adminandClaude Opus 5.5
48ec722660
Claude Code should be able to work inside the user's open editor tab. This first stage connects the two and lets the agent look: what the user sees and a picture of it. Changing the project comes in stage 2. - An agent token per account opens only /mcp, no API route. The dialog "Agent tokens..." in the account menu creates it once, shows the ready "claude mcp add" line and revokes it. The server keeps only its sha256 (api/lib/AgentTokens.php). - Wrong tokens count into the sign-in brake from #427. Changing the password, renaming or deleting an account ends its tokens. - The relay (tools/mcp/) is a small Node service without packages, WebSocket server included. It runs in the container feuerwerk-mcp because PHP-FPM cannot hold connections. Whether a token or a tab ticket is valid is still decided by the PHP API, through two routes that answer only with the relay key. - The tab joins over WebSocket on the same origin with the normal session, an Origin check and a one-time ticket. It connects only after "Agent" is switched on in the account menu. One tab per account is active, a new one takes over. Guests get nothing. - Tools: get_view (project, tab, document, selection with names, camera, play state, open dialog) and screenshot. The resource feuerwerk://view can be subscribed. Claude Code does not act on that reliably, so a changed view is also noted on the next answer. - A badge next to the account menu shows the connected agents. It counts only agents with an open stream or a request in the last two minutes. - CI starts the relay in front of php -S (tools/ci/serve.sh), and e2e 71 runs the whole path in the browser. Found on the live test: the badge showed four agents because old sessions of revoked tokens were still counted. Tests: - Gate on atx: 316 files, 4888 tests - relay protocol test with fake API and fake tabs: 23/23 - get_view, tools, socketUrl: 16/16 - PHP agents 29, rights 103 checks - e2e 71 on atx 10/10, against the live site 10/10, no CSP violation - real Claude Code against the live site: get_view answered - ZAP against /mcp: nothing at High or Medium - every new check fails when the guard it covers is taken out (6) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
413 lines
22 KiB
PHP
413 lines
22 KiB
PHP
<?php
|
||
declare(strict_types=1);
|
||
|
||
// A command-line script: under a web server it does nothing (#427).
|
||
if (PHP_SAPI !== 'cli') {
|
||
exit(1);
|
||
}
|
||
|
||
/**
|
||
* Who may do what (#427): every route of the API asked by somebody signed out, by the owner of what
|
||
* it is about, by another account and by an administrator. The API runs for real under `php -S` on
|
||
* a scratch directory (FEUERWERK_DATA) with a small quota (FEUERWERK_QUOTA_BYTES), so nothing of a
|
||
* checkout's own data is touched.
|
||
*
|
||
* Each route the header comment of api/index.php names has to be in the matrix: a new route that is
|
||
* not asked about here makes this test fail rather than stay open unnoticed.
|
||
*
|
||
* Plain PHP like releases.test.php; CI runs it with `php tests/php/rights.test.php`.
|
||
*/
|
||
|
||
require __DIR__ . '/../../api/lib/AtomicFile.php';
|
||
require __DIR__ . '/../../api/lib/UserStore.php';
|
||
|
||
$failed = 0;
|
||
$passed = 0;
|
||
|
||
function check(string $name, bool $ok, mixed $got = null): void
|
||
{
|
||
global $failed, $passed;
|
||
if ($ok) {
|
||
$passed++;
|
||
echo "PASS {$name}\n";
|
||
return;
|
||
}
|
||
$failed++;
|
||
echo "FAIL {$name}", $got === null ? '' : ' — got ' . json_encode($got, JSON_UNESCAPED_SLASHES), "\n";
|
||
}
|
||
|
||
const QUOTA = 300_000;
|
||
|
||
$root = dirname(__DIR__, 2);
|
||
$base = sys_get_temp_dir() . '/feuerwerk-php-rights-' . bin2hex(random_bytes(4));
|
||
$data = "{$base}/data";
|
||
mkdir("{$base}/www", 0775, true);
|
||
mkdir($data, 0775, true);
|
||
symlink($root, "{$base}/www/feuerwerk");
|
||
|
||
$users = new UserStore("{$data}/users.json");
|
||
$users->put('alice', 'password-alice', 'user');
|
||
$users->put('bob', 'password-bob', 'user');
|
||
$users->put('root', 'password-root', 'admin');
|
||
$users->put('carol', 'password-carol', 'user');
|
||
|
||
$probe = stream_socket_server('tcp://127.0.0.1:0');
|
||
$port = (int) substr((string) stream_socket_get_name($probe, false), strrpos((string) stream_socket_get_name($probe, false), ':') + 1);
|
||
fclose($probe);
|
||
$server = proc_open(
|
||
[PHP_BINARY, '-S', "127.0.0.1:{$port}", '-t', "{$base}/www"],
|
||
[0 => ['file', '/dev/null', 'r'], 1 => ['file', '/dev/null', 'w'], 2 => ['file', "{$base}/server.log", 'w']],
|
||
$pipes,
|
||
null,
|
||
['FEUERWERK_DATA' => $data, 'FEUERWERK_QUOTA_BYTES' => (string) QUOTA] + getenv(),
|
||
);
|
||
register_shutdown_function(static function () use ($server, $base): void {
|
||
proc_terminate($server);
|
||
exec('rm -rf ' . escapeshellarg($base));
|
||
});
|
||
|
||
/**
|
||
* One request against the API.
|
||
*
|
||
* @param array<string,string> $headers
|
||
* @return array{status:int,body:mixed,headers:list<string>}
|
||
*/
|
||
function call(string $method, string $route, ?string $cookie = null, mixed $body = null, array $headers = []): array
|
||
{
|
||
global $port;
|
||
$lines = [];
|
||
if ($cookie !== null) {
|
||
$lines[] = "Cookie: feuerwerk_session={$cookie}";
|
||
}
|
||
foreach ($headers as $name => $value) {
|
||
$lines[] = "{$name}: {$value}";
|
||
}
|
||
$content = '';
|
||
if (is_string($body)) {
|
||
$content = $body;
|
||
$lines[] = 'Content-Type: application/octet-stream';
|
||
} elseif ($body !== null) {
|
||
$content = (string) json_encode($body);
|
||
$lines[] = 'Content-Type: application/json';
|
||
}
|
||
$context = stream_context_create(['http' => [
|
||
'method' => $method,
|
||
'header' => implode("\r\n", $lines),
|
||
'content' => $content,
|
||
'ignore_errors' => true,
|
||
'timeout' => 20,
|
||
]]);
|
||
[$path, $query] = array_pad(explode('&', $route, 2), 2, null);
|
||
$url = "http://127.0.0.1:{$port}/feuerwerk/api/index.php?r=" . $path . ($query === null ? '' : "&{$query}");
|
||
$text = @file_get_contents($url, false, $context);
|
||
$received = $http_response_header ?? [];
|
||
preg_match('#^HTTP/\S+ (\d{3})#', $received[0] ?? '', $status);
|
||
return [
|
||
'status' => (int) ($status[1] ?? 0),
|
||
'body' => $text === false || $text === '' ? null : json_decode($text, true),
|
||
'headers' => $received,
|
||
];
|
||
}
|
||
|
||
function signIn(string $name, string $password): string
|
||
{
|
||
$answer = call('POST', 'auth/login', null, ['username' => $name, 'password' => $password]);
|
||
foreach ($answer['headers'] as $line) {
|
||
if (preg_match('/^Set-Cookie: feuerwerk_session=([^;]+)/i', $line, $match)) {
|
||
return $match[1];
|
||
}
|
||
}
|
||
throw new RuntimeException("{$name} could not sign in: " . json_encode($answer));
|
||
}
|
||
|
||
$up = false;
|
||
for ($i = 0; $i < 50 && !$up; $i++) {
|
||
usleep(100_000);
|
||
$up = call('GET', 'auth/session')['status'] === 200;
|
||
}
|
||
check('the API comes up on its scratch directory', $up, @file_get_contents("{$base}/server.log"));
|
||
if (!$up) {
|
||
exit(1);
|
||
}
|
||
|
||
/** A PNG of one pixel: the smallest image the texture store takes. */
|
||
$png = base64_decode('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==');
|
||
$wav = static fn(int $bytes, string $tag): string => 'RIFF' . pack('V', 36) . 'WAVE' . str_repeat("\0", $bytes) . $tag;
|
||
|
||
$alice = signIn('alice', 'password-alice');
|
||
$bob = signIn('bob', 'password-bob');
|
||
$admin = signIn('root', 'password-root');
|
||
|
||
// What the matrix asks about: a project of alice's that uses an image of hers, with a snapshot and a
|
||
// release, and a sound of hers that nothing uses.
|
||
$project = call('POST', 'projects', $alice, ['name' => 'Alice'])['body'];
|
||
$texture = call('POST', 'textures&name=a.png', $alice, $png)['body']['file'] ?? '';
|
||
$sound = call('POST', 'sounds&name=a.wav', $alice, $wav(32, 'alice'))['body']['file'] ?? '';
|
||
$saved = call('PUT', "projects/{$project['id']}", $alice, [
|
||
'revision' => 1,
|
||
'project' => ['id' => $project['id'], 'name' => 'Alice', 'assets' => [['id' => 't', 'file' => $texture]]],
|
||
]);
|
||
$snapshot = call('POST', "projects/{$project['id']}/snapshots", $alice, ['name' => 'One'])['body'];
|
||
$release = call('POST', "projects/{$project['id']}/release", $alice)['body'];
|
||
// An administrator makes a demo copy of it and offers her image to everybody (#428).
|
||
$demo = call('POST', "projects/{$project['id']}/demo", $admin)['body'];
|
||
$offered = call('PATCH', "textures/{$texture}", $admin, ['demo' => true])['status'];
|
||
check(
|
||
'alice has her project, image, sound, snapshot, release and a demo copy, her image is offered',
|
||
$saved['status'] === 200 && $texture !== '' && $sound !== '' && isset($snapshot['id'], $release['token'], $demo['token']) && $offered === 204,
|
||
[$saved['status'], $texture, $sound, $snapshot, $release, $demo, $offered],
|
||
);
|
||
// An agent token of alice's (#429), which only the relay's routes take.
|
||
$agent = call('POST', 'agent-tokens', $alice, ['name' => 'Claude Code', 'days' => 7])['body'];
|
||
$folder = explode('/', $texture)[0];
|
||
$p = $project['id'];
|
||
$s = $snapshot['id'];
|
||
$missing = $folder . '/' . str_repeat('0', 64);
|
||
|
||
/**
|
||
* Method, route, body, the route as the header comment of api/index.php names it, and the status
|
||
* expected from [signed out, alice who owns it, bob who does not, an administrator]; null where
|
||
* asking would destroy what the next rows need.
|
||
*
|
||
* @var list<array{0:string,1:string,2:mixed,3:string,4:array{0:?int,1:?int,2:?int,3:?int}}>
|
||
*/
|
||
$matrix = [
|
||
['GET', 'auth/session', null, 'GET auth/session', [200, 200, 200, 200]],
|
||
['POST', 'auth/login', ['username' => 'carol', 'password' => 'password-carol'], 'POST auth/login', [200, 200, 200, 200]],
|
||
['POST', 'auth/logout', null, 'POST auth/logout', [204, null, null, null]],
|
||
['POST', 'auth/password', ['currentPassword' => 'x', 'newPassword' => ''], 'POST auth/password', [401, 422, 422, 422]],
|
||
|
||
['GET', 'users', null, 'GET users', [401, 403, 403, 200]],
|
||
['POST', 'users', ['username' => '', 'password' => '', 'role' => 'user'], 'POST users', [401, 403, 403, 422]],
|
||
['PATCH', 'users/alice', [], 'PATCH users/{}', [401, 403, 403, 200]],
|
||
['DELETE', 'users/nobody', null, 'DELETE users/{}', [401, 403, 403, 404]],
|
||
|
||
['GET', 'projects', null, 'GET projects', [401, 200, 200, 200]],
|
||
['POST', 'projects', ['name' => ''], 'POST projects', [401, 422, 422, 422]],
|
||
['GET', "projects/{$p}", null, 'GET projects/{}', [401, 200, 404, 200]],
|
||
['PUT', "projects/{$p}", ['revision' => 999, 'project' => []], 'PUT projects/{}', [401, 409, 404, 409]],
|
||
['DELETE', "projects/{$p}", null, 'DELETE projects/{}', [401, null, 404, 403]],
|
||
['GET', "projects/{$p}/snapshots", null, 'GET projects/{}/snapshots', [401, 200, 404, 200]],
|
||
['POST', "projects/{$p}/snapshots", [], 'POST projects/{}/snapshots', [401, 201, 404, 201]],
|
||
['DELETE', "projects/{$p}/snapshots/{$s}", null, 'DELETE projects/{}/snapshots/{}', [401, null, 404, null]],
|
||
['POST', "projects/{$p}/snapshots/{$s}/restore", ['revision' => -1], 'POST projects/{}/snapshots/{}/restore', [401, 409, 404, 409]],
|
||
['GET', "projects/{$p}/release", null, 'GET projects/{}/release', [401, 200, 404, 200]],
|
||
['POST', "projects/{$p}/release", null, 'POST projects/{}/release', [401, 200, 404, 200]],
|
||
['DELETE', "projects/{$p}/release", null, 'DELETE projects/{}/release', [401, null, 404, null]],
|
||
['GET', "releases/{$release['token']}", null, 'GET releases/{}', [200, 200, 200, 200]],
|
||
['GET', 'demos', null, 'GET demos', [200, 200, 200, 200]],
|
||
['GET', "demos/{$demo['token']}", null, 'GET demos/{}', [200, 200, 200, 200]],
|
||
['GET', "projects/{$p}/demo", null, 'GET projects/{}/demo', [401, 403, 403, 200]],
|
||
['POST', "projects/{$p}/demo", null, 'POST projects/{}/demo', [401, 403, 403, 200]],
|
||
['DELETE', "projects/{$p}/demo", null, 'DELETE projects/{}/demo', [401, 403, 403, null]],
|
||
|
||
['GET', 'textures', null, 'GET textures', [200, 200, 200, 200]],
|
||
['POST', 'textures&name=b.png', $png, 'POST textures', [401, 201, 201, 201]],
|
||
['DELETE', "textures/{$texture}", null, 'DELETE textures/{}', [401, 409, 403, 409]],
|
||
['PATCH', "textures/{$texture}", ['demo' => true], 'PATCH textures/{}', [401, 403, 403, 204]],
|
||
['GET', 'fonts', null, 'GET fonts', [200, 200, 200, 200]],
|
||
['POST', 'fonts&name=x.ttf', 'not a font at all', 'POST fonts', [401, 422, 422, 422]],
|
||
['DELETE', "fonts/{$missing}.ttf", null, 'DELETE fonts/{}', [401, 404, 403, 404]],
|
||
['PATCH', "fonts/{$missing}.ttf", ['demo' => true], 'PATCH fonts/{}', [401, 403, 403, 404]],
|
||
['GET', 'sounds', null, 'GET sounds', [200, 200, 200, 200]],
|
||
['POST', 'sounds&name=b.wav', $wav(32, 'b'), 'POST sounds', [401, 201, 201, 201]],
|
||
['DELETE', "sounds/{$sound}", null, 'DELETE sounds/{}', [401, null, 403, null]],
|
||
['PATCH', "sounds/{$sound}", ['demo' => 'yes'], 'PATCH sounds/{}', [401, 403, 403, 422]],
|
||
['GET', 'videos', null, 'GET videos', [200, 200, 200, 200]],
|
||
['POST', 'videos&name=x.mov&convert=0', 'not a video at all', 'POST videos', [401, 422, 422, 422]],
|
||
['POST', "videos/{$missing}.mp4/convert", null, 'POST videos/{}/convert', [401, 404, 403, 404]],
|
||
['DELETE', "videos/{$missing}.mp4", null, 'DELETE videos/{}', [401, 404, 403, 404]],
|
||
['PATCH', "videos/{$missing}.mp4", ['demo' => true], 'PATCH videos/{}', [401, 403, 403, 404]],
|
||
['POST', 'pixels', 'not a cel', 'POST pixels', [401, 422, 422, 422]],
|
||
['GET', 'plugins', null, 'GET plugins', [200, 200, 200, 200]],
|
||
['GET', 'plugins/nothing.js', null, 'GET plugins/{}', [404, 404, 404, 404]],
|
||
|
||
['GET', 'agent-tokens', null, 'GET agent-tokens', [401, 200, 200, 200]],
|
||
['POST', 'agent-tokens', ['name' => ''], 'POST agent-tokens', [401, 422, 422, 422]],
|
||
['DELETE', "agent-tokens/{$agent['id']}", null, 'DELETE agent-tokens/{}', [401, null, 404, 404]],
|
||
['POST', 'agent/ticket', null, 'POST agent/ticket', [401, 200, 200, 200]],
|
||
// Without the relay's key they are not there, for anybody.
|
||
['POST', 'agent/verify', ['token' => $agent['token'], 'address' => '192.0.2.1'], 'POST agent/verify', [404, 404, 404, 404]],
|
||
['POST', 'agent/redeem', ['ticket' => str_repeat('0', 64)], 'POST agent/redeem', [404, 404, 404, 404]],
|
||
];
|
||
|
||
$actors = ['signed out' => null, 'alice' => $alice, 'bob' => $bob, 'an administrator' => $admin];
|
||
foreach ($matrix as [$method, $route, $body, $documented, $expected]) {
|
||
$got = [];
|
||
$want = [];
|
||
foreach (array_values($actors) as $i => $cookie) {
|
||
if ($expected[$i] === null) {
|
||
continue;
|
||
}
|
||
$got[] = call($method, $route, $cookie, $body)['status'];
|
||
$want[] = $expected[$i];
|
||
}
|
||
check("{$documented}: " . implode(' / ', array_map(
|
||
static fn(string $who, ?int $status): string => "{$who} " . ($status ?? '-'),
|
||
array_keys($actors),
|
||
$expected,
|
||
)), $got === $want, $got);
|
||
}
|
||
|
||
// Every route the API documents is asked about above.
|
||
preg_match_all('/^\s*\*\s+(GET|POST|PUT|PATCH|DELETE)\s+\?r=([^\s&\[]+)/m', (string) file_get_contents("{$root}/api/index.php"), $found, PREG_SET_ORDER);
|
||
$documentedRoutes = array_values(array_unique(array_map(
|
||
static fn(array $m): string => $m[1] . ' ' . preg_replace('/\{[^}]*\}/', '{}', $m[2]),
|
||
$found,
|
||
)));
|
||
$asked = array_unique(array_column($matrix, 3));
|
||
$unasked = array_values(array_diff($documentedRoutes, $asked));
|
||
check('every route of the API is in the matrix', count($documentedRoutes) > 30 && $unasked === [], $unasked ?: count($documentedRoutes));
|
||
check('and the matrix asks about no route the API does not name', array_values(array_diff($asked, $documentedRoutes)) === [], array_values(array_diff($asked, $documentedRoutes)));
|
||
|
||
// --- Demo copies and demo material (#428) ---------------------------------------------------------
|
||
|
||
$signedOut = call('GET', 'textures')['body'];
|
||
check(
|
||
'signed out, the image list is the offered image alone, without who uploaded it',
|
||
count($signedOut) === 1 && $signedOut[0]['file'] === $texture && $signedOut[0]['demo'] === true
|
||
&& $signedOut[0]['owner'] === null && $signedOut[0]['deletable'] === false,
|
||
$signedOut,
|
||
);
|
||
$bobs = call('GET', 'textures', $bob)['body'];
|
||
$hers = array_values(array_filter($bobs, static fn(array $item): bool => $item['file'] === $texture));
|
||
check(
|
||
'another account lists it beside its own, offered and not for it to delete',
|
||
count($hers) === 1 && $hers[0]['demo'] === true && $hers[0]['deletable'] === false && $hers[0]['owner'] === 'alice',
|
||
$hers,
|
||
);
|
||
check(
|
||
'its owner sees it marked as well',
|
||
in_array(true, array_column(call('GET', 'textures', $alice)['body'], 'demo'), true),
|
||
);
|
||
check('the signed-out sound list is empty while nothing is offered', call('GET', 'sounds')['body'] === []);
|
||
call('PATCH', "sounds/{$sound}", $admin, ['demo' => true]);
|
||
$kept = call('DELETE', "sounds/{$sound}", $alice);
|
||
check(
|
||
'its owner cannot delete a file while everybody is offered it',
|
||
$kept['status'] === 409 && str_contains((string) ($kept['body']['error'] ?? ''), 'demo material'),
|
||
$kept,
|
||
);
|
||
$demos = call('GET', 'demos')['body'];
|
||
check('the demo list names the copy, signed out', array_column($demos, 'name') === ['Alice'] && $demos[0]['token'] === $demo['token'], $demos);
|
||
$opened = call('GET', "demos/{$demo['token']}")['body'];
|
||
check('a demo copy goes out under its token, not the project id', ($opened['project']['id'] ?? null) === $demo['token'], $opened);
|
||
check('an unknown demo is not found', call('GET', 'demos/' . str_repeat('0', 32))['status'] === 404);
|
||
check('a demo cannot be changed through its open route', call('POST', "demos/{$demo['token']}", $admin)['status'] === 404);
|
||
|
||
// --- The MCP relay's routes (#429) ----------------------------------------------------------------
|
||
|
||
$relayKey = bin2hex(random_bytes(32));
|
||
file_put_contents("{$data}/mcp-relay.key", $relayKey . "\n");
|
||
$relay = ['X-Relay-Key' => $relayKey];
|
||
$verify = static fn(string $token, string $address, array $headers): array =>
|
||
call('POST', 'agent/verify', null, ['token' => $token, 'address' => $address], $headers);
|
||
|
||
$known = $verify($agent['token'], '192.0.2.1', $relay);
|
||
check('with the key, the relay learns whose token it is', $known['status'] === 200 && $known['body'] === ['user' => 'alice', 'role' => 'user'], $known);
|
||
check('with a wrong key the route is not there', $verify($agent['token'], '192.0.2.1', ['X-Relay-Key' => str_repeat('a', 64)])['status'] === 404);
|
||
check('a wrong token is 401', $verify('fwa_' . str_repeat('0', 64), '192.0.2.1', $relay)['status'] === 401);
|
||
check(
|
||
'an agent token opens no route of the API',
|
||
call('GET', 'projects', null, null, ['Authorization' => "Bearer {$agent['token']}"])['status'] === 401,
|
||
);
|
||
|
||
$ticket = call('POST', 'agent/ticket', $alice)['body'];
|
||
check('a tab gets a ticket for a minute', preg_match('/^[0-9a-f]{64}$/', (string) ($ticket['ticket'] ?? '')) === 1 && $ticket['expiresIn'] === 60, $ticket);
|
||
check('asked without the key, it is not taken', call('POST', 'agent/redeem', null, ['ticket' => $ticket['ticket']])['status'] === 404);
|
||
$redeemed = call('POST', 'agent/redeem', null, ['ticket' => $ticket['ticket']], $relay);
|
||
check('the relay redeems it for its account', $redeemed['status'] === 200 && $redeemed['body']['user'] === 'alice', $redeemed);
|
||
check('once', call('POST', 'agent/redeem', null, ['ticket' => $ticket['ticket']], $relay)['status'] === 401);
|
||
|
||
$guesses = [];
|
||
for ($i = 0; $i < 5; $i++) {
|
||
$guesses[] = $verify('fwa_' . str_repeat((string) $i, 64), '198.51.100.9', $relay)['status'];
|
||
}
|
||
$braked = $verify($agent['token'], '198.51.100.9', $relay);
|
||
check(
|
||
'five wrong tokens from one address, and even the right one waits there, with Retry-After',
|
||
$guesses === [401, 401, 401, 401, 401] && $braked['status'] === 429 && preg_grep('/^Retry-After: \d+$/i', $braked['headers']) !== [],
|
||
[$guesses, $braked['status']],
|
||
);
|
||
check('another address is not braked', $verify($agent['token'], '192.0.2.1', $relay)['status'] === 200);
|
||
|
||
$bobsToken = call('POST', 'agent-tokens', $bob, ['name' => 'bob'])['body'];
|
||
check('another account cannot revoke alice’s token', call('DELETE', "agent-tokens/{$agent['id']}", $bob)['status'] === 404);
|
||
check(
|
||
'an account lists its own tokens, never a token itself',
|
||
array_column(call('GET', 'agent-tokens', $bob)['body'], 'id') === [$bobsToken['id']]
|
||
&& !array_key_exists('token', call('GET', 'agent-tokens', $bob)['body'][0]),
|
||
);
|
||
check('alice revokes hers', call('DELETE', "agent-tokens/{$agent['id']}", $alice)['status'] === 204);
|
||
check('and the relay no longer takes it', $verify($agent['token'], '192.0.2.1', $relay)['status'] === 401);
|
||
check('a token lasts at most a year', call('POST', 'agent-tokens', $alice, ['name' => 'x', 'days' => 366])['status'] === 422);
|
||
|
||
$second = call('POST', 'agent-tokens', $alice, ['name' => 'again'])['body'];
|
||
call('POST', 'auth/password', $alice, ['currentPassword' => 'password-alice', 'newPassword' => 'password-alice-2']);
|
||
check('a new password ends the account’s tokens', $verify($second['token'], '192.0.2.1', $relay)['status'] === 401);
|
||
call('PATCH', 'users/bob', $admin, ['password' => 'password-bob-2']);
|
||
check('so does one an administrator sets', $verify($bobsToken['token'], '192.0.2.1', $relay)['status'] === 401);
|
||
$bob = signIn('bob', 'password-bob-2');
|
||
|
||
// --- Paths, depth and unknown routes --------------------------------------------------------------
|
||
|
||
check('an unknown route is 401 signed out', call('GET', 'nothing')['status'] === 401);
|
||
check('and 404 signed in', call('GET', 'nothing', $alice)['status'] === 404);
|
||
check('a path that climbs out of a store is refused for a user', call('DELETE', 'textures/../users.json', $bob)['status'] === 403);
|
||
check('and not found for an administrator', call('DELETE', 'textures/../users.json', $admin)['status'] === 404);
|
||
check('a project id that climbs out is no project id', call('GET', 'projects/..%2Fusers', $alice)['status'] === 400);
|
||
check('a route deeper than its kind allows is not there', call('GET', "projects/{$p}/snapshots/{$s}/restore/more", $alice)['status'] === 404);
|
||
check('the accounts file is still there', is_file("{$data}/users.json"));
|
||
|
||
// --- Requests from other sites --------------------------------------------------------------------
|
||
|
||
check(
|
||
'a write from another site is refused before anything else',
|
||
call('POST', 'projects', $alice, ['name' => 'x'], ['Sec-Fetch-Site' => 'cross-site'])['status'] === 403,
|
||
);
|
||
check(
|
||
'so is one from a sibling subdomain',
|
||
call('POST', 'auth/login', null, ['username' => 'alice', 'password' => 'password-alice'], ['Sec-Fetch-Site' => 'same-site'])['status'] === 403,
|
||
);
|
||
check(
|
||
'the editor’s own page passes',
|
||
call('POST', 'projects', $alice, ['name' => ''], ['Sec-Fetch-Site' => 'same-origin'])['status'] === 422,
|
||
);
|
||
check('reading from another site is no write', call('GET', 'projects', $alice, null, ['Sec-Fetch-Site' => 'cross-site'])['status'] === 200);
|
||
|
||
// --- Quota ----------------------------------------------------------------------------------------
|
||
|
||
$large = $wav(QUOTA, 'large');
|
||
$refused = call('POST', 'sounds&name=large.wav', $alice, $large);
|
||
check(
|
||
'an upload past the quota is refused with 413, saying how full the account is',
|
||
$refused['status'] === 413 && str_contains((string) ($refused['body']['error'] ?? ''), 'Not enough space'),
|
||
$refused,
|
||
);
|
||
check('an administrator has no quota', call('POST', 'sounds&name=large.wav', $admin, $large)['status'] === 201);
|
||
$big = ['id' => $p, 'name' => 'Alice', 'assets' => [], 'pad' => str_repeat('x', QUOTA)];
|
||
check('so is a save that would grow a project past it', call('PUT', "projects/{$p}", $alice, ['revision' => 2, 'project' => $big])['status'] === 413);
|
||
check('a save that keeps it small goes through', call('PUT', "projects/{$p}", $alice, ['revision' => 2, 'project' => ['name' => 'Alice']])['status'] === 200);
|
||
|
||
// --- Deleting the project takes its copies along ---------------------------------------------------
|
||
|
||
check('deleting the project', call('DELETE', "projects/{$p}", $alice)['status'] === 204);
|
||
check('takes its demo copy along', call('GET', "demos/{$demo['token']}")['status'] === 404 && call('GET', 'demos')['body'] === []);
|
||
|
||
// --- Sign-ins: the brake -------------------------------------------------------------------------
|
||
|
||
$gone = signIn('carol', 'password-carol');
|
||
check('signing out ends that session', call('POST', 'auth/logout', $gone)['status'] === 204 && call('GET', 'projects', $gone)['status'] === 401);
|
||
$wrong = [];
|
||
for ($i = 0; $i < 5; $i++) {
|
||
$wrong[] = call('POST', 'auth/login', null, ['username' => 'bob', 'password' => 'guess'])['status'];
|
||
}
|
||
check('five wrong passwords are five 401', $wrong === [401, 401, 401, 401, 401], $wrong);
|
||
$locked = call('POST', 'auth/login', null, ['username' => 'bob', 'password' => 'password-bob-2']);
|
||
$retry = preg_grep('/^Retry-After: \d+$/i', $locked['headers']);
|
||
check('then even the right one waits, with 429 and Retry-After', $locked['status'] === 429 && $retry !== [], $locked);
|
||
check('the session of somebody already signed in goes on', call('GET', 'projects', $alice)['status'] === 200);
|
||
|
||
echo $failed === 0 ? "ALL PASSED – {$passed} checks\n" : "{$failed} FAILED, {$passed} passed\n";
|
||
exit($failed === 0 ? 0 : 1);
|