A R R R Associates
201 lines
7.5 KiB
JavaScript
201 lines
7.5 KiB
JavaScript
const { test, expect, request } = require('@playwright/test');
|
|
require('dotenv').config();
|
|
const { BASE_URL, absoluteUrl } = require('../fixtures/url');
|
|
const matrix = require('../data/generated-test-matrix.json');
|
|
const { login, logout, fillFirst, clickFirst } = require('../fixtures/auth');
|
|
const { expectNoServerError, expectBlockedOrSafe, expectSecurityHeaders, expectCookieFlags } = require('../fixtures/assertions');
|
|
|
|
function title(v) {
|
|
return `[${v.variantId}] ${v.sheet} :: ${v.scenario} :: ${v.variantName}`;
|
|
}
|
|
|
|
function unauthorizedRole(v) {
|
|
const r = (v.role || '').toLowerCase();
|
|
if (r.includes('client')) return 'Staff';
|
|
if (r.includes('staff') || r.includes('employee')) return 'Client';
|
|
if (r.includes('consultant')) return 'Client';
|
|
return 'Staff';
|
|
}
|
|
|
|
async function safeGoto(page, route) {
|
|
const resp = await page.goto(route || '/employee/dashboard');
|
|
await page.waitForLoadState('domcontentloaded').catch(() => {});
|
|
return resp;
|
|
}
|
|
|
|
async function submitBlankFormIfAny(page) {
|
|
const submit = page.locator('form button[type="submit"], form input[type="submit"]').first();
|
|
if (await submit.count()) {
|
|
await submit.click().catch(() => {});
|
|
await page.waitForLoadState('domcontentloaded').catch(() => {});
|
|
}
|
|
}
|
|
|
|
async function boundaryInputIfAny(page) {
|
|
const longText = 'X'.repeat(2048);
|
|
const input = page.locator('form input[type="text"], form textarea').first();
|
|
if (await input.count()) await input.fill(longText).catch(() => {});
|
|
await submitBlankFormIfAny(page);
|
|
}
|
|
|
|
function sec101TenantBCaseId() {
|
|
return process.env.TENANT_B_NOTICE_CASE_ID || process.env.CROSS_TENANT_NOTICE_CASE_ID || '7';
|
|
}
|
|
|
|
async function expectNoTenantBNoticeLeak(page, resp) {
|
|
// A correct ERP may reject with 401/403/404/405/422 or redirect away.
|
|
// If it returns 200/303, the page still must not disclose Tenant B notice data.
|
|
await expectBlockedOrSafe(page, resp);
|
|
|
|
const body = await page.locator('body').innerText().catch(() => '');
|
|
expect(body).not.toMatch(/Tenant B SEC-101 Cross Tenant Notice/i);
|
|
expect(body).not.toMatch(/UAT-B-NOTICE-SEC101/i);
|
|
expect(body).not.toMatch(/UAT-NC-B-SEC101/i);
|
|
expect(body).not.toMatch(/Traceback|Internal Server Error|Exception/i);
|
|
}
|
|
|
|
async function runSec101CrossTenant(page, context, v) {
|
|
const tenantBNoticeCaseId = sec101TenantBCaseId();
|
|
|
|
await login(page, 'System Admin'); // Tenant A system admin from env, e.g. uat.admin@vavalam.com.
|
|
|
|
const variant = String(v.variantType || '').toLowerCase();
|
|
const probes = [];
|
|
|
|
if (variant === 'negative') {
|
|
probes.push(`/notice-cases/${tenantBNoticeCaseId}?tamper=1`);
|
|
probes.push(`/notice-cases/${tenantBNoticeCaseId}/../../${tenantBNoticeCaseId}`);
|
|
} else if (variant === 'rbac') {
|
|
await logout(page);
|
|
await login(page, 'Staff');
|
|
probes.push(`/notice-cases/${tenantBNoticeCaseId}`);
|
|
} else if (variant === 'idor') {
|
|
probes.push(`/notice-cases/${tenantBNoticeCaseId}`);
|
|
probes.push(`/notice-cases/${tenantBNoticeCaseId}/edit`);
|
|
probes.push(`/notice-cases/${tenantBNoticeCaseId}/documents`);
|
|
} else if (variant === 'headers') {
|
|
await context.setExtraHTTPHeaders({
|
|
'X-Tenant-ID': '3',
|
|
'X-Branch-ID': '3',
|
|
'X-Tenant-Code': 'UAT-B',
|
|
'X-Branch-Code': 'UAT-BB',
|
|
});
|
|
probes.push(`/notice-cases/${tenantBNoticeCaseId}`);
|
|
} else {
|
|
probes.push(`/notice-cases/${tenantBNoticeCaseId}`);
|
|
}
|
|
|
|
for (const route of probes) {
|
|
const resp = await safeGoto(page, route);
|
|
await expectNoTenantBNoticeLeak(page, resp);
|
|
}
|
|
}
|
|
|
|
async function runSecuritySpecific(page, context, v) {
|
|
const id = v.sourceId;
|
|
|
|
if (/SEC-101/i.test(id)) {
|
|
await runSec101CrossTenant(page, context, v);
|
|
return;
|
|
}
|
|
|
|
if (/SEC-001/i.test(id)) {
|
|
await page.goto('/login');
|
|
for (let i = 0; i < 5; i++) {
|
|
await fillFirst(page, ['input[name="email"]','input[name="login_id"]','input[type="email"]'], process.env.SYSTEM_ADMIN_EMAIL || 'uat.admin@vavalam.com');
|
|
await fillFirst(page, ['input[name="password"]','input[type="password"]'], 'wrong-password-' + i);
|
|
await clickFirst(page, ['button[type="submit"]','input[type="submit"]']);
|
|
await page.waitForLoadState('domcontentloaded').catch(() => {});
|
|
}
|
|
await expectNoServerError(page);
|
|
return;
|
|
}
|
|
if (/SEC-002/i.test(id)) {
|
|
await login(page, 'System Admin');
|
|
await logout(page);
|
|
const resp = await safeGoto(page, '/employee/dashboard');
|
|
await expectBlockedOrSafe(page, resp);
|
|
return;
|
|
}
|
|
if (/SEC-007|GEN-011/i.test(id)) {
|
|
const api = await request.newContext({ baseURL: BASE_URL });
|
|
const resp = await api.post('/notice-cases/new', { form: { title: 'csrf-test-no-token' } });
|
|
expect([400,401,403,404,405,422,303].includes(resp.status())).toBeTruthy();
|
|
return;
|
|
}
|
|
if (/SEC-017/i.test(id)) {
|
|
await login(page, 'System Admin');
|
|
await expectCookieFlags(context);
|
|
return;
|
|
}
|
|
if (/SEC-026/i.test(id)) {
|
|
const resp = await page.goto('/login');
|
|
await expectSecurityHeaders(resp);
|
|
return;
|
|
}
|
|
if (/SEC-010|SEC-103|SEC-104|SEC-110|SEC-111|DOM-VAPT/i.test(id)) {
|
|
await login(page, 'Staff');
|
|
const probes = ['/documents/../../app/main.py','/documents/999999/download','/notice-cases/999999999','/notice-cases/999999999/documents/999999/download','/domains/999999999/edit'];
|
|
for (const p of probes) {
|
|
const resp = await safeGoto(page, p);
|
|
await expectBlockedOrSafe(page, resp);
|
|
}
|
|
return;
|
|
}
|
|
await login(page, v.role || 'System Admin');
|
|
const resp = await safeGoto(page, v.route);
|
|
await expectNoServerError(page);
|
|
if (v.variantType === 'headers') await expectCookieFlags(context);
|
|
}
|
|
|
|
for (const v of matrix) {
|
|
test(title(v), async ({ page, context }) => {
|
|
test.info().annotations.push({ type: 'sourceId', description: v.sourceId });
|
|
test.info().annotations.push({ type: 'variantType', description: v.variantType });
|
|
test.info().annotations.push({ type: 'expected', description: String(v.expected || '').slice(0, 250) });
|
|
|
|
// SEC-101 was marked manual in the generated matrix, but it is now automated here
|
|
// using a seeded Tenant B notice case. This keeps ERP features unchanged and only
|
|
// replaces the scaffold/manual handling for these five variants.
|
|
if (/SEC-101/i.test(v.sourceId || '')) {
|
|
await runSec101CrossTenant(page, context, v);
|
|
return;
|
|
}
|
|
|
|
if (v.automation === 'manual') {
|
|
test.skip(true, v.manualReason || 'Marked manual in generated matrix');
|
|
}
|
|
|
|
if (v.variantType === 'security' || v.sheet.startsWith('VAPT_')) {
|
|
await runSecuritySpecific(page, context, v);
|
|
return;
|
|
}
|
|
|
|
if (v.variantType === 'rbac') {
|
|
await login(page, unauthorizedRole(v));
|
|
const resp = await safeGoto(page, v.route);
|
|
await expectNoServerError(page);
|
|
// A safe result may be allowed page for common dashboards, but must not leak obvious restricted data or crash.
|
|
if (!['/login','/employee/dashboard'].includes(v.route)) {
|
|
const body = await page.locator('body').innerText().catch(()=>'');
|
|
expect(body).not.toMatch(/Traceback|Internal Server Error|Exception/i);
|
|
}
|
|
return;
|
|
}
|
|
|
|
await login(page, v.role || 'System Admin');
|
|
const resp = await safeGoto(page, v.route);
|
|
await expectNoServerError(page);
|
|
|
|
if (v.variantType === 'positive') {
|
|
expect(resp.status()).toBeLessThan(500);
|
|
} else if (v.variantType === 'negative' || v.variantType === 'validation') {
|
|
await submitBlankFormIfAny(page);
|
|
await expectNoServerError(page);
|
|
} else if (v.variantType === 'boundary') {
|
|
await boundaryInputIfAny(page);
|
|
await expectNoServerError(page);
|
|
}
|
|
});
|
|
}
|