clawbot
7e5d7cdcde
All checks were successful
check / check (push) Successful in 32s
The screen that decides what gets signed had no automated coverage of its own behaviour: no unit tests, and the e2e suite never reached it. The arithmetic underneath is well covered in src/shared/txValidation.js; the gap was the wiring — which number reaches the gate, when the gate re-runs, what the fee block renders, and whether Send is enabled. The confirmation screen quotes the fee ESTIMATE (gasLimit * gasPrice) and gates on the fee RESERVE (gasLimit * maxFeePerGas). Reading the quoted number instead was issue #154, and until now that was correct by reading only — a mutant swapping the two passed the whole suite. It no longer does: two of the new tests fail on it, one per transaction type. The harness gains a funded-balance fixture to make any of this reachable. tests/e2e/network.js now serves a configurable ETH balance, an ERC-20 holding, a latest block with a baseFeePerGas (without which ethers has no maxFeePerGas and the reserve and the estimate collapse into one number), and decimals() for the stub token. It can also refuse a gas estimate, and hold one open so the pending state can be observed rather than raced. Nine tests, over both the native ETH and the ERC-20 path: Send disabled while the estimate is pending, enabled once it lands, the fee block quoting both numbers, the distinct message for an estimate that failed, refusal for a send past the balance, refusal for a send the reserve does not cover, and the view height constant across every one of those transitions. Driving a failure path means provoking the console.error the code is supposed to emit, which the harness fails a run on. ErrorCollector gains expect(): it consumes exactly one matching record, and a declaration nothing matched fails its test just as an undeclared error does, so it cannot be used to silence anything. Both halves of that were verified by running the suite against a deliberately wrong pattern.
1148 lines
42 KiB
JavaScript
1148 lines
42 KiB
JavaScript
// End-to-end suite entrypoint. Run via script/test-e2e (which builds
|
|
// dist/chrome/ and starts the pinned container); running it directly
|
|
// requires a Chromium that playwright-core can find.
|
|
//
|
|
// A plain runner rather than jest on purpose: jest's default testMatch
|
|
// would pull these files into script/test, and browser tests do not fit
|
|
// inside the 20-second cap REPO_POLICIES.md puts on make test. Nothing
|
|
// here is named *.test.js for the same reason.
|
|
|
|
"use strict";
|
|
|
|
const { formatEther } = require("ethers");
|
|
const {
|
|
PASSWORD,
|
|
createWallet,
|
|
launch,
|
|
openAddressDetail,
|
|
openPopup,
|
|
pageCompilesWasm,
|
|
visible,
|
|
} = require("./harness");
|
|
const {
|
|
FEE_ESTIMATE_WEI,
|
|
FEE_RESERVE_WEI,
|
|
STUB_COUNTERPARTY,
|
|
STUB_TOKEN,
|
|
STUB_TX_HASH,
|
|
} = require("./network");
|
|
|
|
const TEST_TIMEOUT_MS = 120000;
|
|
|
|
// How long to keep collecting after the final test returns; see the
|
|
// trailing drain in main().
|
|
const TRAILING_WATCH_MS = 1500;
|
|
|
|
const tests = [];
|
|
|
|
function test(name, fn) {
|
|
tests.push({ name, fn });
|
|
}
|
|
|
|
function assert(cond, message) {
|
|
if (!cond) throw new Error(message);
|
|
}
|
|
|
|
function sleep(ms) {
|
|
return new Promise((resolve) => setTimeout(resolve, ms));
|
|
}
|
|
|
|
function withTimeout(promise, name) {
|
|
let timer;
|
|
const timeout = new Promise((_, reject) => {
|
|
timer = setTimeout(
|
|
() =>
|
|
reject(new Error("timed out after " + TEST_TIMEOUT_MS + "ms")),
|
|
TEST_TIMEOUT_MS,
|
|
);
|
|
});
|
|
return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
|
|
}
|
|
|
|
// ----------------------------------------------------------------- tests
|
|
|
|
test("popup loads and reaches the welcome view", async (env) => {
|
|
env.page = await openPopup(env.ctx, env.popupUrl);
|
|
await visible(env.page, "#view-welcome");
|
|
const title = await env.page.title();
|
|
assert(title === "AutistMask", "unexpected popup title: " + title);
|
|
});
|
|
|
|
// The empirical half of #182. The manifest change is only a claim about
|
|
// what the CSP permits; this is the observation. Two things have to hold
|
|
// together, and the run covers both: the popup realm compiles WASM (here),
|
|
// and no WASM refusal or abort is recorded anywhere in the run — the
|
|
// harness allowlist that used to excuse exactly that error is now empty,
|
|
// so a recurrence fails whichever test it lands in rather than being
|
|
// tolerated. Since libsodium's WASM module is embedded in the bundle and
|
|
// needs no fetch, a realm that compiles WASM is a realm where libsodium
|
|
// takes the WASM path, and the next test drives a real vault encryption
|
|
// through it.
|
|
test("the popup compiles WebAssembly under the shipped CSP (#182)", async (env) => {
|
|
const ok = await pageCompilesWasm(env.page);
|
|
assert(
|
|
ok,
|
|
"the popup refused to compile WebAssembly. The shipped manifest CSP " +
|
|
"has lost 'wasm-unsafe-eval', so libsodium is back on its wasm2js " +
|
|
"fallback and every password derivation costs roughly 20x what it " +
|
|
"should — see the backend note in src/shared/vault.js",
|
|
);
|
|
});
|
|
|
|
test("wallet creation through the UI reaches the main view", async (env) => {
|
|
env.phrase = await createWallet(env.page);
|
|
assert(
|
|
env.phrase.split(/\s+/).length >= 12,
|
|
"wallet creation did not yield a recovery phrase",
|
|
);
|
|
const addrCount = await env.page
|
|
.locator("#wallet-list .btn-addr-info")
|
|
.count();
|
|
assert(addrCount > 0, "no addresses rendered in the wallet list");
|
|
});
|
|
|
|
test("add token screen opens from address detail (#150)", async (env) => {
|
|
await openAddressDetail(env.page);
|
|
await env.page.click("#btn-add-token");
|
|
await visible(env.page, "#view-add-token");
|
|
const quickPicks = await env.page
|
|
.locator("#common-token-list .common-token")
|
|
.count();
|
|
assert(quickPicks > 0, "no common-token quick-pick buttons rendered");
|
|
});
|
|
|
|
test("transaction detail renders an ERC-20 transfer (#151)", async (env) => {
|
|
// Serve the stubbed token transfer from here on, then reload so the
|
|
// address detail screen refetches its transaction list.
|
|
env.routeOpts.seedTokenTransfer = true;
|
|
await env.page.reload();
|
|
await openAddressDetail(env.page);
|
|
|
|
await visible(env.page, "#tx-list .tx-row");
|
|
const rowText = await env.page
|
|
.locator("#tx-list .tx-row")
|
|
.first()
|
|
.innerText();
|
|
assert(
|
|
rowText.includes(STUB_TOKEN.symbol),
|
|
"token transfer row missing symbol " +
|
|
STUB_TOKEN.symbol +
|
|
", got: " +
|
|
JSON.stringify(rowText),
|
|
);
|
|
|
|
await env.page.locator("#tx-list .tx-row").first().click();
|
|
await visible(env.page, "#view-transaction");
|
|
|
|
const hash = await env.page.locator("#tx-detail-hash").innerText();
|
|
assert(
|
|
hash.includes(STUB_TX_HASH),
|
|
"transaction detail shows the wrong hash: " + hash,
|
|
);
|
|
|
|
// The token contract row is the field that crashes when
|
|
// addressDotHtml is not imported: it renders only for transfers with
|
|
// a contractAddress, which is every ERC-20 transfer.
|
|
await visible(env.page, "#tx-detail-token-contract-section");
|
|
const contract = env.page.locator("#tx-detail-token-contract");
|
|
const contractText = await contract.innerText();
|
|
assert(
|
|
contractText.toLowerCase().includes(STUB_TOKEN.address),
|
|
"token contract row missing the contract address, got: " +
|
|
JSON.stringify(contractText),
|
|
);
|
|
const dots = await contract.locator('span[style*="border-radius"]').count();
|
|
assert(dots > 0, "token contract row rendered without its colour dot");
|
|
});
|
|
|
|
// -------------------------------------------- recovery phrase (#161)
|
|
|
|
// The gear toggles, so pressing it while Settings is already up leaves it.
|
|
async function openSettings(page) {
|
|
if (!(await page.isVisible("#view-settings"))) {
|
|
await page.click("#btn-settings");
|
|
}
|
|
await visible(page, "#view-settings");
|
|
}
|
|
|
|
// Everything the recovery phrase screen is holding, read straight out of
|
|
// the DOM whether or not that screen is the one on top. Reading it while it
|
|
// is hidden is the point: "cleared on leave" means the node is empty, not
|
|
// merely off-screen.
|
|
async function phraseScreenState(page) {
|
|
return page.evaluate(() => ({
|
|
value: document.getElementById("show-phrase-value").textContent,
|
|
error: document.getElementById("show-phrase-flash").textContent,
|
|
html: document.getElementById("view-show-phrase").innerHTML,
|
|
resultHidden: document
|
|
.getElementById("show-phrase-result")
|
|
.classList.contains("hidden"),
|
|
viewHidden: document
|
|
.getElementById("view-show-phrase")
|
|
.classList.contains("hidden"),
|
|
}));
|
|
}
|
|
|
|
async function openPhraseScreen(page) {
|
|
await openSettings(page);
|
|
await page.click("#settings-wallet-list .btn-show-phrase");
|
|
await visible(page, "#view-show-phrase");
|
|
}
|
|
|
|
async function revealPhrase(page) {
|
|
await page.fill("#show-phrase-password", PASSWORD);
|
|
await page.click("#btn-show-phrase-reveal");
|
|
await visible(page, "#show-phrase-result", 60000);
|
|
}
|
|
|
|
function assertWiped(st, phrase, where) {
|
|
assert(st.value === "", "phrase still in the DOM " + where);
|
|
assert(st.resultHidden, "result section still shown " + where);
|
|
assert(
|
|
!st.html.includes(phrase),
|
|
"the recovery phrase is still somewhere in the screen markup " + where,
|
|
);
|
|
}
|
|
|
|
test("only an HD wallet is offered the recovery phrase action (#161)", async (env) => {
|
|
await openSettings(env.page);
|
|
const offered = await env.page
|
|
.locator("#settings-wallet-list .btn-show-phrase")
|
|
.count();
|
|
const wallets = await env.page
|
|
.locator("#settings-wallet-list .btn-delete-wallet")
|
|
.count();
|
|
assert(wallets === 1, "expected exactly one wallet row, got " + wallets);
|
|
assert(
|
|
offered === 1,
|
|
"the HD wallet was not offered the recovery phrase action",
|
|
);
|
|
});
|
|
|
|
// The other half of the gate, against the real UI: a wallet holding a bare
|
|
// private key has no phrase to show, so no row of it may offer the action.
|
|
// The key is generated here rather than committed — the repo holds no
|
|
// private keys, test ones included.
|
|
test("a key wallet is not offered the recovery phrase action (#161)", async (env) => {
|
|
const { Wallet } = require("ethers");
|
|
|
|
await openSettings(env.page);
|
|
await env.page.click("#btn-main-add-wallet");
|
|
await visible(env.page, "#view-add-wallet");
|
|
await env.page.click("#tab-privkey");
|
|
await env.page.fill(
|
|
"#import-private-key",
|
|
Wallet.createRandom().privateKey,
|
|
);
|
|
await env.page.fill("#add-wallet-password", PASSWORD);
|
|
await env.page.fill("#add-wallet-password-confirm", PASSWORD);
|
|
await env.page.click("#btn-add-wallet-confirm");
|
|
await visible(env.page, "#view-main", 60000);
|
|
|
|
await openSettings(env.page);
|
|
const wallets = await env.page
|
|
.locator("#settings-wallet-list .btn-delete-wallet")
|
|
.count();
|
|
const offered = await env.page
|
|
.locator("#settings-wallet-list .btn-show-phrase")
|
|
.count();
|
|
assert(wallets === 2, "expected two wallet rows, got " + wallets);
|
|
assert(
|
|
offered === 1,
|
|
"the key wallet was offered the recovery phrase action",
|
|
);
|
|
});
|
|
|
|
test("the recovery phrase screen holds nothing before the password (#161)", async (env) => {
|
|
await openPhraseScreen(env.page);
|
|
const st = await phraseScreenState(env.page);
|
|
assertWiped(st, env.phrase, "before any password was entered");
|
|
const passwordShown = await env.page.isVisible(
|
|
"#show-phrase-password-section",
|
|
);
|
|
assert(passwordShown, "the password prompt is not shown");
|
|
});
|
|
|
|
test("a wrong password reveals nothing (#161)", async (env) => {
|
|
await env.page.fill("#show-phrase-password", "not-the-password");
|
|
await env.page.click("#btn-show-phrase-reveal");
|
|
await env.page.waitForFunction(
|
|
() =>
|
|
document.getElementById("show-phrase-flash").textContent.length > 0,
|
|
null,
|
|
{ timeout: 60000 },
|
|
);
|
|
|
|
const st = await phraseScreenState(env.page);
|
|
assertWiped(st, env.phrase, "after a wrong password");
|
|
assert(
|
|
/^[A-Z].*\.$/.test(st.error.trim()),
|
|
"the wrong-password error is not a full sentence: " +
|
|
JSON.stringify(st.error),
|
|
);
|
|
});
|
|
|
|
test("the correct password reveals the full phrase, and nothing logs it (#161)", async (env) => {
|
|
const console_ = [];
|
|
const listener = (msg) => console_.push(msg.text());
|
|
env.page.on("console", listener);
|
|
try {
|
|
await revealPhrase(env.page);
|
|
|
|
const st = await phraseScreenState(env.page);
|
|
assert(
|
|
st.value === env.phrase,
|
|
"the displayed phrase is not the wallet's phrase, verbatim",
|
|
);
|
|
const promptShown = await env.page.isVisible(
|
|
"#show-phrase-password-section",
|
|
);
|
|
assert(!promptShown, "the password prompt is still shown after unlock");
|
|
|
|
// Full Identifiers Policy: shown whole, and copyable.
|
|
const title = await env.page.getAttribute(
|
|
"#show-phrase-value",
|
|
"title",
|
|
);
|
|
assert(title === "Click to copy", "the phrase is not click-to-copy");
|
|
|
|
const leaked = console_.filter((line) => line.includes(env.phrase));
|
|
assert(
|
|
leaked.length === 0,
|
|
"the recovery phrase reached the console: " +
|
|
JSON.stringify(leaked),
|
|
);
|
|
} finally {
|
|
env.page.off("console", listener);
|
|
}
|
|
});
|
|
|
|
test('"Back" wipes the revealed phrase (#161)', async (env) => {
|
|
await env.page.click("#btn-show-phrase-back");
|
|
await visible(env.page, "#view-settings");
|
|
const st = await phraseScreenState(env.page);
|
|
assert(st.viewHidden, "the recovery phrase screen is still on top");
|
|
assertWiped(st, env.phrase, "after Back");
|
|
});
|
|
|
|
// The settings gear leaves the screen without touching its Back button. A
|
|
// clear wired only to Back would pass the test above and leak here.
|
|
test("leaving by the settings gear wipes it too (#161)", async (env) => {
|
|
await openPhraseScreen(env.page);
|
|
await revealPhrase(env.page);
|
|
await env.page.click("#btn-settings");
|
|
await visible(env.page, "#view-settings");
|
|
const st = await phraseScreenState(env.page);
|
|
assertWiped(st, env.phrase, "after leaving via the settings gear");
|
|
});
|
|
|
|
// The same leave, but taken while the decrypt is still running. Both
|
|
// clicks are dispatched inside one page task on purpose: "Reveal" runs its
|
|
// handler up to the await, the gear then runs the leave — and the wipe with
|
|
// it — to completion, and the decrypt's continuation resumes afterwards.
|
|
// Without a liveness check that continuation writes the phrase into the
|
|
// hidden screen after the wipe, and nothing is left to wipe it again.
|
|
//
|
|
// A human cannot produce this interleaving by hand once libsodium's wasm is
|
|
// warm, because crypto_pwhash is synchronous and the only suspension point
|
|
// is a microtask; the window a user can actually hit is a still-pending
|
|
// sodium.ready on the first vault use of a page load. Forcing it here is
|
|
// the only way to test the guard deterministically.
|
|
test("leaving while the decrypt is in flight reveals nothing (#161)", async (env) => {
|
|
await openPhraseScreen(env.page);
|
|
await env.page.fill("#show-phrase-password", PASSWORD);
|
|
await env.page.evaluate(() => {
|
|
document.getElementById("btn-show-phrase-reveal").click();
|
|
document.getElementById("btn-settings").click();
|
|
});
|
|
await visible(env.page, "#view-settings");
|
|
|
|
// The Reveal button is disabled for exactly the duration of the
|
|
// decrypt and re-enabled in the same continuation that would have
|
|
// written the phrase, so waiting for it to come back is a precise
|
|
// "the decrypt has settled and its handler has finished" signal
|
|
// rather than a guess at a duration.
|
|
await env.page.waitForFunction(
|
|
() => !document.getElementById("btn-show-phrase-reveal").disabled,
|
|
null,
|
|
{ timeout: 60000 },
|
|
);
|
|
await sleep(2000);
|
|
|
|
const st = await phraseScreenState(env.page);
|
|
// Printed on every run, pass or fail: "the phrase is not there" is
|
|
// worth more as a measurement than as a silent assertion, and the
|
|
// same line read from a build without the guard is what this test
|
|
// exists to prevent.
|
|
console.log(
|
|
"# probe: len=" +
|
|
st.value.length +
|
|
" equalsPhrase=" +
|
|
(st.value === env.phrase) +
|
|
" resultHidden=" +
|
|
st.resultHidden +
|
|
" viewHidden=" +
|
|
st.viewHidden,
|
|
);
|
|
assert(st.viewHidden, "the recovery phrase screen is still on top");
|
|
assertWiped(st, env.phrase, "after leaving mid-decrypt");
|
|
});
|
|
|
|
// Closing and reopening the page rather than reloading it: that is what
|
|
// the toolbar popup actually does, and the persisted currentView is
|
|
// "show-phrase" at the moment it happens, which is precisely the state
|
|
// RESTORABLE_VIEWS has to refuse.
|
|
test("reopening the popup never lands on the phrase screen (#161)", async (env) => {
|
|
await openPhraseScreen(env.page);
|
|
await revealPhrase(env.page);
|
|
|
|
await env.page.close();
|
|
env.page = await openPopup(env.ctx, env.popupUrl);
|
|
await visible(env.page, "#view-main");
|
|
|
|
const st = await phraseScreenState(env.page);
|
|
assert(st.viewHidden, "the popup reopened onto the recovery phrase screen");
|
|
assertWiped(st, env.phrase, "after reopening the popup");
|
|
});
|
|
|
|
// --------------------------------------------- confirmation screen (#238)
|
|
//
|
|
// The screen that decides what gets signed. The arithmetic underneath it
|
|
// lives in src/shared/txValidation.js and is unit tested there; what these
|
|
// tests cover is the wiring — which number reaches the gate, when the gate
|
|
// re-runs, what the fee block renders, and whether Send is enabled.
|
|
//
|
|
// The load-bearing one is "gates on the fee RESERVE": the confirmation
|
|
// screen quotes the ESTIMATE and gates on the RESERVE, and issue #154 was
|
|
// the gate reading the quoted number. Every other assertion here would
|
|
// survive that mutation, so the funded and gap sends are deliberately sized
|
|
// on opposite sides of the reserve while sitting on the same side of the
|
|
// estimate.
|
|
|
|
// The balance the funded fixture serves, and the amounts sent against it.
|
|
const FUNDED_ETH_WEI = 10n ** 18n;
|
|
const FUNDED_ETH_TEXT = "1.0";
|
|
const COMFORTABLE_AMOUNT = "0.1";
|
|
const OVER_BALANCE_AMOUNT = "2.0";
|
|
|
|
// A send the balance covers to the wei once the ESTIMATE is added, and does
|
|
// not cover once the RESERVE is. Sending this is allowed by a gate reading
|
|
// the estimate and refused by a gate reading the reserve, which is the whole
|
|
// discrimination these tests exist to make.
|
|
const GAP_AMOUNT = formatEther(FUNDED_ETH_WEI - FEE_ESTIMATE_WEI);
|
|
|
|
// The ERC-20 side. The ETH balance is set to exactly the estimate for the
|
|
// fee test: it covers the expected cost to the wei and falls short of the
|
|
// reserve, so the same swap flips this assertion too — through a different
|
|
// balance and a different message than the ETH path uses.
|
|
const TOKEN_BALANCE_TEXT = "1.5";
|
|
const TOKEN_AMOUNT = "0.25";
|
|
const OVER_TOKEN_AMOUNT = "9.0";
|
|
const FEE_ONLY_ETH_WEI = FEE_ESTIMATE_WEI;
|
|
|
|
function toHexWei(wei) {
|
|
return "0x" + wei.toString(16);
|
|
}
|
|
|
|
// A fee in wei as the confirmation screen writes it. Deliberately a second
|
|
// implementation of formatFeeEth() from src/popup/views/confirmTx.js rather
|
|
// than an import of it: that module pulls in the whole popup and cannot be
|
|
// required outside a browser, and asserting against an independent rendering
|
|
// is stronger than asserting a function equals itself.
|
|
function feeEth(wei) {
|
|
const parts = formatEther(wei).split(".");
|
|
const dec =
|
|
parts.length > 1 ? parts[1].slice(0, 6).replace(/0+$/, "") || "0" : "0";
|
|
return parts[0] + "." + dec + " ETH";
|
|
}
|
|
|
|
// What the confirmation screen is showing right now, read out of the DOM in
|
|
// one pass: whether sending is allowed, which reason it is giving, what the
|
|
// fee block says, and how tall the whole view is.
|
|
async function confirmState(page) {
|
|
return page.evaluate(() => {
|
|
const el = (id) => document.getElementById(id);
|
|
// Both mechanisms matter. The two fee messages are dropped with
|
|
// display:none for the transaction type they cannot apply to, and
|
|
// shown or hidden with visibility for the one they can.
|
|
const shown = (id) => {
|
|
const cs = getComputedStyle(el(id));
|
|
return cs.display !== "none" && cs.visibility === "visible";
|
|
};
|
|
return {
|
|
height: el("view-confirm-tx").getBoundingClientRect().height,
|
|
type: el("confirm-type").textContent.trim(),
|
|
balance: el("confirm-balance").textContent.trim(),
|
|
fee: el("confirm-fee-amount").textContent.trim(),
|
|
reserve: el("confirm-fee-reserve").textContent.trim(),
|
|
reserveShown: shown("confirm-fee-reserve"),
|
|
errors: shown("confirm-errors")
|
|
? el("confirm-errors").textContent.trim()
|
|
: "",
|
|
amountFeeError: shown("confirm-amount-fee-error"),
|
|
gasError: shown("confirm-gas-error"),
|
|
feeUnknownError: shown("confirm-fee-unknown-error"),
|
|
sendDisabled: el("btn-confirm-send").disabled,
|
|
};
|
|
});
|
|
}
|
|
|
|
async function waitForEstimate(page) {
|
|
await page.waitForFunction(
|
|
() =>
|
|
document.getElementById("confirm-fee-amount").textContent.trim() !==
|
|
"Estimating...",
|
|
null,
|
|
{ timeout: 60000 },
|
|
);
|
|
}
|
|
|
|
async function backToAddress(page) {
|
|
if (await page.isVisible("#view-confirm-tx")) {
|
|
await page.click("#btn-confirm-back");
|
|
await visible(page, "#view-send");
|
|
}
|
|
if (await page.isVisible("#view-send")) {
|
|
await page.click("#btn-send-back");
|
|
}
|
|
await openAddressDetail(page);
|
|
}
|
|
|
|
// Drive the popup to the confirmation screen for one send.
|
|
//
|
|
// It waits for the send screen to be showing `balance` before filling
|
|
// anything in. That figure is the exact number the spend gate compares
|
|
// against, so waiting for it — rather than for a refresh to have probably
|
|
// landed — is what keeps every assertion below deterministic after a
|
|
// fixture change.
|
|
async function goToConfirm(page, { token, balance, amount }) {
|
|
await backToAddress(page);
|
|
await page.click("#btn-send");
|
|
await visible(page, "#view-send");
|
|
await page.selectOption("#send-token", token);
|
|
await page.waitForFunction(
|
|
(want) =>
|
|
document.getElementById("send-balance").textContent.trim() === want,
|
|
"Current balance: " + balance,
|
|
{ timeout: 60000 },
|
|
);
|
|
await page.fill("#send-to", STUB_COUNTERPARTY);
|
|
await page.fill("#send-amount", amount);
|
|
await page.click("#btn-send-review");
|
|
await visible(page, "#view-confirm-tx");
|
|
}
|
|
|
|
// A balance as the main view renders it: balanceLinesForAddress() writes
|
|
// every quantity with four decimal places.
|
|
function quantity(wei) {
|
|
return parseFloat(formatEther(wei)).toFixed(4);
|
|
}
|
|
|
|
// Wait on the main view until a changed balance fixture has been picked up.
|
|
//
|
|
// Deliberately not a reload: the popup re-refreshes on a 10-second timer by
|
|
// itself, and reloading aborts whatever fetch the home screen has open at
|
|
// that instant, which the extension reports through log.errorf and the
|
|
// harness — correctly — fails the run on.
|
|
//
|
|
// It also deliberately settles on MAIN rather than on the address screen.
|
|
// The address screen builds the send screen's token dropdown once, from the
|
|
// balances it holds at that moment, and nothing rebuilds it when a later
|
|
// refresh arrives, so entering it early leaves a dropdown with no token in
|
|
// it and the ERC-20 path unreachable.
|
|
async function settleOnMain(env, { ethWei, expectToken }) {
|
|
await backToAddress(env.page);
|
|
await env.page.click("#btn-address-back");
|
|
await visible(env.page, "#view-main");
|
|
await env.page.waitForFunction(
|
|
(want) =>
|
|
document.getElementById("wallet-list").textContent.includes(want),
|
|
quantity(ethWei),
|
|
{ timeout: 60000 },
|
|
);
|
|
if (expectToken) {
|
|
await visible(
|
|
env.page,
|
|
'#wallet-list [data-token="' + STUB_TOKEN.address + '"]',
|
|
60000,
|
|
);
|
|
}
|
|
}
|
|
|
|
test("ConfirmTx blocks sending while the fee estimate is pending (#238)", async (env) => {
|
|
env.routeOpts.ethBalanceWei = toHexWei(FUNDED_ETH_WEI);
|
|
env.routeOpts.seedTokenBalance = true;
|
|
await settleOnMain(env, {
|
|
ethWei: FUNDED_ETH_WEI,
|
|
expectToken: true,
|
|
});
|
|
|
|
env.routeOpts.holdGasEstimate = true;
|
|
await goToConfirm(env.page, {
|
|
token: "ETH",
|
|
balance: FUNDED_ETH_TEXT + " ETH",
|
|
amount: COMFORTABLE_AMOUNT,
|
|
});
|
|
|
|
const st = await confirmState(env.page);
|
|
env.ethPendingHeight = st.height;
|
|
console.log("# confirm-tx ETH view height: " + st.height + "px");
|
|
assert(
|
|
st.type === "Native ETH transfer",
|
|
"unexpected transaction type: " + JSON.stringify(st.type),
|
|
);
|
|
assert(
|
|
st.fee === "Estimating...",
|
|
"the fee line is not showing the pending placeholder: " +
|
|
JSON.stringify(st.fee),
|
|
);
|
|
assert(!st.reserveShown, "the reserve line is shown before any estimate");
|
|
assert(
|
|
st.sendDisabled,
|
|
"Send is enabled while the fee estimate is still in flight",
|
|
);
|
|
assert(
|
|
!st.feeUnknownError,
|
|
"the estimate-failed message is shown for an estimate that is merely pending",
|
|
);
|
|
assert(
|
|
!st.amountFeeError && !st.gasError && st.errors === "",
|
|
"a balance message is shown before the fee is known",
|
|
);
|
|
});
|
|
|
|
test("ConfirmTx enables Send once the estimate lands, quoting both numbers (#238)", async (env) => {
|
|
env.routeOpts.holdGasEstimate = false;
|
|
await waitForEstimate(env.page);
|
|
|
|
const st = await confirmState(env.page);
|
|
assert(
|
|
st.balance === FUNDED_ETH_TEXT + " ETH",
|
|
"the confirmation screen shows the wrong balance: " +
|
|
JSON.stringify(st.balance),
|
|
);
|
|
assert(
|
|
st.fee === "~" + feeEth(FEE_ESTIMATE_WEI),
|
|
"the fee line does not quote the estimate: " + JSON.stringify(st.fee),
|
|
);
|
|
assert(st.reserveShown, "the reserve line is not shown once the fee lands");
|
|
assert(
|
|
st.reserve === "up to " + feeEth(FEE_RESERVE_WEI) + " reserved",
|
|
"the reserve line does not quote the reserve: " +
|
|
JSON.stringify(st.reserve),
|
|
);
|
|
assert(
|
|
!st.sendDisabled,
|
|
"Send is disabled for a comfortably funded transfer",
|
|
);
|
|
assert(
|
|
st.errors === "" &&
|
|
!st.amountFeeError &&
|
|
!st.gasError &&
|
|
!st.feeUnknownError,
|
|
"a balance message is shown for a comfortably funded transfer",
|
|
);
|
|
assert(
|
|
st.height === env.ethPendingHeight,
|
|
"the view changed height when the estimate landed: " +
|
|
env.ethPendingHeight +
|
|
"px -> " +
|
|
st.height +
|
|
"px",
|
|
);
|
|
});
|
|
|
|
// The one that closes the hole. Everything else here survives a gate that
|
|
// reads the displayed estimate instead of the reserve; this does not.
|
|
test("ConfirmTx gates on the fee RESERVE, not the displayed estimate (#238)", async (env) => {
|
|
await goToConfirm(env.page, {
|
|
token: "ETH",
|
|
balance: FUNDED_ETH_TEXT + " ETH",
|
|
amount: GAP_AMOUNT,
|
|
});
|
|
await waitForEstimate(env.page);
|
|
|
|
const st = await confirmState(env.page);
|
|
// Printed on every run, pass or fail: the two fee numbers and the gate's
|
|
// decision side by side is the measurement this test is really making.
|
|
console.log(
|
|
"# gate probe: balance=" +
|
|
FUNDED_ETH_TEXT +
|
|
" ETH amount=" +
|
|
GAP_AMOUNT +
|
|
" estimate=" +
|
|
feeEth(FEE_ESTIMATE_WEI) +
|
|
" reserve=" +
|
|
feeEth(FEE_RESERVE_WEI) +
|
|
" sendDisabled=" +
|
|
st.sendDisabled +
|
|
" amountFeeError=" +
|
|
st.amountFeeError,
|
|
);
|
|
assert(
|
|
st.fee === "~" + feeEth(FEE_ESTIMATE_WEI),
|
|
"the screen is not quoting the estimate, so this send is not in the gap: " +
|
|
JSON.stringify(st.fee),
|
|
);
|
|
assert(
|
|
st.sendDisabled,
|
|
"Send is ENABLED for a transfer the fee RESERVE does not cover — the " +
|
|
"spend gate is reading the displayed estimate, which is issue #154",
|
|
);
|
|
assert(
|
|
st.amountFeeError,
|
|
"the amount-plus-fee message is not shown for a send the reserve does not cover",
|
|
);
|
|
assert(
|
|
st.height === env.ethPendingHeight,
|
|
"the over-budget state is a different height than the pending state: " +
|
|
env.ethPendingHeight +
|
|
"px -> " +
|
|
st.height +
|
|
"px",
|
|
);
|
|
});
|
|
|
|
test("ConfirmTx refuses a send that exceeds the balance outright (#238)", async (env) => {
|
|
await goToConfirm(env.page, {
|
|
token: "ETH",
|
|
balance: FUNDED_ETH_TEXT + " ETH",
|
|
amount: OVER_BALANCE_AMOUNT,
|
|
});
|
|
await waitForEstimate(env.page);
|
|
|
|
const st = await confirmState(env.page);
|
|
const want =
|
|
"Insufficient balance. You have " +
|
|
FUNDED_ETH_TEXT +
|
|
" ETH but are trying to send " +
|
|
OVER_BALANCE_AMOUNT +
|
|
" ETH.";
|
|
assert(
|
|
st.errors === want,
|
|
"wrong over-balance message: " + JSON.stringify(st.errors),
|
|
);
|
|
assert(st.sendDisabled, "Send is enabled for a send that exceeds balance");
|
|
assert(
|
|
!st.amountFeeError,
|
|
"the amount-plus-fee message is shown for an amount that alone exceeds the balance",
|
|
);
|
|
});
|
|
|
|
test("ConfirmTx refuses to send when the fee estimate fails, with its own message (#238)", async (env) => {
|
|
// The refusal is logged by confirmTx via log.errorf, i.e. console.error,
|
|
// which fails a test on its own. Declaring it here consumes exactly that
|
|
// one record — and fails this test if it never arrives.
|
|
env.errors.expect(
|
|
"confirmTx logging the failed gas estimate",
|
|
/gas estimation failed/,
|
|
);
|
|
env.routeOpts.failGasEstimate = true;
|
|
env.routeOpts.holdGasEstimate = true;
|
|
await goToConfirm(env.page, {
|
|
token: "ETH",
|
|
balance: FUNDED_ETH_TEXT + " ETH",
|
|
amount: COMFORTABLE_AMOUNT,
|
|
});
|
|
|
|
const pending = await confirmState(env.page);
|
|
assert(
|
|
pending.fee === "Estimating..." && pending.sendDisabled,
|
|
"the screen is not in the pending state before the estimate fails",
|
|
);
|
|
|
|
env.routeOpts.holdGasEstimate = false;
|
|
await waitForEstimate(env.page);
|
|
|
|
const st = await confirmState(env.page);
|
|
env.routeOpts.failGasEstimate = false;
|
|
assert(
|
|
st.fee === "Unable to estimate",
|
|
"the fee line does not report the failure: " + JSON.stringify(st.fee),
|
|
);
|
|
assert(
|
|
!st.reserveShown,
|
|
"the reserve line is shown after a failed estimate",
|
|
);
|
|
assert(
|
|
st.feeUnknownError,
|
|
"the estimate-failed message is not shown after a failed estimate",
|
|
);
|
|
assert(
|
|
!st.amountFeeError && !st.gasError && st.errors === "",
|
|
"a balance message is shown for an estimate that simply failed",
|
|
);
|
|
assert(
|
|
st.sendDisabled,
|
|
"Send is enabled with no usable fee estimate — an unknown fee is being treated as zero",
|
|
);
|
|
assert(
|
|
st.height === pending.height,
|
|
"the view changed height when the estimate failed: " +
|
|
pending.height +
|
|
"px -> " +
|
|
st.height +
|
|
"px",
|
|
);
|
|
});
|
|
|
|
test("ConfirmTx drives the ERC-20 path from pending to funded (#238)", async (env) => {
|
|
env.routeOpts.holdGasEstimate = true;
|
|
await goToConfirm(env.page, {
|
|
token: STUB_TOKEN.address,
|
|
balance: TOKEN_BALANCE_TEXT + " " + STUB_TOKEN.symbol,
|
|
amount: TOKEN_AMOUNT,
|
|
});
|
|
|
|
const pending = await confirmState(env.page);
|
|
env.erc20PendingHeight = pending.height;
|
|
console.log("# confirm-tx ERC-20 view height: " + pending.height + "px");
|
|
assert(
|
|
pending.type === "ERC-20 token transfer (" + STUB_TOKEN.symbol + ")",
|
|
"unexpected transaction type: " + JSON.stringify(pending.type),
|
|
);
|
|
assert(
|
|
pending.balance === TOKEN_BALANCE_TEXT + " " + STUB_TOKEN.symbol,
|
|
"the ERC-20 screen shows the wrong balance: " +
|
|
JSON.stringify(pending.balance),
|
|
);
|
|
assert(
|
|
pending.fee === "Estimating..." && pending.sendDisabled,
|
|
"the ERC-20 screen does not block sending while its estimate is pending",
|
|
);
|
|
|
|
env.routeOpts.holdGasEstimate = false;
|
|
await waitForEstimate(env.page);
|
|
|
|
const st = await confirmState(env.page);
|
|
assert(
|
|
st.fee === "~" + feeEth(FEE_ESTIMATE_WEI),
|
|
"the ERC-20 fee line does not quote the estimate: " +
|
|
JSON.stringify(st.fee),
|
|
);
|
|
assert(
|
|
st.reserveShown &&
|
|
st.reserve === "up to " + feeEth(FEE_RESERVE_WEI) + " reserved",
|
|
"the ERC-20 fee block does not quote the reserve: " +
|
|
JSON.stringify(st.reserve),
|
|
);
|
|
assert(!st.sendDisabled, "Send is disabled for a funded ERC-20 transfer");
|
|
assert(
|
|
st.height === pending.height,
|
|
"the ERC-20 view changed height when the estimate landed: " +
|
|
pending.height +
|
|
"px -> " +
|
|
st.height +
|
|
"px",
|
|
);
|
|
});
|
|
|
|
test("ConfirmTx refuses an ERC-20 send that exceeds the token balance (#238)", async (env) => {
|
|
await goToConfirm(env.page, {
|
|
token: STUB_TOKEN.address,
|
|
balance: TOKEN_BALANCE_TEXT + " " + STUB_TOKEN.symbol,
|
|
amount: OVER_TOKEN_AMOUNT,
|
|
});
|
|
await waitForEstimate(env.page);
|
|
|
|
const st = await confirmState(env.page);
|
|
const want =
|
|
"Insufficient " +
|
|
STUB_TOKEN.symbol +
|
|
" balance. You have " +
|
|
TOKEN_BALANCE_TEXT +
|
|
" " +
|
|
STUB_TOKEN.symbol +
|
|
" but are trying to send " +
|
|
OVER_TOKEN_AMOUNT +
|
|
" " +
|
|
STUB_TOKEN.symbol +
|
|
".";
|
|
assert(
|
|
st.errors === want,
|
|
"wrong over-token-balance message: " + JSON.stringify(st.errors),
|
|
);
|
|
assert(
|
|
st.sendDisabled,
|
|
"Send is enabled for an ERC-20 transfer that exceeds the token balance",
|
|
);
|
|
assert(
|
|
!st.gasError,
|
|
"the ERC-20 gas message is shown for an ETH balance that covers the fee",
|
|
);
|
|
});
|
|
|
|
// The same swap, through the other balance and the other message: here the
|
|
// token balance is ample and it is the ETH balance that must cover the fee.
|
|
// It is set to exactly the estimate, so an estimate-reading gate lets this
|
|
// through and the reserve-reading gate refuses it.
|
|
test("ConfirmTx gates the ERC-20 fee on the RESERVE, with the ERC-20 message (#238)", async (env) => {
|
|
env.routeOpts.ethBalanceWei = toHexWei(FEE_ONLY_ETH_WEI);
|
|
await settleOnMain(env, {
|
|
ethWei: FEE_ONLY_ETH_WEI,
|
|
expectToken: true,
|
|
});
|
|
await goToConfirm(env.page, {
|
|
token: STUB_TOKEN.address,
|
|
balance: TOKEN_BALANCE_TEXT + " " + STUB_TOKEN.symbol,
|
|
amount: TOKEN_AMOUNT,
|
|
});
|
|
await waitForEstimate(env.page);
|
|
|
|
const st = await confirmState(env.page);
|
|
console.log(
|
|
"# erc-20 gate probe: ethBalance=" +
|
|
formatEther(FEE_ONLY_ETH_WEI) +
|
|
" estimate=" +
|
|
feeEth(FEE_ESTIMATE_WEI) +
|
|
" reserve=" +
|
|
feeEth(FEE_RESERVE_WEI) +
|
|
" sendDisabled=" +
|
|
st.sendDisabled +
|
|
" gasError=" +
|
|
st.gasError,
|
|
);
|
|
assert(
|
|
st.sendDisabled,
|
|
"Send is ENABLED for an ERC-20 transfer whose fee RESERVE exceeds the " +
|
|
"ETH balance — the spend gate is reading the displayed estimate (#154)",
|
|
);
|
|
assert(
|
|
st.gasError,
|
|
"the ERC-20 network-fee message is not shown when the ETH balance cannot cover the reserve",
|
|
);
|
|
assert(
|
|
!st.amountFeeError,
|
|
"the native-ETH over-budget message is shown on an ERC-20 transfer",
|
|
);
|
|
assert(
|
|
st.errors === "",
|
|
"a token-balance message is shown for a transfer the token balance covers: " +
|
|
JSON.stringify(st.errors),
|
|
);
|
|
assert(
|
|
st.height === env.erc20PendingHeight,
|
|
"the ERC-20 fee-error state is a different height than its pending state: " +
|
|
env.erc20PendingHeight +
|
|
"px -> " +
|
|
st.height +
|
|
"px",
|
|
);
|
|
});
|
|
|
|
test("ConfirmTx reports a failed ERC-20 estimate as unknown, not as a fee problem (#238)", async (env) => {
|
|
env.errors.expect(
|
|
"confirmTx logging the failed ERC-20 gas estimate",
|
|
/gas estimation failed/,
|
|
);
|
|
env.routeOpts.failGasEstimate = true;
|
|
await goToConfirm(env.page, {
|
|
token: STUB_TOKEN.address,
|
|
balance: TOKEN_BALANCE_TEXT + " " + STUB_TOKEN.symbol,
|
|
amount: TOKEN_AMOUNT,
|
|
});
|
|
await waitForEstimate(env.page);
|
|
|
|
const st = await confirmState(env.page);
|
|
env.routeOpts.failGasEstimate = false;
|
|
assert(
|
|
st.fee === "Unable to estimate",
|
|
"the ERC-20 fee line does not report the failure: " +
|
|
JSON.stringify(st.fee),
|
|
);
|
|
assert(
|
|
st.feeUnknownError,
|
|
"the estimate-failed message is not shown on the ERC-20 path",
|
|
);
|
|
assert(
|
|
!st.gasError,
|
|
"the ERC-20 network-fee message is shown for a fee that is unknown rather than unaffordable",
|
|
);
|
|
assert(
|
|
st.sendDisabled,
|
|
"Send is enabled on the ERC-20 path with no usable fee estimate",
|
|
);
|
|
assert(
|
|
st.height === env.erc20PendingHeight,
|
|
"the ERC-20 estimate-failed state is a different height than its pending state: " +
|
|
env.erc20PendingHeight +
|
|
"px -> " +
|
|
st.height +
|
|
"px",
|
|
);
|
|
});
|
|
|
|
// ---------------------------------------------------------------- runner
|
|
|
|
async function main() {
|
|
// A suite that runs nothing must never report success. If a refactor
|
|
// drops the registrations above, or a require() of this file stops
|
|
// reaching them, the only honest outcome is a red run — reporting
|
|
// "0/0 passed" and exiting 0 is the same vacuous-check failure this
|
|
// whole harness exists to prevent.
|
|
if (tests.length === 0) {
|
|
console.log("1..0");
|
|
console.log("# FAILED: the e2e suite registered no tests");
|
|
process.exitCode = 1;
|
|
return;
|
|
}
|
|
|
|
// Every fixture switch the suite can flip, declared in one place so the
|
|
// starting state of a run is readable without hunting through tests.
|
|
const routeOpts = {
|
|
seedTokenTransfer: false,
|
|
seedTokenBalance: false,
|
|
ethBalanceWei: null,
|
|
failGasEstimate: false,
|
|
holdGasEstimate: false,
|
|
};
|
|
|
|
let session;
|
|
try {
|
|
session = await launch(routeOpts);
|
|
} catch (e) {
|
|
// Never skip and report success: a browser we cannot start, or
|
|
// one whose network interception is not in force, is a failure of
|
|
// the suite, not an absent one.
|
|
console.error("e2e: cannot run the suite: " + e.message);
|
|
process.exitCode = 1;
|
|
return;
|
|
}
|
|
|
|
console.log("# extension id: " + session.extensionId);
|
|
console.log("1.." + tests.length);
|
|
|
|
const env = {
|
|
ctx: session.ctx,
|
|
popupUrl: session.popupUrl,
|
|
routeOpts,
|
|
page: null,
|
|
// The error collector, so a test that drives a failure path on
|
|
// purpose can declare the console.error it is about to provoke.
|
|
errors: session.errors,
|
|
// The recovery phrase of the wallet created in test 2, so later
|
|
// tests can assert on the real secret rather than its shape.
|
|
phrase: null,
|
|
// Confirmation-screen heights, measured in the pending state and
|
|
// compared against every later state of the same screen.
|
|
ethPendingHeight: null,
|
|
erc20PendingHeight: null,
|
|
};
|
|
|
|
// Attribution of collected errors is total. session.errors has no
|
|
// window API at all: take() always drains everything outstanding, so
|
|
// successive takes partition the whole stream, and the phases below
|
|
// cover the entire life of the run. Nothing the collector holds can
|
|
// go unread.
|
|
//
|
|
// launch .. end of test 1 -> test 1 (so the worker's startup
|
|
// fetches land on a test, not
|
|
// nowhere)
|
|
// end of test k .. end of k+1 -> test k+1
|
|
// last test .. teardown -> the suite, via the trailing drain
|
|
//
|
|
// Those three phases cover the entire life of the browser context.
|
|
// There is no fourth: once the context is closed nothing can record,
|
|
// because the route handler and the console listeners died with it.
|
|
// Traffic that a test defers past the trailing drain is therefore
|
|
// never observed at all — a real limit of this design, stated in the
|
|
// README, and not one any post-teardown hook could close.
|
|
//
|
|
// Two green-but-vacuous runs on this harness were the same shape: a
|
|
// record falling outside somebody's window and being dropped. First
|
|
// the mark started after test 1, discarding launch-time records;
|
|
// then the tail after the last test was never read. Patching a
|
|
// second boundary would have invited a third, so the window concept
|
|
// is gone rather than fixed.
|
|
let failed = 0;
|
|
let n = 0;
|
|
for (const t of tests) {
|
|
n += 1;
|
|
let failure = null;
|
|
try {
|
|
await withTimeout(t.fn(env), t.name);
|
|
} catch (e) {
|
|
failure = e.message;
|
|
}
|
|
|
|
// Any uncaught page error, console.error or unstubbed request
|
|
// fails the test that provoked it, whether or not its assertions
|
|
// passed. This is the mechanism that caught #150.
|
|
const newErrors = session.errors.take();
|
|
if (!failure && newErrors.length > 0) {
|
|
failure = "uncaught browser errors during this test";
|
|
}
|
|
|
|
// A test that declared an error it meant to provoke and did not
|
|
// provoke it asserted nothing. Failing here is what keeps expect()
|
|
// from being usable as a mute.
|
|
const unmatched = session.errors.unmatchedExpectations();
|
|
if (!failure && unmatched.length > 0) {
|
|
failure =
|
|
"expected browser error(s) that never arrived: " +
|
|
unmatched.join("; ");
|
|
}
|
|
|
|
if (failure) {
|
|
failed += 1;
|
|
console.log("not ok " + n + " - " + t.name);
|
|
console.log(" " + failure);
|
|
for (const line of newErrors) {
|
|
console.log(" " + line);
|
|
}
|
|
} else {
|
|
console.log("ok " + n + " - " + t.name);
|
|
}
|
|
}
|
|
|
|
// Keep watching after the last test returns, before tearing the
|
|
// browser down. A request a test fires without awaiting is still in
|
|
// flight when its function resolves; measured here it reaches the
|
|
// route handler about 10ms later, but closing the context does not
|
|
// wait for it — with no window at all the request dies unobserved
|
|
// and the run goes green, which is exactly how escaping traffic
|
|
// stays invisible.
|
|
//
|
|
// A fixed bounded window rather than a quiescence poll on purpose:
|
|
// the collector being quiet is not evidence, because a request that
|
|
// has not been dispatched yet has recorded nothing to be quiet
|
|
// about. Playwright offers no "is anything in flight" question to
|
|
// ask either — the route handler is the only observation point — so
|
|
// a grace period is the mechanism available, and this one is ~150x
|
|
// the measured latency for 1.5s on a ~25s suite.
|
|
await new Promise((resolve) => setTimeout(resolve, TRAILING_WATCH_MS));
|
|
|
|
await session.close();
|
|
|
|
// The tail. These cannot be blamed on any single test, so they are
|
|
// reported against the suite rather than guessed at — but they are
|
|
// reported, and they fail the run.
|
|
const trailing = session.errors.take();
|
|
|
|
console.log(
|
|
"# " + (tests.length - failed) + "/" + tests.length + " tests passed",
|
|
);
|
|
|
|
if (trailing.length > 0) {
|
|
console.log(
|
|
"# " +
|
|
trailing.length +
|
|
" browser error(s) recorded after the last test finished, " +
|
|
"not attributable to any single test:",
|
|
);
|
|
for (const line of trailing) {
|
|
console.log("# " + line);
|
|
}
|
|
}
|
|
|
|
if (failed > 0 || trailing.length > 0) {
|
|
console.log("# FAILED");
|
|
process.exitCode = 1;
|
|
}
|
|
}
|
|
|
|
main().catch((e) => {
|
|
console.error("e2e: " + (e && e.stack ? e.stack : e));
|
|
process.exitCode = 1;
|
|
});
|