feat: release passwordless hierarchical APT v1.2.5

test/runtime-contract.test.js

@@ -92,14 +92,11 @@ test('runtime keeps Alta credentials in main-owned modules and exposes only non-
       localStorage: null,
     }],
   });
-  const launched = await runtime.launchProxy(
-    '550e8400-e29b-41d4-a716-446655440000',
-    'proxy.operator@example.com'
-  );
+  const launched = await runtime.launchProxy('550e8400-e29b-41d4-a716-446655440000');
   assert.equal(launched.success, true);
   assert.deepEqual(calls[0], {
     deploymentHost: 'customer.avasecurity.com',
-    username: 'proxy.operator@example.com',
+    cookie: 'top-secret-cookie',
     deviceId: '550e8400-e29b-41d4-a716-446655440000',
   });
   assert.deepEqual(runtime.getConnectionState(), {
@@ -189,7 +186,7 @@ test('newest hierarchy discovery owns the launch allowlist when completions arri
   const freshB = runtime.getDeviceHierarchy();
   pending[1]([{ guid: deviceB }]);
   assert.equal((await freshB).success, true);
-  assert.equal((await runtime.launchProxy(deviceB, 'operator@example.com')).success, true);
+  assert.equal((await runtime.launchProxy(deviceB)).success, true);
   pending[0]([{ guid: deviceA }]);
   assert.deepEqual(await staleA, {
     success: false,
@@ -197,7 +194,7 @@ test('newest hierarchy discovery owns the launch allowlist when completions arri
     hierarchy: { devices: [], sites: [], groups: [] },
     message: 'Alta device discovery result is stale',
   });
-  assert.equal((await runtime.launchProxy(deviceA, 'operator@example.com')).success, false);
+  assert.equal((await runtime.launchProxy(deviceA)).success, false);
   assert.deepEqual(launches, [deviceB]);
 });
 
@@ -248,7 +245,7 @@ test('launch allowlist remains bound to the session origin that produced it', as
   });
   assert.equal((await runtime.getDeviceHierarchy()).success, true);
   sessionStore.establish('https://second.avasecurity.com', 'replacement-cookie');
-  assert.equal((await runtime.launchProxy(deviceId, 'operator@example.com')).success, false);
+  assert.equal((await runtime.launchProxy(deviceId)).success, false);
   assert.equal(launches, 0);
 });
 
@@ -256,28 +253,6 @@ test('runtime rejects discovery deadlines above 60 seconds', () => {
   assert.throws(() => new AppRuntime({ discoveryTimeoutMs: 60_001 }), /discovery timeout/i);
 });
 
-test('runtime rejects invalid usernames before calling the proxy manager', async () => {
-  const sessionStore = createSessionStore();
-  sessionStore.establish('https://customer.avasecurity.com', 'top-secret-cookie');
-  const deviceId = '550e8400-e29b-41d4-a716-446655440000';
-  let launches = 0;
-  const runtime = new AppRuntime({
-    sessionStore,
-    altaClient: { getDevices: async () => [{ guid: deviceId }] },
-    proxyManager: {
-      launchProxy() { launches += 1; },
-      listTrackedProxies() { return []; },
-    },
-  });
-  await runtime.getDevices();
-
-  for (const username of ['', 'x'.repeat(255), 'operator@example.com\r\n-k secret', null]) {
-    const result = await runtime.launchProxy(deviceId, username);
-    assert.equal(result.success, false);
-    assert.match(result.message, /username/i);
-  }
-  assert.equal(launches, 0);
-});
 
 test('bridge authenticates itself before accepting a one-time HMAC cookie request', async () => {
   const protect = (value) => Buffer.from(`protected:${value}`);
@@ -403,10 +378,10 @@ test('runtime reconciles exited children and permits relaunch for the same devic
     },
   });
   await runtime.getDevices();
-  assert.equal((await runtime.launchProxy(deviceId, 'operator@example.com')).processId, 4101);
+  assert.equal((await runtime.launchProxy(deviceId)).processId, 4101);
   tracked.length = 0;
   assert.deepEqual(runtime.getConnectionState().activeProxies, []);
-  assert.equal((await runtime.launchProxy(deviceId, 'operator@example.com')).processId, 4102);
+  assert.equal((await runtime.launchProxy(deviceId)).processId, 4102);
 });
 
 test('disconnect stops every owned proxy before clearing the Alta session', async () => {
@@ -474,7 +449,7 @@ test('kill request without exit keeps proxy tracked and session connected until
     setTimeout(callback) { timeoutCallback = callback; return 1; },
     clearTimeout() {},
   });
-  proxyManager.launchProxy({ deploymentHost: 'customer.avasecurity.com', username: 'operator@example.com', deviceId });
+  proxyManager.launchProxy({ deploymentHost: 'customer.avasecurity.com', cookie: 'synthetic-cookie', deviceId });
   const runtime = new AppRuntime({ sessionStore, altaClient: {}, proxyManager });
 
   const firstDisconnect = runtime.disconnect();
@@ -525,13 +500,16 @@ test('preload and renderer expose only narrow, credential-free contracts', () =>
   ];
   for (const method of expectedMethods) assert.match(preload, new RegExp(`\\b${method}\\b`));
   assert.doesNotMatch(preload, /downloadAndInstall|download-and-install|onUpdateDownloadProgress|onExtensionCookie/);
-  assert.match(preload, /launchProxy:\s*\(deviceId, username\)/);
+  assert.match(preload, /launchProxy:\s*\(deviceId\)/);
   assert.doesNotMatch(preload, /launchProxy:\s*\([^)]*(?:cookie|origin)/i);
   assert.doesNotMatch(renderer, /cookieValue|sessionData\.cookies|cookies\s*:/);
   assert.match(renderer, /state\.connected\s*&&\s*\(!wasConnected\s*\|\|\s*state\.origin\s*!==\s*previousOrigin\)/);
   assert.match(read('main.js'), /onConnectionStateChanged:\s*\(\)\s*=>\s*\{\s*runtime\.onSessionChanged\(\)/);
-  assert.doesNotMatch(html, /id="cookieKey"|updateProgress|Install Update/);
-  assert.match(html, /id="altaUsername"/);
+  assert.doesNotMatch(html, /id="cookieKey"|id="altaUsername"|type="password"|updateProgress|Install Update/);
+  assert.match(html, /paired Chrome extension session/i);
+  assert.match(html, /id="pairingSection"[^>]*hidden/);
+  assert.match(html, /id="managePairingBtn"/);
+  assert.match(renderer, /shouldShowPairingOnboarding/);
   assert.match(renderer, /openFixedReleasesPage/);
   assert.match(html, /Bridge Pairing/);
 });