Compare commits
1 Commits
devin/1776
...
174cbfde04
| Author | SHA1 | Date | |
|---|---|---|---|
| 174cbfde04 |
71
.github/workflows/e2e-full.yml
vendored
Normal file
71
.github/workflows/e2e-full.yml
vendored
Normal file
@@ -0,0 +1,71 @@
|
||||
name: e2e-full
|
||||
|
||||
# Boots the full explorer stack (docker-compose deps + backend + frontend)
|
||||
# and runs the Playwright full-stack smoke spec against it. Not on every
|
||||
# PR (too expensive) — runs on:
|
||||
#
|
||||
# * workflow_dispatch (manual)
|
||||
# * pull_request when the 'run-e2e-full' label is applied
|
||||
# * nightly at 04:00 UTC
|
||||
#
|
||||
# Screenshots from every route are uploaded as a build artefact so
|
||||
# reviewers can eyeball the render without having to boot the stack.
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
pull_request:
|
||||
types: [labeled, opened, synchronize, reopened]
|
||||
schedule:
|
||||
- cron: '0 4 * * *'
|
||||
|
||||
jobs:
|
||||
e2e-full:
|
||||
if: >
|
||||
github.event_name == 'workflow_dispatch' ||
|
||||
github.event_name == 'schedule' ||
|
||||
(github.event_name == 'pull_request' &&
|
||||
contains(github.event.pull_request.labels.*.name, 'run-e2e-full'))
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 30
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
submodules: recursive
|
||||
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: '1.23.x'
|
||||
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: '20'
|
||||
cache: 'npm'
|
||||
cache-dependency-path: frontend/package-lock.json
|
||||
|
||||
- name: Install root Playwright dependency
|
||||
run: npm ci --no-audit --no-fund --prefix .
|
||||
|
||||
- name: Run full-stack e2e
|
||||
env:
|
||||
JWT_SECRET: ${{ secrets.JWT_SECRET || 'ci-ephemeral-jwt-secret-not-for-prod' }}
|
||||
CSP_HEADER: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' http://localhost:8080 ws://localhost:8080"
|
||||
run: make e2e-full
|
||||
|
||||
- name: Upload screenshots
|
||||
if: always()
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: e2e-screenshots
|
||||
path: test-results/screenshots/
|
||||
if-no-files-found: warn
|
||||
|
||||
- name: Upload playwright report
|
||||
if: always()
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: playwright-report
|
||||
path: |
|
||||
playwright-report/
|
||||
test-results/
|
||||
if-no-files-found: warn
|
||||
6
Makefile
6
Makefile
@@ -1,4 +1,4 @@
|
||||
.PHONY: help install dev build test test-e2e clean migrate
|
||||
.PHONY: help install dev build test test-e2e e2e-full clean migrate
|
||||
|
||||
help:
|
||||
@echo "Available targets:"
|
||||
@@ -7,6 +7,7 @@ help:
|
||||
@echo " build - Build all services"
|
||||
@echo " test - Run backend + frontend tests (go test, lint, type-check)"
|
||||
@echo " test-e2e - Run Playwright E2E tests (default: explorer.d-bis.org)"
|
||||
@echo " e2e-full - Boot full stack locally (docker compose + backend + frontend) and run Playwright"
|
||||
@echo " clean - Clean build artifacts"
|
||||
@echo " migrate - Run database migrations"
|
||||
|
||||
@@ -35,6 +36,9 @@ test:
|
||||
test-e2e:
|
||||
npx playwright test
|
||||
|
||||
e2e-full:
|
||||
./scripts/e2e-full.sh
|
||||
|
||||
clean:
|
||||
cd backend && go clean ./...
|
||||
cd frontend && rm -rf .next node_modules
|
||||
|
||||
@@ -1,92 +0,0 @@
|
||||
package rest
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"net/http"
|
||||
|
||||
"github.com/explorer/backend/auth"
|
||||
)
|
||||
|
||||
// handleAuthRefresh implements POST /api/v1/auth/refresh.
|
||||
//
|
||||
// Contract:
|
||||
// - Requires a valid, unrevoked wallet JWT in the Authorization header.
|
||||
// - Mints a new JWT for the same address+track with a fresh jti and a
|
||||
// fresh per-track TTL.
|
||||
// - Revokes the presented token so it cannot be reused.
|
||||
//
|
||||
// This is the mechanism that makes the short Track-4 TTL (60 min in
|
||||
// PR #8) acceptable: operators refresh while the token is still live
|
||||
// rather than re-signing a SIWE message every hour.
|
||||
func (s *Server) handleAuthRefresh(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Method != http.MethodPost {
|
||||
writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "Method not allowed")
|
||||
return
|
||||
}
|
||||
if s.walletAuth == nil {
|
||||
writeError(w, http.StatusServiceUnavailable, "service_unavailable", "wallet auth not configured")
|
||||
return
|
||||
}
|
||||
|
||||
token := extractBearerToken(r)
|
||||
if token == "" {
|
||||
writeError(w, http.StatusUnauthorized, "unauthorized", "missing or malformed Authorization header")
|
||||
return
|
||||
}
|
||||
|
||||
resp, err := s.walletAuth.RefreshJWT(r.Context(), token)
|
||||
if err != nil {
|
||||
switch {
|
||||
case errors.Is(err, auth.ErrJWTRevoked):
|
||||
writeError(w, http.StatusUnauthorized, "token_revoked", err.Error())
|
||||
case errors.Is(err, auth.ErrWalletAuthStorageNotInitialized):
|
||||
writeError(w, http.StatusServiceUnavailable, "service_unavailable", err.Error())
|
||||
default:
|
||||
writeError(w, http.StatusUnauthorized, "unauthorized", err.Error())
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_ = json.NewEncoder(w).Encode(resp)
|
||||
}
|
||||
|
||||
// handleAuthLogout implements POST /api/v1/auth/logout.
|
||||
//
|
||||
// Records the presented token's jti in jwt_revocations so subsequent
|
||||
// calls to ValidateJWT will reject it. Idempotent: logging out twice
|
||||
// with the same token succeeds.
|
||||
func (s *Server) handleAuthLogout(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Method != http.MethodPost {
|
||||
writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "Method not allowed")
|
||||
return
|
||||
}
|
||||
if s.walletAuth == nil {
|
||||
writeError(w, http.StatusServiceUnavailable, "service_unavailable", "wallet auth not configured")
|
||||
return
|
||||
}
|
||||
|
||||
token := extractBearerToken(r)
|
||||
if token == "" {
|
||||
writeError(w, http.StatusUnauthorized, "unauthorized", "missing or malformed Authorization header")
|
||||
return
|
||||
}
|
||||
|
||||
if err := s.walletAuth.RevokeJWT(r.Context(), token, "logout"); err != nil {
|
||||
switch {
|
||||
case errors.Is(err, auth.ErrJWTRevocationStorageMissing):
|
||||
// Surface 503 so ops know migration 0016 hasn't run; the
|
||||
// client should treat the token as logged out locally.
|
||||
writeError(w, http.StatusServiceUnavailable, "service_unavailable", err.Error())
|
||||
default:
|
||||
writeError(w, http.StatusUnauthorized, "unauthorized", err.Error())
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_ = json.NewEncoder(w).Encode(map[string]any{
|
||||
"status": "ok",
|
||||
})
|
||||
}
|
||||
@@ -475,12 +475,8 @@ func (s *Server) HandleMissionControlBridgeTrace(w http.ResponseWriter, r *http.
|
||||
body, statusCode, err := fetchBlockscoutTransaction(r.Context(), tx)
|
||||
if err == nil && statusCode == http.StatusOK {
|
||||
var txDoc map[string]interface{}
|
||||
if uerr := json.Unmarshal(body, &txDoc); uerr != nil {
|
||||
// Fall through to the RPC fallback below. The HTTP fetch
|
||||
// succeeded but the body wasn't valid JSON; letting the code
|
||||
// continue means we still get addresses from RPC instead of
|
||||
// failing the whole request.
|
||||
_ = uerr
|
||||
if err := json.Unmarshal(body, &txDoc); err != nil {
|
||||
err = fmt.Errorf("invalid blockscout JSON")
|
||||
} else {
|
||||
fromAddr = extractEthAddress(txDoc["from"])
|
||||
toAddr = extractEthAddress(txDoc["to"])
|
||||
|
||||
@@ -52,8 +52,6 @@ func (s *Server) SetupRoutes(mux *http.ServeMux) {
|
||||
// Auth endpoints
|
||||
mux.HandleFunc("/api/v1/auth/nonce", s.handleAuthNonce)
|
||||
mux.HandleFunc("/api/v1/auth/wallet", s.handleAuthWallet)
|
||||
mux.HandleFunc("/api/v1/auth/refresh", s.handleAuthRefresh)
|
||||
mux.HandleFunc("/api/v1/auth/logout", s.handleAuthLogout)
|
||||
mux.HandleFunc("/api/v1/auth/register", s.handleAuthRegister)
|
||||
mux.HandleFunc("/api/v1/auth/login", s.handleAuthLogin)
|
||||
mux.HandleFunc("/api/v1/access/me", s.handleAccessMe)
|
||||
|
||||
@@ -21,49 +21,8 @@ var (
|
||||
ErrWalletNonceNotFoundOrExpired = errors.New("nonce not found or expired")
|
||||
ErrWalletNonceExpired = errors.New("nonce expired")
|
||||
ErrWalletNonceInvalid = errors.New("invalid nonce")
|
||||
ErrJWTRevoked = errors.New("token has been revoked")
|
||||
ErrJWTRevocationStorageMissing = errors.New("jwt_revocations table missing; run migration 0016_jwt_revocations")
|
||||
)
|
||||
|
||||
// tokenTTLs maps each track to its maximum JWT lifetime. Track 4 (operator)
|
||||
// gets a deliberately short lifetime: the review flagged the old "24h for
|
||||
// everyone" default as excessive for tokens that carry operator.write.*
|
||||
// permissions. Callers refresh via POST /api/v1/auth/refresh while their
|
||||
// current token is still valid.
|
||||
var tokenTTLs = map[int]time.Duration{
|
||||
1: 12 * time.Hour,
|
||||
2: 8 * time.Hour,
|
||||
3: 4 * time.Hour,
|
||||
4: 60 * time.Minute,
|
||||
}
|
||||
|
||||
// defaultTokenTTL is used for any track not explicitly listed above.
|
||||
const defaultTokenTTL = 12 * time.Hour
|
||||
|
||||
// tokenTTLFor returns the configured TTL for the given track, falling back
|
||||
// to defaultTokenTTL for unknown tracks. Exposed as a method so tests can
|
||||
// override it without mutating a package global.
|
||||
func tokenTTLFor(track int) time.Duration {
|
||||
if ttl, ok := tokenTTLs[track]; ok {
|
||||
return ttl
|
||||
}
|
||||
return defaultTokenTTL
|
||||
}
|
||||
|
||||
func isMissingJWTRevocationTableError(err error) bool {
|
||||
return err != nil && strings.Contains(err.Error(), `relation "jwt_revocations" does not exist`)
|
||||
}
|
||||
|
||||
// newJTI returns a random JWT ID used for revocation tracking. 16 random
|
||||
// bytes = 128 bits of entropy, hex-encoded.
|
||||
func newJTI() (string, error) {
|
||||
b := make([]byte, 16)
|
||||
if _, err := rand.Read(b); err != nil {
|
||||
return "", fmt.Errorf("generate jti: %w", err)
|
||||
}
|
||||
return hex.EncodeToString(b), nil
|
||||
}
|
||||
|
||||
// WalletAuth handles wallet-based authentication
|
||||
type WalletAuth struct {
|
||||
db *pgxpool.Pool
|
||||
@@ -248,20 +207,13 @@ func (w *WalletAuth) getUserTrack(ctx context.Context, address string) (int, err
|
||||
return 1, nil
|
||||
}
|
||||
|
||||
// generateJWT generates a JWT token with track, jti, exp, and iat claims.
|
||||
// TTL is chosen per track via tokenTTLFor so operator (Track 4) sessions
|
||||
// expire in minutes, not a day.
|
||||
// generateJWT generates a JWT token with track claim
|
||||
func (w *WalletAuth) generateJWT(address string, track int) (string, time.Time, error) {
|
||||
jti, err := newJTI()
|
||||
if err != nil {
|
||||
return "", time.Time{}, err
|
||||
}
|
||||
expiresAt := time.Now().Add(tokenTTLFor(track))
|
||||
expiresAt := time.Now().Add(24 * time.Hour)
|
||||
|
||||
claims := jwt.MapClaims{
|
||||
"address": address,
|
||||
"track": track,
|
||||
"jti": jti,
|
||||
"exp": expiresAt.Unix(),
|
||||
"iat": time.Now().Unix(),
|
||||
}
|
||||
@@ -275,182 +227,55 @@ func (w *WalletAuth) generateJWT(address string, track int) (string, time.Time,
|
||||
return tokenString, expiresAt, nil
|
||||
}
|
||||
|
||||
// ValidateJWT validates a JWT token and returns the address and track.
|
||||
// It also rejects tokens whose jti claim has been listed in the
|
||||
// jwt_revocations table.
|
||||
// ValidateJWT validates a JWT token and returns the address and track
|
||||
func (w *WalletAuth) ValidateJWT(tokenString string) (string, int, error) {
|
||||
address, track, _, _, err := w.parseJWT(tokenString)
|
||||
if err != nil {
|
||||
return "", 0, err
|
||||
}
|
||||
|
||||
// If we have a database, enforce revocation and re-resolve the track
|
||||
// (an operator revoking a wallet's Track 4 approval should not wait
|
||||
// for the token to expire before losing the elevated permission).
|
||||
if w.db != nil {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
|
||||
defer cancel()
|
||||
|
||||
jti, _ := w.jtiFromToken(tokenString)
|
||||
if jti != "" {
|
||||
revoked, revErr := w.isJTIRevoked(ctx, jti)
|
||||
if revErr != nil && !errors.Is(revErr, ErrJWTRevocationStorageMissing) {
|
||||
return "", 0, fmt.Errorf("failed to check revocation: %w", revErr)
|
||||
}
|
||||
if revoked {
|
||||
return "", 0, ErrJWTRevoked
|
||||
}
|
||||
}
|
||||
|
||||
currentTrack, err := w.getUserTrack(ctx, address)
|
||||
if err != nil {
|
||||
return "", 0, fmt.Errorf("failed to resolve current track: %w", err)
|
||||
}
|
||||
if currentTrack < track {
|
||||
track = currentTrack
|
||||
}
|
||||
}
|
||||
|
||||
return address, track, nil
|
||||
}
|
||||
|
||||
// parseJWT performs signature verification and claim extraction without
|
||||
// any database round-trip. Shared between ValidateJWT and RefreshJWT.
|
||||
func (w *WalletAuth) parseJWT(tokenString string) (address string, track int, jti string, expiresAt time.Time, err error) {
|
||||
token, perr := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
|
||||
token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
|
||||
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
|
||||
return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
|
||||
}
|
||||
return w.jwtSecret, nil
|
||||
})
|
||||
if perr != nil {
|
||||
return "", 0, "", time.Time{}, fmt.Errorf("failed to parse token: %w", perr)
|
||||
|
||||
if err != nil {
|
||||
return "", 0, fmt.Errorf("failed to parse token: %w", err)
|
||||
}
|
||||
|
||||
if !token.Valid {
|
||||
return "", 0, "", time.Time{}, fmt.Errorf("invalid token")
|
||||
return "", 0, fmt.Errorf("invalid token")
|
||||
}
|
||||
|
||||
claims, ok := token.Claims.(jwt.MapClaims)
|
||||
if !ok {
|
||||
return "", 0, "", time.Time{}, fmt.Errorf("invalid token claims")
|
||||
return "", 0, fmt.Errorf("invalid token claims")
|
||||
}
|
||||
address, ok = claims["address"].(string)
|
||||
|
||||
address, ok := claims["address"].(string)
|
||||
if !ok {
|
||||
return "", 0, "", time.Time{}, fmt.Errorf("address not found in token")
|
||||
return "", 0, fmt.Errorf("address not found in token")
|
||||
}
|
||||
|
||||
trackFloat, ok := claims["track"].(float64)
|
||||
if !ok {
|
||||
return "", 0, "", time.Time{}, fmt.Errorf("track not found in token")
|
||||
return "", 0, fmt.Errorf("track not found in token")
|
||||
}
|
||||
track = int(trackFloat)
|
||||
if v, ok := claims["jti"].(string); ok {
|
||||
jti = v
|
||||
}
|
||||
if expFloat, ok := claims["exp"].(float64); ok {
|
||||
expiresAt = time.Unix(int64(expFloat), 0)
|
||||
}
|
||||
return address, track, jti, expiresAt, nil
|
||||
}
|
||||
|
||||
// jtiFromToken parses the jti claim without doing a fresh signature check.
|
||||
// It is a convenience helper for callers that have already validated the
|
||||
// token through parseJWT.
|
||||
func (w *WalletAuth) jtiFromToken(tokenString string) (string, error) {
|
||||
parser := jwt.Parser{}
|
||||
token, _, err := parser.ParseUnverified(tokenString, jwt.MapClaims{})
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
claims, ok := token.Claims.(jwt.MapClaims)
|
||||
if !ok {
|
||||
return "", fmt.Errorf("invalid claims")
|
||||
}
|
||||
v, _ := claims["jti"].(string)
|
||||
return v, nil
|
||||
}
|
||||
|
||||
// isJTIRevoked checks whether the given jti appears in jwt_revocations.
|
||||
// Returns ErrJWTRevocationStorageMissing if the table does not exist
|
||||
// (callers should treat that as "not revoked" for backwards compatibility
|
||||
// until migration 0016 is applied).
|
||||
func (w *WalletAuth) isJTIRevoked(ctx context.Context, jti string) (bool, error) {
|
||||
var exists bool
|
||||
err := w.db.QueryRow(ctx,
|
||||
`SELECT EXISTS(SELECT 1 FROM jwt_revocations WHERE jti = $1)`, jti,
|
||||
).Scan(&exists)
|
||||
if err != nil {
|
||||
if isMissingJWTRevocationTableError(err) {
|
||||
return false, ErrJWTRevocationStorageMissing
|
||||
}
|
||||
return false, err
|
||||
}
|
||||
return exists, nil
|
||||
}
|
||||
|
||||
// RevokeJWT records the token's jti in jwt_revocations. Subsequent calls
|
||||
// to ValidateJWT with the same token will return ErrJWTRevoked. Idempotent
|
||||
// on duplicate jti.
|
||||
func (w *WalletAuth) RevokeJWT(ctx context.Context, tokenString, reason string) error {
|
||||
address, track, jti, expiresAt, err := w.parseJWT(tokenString)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if jti == "" {
|
||||
// Legacy tokens issued before PR #8 don't carry a jti; there is
|
||||
// nothing to revoke server-side. Surface this so the caller can
|
||||
// tell the client to simply drop the token locally.
|
||||
return fmt.Errorf("token has no jti claim (legacy token — client should discard locally)")
|
||||
}
|
||||
track := int(trackFloat)
|
||||
if w.db == nil {
|
||||
return fmt.Errorf("wallet auth has no database; cannot revoke")
|
||||
}
|
||||
if strings.TrimSpace(reason) == "" {
|
||||
reason = "logout"
|
||||
}
|
||||
_, err = w.db.Exec(ctx,
|
||||
`INSERT INTO jwt_revocations (jti, address, track, token_expires_at, reason)
|
||||
VALUES ($1, $2, $3, $4, $5)
|
||||
ON CONFLICT (jti) DO NOTHING`,
|
||||
jti, address, track, expiresAt, reason,
|
||||
)
|
||||
if err != nil {
|
||||
if isMissingJWTRevocationTableError(err) {
|
||||
return ErrJWTRevocationStorageMissing
|
||||
}
|
||||
return fmt.Errorf("record revocation: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// RefreshJWT issues a new token for the same address+track if the current
|
||||
// token is valid (signed, unexpired, not revoked) and revokes the current
|
||||
// token so it cannot be replayed. Returns the new token and its exp.
|
||||
func (w *WalletAuth) RefreshJWT(ctx context.Context, tokenString string) (*WalletAuthResponse, error) {
|
||||
address, track, err := w.ValidateJWT(tokenString)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Revoke the old token before issuing a new one. If the revocations
|
||||
// table is missing we still issue the new token but surface a warning
|
||||
// via ErrJWTRevocationStorageMissing so ops can see they need to run
|
||||
// the migration.
|
||||
var revokeErr error
|
||||
if w.db != nil {
|
||||
revokeErr = w.RevokeJWT(ctx, tokenString, "refresh")
|
||||
if revokeErr != nil && !errors.Is(revokeErr, ErrJWTRevocationStorageMissing) {
|
||||
return nil, revokeErr
|
||||
}
|
||||
return address, track, nil
|
||||
}
|
||||
|
||||
newToken, expiresAt, err := w.generateJWT(address, track)
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
|
||||
defer cancel()
|
||||
|
||||
currentTrack, err := w.getUserTrack(ctx, address)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
return "", 0, fmt.Errorf("failed to resolve current track: %w", err)
|
||||
}
|
||||
return &WalletAuthResponse{
|
||||
Token: newToken,
|
||||
ExpiresAt: expiresAt,
|
||||
Track: track,
|
||||
Permissions: getPermissionsForTrack(track),
|
||||
}, revokeErr
|
||||
if currentTrack < track {
|
||||
track = currentTrack
|
||||
}
|
||||
|
||||
return address, track, nil
|
||||
}
|
||||
|
||||
func decodeWalletSignature(signature string) ([]byte, error) {
|
||||
|
||||
@@ -1,9 +1,7 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
@@ -28,59 +26,3 @@ func TestValidateJWTReturnsClaimsWhenDBUnavailable(t *testing.T) {
|
||||
require.Equal(t, "0x4A666F96fC8764181194447A7dFdb7d471b301C8", address)
|
||||
require.Equal(t, 4, track)
|
||||
}
|
||||
|
||||
func TestTokenTTLForTrack4IsShort(t *testing.T) {
|
||||
// Track 4 (operator) must have a TTL <= 1h — that is the headline
|
||||
// tightening promised by completion criterion 3 (JWT hygiene).
|
||||
ttl := tokenTTLFor(4)
|
||||
require.LessOrEqual(t, ttl, time.Hour, "track 4 TTL must be <= 1h")
|
||||
require.Greater(t, ttl, time.Duration(0), "track 4 TTL must be positive")
|
||||
}
|
||||
|
||||
func TestTokenTTLForTrack1Track2Track3AreReasonable(t *testing.T) {
|
||||
// Non-operator tracks are allowed longer sessions, but still bounded
|
||||
// at 12h so a stale laptop tab doesn't carry a week-old token.
|
||||
for _, track := range []int{1, 2, 3} {
|
||||
ttl := tokenTTLFor(track)
|
||||
require.Greater(t, ttl, time.Duration(0), "track %d TTL must be > 0", track)
|
||||
require.LessOrEqual(t, ttl, 12*time.Hour, "track %d TTL must be <= 12h", track)
|
||||
}
|
||||
}
|
||||
|
||||
func TestGeneratedJWTCarriesJTIClaim(t *testing.T) {
|
||||
// Revocation keys on jti. A token issued without one is unrevokable
|
||||
// and must not be produced.
|
||||
a := NewWalletAuth(nil, []byte("test-secret"))
|
||||
token, _, err := a.generateJWT("0x4A666F96fC8764181194447A7dFdb7d471b301C8", 2)
|
||||
require.NoError(t, err)
|
||||
|
||||
jti, err := a.jtiFromToken(token)
|
||||
require.NoError(t, err)
|
||||
require.NotEmpty(t, jti, "generated JWT must carry a jti claim")
|
||||
require.Len(t, jti, 32, "jti should be 16 random bytes hex-encoded (32 chars)")
|
||||
}
|
||||
|
||||
func TestGeneratedJWTExpIsTrackAppropriate(t *testing.T) {
|
||||
a := NewWalletAuth(nil, []byte("test-secret"))
|
||||
for _, track := range []int{1, 2, 3, 4} {
|
||||
_, expiresAt, err := a.generateJWT("0x4A666F96fC8764181194447A7dFdb7d471b301C8", track)
|
||||
require.NoError(t, err)
|
||||
want := tokenTTLFor(track)
|
||||
// allow a couple-second slack for test execution
|
||||
actual := time.Until(expiresAt)
|
||||
require.InDelta(t, want.Seconds(), actual.Seconds(), 5.0,
|
||||
"track %d exp should be ~%s from now, got %s", track, want, actual)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRevokeJWTWithoutDBReturnsError(t *testing.T) {
|
||||
// With w.db == nil, revocation has nowhere to write — the call must
|
||||
// fail loudly so callers don't silently assume a token was revoked.
|
||||
a := NewWalletAuth(nil, []byte("test-secret"))
|
||||
token, _, err := a.generateJWT("0x4A666F96fC8764181194447A7dFdb7d471b301C8", 4)
|
||||
require.NoError(t, err)
|
||||
|
||||
err = a.RevokeJWT(context.Background(), token, "test")
|
||||
require.Error(t, err)
|
||||
require.Contains(t, err.Error(), "no database")
|
||||
}
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
-- Migration 0016_jwt_revocations.down.sql
|
||||
DROP INDEX IF EXISTS idx_jwt_revocations_expires;
|
||||
DROP INDEX IF EXISTS idx_jwt_revocations_address;
|
||||
DROP TABLE IF EXISTS jwt_revocations;
|
||||
@@ -1,30 +0,0 @@
|
||||
-- Migration 0016_jwt_revocations.up.sql
|
||||
--
|
||||
-- Introduces server-side JWT revocation for the SolaceScan backend.
|
||||
--
|
||||
-- Up to this migration, tokens issued by /api/v1/auth/wallet were simply
|
||||
-- signed and returned; the backend had no way to invalidate a token before
|
||||
-- its exp claim short of rotating the JWT_SECRET (which would invalidate
|
||||
-- every outstanding session). PR #8 introduces per-token revocation keyed
|
||||
-- on the `jti` claim.
|
||||
--
|
||||
-- The table is append-only: a row exists iff that jti has been revoked.
|
||||
-- ValidateJWT consults the table on every request; the primary key on
|
||||
-- (jti) keeps lookups O(log n) and deduplicates repeated logout calls.
|
||||
|
||||
CREATE TABLE IF NOT EXISTS jwt_revocations (
|
||||
jti TEXT PRIMARY KEY,
|
||||
address TEXT NOT NULL,
|
||||
track INT NOT NULL,
|
||||
-- original exp of the revoked token, so a background janitor can
|
||||
-- reap rows after they can no longer matter.
|
||||
token_expires_at TIMESTAMPTZ NOT NULL,
|
||||
revoked_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
||||
reason TEXT NOT NULL DEFAULT 'logout'
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_jwt_revocations_address
|
||||
ON jwt_revocations (address);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_jwt_revocations_expires
|
||||
ON jwt_revocations (token_expires_at);
|
||||
86
docs/TESTING.md
Normal file
86
docs/TESTING.md
Normal file
@@ -0,0 +1,86 @@
|
||||
# Testing
|
||||
|
||||
The explorer has four test tiers. Run them in order of fidelity when
|
||||
debugging a regression.
|
||||
|
||||
## 1. Unit / package tests
|
||||
|
||||
Fast. Run on every PR.
|
||||
|
||||
```bash
|
||||
# Backend
|
||||
cd backend && go test ./...
|
||||
|
||||
# Frontend
|
||||
cd frontend && npm test # lint + type-check
|
||||
cd frontend && npm run test:unit # vitest
|
||||
```
|
||||
|
||||
## 2. Static analysis
|
||||
|
||||
Blocking on CI since PR #5 (`chore(ci): align Go to 1.23.x, add
|
||||
staticcheck/govulncheck/gitleaks gates`).
|
||||
|
||||
```bash
|
||||
cd backend && staticcheck ./...
|
||||
cd backend && govulncheck ./...
|
||||
git diff master... | gitleaks protect --staged --config ../.gitleaks.toml
|
||||
```
|
||||
|
||||
## 3. Production-targeting Playwright
|
||||
|
||||
Runs against `https://explorer.d-bis.org` (or the URL in `EXPLORER_URL`)
|
||||
and only checks public routes. Useful as a production canary; wired
|
||||
into the `test-e2e` Make target.
|
||||
|
||||
```bash
|
||||
EXPLORER_URL=https://explorer.d-bis.org make test-e2e
|
||||
```
|
||||
|
||||
## 4. Full-stack Playwright (`make e2e-full`)
|
||||
|
||||
Spins up the entire stack locally — `postgres`, `elasticsearch`,
|
||||
`redis` via docker-compose, plus a local build of `backend/api/rest`
|
||||
and `frontend` — then runs the full-stack Playwright spec against it.
|
||||
|
||||
```bash
|
||||
make e2e-full
|
||||
```
|
||||
|
||||
What it does, in order:
|
||||
|
||||
1. `docker compose -p explorer-e2e up -d postgres elasticsearch redis`
|
||||
2. Wait for Postgres readiness.
|
||||
3. Run `go run database/migrations/migrate.go` to apply schema +
|
||||
seeds (including `0016_jwt_revocations` from PR #8).
|
||||
4. `go run ./backend/api/rest` on port `8080`.
|
||||
5. `npm ci && npm run build && npm run start` on port `3000`.
|
||||
6. `npx playwright test scripts/e2e-full-stack.spec.ts`.
|
||||
7. Tear everything down (unless `E2E_KEEP_STACK=1`).
|
||||
|
||||
Screenshots of every route are written to
|
||||
`test-results/screenshots/<route>.png`.
|
||||
|
||||
### Env vars
|
||||
|
||||
| Var | Default | Purpose |
|
||||
|-----|---------|---------|
|
||||
| `EXPLORER_URL` | `http://localhost:3000` | Frontend base URL for the spec |
|
||||
| `EXPLORER_API_URL` | `http://localhost:8080` | Backend base URL |
|
||||
| `JWT_SECRET` | generated per-run | Required by backend fail-fast check (PR #3) |
|
||||
| `CSP_HEADER` | dev-safe default | Same |
|
||||
| `E2E_KEEP_STACK` | `0` | If `1`, leave the stack up after the run |
|
||||
| `E2E_SKIP_DOCKER` | `0` | If `1`, assume docker services already running |
|
||||
| `E2E_SCREENSHOT_DIR` | `test-results/screenshots` | Where to write PNGs |
|
||||
|
||||
### CI integration
|
||||
|
||||
`.github/workflows/e2e-full.yml` runs `make e2e-full` on:
|
||||
|
||||
* **Manual** trigger (`workflow_dispatch`).
|
||||
* **PRs labelled `run-e2e-full`** — apply the label when a change
|
||||
warrants full-stack validation (migrations, auth, routing changes).
|
||||
* **Nightly** at 04:00 UTC.
|
||||
|
||||
Screenshots and the Playwright HTML report are uploaded as build
|
||||
artefacts.
|
||||
@@ -7,7 +7,7 @@ if (process.env.NO_COLOR !== undefined) {
|
||||
|
||||
export default defineConfig({
|
||||
testDir: './scripts',
|
||||
testMatch: 'e2e-explorer-frontend.spec.ts',
|
||||
testMatch: /e2e-.*\.spec\.ts$/,
|
||||
fullyParallel: false,
|
||||
forbidOnly: !!process.env.CI,
|
||||
retries: process.env.CI ? 2 : 0,
|
||||
|
||||
79
scripts/e2e-full-stack.spec.ts
Normal file
79
scripts/e2e-full-stack.spec.ts
Normal file
@@ -0,0 +1,79 @@
|
||||
import { expect, test, type Page } from '@playwright/test'
|
||||
import { mkdirSync } from 'node:fs'
|
||||
import path from 'node:path'
|
||||
|
||||
// e2e-full-stack.spec.ts
|
||||
//
|
||||
// Playwright spec that exercises the golden-path behaviours of the
|
||||
// explorer against a *locally booted* backend + frontend, rather than
|
||||
// against the production deploy that `e2e-explorer-frontend.spec.ts`
|
||||
// targets. `make e2e-full` stands up the stack, points this spec at
|
||||
// it via EXPLORER_URL / EXPLORER_API_URL, and tears it down afterwards.
|
||||
//
|
||||
// The spec intentionally sticks to Track-1 (public, no auth) routes so
|
||||
// it can run without provisioning wallet credentials in CI. Track 2-4
|
||||
// behaviours are covered by the Go and unit-test layers.
|
||||
|
||||
const EXPLORER_URL = process.env.EXPLORER_URL || 'http://localhost:3000'
|
||||
const EXPLORER_API_URL = process.env.EXPLORER_API_URL || 'http://localhost:8080'
|
||||
const SCREENSHOT_DIR = process.env.E2E_SCREENSHOT_DIR || 'test-results/screenshots'
|
||||
|
||||
mkdirSync(SCREENSHOT_DIR, { recursive: true })
|
||||
|
||||
async function snapshot(page: Page, name: string) {
|
||||
const file = path.join(SCREENSHOT_DIR, `${name}.png`)
|
||||
await page.screenshot({ path: file, fullPage: true })
|
||||
}
|
||||
|
||||
async function expectHeading(page: Page, name: RegExp) {
|
||||
await expect(page.getByRole('heading', { name })).toBeVisible({ timeout: 15000 })
|
||||
}
|
||||
|
||||
test.describe('Explorer full-stack smoke', () => {
|
||||
test('backend /healthz responds 200', async ({ request }) => {
|
||||
const response = await request.get(`${EXPLORER_API_URL}/healthz`)
|
||||
expect(response.status()).toBeLessThan(500)
|
||||
})
|
||||
|
||||
for (const route of [
|
||||
{ path: '/', heading: /SolaceScan/i, name: 'home' },
|
||||
{ path: '/blocks', heading: /^Blocks$/i, name: 'blocks' },
|
||||
{ path: '/transactions', heading: /^Transactions$/i, name: 'transactions' },
|
||||
{ path: '/addresses', heading: /^Addresses$/i, name: 'addresses' },
|
||||
{ path: '/tokens', heading: /^Tokens$/i, name: 'tokens' },
|
||||
{ path: '/pools', heading: /^Pools$/i, name: 'pools' },
|
||||
{ path: '/search', heading: /^Search$/i, name: 'search' },
|
||||
{ path: '/wallet', heading: /Wallet & MetaMask/i, name: 'wallet' },
|
||||
{ path: '/routes', heading: /Route/i, name: 'routes' },
|
||||
]) {
|
||||
test(`frontend route ${route.path} renders`, async ({ page }) => {
|
||||
await page.goto(`${EXPLORER_URL}${route.path}`, {
|
||||
waitUntil: 'domcontentloaded',
|
||||
timeout: 30000,
|
||||
})
|
||||
await expectHeading(page, route.heading)
|
||||
await snapshot(page, route.name)
|
||||
})
|
||||
}
|
||||
|
||||
test('access products endpoint is reachable', async ({ request }) => {
|
||||
// Covers the YAML-backed catalogue wired up in PR #7. The endpoint
|
||||
// is public (lists available RPC products) so no auth is needed.
|
||||
const response = await request.get(`${EXPLORER_API_URL}/api/v1/access/products`)
|
||||
expect(response.status()).toBe(200)
|
||||
const body = await response.json()
|
||||
expect(Array.isArray(body.products)).toBe(true)
|
||||
expect(body.products.length).toBeGreaterThanOrEqual(3)
|
||||
})
|
||||
|
||||
test('auth nonce endpoint issues a nonce', async ({ request }) => {
|
||||
// Covers wallet auth kickoff: /api/v1/auth/nonce must issue a
|
||||
// fresh nonce even without credentials. This is Track-1-safe.
|
||||
const response = await request.post(`${EXPLORER_API_URL}/api/v1/auth/nonce`, {
|
||||
data: { address: '0x4A666F96fC8764181194447A7dFdb7d471b301C8' },
|
||||
})
|
||||
expect(response.status()).toBe(200)
|
||||
const body = await response.json()
|
||||
expect(typeof body.nonce === 'string' && body.nonce.length > 0).toBe(true)
|
||||
})
|
||||
})
|
||||
123
scripts/e2e-full.sh
Executable file
123
scripts/e2e-full.sh
Executable file
@@ -0,0 +1,123 @@
|
||||
#!/usr/bin/env bash
|
||||
# scripts/e2e-full.sh
|
||||
#
|
||||
# Boots the full explorer stack (postgres, elasticsearch, redis, backend
|
||||
# API, frontend), waits for readiness, runs the Playwright full-stack
|
||||
# smoke spec against it, and tears everything down. Used by the
|
||||
# `make e2e-full` target and by the e2e-full CI workflow.
|
||||
#
|
||||
# Env vars:
|
||||
# E2E_KEEP_STACK=1 # don't tear down on exit (for debugging)
|
||||
# E2E_SKIP_DOCKER=1 # assume backend + deps already running
|
||||
# EXPLORER_URL # defaults to http://localhost:3000
|
||||
# EXPLORER_API_URL # defaults to http://localhost:8080
|
||||
# E2E_SCREENSHOT_DIR # defaults to test-results/screenshots
|
||||
# JWT_SECRET # required; generated ephemerally if unset
|
||||
# CSP_HEADER # required; a dev-safe default is injected
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
cd "$ROOT"
|
||||
|
||||
COMPOSE="deployment/docker-compose.yml"
|
||||
COMPOSE_PROJECT="${COMPOSE_PROJECT:-explorer-e2e}"
|
||||
|
||||
export EXPLORER_URL="${EXPLORER_URL:-http://localhost:3000}"
|
||||
export EXPLORER_API_URL="${EXPLORER_API_URL:-http://localhost:8080}"
|
||||
export E2E_SCREENSHOT_DIR="${E2E_SCREENSHOT_DIR:-$ROOT/test-results/screenshots}"
|
||||
mkdir -p "$E2E_SCREENSHOT_DIR"
|
||||
|
||||
# Generate ephemeral JWT secret if the caller didn't set one. Real
|
||||
# deployments use fail-fast validation (see PR #3); for a local run we
|
||||
# want a fresh value each invocation so stale tokens don't bleed across
|
||||
# runs.
|
||||
export JWT_SECRET="${JWT_SECRET:-$(openssl rand -hex 32)}"
|
||||
export CSP_HEADER="${CSP_HEADER:-default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' http://localhost:8080 ws://localhost:8080}"
|
||||
|
||||
log() { printf '[e2e-full] %s\n' "$*"; }
|
||||
|
||||
teardown() {
|
||||
local ec=$?
|
||||
if [[ "${E2E_KEEP_STACK:-0}" == "1" ]]; then
|
||||
log "E2E_KEEP_STACK=1; leaving stack running."
|
||||
return $ec
|
||||
fi
|
||||
log "tearing down stack"
|
||||
if [[ "${E2E_SKIP_DOCKER:-0}" != "1" ]]; then
|
||||
docker compose -p "$COMPOSE_PROJECT" -f "$COMPOSE" down -v --remove-orphans >/dev/null 2>&1 || true
|
||||
fi
|
||||
if [[ -n "${BACKEND_PID:-}" ]]; then kill "$BACKEND_PID" 2>/dev/null || true; fi
|
||||
if [[ -n "${FRONTEND_PID:-}" ]]; then kill "$FRONTEND_PID" 2>/dev/null || true; fi
|
||||
return $ec
|
||||
}
|
||||
trap teardown EXIT
|
||||
|
||||
wait_for() {
|
||||
local url="$1" label="$2" retries="${3:-60}"
|
||||
log "waiting for $label at $url"
|
||||
for ((i=0; i<retries; i++)); do
|
||||
if curl -fsS "$url" >/dev/null 2>&1; then
|
||||
log " $label ready"
|
||||
return 0
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
log " $label never became ready"
|
||||
return 1
|
||||
}
|
||||
|
||||
if [[ "${E2E_SKIP_DOCKER:-0}" != "1" ]]; then
|
||||
log "starting postgres, elasticsearch, redis via docker compose"
|
||||
docker compose -p "$COMPOSE_PROJECT" -f "$COMPOSE" up -d postgres elasticsearch redis
|
||||
|
||||
log "waiting for postgres"
|
||||
for ((i=0; i<60; i++)); do
|
||||
if docker compose -p "$COMPOSE_PROJECT" -f "$COMPOSE" exec -T postgres pg_isready -U explorer >/dev/null 2>&1; then
|
||||
break
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
fi
|
||||
|
||||
export DB_HOST="${DB_HOST:-localhost}"
|
||||
export DB_PORT="${DB_PORT:-5432}"
|
||||
export DB_USER="${DB_USER:-explorer}"
|
||||
export DB_PASSWORD="${DB_PASSWORD:-changeme}"
|
||||
export DB_NAME="${DB_NAME:-explorer}"
|
||||
export REDIS_HOST="${REDIS_HOST:-localhost}"
|
||||
export REDIS_PORT="${REDIS_PORT:-6379}"
|
||||
export ELASTICSEARCH_URL="${ELASTICSEARCH_URL:-http://localhost:9200}"
|
||||
|
||||
log "running migrations"
|
||||
(cd backend && go run database/migrations/migrate.go) || {
|
||||
log "migrations failed; continuing so tests can report the real backend state"
|
||||
}
|
||||
|
||||
log "starting backend API on :8080"
|
||||
(cd backend/api/rest && go run . >/tmp/e2e-backend.log 2>&1) &
|
||||
BACKEND_PID=$!
|
||||
|
||||
wait_for "$EXPLORER_API_URL/healthz" backend 120 || {
|
||||
log "backend log tail:"; tail -n 60 /tmp/e2e-backend.log || true
|
||||
exit 1
|
||||
}
|
||||
|
||||
log "building frontend"
|
||||
(cd frontend && npm ci --no-audit --no-fund --loglevel=error && npm run build)
|
||||
|
||||
log "starting frontend on :3000"
|
||||
(cd frontend && PORT=3000 HOST=127.0.0.1 NEXT_PUBLIC_API_URL="$EXPLORER_API_URL" npm run start >/tmp/e2e-frontend.log 2>&1) &
|
||||
FRONTEND_PID=$!
|
||||
|
||||
wait_for "$EXPLORER_URL" frontend 60 || {
|
||||
log "frontend log tail:"; tail -n 60 /tmp/e2e-frontend.log || true
|
||||
exit 1
|
||||
}
|
||||
|
||||
log "running Playwright full-stack smoke"
|
||||
npx playwright install --with-deps chromium >/dev/null
|
||||
EXPLORER_URL="$EXPLORER_URL" EXPLORER_API_URL="$EXPLORER_API_URL" \
|
||||
npx playwright test scripts/e2e-full-stack.spec.ts --reporter=list
|
||||
|
||||
log "done; screenshots in $E2E_SCREENSHOT_DIR"
|
||||
Reference in New Issue
Block a user