23 lines
5.3 KiB
JavaScript
23 lines
5.3 KiB
JavaScript
const {start,assert,DIR,path,fs,sanitized,actors,TARGET}=require('./portal-functional-qa-lib.cjs');
|
|
actors.documentReviewer=JSON.parse(fs.readFileSync(path.join(DIR,'functional-document-revocation-actor-private.json'),'utf8'));
|
|
void(async()=>{const q=await start('functional-document-boundary-chromium-20261011');const contexts=[];try{
|
|
const inspection=JSON.parse(fs.readFileSync(path.join(DIR,'functional-scope-inspection-qa-20261011.json'),'utf8'));
|
|
const links=inspection.links.filter(l=>l.opportunity_id===54);assert.equal(links.length,3);
|
|
async function actor(role){const p=await q.context(role);contexts.push(p.ctx);await q.login(p.page,role);return p.page;}
|
|
async function binary(page,url){const result=await page.evaluate(async u=>{const r=await fetch(u,{headers:{Accept:'application/json'}});const bytes=await r.arrayBuffer();const hash=await crypto.subtle.digest('SHA-256',bytes);return {status:r.status,final_path:new URL(r.url).pathname,target:r.headers.get('X-Investmoz-QA-Target'),sha256:[...new Uint8Array(hash)].map(b=>b.toString(16).padStart(2,'0')).join(''),cache:r.headers.get('cache-control')};},url);assert.equal(result.target,TARGET);return result;}
|
|
async function post(page,url,data){return page.evaluate(async({url,data})=>{const token=decodeURIComponent(document.cookie.split('; ').find(v=>v.startsWith('XSRF-TOKEN='))?.slice(11)??'');const r=await fetch(url,{method:'POST',headers:{Accept:'application/json','Content-Type':'application/json','X-XSRF-TOKEN':token},body:JSON.stringify(data)});return {status:r.status,target:r.headers.get('X-Investmoz-QA-Target'),data:await r.json()};},{url,data});}
|
|
q.phase('Authorized recovery after the shared binary boundary fix');
|
|
for(const role of ['promoter','validator','publisher']){const page=await actor(role);for(const link of links){const r=await binary(page,`/minhas-oportunidades/54/resources/documents/${link.id}/download`);assert.equal(r.status,200);assert.equal(r.sha256,link.sha256);assert(/no-store/.test(r.cache));}(q.proof.authorized_recoveries||=[]).push({role,documents:3,hashes_match:true});}
|
|
const promoter=await actor('promoter');await q.open(promoter,'/minhas-oportunidades/15/resources');await promoter.getByRole('button',{name:'Imagens',exact:true}).click();const preview=promoter.locator('img[src*="/resources/images/"]').first();
|
|
if(await preview.count()){const signed=await preview.getAttribute('src');const valid=await binary(promoter,signed);assert.equal(valid.status,200);const manager=await actor('manager');const denied=await binary(manager,signed);assert([403,404].includes(denied.status));assert.notEqual(denied.sha256,valid.sha256);q.proof.checks.signed_derivative_still_requires_profile=true;q.proof.derivative={status_authorized:200,status_denied:denied.status,sha256:valid.sha256};}else{q.proof.pending_image_boundary='No current derivative on15; image-specific proof must be supplied separately';}
|
|
const manager=await actor('manager');for(const link of links){const r=await binary(manager,'/management/documents/'+link.document_id+'/download');assert.equal(r.status,403);assert.notEqual(r.sha256,link.sha256);}q.proof.checks.management_alias_no_bypass=true;
|
|
const geo=await actor('super_first');let grant=q.prior.assignment_id;
|
|
if(!grant){const r=await post(geo,'/perfis/atribuicoes',{user_id:actors.documentReviewer.id,role:'validator',organization_id:null,opportunity_types:['real_estate'],responsibilities:[],reason:'Ensaio sintético QA de revogação de perfil e proteção dos URLs documentais anteriores.'});assert.equal(r.status,201);assert.equal(r.target,TARGET);grant=r.data.id;q.proof.assignment_id=grant;q.save();}else{q.proof.assignment_id=grant;}
|
|
const reviewer=await actor('documentReviewer'),url=`/minhas-oportunidades/54/resources/documents/${links[0].id}/download`;
|
|
if(!q.prior.revocation_completed){assert.equal((await binary(reviewer,url)).sha256,links[0].sha256);q.proof.checks.grant_allows_document=true;const revoked=await post(geo,'/perfis/atribuicoes/'+grant+'/revogar',{reason:'Revogação sintética QA: confirmar que o URL anteriormente autorizado e a sessão já não dão acesso.'});assert.equal(revoked.status,200);q.proof.revocation_completed=true;q.save();}
|
|
const old=await binary(reviewer,url);assert(old.status!==200||old.final_path==='/login');assert.notEqual(old.sha256,links[0].sha256);q.proof.checks.revoked_old_session_denied=true;
|
|
const fresh=await actor('documentReviewer');const denied=await binary(fresh,url);assert.equal(denied.status,403);q.proof.checks.revoked_new_session_denied=true;
|
|
const anonymous=await q.context('anonymous');contexts.push(anonymous.ctx);await q.open(anonymous.page,'/login');for(const link of links){const r=await binary(anonymous.page,`/minhas-oportunidades/54/resources/documents/${link.id}/download`);assert(r.status!==200||r.final_path==='/login');assert.notEqual(r.sha256,link.sha256);}q.proof.checks.anonymous_attachments_denied=true;
|
|
q.proof.AB_C37_not_repeated=true;q.proof.result='passed';q.save();console.log(JSON.stringify({result:'passed',checks:q.proof.checks,pending:q.proof.pending_image_boundary,active_writes:0}));
|
|
}catch(e){q.proof.result='failed';q.proof.failure=sanitized(e);q.save();console.log(JSON.stringify({result:'failed',failure:q.proof.failure,active_writes:0}));process.exitCode=1;}finally{for(const ctx of contexts)await ctx.close();await q.browser.close();}})();
|