API used'); };
player.container.webkitRequestFullscreen = () => { throw Error('Disabled prefixed API used'); };
player.video.webkitEnterFullscreen = () => { calls.push('native'); };
}
if (scenario.nativeExit) Object.assign(player.video, { webkitDisplayingFullscreen: true, webkitExitFullscreen() { calls.push('exit-native'); } });
const result = player.toggleFullscreen();
assert.deepEqual(calls, [scenario.expected], 'invoke during the originating user gesture');
assert.equal(await result, true);
}
const rejected = fullscreenFixture(name);
rejected.document.fullscreenEnabled = true;
rejected.player.container.requestFullscreen = () => Promise.reject(Error('Fullscreen denied'));
assert.equal(await rejected.player.toggleFullscreen(), false, 'handle rejected promises');
const missing = fullscreenFixture(name);
assert.equal(await missing.player.toggleFullscreen(), false, 'missing API is harmless');
});
}
const browserEnabled = process.env.NODECAST_BROWSER_TESTS === '1';
test('login prevents native GET credential leaks after missing or failed scripts and still supports setup/login',
{ skip: browserEnabled ? false : 'Browser tests enabled in CI', timeout: 45000 }, async t => {
const { chromium } = require('playwright');
const source = fs.readFileSync(path.join(__dirname, '../public/login.html'), 'utf8');
const requests = [];
let mode = 'normal', setup = true;
const server = http.createServer((req, res) => {
const url = new URL(req.url, 'http://fixture');
if (req.method === 'POST') {
let body = '';
req.on('data', chunk => { body += chunk; });
req.on('end', () => {
requests.push({ method: req.method, url: req.url, body, type: req.headers['content-type'] });
res.setHeader('Content-Type', 'application/json');
if (!req.headers['content-type']?.startsWith('application/json')) { res.writeHead(400); res.end('{"error":"JavaScript required"}'); return; }
if (url.pathname === '/api/auth/setup') setup = false;
res.writeHead(url.pathname.endsWith('/setup') ? 201 : 200); res.end('{}');
});
return;
}
requests.push({ method: req.method, url: req.url });
if (url.pathname === '/api/auth/setup-required') {
res.setHeader('Content-Type', 'application/json');
if (mode === 'unavailable') { res.writeHead(503); res.end('{"error":"Unavailable"}'); }
else res.end(JSON.stringify({ setupRequired: setup }));
return;
}
res.setHeader('Content-Type', 'text/html');
if (url.pathname === '/') { res.end('<p>Main app</p>'); return; }
const html = mode === 'broken' ? source.replace('// Start SSO Login', "throw Error('Fixture script failed');\n // Start SSO Login") : source;
res.end(html);
});
await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
t.after(() => new Promise(resolve => { server.close(resolve); server.closeAllConnections(); }));
const base = `http://127.0.0.1:${server.address().port}`;
const browser = await chromium.launch({ headless: true, executablePath: process.env.NODECAST_BROWSER_EXECUTABLE || undefined });
t.after(() => browser.close());
for (const scenario of ['no-js', 'broken']) {
mode = scenario === 'broken' ? 'broken' : 'normal';
const context = await browser.newContext({ javaScriptEnabled: scenario !== 'no-js' });
const page = await context.newPage();
page.on('pageerror', () => {});
await page.route('**/*', route => route.request().url().startsWith(base) ? route.continue() : route.abort());
await page.goto(base + '/login.html');
await page.fill('#username', 'fixture-user'); await page.fill('#password', 'fixture-password');
assert.equal(await page.locator('#submit-btn').isDisabled(), true);
await page.locator('#password').press('Enter');
assert.equal(new URL(page.url()).pathname, '/login.html');
// Even direct native form.submit() must put credentials in a POST body, never a URL.
const sent = page.waitForRequest(request => request.method() === 'POST');
await page.evaluate(() => document.getElementById('login-form').submit());
const request = await sent;
assert.equal(new URL(request.url()).pathname, '/api/auth/login');
assert.equal(new URL(request.url()).search, '');
assert.equal(new URLSearchParams(request.postData()).get('username'), 'fixture-user');
await context.close();
}
mode = 'unavailable';
const failed = await browser.newPage();
await failed.route('**/*', route => route.request().url().startsWith(base) ? route.continue() : route.abort());
await failed.goto(base + '/login.html');
await failed.waitForFunction(() => document.querySelector('#error-message').textContent.includes('Reload'));
assert.equal(await failed.locator('#submit-btn').isDisabled(), true);
await failed.close();
mode = 'normal';
for (const endpoint of ['/api/auth/setup', '/api/auth/login']) {
const page = await browser.newPage();
await page.route('**/*', route => route.request().url().startsWith(base) ? route.continue() : route.abort());
await page.goto(base + '/login.html');
await page.waitForFunction(() => !document.querySelector('#submit-btn').disabled);
assert.equal(await page.locator('#submit-btn').textContent(), endpoint.endsWith('setup') ? 'Create Account' : 'Sign In');
await page.fill('#username', 'fixture-user'); await page.fill('#password', 'fixture-password');
const sent = page.waitForRequest(request => request.url() === base + endpoint && request.method() === 'POST');
await page.click('#submit-btn');
const request = await sent;
assert.deepEqual(JSON.parse(request.postData()), { username: 'fixture-user', password: 'fixture-password' });
await page.waitForURL(base + '/'); await page.close();
}
assert.equal(requests.some(request => /[?&](username|password)=/.test(request.url)), false);
});
test('both real Chromium player buttons enter and exit element fullscreen',
{ skip: browserEnabled ? false : 'Browser tests enabled in CI', timeout: 30000 }, async t => {
const { chromium } = require('playwright');
const scripts = ['/js/components/PlayerFullscreen.js', '/js/components/VideoPlayer.js', '/js/pages/WatchPage.js'];
const root = path.join(__dirname, '../public');
const server = http.createServer((req, res) => {
if (scripts.includes(req.url)) { res.setHeader('Content-Type', 'application/javascript'); res.end(fs.readFileSync(path.join(root, req.url))); return; }
res.setHeader('Content-Type', 'text/html');
res.end(`<div class="watch-video-section"><video></video><button>Fullscreen</button></div>${scripts.map(src => `<script src="${src}"></script>`).join('')}`);
});
await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
t.after(() => new Promise(resolve => { server.close(resolve); server.closeAllConnections(); }));
const browser = await chromium.launch({ headless: true, executablePath: process.env.NODECAST_BROWSER_EXECUTABLE || undefined });
t.after(() => browser.close());
for (const name of ['VideoPlayer', 'WatchPage']) {
const page = await browser.newPage(), errors = [];
page.on('pageerror', error => errors.push(error.message));
await page.goto(`http://127.0.0.1:${server.address().port}`);
await page.evaluate(name => {
const player = Object.create(window[name].prototype);
player.video = document.querySelector('video'); player.container = document.querySelector('.watch-video-section');
document.querySelector('button').addEventListener('click', () => player.toggleFullscreen());
}, name);
await page.click('button');
await page.waitForFunction(() => document.fullscreenElement?.classList.contains('watch-video-section'));
await page.click('button');
await page.waitForFunction(() => document.fullscreenElement === null);
assert.deepEqual(errors, []); await page.close();
}
});