path: root/packages/meshbay-hub/tests/test_desktop_shell.py

"""
The desktop shell's security contract, pinned by reading its source.

There is no npm on the development machine, so the Electron application cannot
be installed or launched here. That is stated plainly rather than worked around:
**nothing below proves the app runs.** What it does prove is that the properties
the design depends on are present in the source, and it fails if one is removed
— which is the same treatment `test_downloads.py` gives the three
browser-specific save paths, for the same reason.

Every assertion here corresponds to a sentence in `docs/desktop-client-v1.md`
§3. Weak evidence, and the only evidence available without a packaged build; a
person with an installed client is what confirms the rest.
"""

import json
import re
from pathlib import Path

import pytest

CLIENT = Path(__file__).resolve().parents[2] / "meshbay-client"
MAIN = CLIENT / "src" / "main.js"
PRELOAD = CLIENT / "src" / "preload.js"
INDEX = CLIENT / "scripts" / "index.html"

pytestmark = pytest.mark.skipif(
    not MAIN.exists(), reason="desktop client sources not present")


def _main() -> str:
    return MAIN.read_text(encoding="utf-8")


def _preload() -> str:
    return PRELOAD.read_text(encoding="utf-8")


# ── The renderer is confined ────────────────────────────────────────────────

@pytest.mark.parametrize("setting", [
    "sandbox: true",
    "contextIsolation: true",
    "nodeIntegration: false",
])
def test_the_renderer_keeps_its_sandbox(setting):
    """
    Electron with these keeps the Chromium renderer sandbox — the strongest
    available, and the reason "native costs the browser sandbox" is false for
    this shell. Without contextIsolation the preload's objects are reachable and
    mutable from page script, which would make the bridge decorative.
    """
    assert setting in _main(), f"{setting} is missing from the window"


def test_the_interface_is_never_loaded_from_the_hub():
    """
    The whole reason this application exists. A shell pointing a WebView at the
    hub's /app/ is a browser with a different icon and fixes nothing (T3).
    """
    source = _main()
    assert "loadURL(`${SCHEME}://" in source or "loadURL('app://" in source
    assert "loadURL('http" not in source and 'loadURL("http' not in source
    assert "loadURL(`http" not in source


def test_navigation_away_from_the_package_is_refused():
    source = _main()
    assert "will-navigate" in source
    assert "setWindowOpenHandler" in source
    assert "event.preventDefault()" in source


def _granted_permissions() -> set[str]:
    """The allowlist, read out of the source rather than described here."""
    match = re.search(r"GRANTED_PERMISSIONS = new Set\(\[([^\]]*)\]\)", _main())
    assert match, "the permission allowlist is gone or was renamed"
    return set(re.findall(r"'([^']+)'", match.group(1)))


def test_the_page_gets_no_camera_microphone_or_location():
    denied = {"media", "geolocation", "midi", "midiSysex", "notifications",
              "pointerLock", "openExternal", "clipboard-read", "hid", "serial",
              "usb", "idle-detection", "window-management"}
    assert not (_granted_permissions() & denied)


def test_video_may_go_fullscreen():
    """
    The regression this replaced a blanket denial to fix, and the reason it is
    worth a test: **a denied `fullscreen` does not reject.** Chromium's own
    video controls ask for it, `requestFullscreen()` returns a promise that
    never settles, and the button does nothing with no error raised anywhere.
    Nothing observable says "permission" — so nothing would have led back here.
    """
    assert "fullscreen" in _granted_permissions()


def test_both_permission_handlers_answer_from_the_same_list():
    """`Permissions.query` takes the check handler and a request takes the
    other; two lists would eventually disagree about what the page may do."""
    source = _main()
    for handler in ("setPermissionRequestHandler", "setPermissionCheckHandler"):
        assert handler in source
        after = source.split(handler, 1)[1][:400]
        assert "GRANTED_PERMISSIONS" in after, (
            f"{handler} decides on its own rather than from the allowlist")


# ── The custom scheme ───────────────────────────────────────────────────────

@pytest.mark.parametrize("privilege", [
    "standard: true",
    "secure: true",
    "supportFetchAPI: true",
    "stream: true",
])
def test_the_scheme_is_privileged(privilege):
    """
    `secure` is what makes it a secure context, and without it **the whole of
    `crypto.subtle` is undefined** — measured, not assumed: the first probe
    loaded a `data:` URL and every algorithm failed with TypeError, AES-GCM
    included. `standard` gives a real origin, so IndexedDB survives an update
    instead of being keyed to something that moves.

    An earlier version of this docstring said `secure` was what let the service
    worker register. That is wrong: Chromium refuses to register a worker on a
    custom scheme whatever its privileges — "The URL protocol of the current
    origin ('app://meshbay') is not supported". The application therefore has no
    service worker and does not need one; it saves files through a native
    dialog, which is better than the path the worker exists to provide.
    """
    assert privilege in _main(), f"{privilege} missing from the scheme privileges"


def test_the_protocol_handler_cannot_be_walked_out_of():
    """
    The renderer parses decrypted content from nodes, which is
    attacker-controlled input. A traversal here would hand it the filesystem.
    """
    source = _main()
    assert "path.resolve(UI_DIR" in source
    assert "startsWith(root + path.sep)" in source
    assert "status: 404" in source


# ── Content Security Policy ─────────────────────────────────────────────────

def test_the_policy_is_sent_as_a_header():
    """
    A <meta> policy cannot carry `frame-ancestors`, and having it there means
    one directive of the policy is decoration. The handler is also the only
    thing that serves the interface, so this is one source rather than two.
    """
    source = _main()
    assert "'Content-Security-Policy': CSP" in source
    assert "Content-Security-Policy" not in INDEX.read_text(encoding="utf-8") \
        .split("-->")[1], "the packaged page still carries a policy of its own"


def test_the_policy_keeps_wasm_unsafe_eval():
    """
    The bundle key is Argon2id in WebAssembly. A policy that forbids it does not
    degrade anything — it locks every user out of their keys.
    """
    assert "'wasm-unsafe-eval'" in _directive("script-src")


def _policy() -> str:
    """
    The policy the protocol handler sends, read out of the CSP constant.

    Not a <meta> tag: `frame-ancestors` is ignored there, and a directive that
    silently does nothing is worse than one that is absent. Chromium said so in
    the console the first time the application was launched.
    """
    import re
    source = _main()
    # The array mixes plain strings and one `${RECAPTCHA_SRC}` template literal;
    # resolve the constant so every directive reads as plain text.
    rec = re.search(r"const RECAPTCHA_SRC = '([^']*)'", source)
    match = re.search(r"const CSP = \[(.*?)\]\.join", source, re.S)
    assert match, "no CSP constant in the main process"
    body = match.group(1)
    if rec:
        body = body.replace("${RECAPTCHA_SRC}", rec.group(1))
    return "; ".join(
        line.strip().strip('`",').strip('`"')
        for line in body.splitlines() if line.strip())


def _directive(name: str) -> str:
    for part in _policy().split(";"):
        part = part.strip()
        if part.startswith(name + " "):
            return part
    return ""


def test_the_hub_is_reachable_but_never_executable():
    """
    connect-src allows the hub's API and its signaling socket. script-src does
    not: nothing the hub returns is ever executed. The only script sources are
    'self', the wasm eval token, and the two reCAPTCHA hosts (see the next
    test) — never a bare `https:` scheme, which would let the hub's own origin
    serve script.
    """
    connect = _directive("connect-src")
    assert "https:" in connect and "wss:" in connect

    script = _directive("script-src")
    assert script, "no script-src directive"
    sources = script.split()[1:]  # drop the "script-src" keyword itself
    allowed = {
        "'self'", "'wasm-unsafe-eval'",
        "https://www.google.com", "https://www.gstatic.com",
    }
    assert set(sources) <= allowed, \
        f"unexpected script-src source: {set(sources) - allowed}"
    assert "https:" not in sources, "a bare https: scheme lets the hub serve script"
    assert "'unsafe-eval'" not in script.replace("'wasm-unsafe-eval'", "")
    assert "default-src 'none'" in _policy()


def test_recaptcha_is_the_only_third_party_and_stays_scoped_to_it():
    """
    reCAPTCHA gates sign-up in the app the same way it does in the browser.
    www.google.com and www.gstatic.com are allowed under script-src, frame-src
    and img-src for that — and no other external origin appears anywhere in the
    policy. Remove this expectation only alongside the reCAPTCHA widget.
    """
    hosts = {"https://www.google.com", "https://www.gstatic.com"}
    for directive in ("script-src", "frame-src", "img-src"):
        srcs = set(_directive(directive).split()[1:])
        assert hosts <= srcs, f"{directive} is missing a reCAPTCHA host"

    for part in _policy().split(";"):
        for tok in part.strip().split()[1:]:
            if tok.startswith(("http://", "https://")):
                assert tok in hosts, f"unexpected external origin in CSP: {tok}"


# ── The bridge ──────────────────────────────────────────────────────────────

def test_the_bridge_is_the_only_way_in():
    source = _preload()
    assert "contextBridge.exposeInMainWorld" in source
    # Handing the raw ipcRenderer to the page would expose every channel in the
    # main process, named or not.
    assert "exposeInMainWorld('meshbay', ipcRenderer" not in source
    assert "ipcRenderer)" not in source.replace("require('electron');", "")


def test_the_renderer_never_names_a_path():
    """
    It asks for a dialog and receives an opaque id; the main process holds the
    handle. A channel that took a path from the renderer and wrote to it would
    be the whole confinement undone.
    """
    source = _preload()
    assert "save:begin" in source
    assert "handle.id" in source
    assert "filePath" not in source, "the preload passes a filesystem path around"


def test_the_hub_address_is_not_fetched_synchronously_over_ipc():
    """
    `platform.hubBase()` runs while the module graph is loading, before anything
    can await. Synchronous IPC would block the renderer on every call for a
    value that cannot change within a run.
    """
    source = _preload()
    assert "--meshbay-hub=" in source
    assert "sendSync" not in source


def test_plain_http_is_refused_except_to_loopback():
    """Anywhere else it would put the session token on the wire in clear."""
    source = _main()
    assert "must be https" in source
    # The guard is a regular expression, so the dot is escaped in the source.
    assert "127\\." in source and "localhost" in source


# ── One interface, one source ───────────────────────────────────────────────

def test_the_interface_is_copied_not_forked():
    """
    §2.7: the hub's static directory is the single source. A silent fork is the
    only real way to end up maintaining the interface twice, so the copy is
    generated and the generated tree is not committed.
    """
    sync = (CLIENT / "scripts" / "sync-ui.js").read_text(encoding="utf-8")
    assert "meshbay-hub" in sync and "static" in sync
    assert "rmSync" in sync, "a stale file could survive a rebuild"

    gitignore = (CLIENT.parents[1] / ".gitignore").read_text(encoding="utf-8")
    assert "meshbay-client/ui/" in gitignore, (
        "the generated copy is committed, which is how a fork begins")


def test_the_packaged_page_loads_the_shared_modules():
    """The app's index.html is its own — the hub's carries a /a/<hash>/ prefix
    that would point back at the hub — but it must load the same files."""
    page = INDEX.read_text(encoding="utf-8")
    for module in ("keyderive.js", "crypto.js", "transport.js", "app.js",
                   "style.css", "argon2.min.js"):
        assert module in page, f"{module} is not loaded by the packaged page"
    assert "/a/" not in page, "the packaged page points at the hub's asset prefix"


# ── Where downloads land ────────────────────────────────────────────────────

def test_automatic_saving_never_opens_a_dialog_for_want_of_a_folder():
    """
    "Save automatically" opened a Save As dialog on the first download, because
    the automatic path required a folder to have been chosen first and nobody
    had chosen one. A browser does not ask before it will save a file; the
    system Downloads folder is the answer when there is no other.
    """
    source = _main()
    begin = source.split("ipcMain.handle('save:begin'", 1)[1].split("ipcMain.handle", 1)[0]
    assert "defaultDownloadDir()" in begin, (
        "the automatic path has no destination when no folder was chosen")
    assert "app.getPath('downloads')" in source


def test_a_chosen_folder_that_has_gone_is_not_silently_replaced():
    """Someone who picked an external drive should be told it is not there,
    not find the film in their home directory a week later."""
    source = _main()
    begin = source.split("ipcMain.handle('save:begin'", 1)[1].split("ipcMain.handle", 1)[0]
    assert "config.downloadDir && !chosen" in begin, (
        "a chosen-but-missing folder falls through to the default instead of asking")
    assert "showSaveDialog" in begin


# ── one definition of the package, not two ───────────────────────────────────

def test_package_json_does_not_define_a_second_linux_package():
    """
    `packaging/build/` builds the client's `.deb` and `.rpm`: `build-client.sh`
    runs electron-builder for `--dir` only, then the tree is assembled by hand
    and `dpkg-deb`/`rpmbuild` package it from `packaging/deb/meshbay-client/
    DEBIAN/control` and `packaging/rpm/meshbay-client.spec`.

    `package.json` used to *also* declare `linux.target: [deb, rpm]` with its
    own `deb.depends`/`rpm.depends`, so `npm run dist` produced a second
    package under the same name — and the two had already drifted. The
    electron-builder one installed to `/opt/MeshBay/meshbay-client` (against
    `/opt/meshbay-client/meshbay`), and declared `Depends:
    python3-meshbay-common` while naming none of the Electron runtime
    libraries the real control file lists — so it would have installed
    cleanly and then refused to start.

    Nothing referenced `npm run dist`, which is why nobody noticed. It now
    delegates to `build-client.sh`, and this keeps the second definition from
    growing back.
    """
    pkg = json.loads((CLIENT / "package.json").read_text(encoding="utf-8"))
    build = pkg.get("build", {})

    for key in ("deb", "rpm", "appImage", "snap", "pacman"):
        assert key not in build, (
            f"package.json's build.{key} defines packaging that "
            "packaging/build/ already owns — two definitions of one package "
            "drift, and the last pair already had")

    targets = build.get("linux", {}).get("target")
    assert not targets, (
        f"build.linux.target is {targets!r}: electron-builder is used for "
        "--dir only. A target list here makes `electron-builder` emit a "
        "package that competes with the one packaging/build/ ships")

    dist = pkg.get("scripts", {}).get("dist", "")
    assert "electron-builder" not in dist, (
        "the dist script builds packages with electron-builder again; it "
        "should delegate to packaging/build/build-client.sh")


# ── System tray is cross-platform ────────────────────────────────────────────

def test_tray_capability_and_ipc_handler_agree_on_which_platforms():
    """
    The tray (GNOME, then Windows) has exactly two platform gates: the
    `tray` capability preload.js exposes, which is all app.js's nav button
    is keyed on, and the `window:minimize-to-tray` IPC handler in main.js
    that actually creates it. Both must name the same platform set, or one
    of two broken states results: a button that renders but does nothing
    (handler stricter than the capability), or a hidden window with no way
    back (capability stricter than the handler, on a desktop with no tray
    to have hidden it into). Everything else the tray uses (`ensureTray`,
    `tray.on('click')`, the poll-refresh, `nodeService.status/stop/restart`)
    is unconditional Electron/abstraction code with no platform check of its
    own -- these two lines are the whole gate.
    """
    preload = _preload()
    cap_line = next(
        (line for line in preload.splitlines() if "tray:" in line
         and "process.platform" in line), None)
    assert cap_line, "no platform-gated `tray:` capability found in preload.js"

    lines = _main().splitlines()
    handler_start = next(
        i for i, line in enumerate(lines) if "'window:minimize-to-tray'" in line)
    handler_block = "\n".join(lines[handler_start:handler_start + 5])

    for plat in ("'linux'", "'win32'"):
        assert plat in cap_line, f"tray capability must name {plat}"
        assert plat in handler_block, f"minimize-to-tray handler must name {plat}"