feat: add paired Chrome bridge authentication

2026-08-19 21:23:03 +00:00
parent b503b5777a
commit b6df6f1a66
10 changed files with 968 additions and 182 deletions
@@ -0,0 +1,179 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { APT_EXTENSION_ID, APT_EXTENSION_ORIGIN } = require('../src/bridge-auth');
+
+const ROOT = path.join(__dirname, '..');
+const EXTENSION = path.join(ROOT, 'chrome-extension');
+const OLD_TOKEN = 'apt-local-' + 'bridge-token';
+const EXPECTED_ID = 'onbkfpbggekakjddomjjnboippimlmch';
+
+function read(name) {
+  return fs.readFileSync(path.join(EXTENSION, name), 'utf8');
+}
+
+function extensionIdFromKey(key) {
+  const digest = crypto.createHash('sha256').update(Buffer.from(key, 'base64')).digest().subarray(0, 16);
+  return [...digest].map((byte) =>
+    String.fromCharCode(97 + (byte >> 4), 97 + (byte & 0x0f))
+  ).join('');
+}
+
+function makeElement() {
+  const listeners = {};
+  return {
+    textContent: '',
+    className: '',
+    disabled: false,
+    hidden: false,
+    checked: false,
+    value: '',
+    addEventListener(type, listener) { listeners[type] = listener; },
+    async dispatch(type) { return listeners[type]?.({ preventDefault() {} }); }
+  };
+}
+
+function makePopupHarness({ paired = true, confirmCopy = false, clipboardReject = null } = {}) {
+  const elements = Object.fromEntries(
+    ['tabInfo', 'pairingInfo', 'sendBtn', 'copyBtn', 'statusMsg', 'copyWarning', 'confirmCopy', 'openOptionsBtn']
+      .map((id) => [id, makeElement()])
+  );
+  const clipboardWrites = [];
+  const fetchCalls = [];
+  let cookieReads = 0;
+  const chromeApi = {
+    storage: { local: { get: async () => paired ? { aptPairingSecret: 'A'.repeat(43) } : {} } },
+    tabs: { query: async () => [{ url: 'https://customer.avasecurity.com/devices' }] },
+    cookies: { get: async () => { cookieReads += 1; return { value: 'sensitive-va-token' }; } },
+    runtime: { openOptionsPage() {} }
+  };
+  const navigatorApi = {
+    clipboard: {
+      async writeText(value) {
+        if (clipboardReject) throw clipboardReject;
+        clipboardWrites.push(value);
+      }
+    }
+  };
+  const documentApi = { getElementById: (id) => elements[id] };
+  const { createPopupController } = require('../chrome-extension/popup.js');
+  const controller = createPopupController({
+    chromeApi,
+    documentApi,
+    navigatorApi,
+    confirmCopy: () => confirmCopy,
+    fetchImpl: async (...args) => {
+      fetchCalls.push(args);
+      return { ok: true, json: async () => ({ success: true }) };
+    }
+  });
+  return { controller, elements, clipboardWrites, fetchCalls, get cookieReads() { return cookieReads; } };
+}
+
+test('manifest commits only a public key, stable ID, local storage, and exact loopback host access', () => {
+  const manifest = JSON.parse(read('manifest.json'));
+  assert.equal(extensionIdFromKey(manifest.key), EXPECTED_ID);
+  assert.equal(APT_EXTENSION_ID, EXPECTED_ID);
+  assert.equal(APT_EXTENSION_ORIGIN, `chrome-extension://${EXPECTED_ID}`);
+  assert.ok(manifest.permissions.includes('storage'));
+  assert.equal(manifest.options_page, 'options.html');
+  assert.ok(manifest.host_permissions.includes('http://127.0.0.1:18247/*'));
+  assert.equal(manifest.host_permissions.some((entry) => entry.includes('localhost')), false);
+  assert.equal(/PRIVATE KEY/.test(manifest.key), false);
+});
+
+test('extension source contains no old token and sends only to the exact bridge endpoint', () => {
+  const sources = ['manifest.json', 'popup.js', 'popup.html', 'options.js', 'options.html']
+    .map(read).join('\n');
+  assert.equal(sources.includes(OLD_TOKEN), false);
+  assert.match(read('popup.js'), /http:\/\/127\.0\.0\.1:18247\/cookie/);
+  assert.doesNotMatch(sources, /http:\/\/(?:localhost|\[::1\]|0\.0\.0\.0):18247/);
+  assert.doesNotMatch(sources, /console\.(?:log|debug|info)\s*\(/);
+});
+
+test('popup stays disabled while unpaired and directs the user to pairing options', async () => {
+  const harness = makePopupHarness({ paired: false });
+  await harness.controller.init();
+  assert.equal(harness.elements.sendBtn.disabled, true);
+  assert.equal(harness.elements.copyBtn.disabled, true);
+  assert.match(harness.elements.pairingInfo.textContent, /Not paired/i);
+  assert.equal(harness.elements.openOptionsBtn.hidden, false);
+});
+
+test('paired popup enables preserved actions only on a supported Alta HTTPS tab', async () => {
+  const harness = makePopupHarness({ paired: true });
+  await harness.controller.init();
+  assert.equal(harness.elements.sendBtn.textContent || 'Send to APT', 'Send to APT');
+  assert.equal(harness.elements.copyBtn.textContent || 'Copy VA Token', 'Copy VA Token');
+  assert.equal(harness.elements.sendBtn.disabled, false);
+  assert.equal(harness.elements.copyBtn.disabled, false);
+  assert.match(harness.elements.pairingInfo.textContent, /Paired/i);
+});
+
+test('deployment detection rejects non-HTTPS, bare, and lookalike Alta hosts', () => {
+  const { isSupportedDeploymentUrl } = require('../chrome-extension/popup.js');
+  assert.equal(isSupportedDeploymentUrl('https://customer.avasecurity.com/path'), true);
+  assert.equal(isSupportedDeploymentUrl('http://customer.avasecurity.com/path'), false);
+  assert.equal(isSupportedDeploymentUrl('https://avasecurity.com/path'), false);
+  assert.equal(isSupportedDeploymentUrl('https://customer.avasecurity.com.evil.test/path'), false);
+});
+
+test('Send to APT uses the paired secret header and exact endpoint', async () => {
+  const harness = makePopupHarness({ paired: true });
+  await harness.controller.init();
+  await harness.controller.sendToApt();
+  assert.equal(harness.fetchCalls.length, 1);
+  const [url, request] = harness.fetchCalls[0];
+  assert.equal(url, 'http://127.0.0.1:18247/cookie');
+  assert.equal(request.headers['X-APT-Pairing-Secret'], 'A'.repeat(43));
+  assert.deepEqual(JSON.parse(request.body), {
+    deploymentUrl: 'https://customer.avasecurity.com',
+    cookieValue: 'sensitive-va-token'
+  });
+});
+
+test('copy cancellation occurs before cookie access and never writes the token', async () => {
+  const harness = makePopupHarness({ paired: true, confirmCopy: false });
+  await harness.controller.init();
+  await harness.controller.copyToken();
+  assert.equal(harness.cookieReads, 0);
+  assert.deepEqual(harness.clipboardWrites, []);
+  assert.match(harness.elements.statusMsg.textContent, /cancelled/i);
+});
+
+test('confirmed copy warns about clipboard history and reports success without exposing token', async () => {
+  const harness = makePopupHarness({ paired: true, confirmCopy: true });
+  await harness.controller.init();
+  assert.match(harness.elements.copyWarning.textContent, /clipboard (?:history|sync)/i);
+  await harness.controller.copyToken();
+  assert.deepEqual(harness.clipboardWrites, ['sensitive-va-token']);
+  assert.match(harness.elements.statusMsg.textContent, /copied/i);
+  assert.equal(harness.elements.statusMsg.textContent.includes('sensitive-va-token'), false);
+});
+
+test('clipboard permission denial is handled without leaking the token', async () => {
+  const harness = makePopupHarness({
+    paired: true,
+    confirmCopy: true,
+    clipboardReject: new Error('NotAllowedError')
+  });
+  await harness.controller.init();
+  await harness.controller.copyToken();
+  assert.match(harness.elements.statusMsg.textContent, /could not copy/i);
+  assert.equal(harness.elements.statusMsg.textContent.includes('sensitive-va-token'), false);
+});
+
+test('options UI stores a validated pairing secret locally and can forget pairing', () => {
+  const html = read('options.html');
+  const js = read('options.js');
+  assert.match(html, /pairingSecret/);
+  assert.match(html, /type="password"/);
+  assert.match(js, /chrome\.storage\.local\.set/);
+  assert.match(js, /chrome\.storage\.local\.remove/);
+  assert.match(js, /aptPairingSecret/);
+  assert.doesNotMatch(js, /console\./);
+});