The lock test learns the doors moved: logout is the front door and asks for a password once ever (the guard is finally wired to its comment), the padlock keeps asking because it must, and the suite walks the real UI again

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JtaatFfAbx91Nh3xqKVqKz

2 files changed, 72 insertions, 97 deletions

diff --git a/src/app.js b/src/app.js
index 0b63492..7e7dc9a 100644
--- a/src/app.js
+++ b/src/app.js
@@ -1710,12 +1710,12 @@ function lock({ offerPassword = false } = {}) {
   ui.txDetail = null;
   ui.broadcastTx = null;
   ui.bump = null;
-  // After the resets above (which clear ui.pw): locking with no password locks
-  // NOTHING — the wallets reopen by themselves. So a person who taps the
-  // padlock gets the password prompt every time until one exists; without it
-  // the tap would just be a confusing trip to the wallet list. (The idle
-  // timer still never nags.)
-  if (noPassword && offerPassword) {
+  // Offer to set a password on the way out — but once, ever: someone who said
+  // "Not now" has answered, and a wallet that nags is a wallet people stop
+  // reading. (The padlock is different: it asks every time via softLock's
+  // in-place prompt, because locking without a password is impossible and
+  // the tap would otherwise be a confusing trip to the wallet list.)
+  if (noPassword && offerPassword && !lockPwAsked()) {
     ui.pw = { purpose: 'lock', mode: 'set', v0: '', v1: '', v2: '', error: '' };
   }
   render();
diff --git a/tools/lock-wallet-test.js b/tools/lock-wallet-test.js
index 1c46f2b..5a25615 100644
--- a/tools/lock-wallet-test.js
+++ b/tools/lock-wallet-test.js
@@ -1,53 +1,60 @@
-// "Lock wallet" locks; only "Clear all" deletes.
+// "Log out" locks; only "Clear all" deletes.
 //
 // Wallets save themselves to this device under an empty password unless the
-// user sets one, so the unlock screen was demanding a password nobody had
-// chosen — which made the action look like it had done something drastic. It
-// hasn't: locking keeps every saved wallet.
+// user sets one. Logging out of a passwordless vault offers a password ONCE
+// (ever), then drops to the wallet list — everything saved, one tap back in.
+// The padlock is the counterpart with its own rules (see padlock-flow-test).
 //
-// Run: bun tools/logout-test.js
+// Run: bun tools/lock-wallet-test.js
 import puppeteer from 'puppeteer-core';
 import { generateMnemonic } from '@scure/bip39';
 import { wordlist } from '@scure/bip39/wordlists/english';
 import { buildHtml } from '../build.js';
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-let ok = true;
-const check = (n, c, d = '') => { console.log(` ${c ? '✓' : '✗'} ${n}${d ? ' — ' + String(d).slice(0, 160) : ''}`); if (!c) ok = false; };
+let fails = 0;
+const check = (n, c, d = '') => { console.log(` ${c ? '✓' : '✗'} ${n}${d ? ' — ' + String(d).slice(0, 160) : ''}`); if (!c) fails++; };
 
 const html = await buildHtml({ minify: true, pwa: false });
 const server = Bun.serve({ port: 5235, fetch: () => new Response(html, { headers: { 'content-type': 'text/html' } }) });
 const browser = await puppeteer.launch({ executablePath: '/usr/bin/google-chrome', headless: 'new', args: ['--no-sandbox'] });
 const page = await browser.newPage();
+await page.setViewport({ width: 420, height: 880 });
 const body = () => page.evaluate(() => document.body.innerText);
 const click = (sel, t) => page.evaluate((s, x) => { const e = [...document.querySelectorAll(s)].find((n) => n.textContent.trim().toLowerCase().includes(x.toLowerCase())); if (e) { e.click(); return true; } return false; }, sel, t);
 const waitText = async (x, ms = 20000) => { for (let i = 0; i < ms / 250; i++) { if ((await body()).toLowerCase().includes(x.toLowerCase())) return true; await sleep(250); } return false; };
+const vaultSize = () => page.evaluate(() => (localStorage.getItem('btc-wallet-vault') || '').length);
+// Log out lives on the own-profile page behind the header avatar.
 const logout = async () => {
   await page.evaluate(() => document.querySelector('.header-avatar')?.click());
-  await sleep(400);
-  await click('.icon-select-item', 'Lock wallet');
+  await sleep(800);
+  await click('button', 'Log out');
+  await sleep(1200);
+};
+const enterSavings = async () => {
+  await click('button', 'Savings');
   await sleep(1500);
+  return waitText('receive');
 };
-const vaultSize = () => page.evaluate(() => (localStorage.getItem('btc-wallet-vault') || '').length);
 
 try {
   await page.goto('http://localhost:5235/', { waitUntil: 'domcontentloaded' });
   await page.evaluate(() => localStorage.setItem('btc-wallet-network', 'regtest'));
   await page.reload({ waitUntil: 'domcontentloaded' });
   await sleep(400);
-  await click('button', 'I already have a wallet');
-  await sleep(300);
+  await click('button', 'Get started');
+  await sleep(500);
   await click('button', 'Import existing');
-  await sleep(300);
+  await sleep(400);
   await page.waitForSelector('textarea');
   await page.type('textarea', generateMnemonic(wordlist));
   await click('button', 'Open wallet');
-  check('wallet open', await waitText('receive', 15000));
+  check('wallet open', await waitText('receive'));
   await sleep(2500);
   const savedBytes = await vaultSize();
   check('it saved itself to the device', savedBytes > 0, `${savedBytes} bytes of vault`);
 
-  console.log('\n[locking with no password set]');
+  console.log('\n[logging out with no password set]');
   await logout();
   let txt = await body();
   check('it offers a password once', /protect this device/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | '));
@@ -55,33 +62,37 @@ try {
   await click('button', 'Not now');
   await sleep(800);
   txt = await body();
-  check('declining locks anyway', !/protect this device/i.test(txt));
+  check('declining logs out anyway', !/protect this device/i.test(txt));
   check('no password is demanded', !/enter your password|unlock saved wallets/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | '));
   check('the saved wallet is still there', (await vaultSize()) === savedBytes);
-  check('and it is offered back', /wallet 1|wallets/i.test(txt), txt.slice(0, 140).replace(/\n+/g, ' | '));
-
-  const listed = await page.evaluate(() => [...document.querySelectorAll('button, .item, .acct')].map((e) => e.textContent.trim()).filter((x) => /Wallet 1/.test(x)));
+  check('and it is offered back', /savings/i.test(txt), txt.slice(0, 140).replace(/\n+/g, ' | '));
+  const listed = await page.evaluate(() => [...document.querySelectorAll('button')].map((e) => e.textContent.trim()).filter((x) => /^[●○] Savings/.test(x)));
   check('and only once — no phantom duplicate', listed.length === 1, JSON.stringify(listed));
 
   console.log('\n[the offer is not a nag]');
-  await page.evaluate(() => { const e = [...document.querySelectorAll('*')].find((n) => n.children.length === 0 && /Wallet 1/.test(n.textContent) && n.closest('button, .item, .acct')); if (e) e.closest('button, .item, .acct').click(); });
-  await sleep(2000);
-  await waitText('receive', 15000);
+  check('one tap returns to the wallet', await enterSavings());
   await logout();
-  check('it does not ask a second time', !/protect this device/i.test(await body()));
+  txt = await body();
+  check('it does not ask a second time', !/protect this device/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | '));
+  check('logout means the front door', /create new|get started|sign in/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | '));
+  await page.reload({ waitUntil: 'domcontentloaded' });
+  check('and a saved passwordless wallet is one reload away', await waitText('receive'));
+  await sleep(1000);
 
-  console.log('\n[getting back in]');
-  await page.evaluate(() => { const e = [...document.querySelectorAll('*')].find((n) => n.children.length === 0 && /Wallet 1/.test(n.textContent) && n.closest('button, .item, .acct')); if (e) e.closest('button, .item, .acct').click(); });
-  await sleep(2000);
-  check('one tap returns to the wallet', await waitText('receive', 15000));
+  console.log('\n[the padlock still asks — locking needs a password]');
+  await page.evaluate(() => { const b = [...document.querySelectorAll('button')].find((n) => n.title === 'Lock wallet'); if (b) b.click(); });
+  await sleep(600);
+  txt = await body();
+  check('padlock asks even after "Not now"', /protect this device/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | '));
+  await click('button', 'Not now');
+  await sleep(600);
+  check('and declining lands home', await waitText('receive'));
 
   console.log('\n[now with a password]');
-  // "Change password" lives on the Wallets screen, behind the header selector
-  await page.evaluate(() => { const b = [...document.querySelectorAll('.row.between button')].find((e) => /Wallet/.test(e.textContent)); if (b) b.click(); });
-  await sleep(1200);
-  check('on the wallets screen', /wallets/i.test(await body()));
+  await click('button', 'Wallets');
+  await sleep(800);
   await click('button', 'Change password');
-  await sleep(1000);
+  await sleep(800);
   const fields = await page.$$('input[type=password]');
   check('the change-password form is up', fields.length >= 3, `${fields.length} field(s)`);
   // current (empty) / new / confirm
@@ -91,76 +102,40 @@ try {
   const pwSet = await waitText('password changed', 8000);
   check('a password is actually set', pwSet, (await body()).slice(0, 120).replace(/\n+/g, ' | '));
 
-  // back into the wallet — the Wallets screen has no avatar menu to log out from
   await click('button', 'Back');
-  await sleep(1500);
-  check('back in the wallet', await waitText('receive', 15000));
+  await sleep(1200);
+  check('back in the wallet', await waitText('receive'));
   await logout();
   txt = await body();
-  check('now it does ask', /unlock saved wallets|enter your password/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | '));
+  check('logout is still the front door', /create new|get started|sign in/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | '));
   check('the wallet is still saved', (await vaultSize()) > 0);
+  await page.reload({ waitUntil: 'domcontentloaded' });
+  await sleep(800);
+  txt = await body();
+  check('now re-entry asks for the password', /unlock saved wallets|enter your password/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | '));
+  const pwField = await page.$('input[type=password]');
+  await pwField.type('hunter22');
+  await click('button', 'Unlock');
+  check('the password opens it', await waitText('receive'));
+  await sleep(1000);
 
   console.log('\n[clear all is the destructive one]');
-  await click('button', 'Use another wallet');
-  await sleep(1500);
-  await page.evaluate(() => { const b = [...document.querySelectorAll('.row.between button')].find((e) => /Wallet/.test(e.textContent)); if (b) b.click(); });
-  await sleep(1200);
-  await click('button', 'Clear all');
+  await click('button', 'Wallets');
   await sleep(800);
-  const txt2 = await body();
-  check('it warns before wiping', /removes every wallet/i.test(txt2), txt2.slice(0, 140).replace(/\n+/g, ' | '));
-  check('and it has not wiped anything yet', (await vaultSize()) > 0);
-  // A clean profile, because the offer is once-per-device and the run above
-  // already answered it.
-  console.log('\n[taking the offer, on a fresh device]');
-  const ctx = await browser.createBrowserContext();
-  const p2 = await ctx.newPage();
-  const body2 = () => p2.evaluate(() => document.body.innerText);
-  const click2 = (sel, x) => p2.evaluate((s, t) => { const e = [...document.querySelectorAll(s)].find((n) => n.textContent.trim().toLowerCase().includes(t.toLowerCase())); if (e) { e.click(); return true; } return false; }, sel, x);
-  const wait2 = async (x, ms = 20000) => { for (let i = 0; i < ms / 250; i++) { if ((await body2()).toLowerCase().includes(x.toLowerCase())) return true; await sleep(250); } return false; };
-  await p2.goto('http://localhost:5235/', { waitUntil: 'domcontentloaded' });
-  await p2.evaluate(() => localStorage.setItem('btc-wallet-network', 'regtest'));
-  await p2.reload({ waitUntil: 'domcontentloaded' });
-  await sleep(400);
-  await click2('button', 'I already have a wallet');
-  await sleep(300);
-  await click2('button', 'Import existing');
-  await sleep(300);
-  await p2.waitForSelector('textarea');
-  await p2.type('textarea', generateMnemonic(wordlist));
-  await click2('button', 'Open wallet');
-  await wait2('receive', 15000);
-  await sleep(2500);
-  await p2.evaluate(() => document.querySelector('.header-avatar')?.click());
-  await sleep(400);
-  await click2('.icon-select-item', 'Lock wallet');
+  await click('button', 'Clear all');
+  await sleep(600);
+  txt = await body();
+  check('it warns first', /clear all/i.test(txt) && /(delete|remove|erase|wipe|lose)/i.test(txt), txt.slice(0, 160).replace(/\n+/g, ' | '));
+  await page.evaluate(() => { const b = [...document.querySelectorAll('.btn-primary')].find((e) => /clear all/i.test(e.textContent)); if (b) b.click(); });
   await sleep(1200);
-  check('offered on this device too', /protect this device/i.test(await body2()));
-
-  const f2 = await p2.$$('input[type=password]');
-  check('a new password and a confirmation', f2.length === 2, `${f2.length} field(s)`);
-  await f2[0].type('correct horse');
-  await f2[1].type('correct horse');
-  await click2('button', 'Save');
-  await sleep(1500);
-  check('accepting it locks for real', /unlock saved wallets/i.test(await body2()), (await body2()).slice(0, 110).replace(/\n+/g, ' | '));
-
-  const wrong = await p2.$('input[type=password]');
-  await wrong.type('not the password');
-  await click2('button', 'Unlock');
-  await sleep(800);
-  check('the wrong password is refused', /wrong password/i.test(await body2()));
-  await p2.evaluate(() => { const i = document.querySelector('input[type=password]'); if (i) { i.value = ''; i.dispatchEvent(new Event('input', { bubbles: true })); } });
-  const right = await p2.$('input[type=password]');
-  await right.type('correct horse');
-  await click2('button', 'Unlock');
-  check('the right one opens it', await wait2('receive', 15000));
-  await ctx.close();
+  txt = await body();
+  check('everything is gone', (await vaultSize()) === 0);
+  check('back at the start page', /get started/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | '));
 } catch (e) {
   check('run completed', false, e.message);
 } finally {
   await browser.close();
   server.stop(true);
 }
-console.log(ok ? '\n✅ locking keeps your wallets' : '\n❌ failures above');
-process.exit(ok ? 0 : 1);
+console.log(fails ? '\n❌ failures above' : '\n✅ log out locks, clear all deletes');
+process.exit(fails ? 1 : 0);