diff options
| -rw-r--r-- | src/app.js | 12 | ||||
| -rw-r--r-- | tools/lock-wallet-test.js | 157 |
2 files changed, 72 insertions, 97 deletions
@@ -1710,12 +1710,12 @@ function lock({ offerPassword = false } = {}) { ui.txDetail = null; ui.broadcastTx = null; ui.bump = null; - // After the resets above (which clear ui.pw): locking with no password locks - // NOTHING — the wallets reopen by themselves. So a person who taps the - // padlock gets the password prompt every time until one exists; without it - // the tap would just be a confusing trip to the wallet list. (The idle - // timer still never nags.) - if (noPassword && offerPassword) { + // Offer to set a password on the way out — but once, ever: someone who said + // "Not now" has answered, and a wallet that nags is a wallet people stop + // reading. (The padlock is different: it asks every time via softLock's + // in-place prompt, because locking without a password is impossible and + // the tap would otherwise be a confusing trip to the wallet list.) + if (noPassword && offerPassword && !lockPwAsked()) { ui.pw = { purpose: 'lock', mode: 'set', v0: '', v1: '', v2: '', error: '' }; } render(); diff --git a/tools/lock-wallet-test.js b/tools/lock-wallet-test.js index 1c46f2b..5a25615 100644 --- a/tools/lock-wallet-test.js +++ b/tools/lock-wallet-test.js @@ -1,53 +1,60 @@ -// "Lock wallet" locks; only "Clear all" deletes. +// "Log out" locks; only "Clear all" deletes. // // Wallets save themselves to this device under an empty password unless the -// user sets one, so the unlock screen was demanding a password nobody had -// chosen — which made the action look like it had done something drastic. It -// hasn't: locking keeps every saved wallet. +// user sets one. Logging out of a passwordless vault offers a password ONCE +// (ever), then drops to the wallet list — everything saved, one tap back in. +// The padlock is the counterpart with its own rules (see padlock-flow-test). // -// Run: bun tools/logout-test.js +// Run: bun tools/lock-wallet-test.js import puppeteer from 'puppeteer-core'; import { generateMnemonic } from '@scure/bip39'; import { wordlist } from '@scure/bip39/wordlists/english'; import { buildHtml } from '../build.js'; const sleep = (ms) => new Promise((r) => setTimeout(r, ms)); -let ok = true; -const check = (n, c, d = '') => { console.log(` ${c ? '✓' : '✗'} ${n}${d ? ' — ' + String(d).slice(0, 160) : ''}`); if (!c) ok = false; }; +let fails = 0; +const check = (n, c, d = '') => { console.log(` ${c ? '✓' : '✗'} ${n}${d ? ' — ' + String(d).slice(0, 160) : ''}`); if (!c) fails++; }; const html = await buildHtml({ minify: true, pwa: false }); const server = Bun.serve({ port: 5235, fetch: () => new Response(html, { headers: { 'content-type': 'text/html' } }) }); const browser = await puppeteer.launch({ executablePath: '/usr/bin/google-chrome', headless: 'new', args: ['--no-sandbox'] }); const page = await browser.newPage(); +await page.setViewport({ width: 420, height: 880 }); const body = () => page.evaluate(() => document.body.innerText); const click = (sel, t) => page.evaluate((s, x) => { const e = [...document.querySelectorAll(s)].find((n) => n.textContent.trim().toLowerCase().includes(x.toLowerCase())); if (e) { e.click(); return true; } return false; }, sel, t); const waitText = async (x, ms = 20000) => { for (let i = 0; i < ms / 250; i++) { if ((await body()).toLowerCase().includes(x.toLowerCase())) return true; await sleep(250); } return false; }; +const vaultSize = () => page.evaluate(() => (localStorage.getItem('btc-wallet-vault') || '').length); +// Log out lives on the own-profile page behind the header avatar. const logout = async () => { await page.evaluate(() => document.querySelector('.header-avatar')?.click()); - await sleep(400); - await click('.icon-select-item', 'Lock wallet'); + await sleep(800); + await click('button', 'Log out'); + await sleep(1200); +}; +const enterSavings = async () => { + await click('button', 'Savings'); await sleep(1500); + return waitText('receive'); }; -const vaultSize = () => page.evaluate(() => (localStorage.getItem('btc-wallet-vault') || '').length); try { await page.goto('http://localhost:5235/', { waitUntil: 'domcontentloaded' }); await page.evaluate(() => localStorage.setItem('btc-wallet-network', 'regtest')); await page.reload({ waitUntil: 'domcontentloaded' }); await sleep(400); - await click('button', 'I already have a wallet'); - await sleep(300); + await click('button', 'Get started'); + await sleep(500); await click('button', 'Import existing'); - await sleep(300); + await sleep(400); await page.waitForSelector('textarea'); await page.type('textarea', generateMnemonic(wordlist)); await click('button', 'Open wallet'); - check('wallet open', await waitText('receive', 15000)); + check('wallet open', await waitText('receive')); await sleep(2500); const savedBytes = await vaultSize(); check('it saved itself to the device', savedBytes > 0, `${savedBytes} bytes of vault`); - console.log('\n[locking with no password set]'); + console.log('\n[logging out with no password set]'); await logout(); let txt = await body(); check('it offers a password once', /protect this device/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | ')); @@ -55,33 +62,37 @@ try { await click('button', 'Not now'); await sleep(800); txt = await body(); - check('declining locks anyway', !/protect this device/i.test(txt)); + check('declining logs out anyway', !/protect this device/i.test(txt)); check('no password is demanded', !/enter your password|unlock saved wallets/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | ')); check('the saved wallet is still there', (await vaultSize()) === savedBytes); - check('and it is offered back', /wallet 1|wallets/i.test(txt), txt.slice(0, 140).replace(/\n+/g, ' | ')); - - const listed = await page.evaluate(() => [...document.querySelectorAll('button, .item, .acct')].map((e) => e.textContent.trim()).filter((x) => /Wallet 1/.test(x))); + check('and it is offered back', /savings/i.test(txt), txt.slice(0, 140).replace(/\n+/g, ' | ')); + const listed = await page.evaluate(() => [...document.querySelectorAll('button')].map((e) => e.textContent.trim()).filter((x) => /^[●○] Savings/.test(x))); check('and only once — no phantom duplicate', listed.length === 1, JSON.stringify(listed)); console.log('\n[the offer is not a nag]'); - await page.evaluate(() => { const e = [...document.querySelectorAll('*')].find((n) => n.children.length === 0 && /Wallet 1/.test(n.textContent) && n.closest('button, .item, .acct')); if (e) e.closest('button, .item, .acct').click(); }); - await sleep(2000); - await waitText('receive', 15000); + check('one tap returns to the wallet', await enterSavings()); await logout(); - check('it does not ask a second time', !/protect this device/i.test(await body())); + txt = await body(); + check('it does not ask a second time', !/protect this device/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | ')); + check('logout means the front door', /create new|get started|sign in/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | ')); + await page.reload({ waitUntil: 'domcontentloaded' }); + check('and a saved passwordless wallet is one reload away', await waitText('receive')); + await sleep(1000); - console.log('\n[getting back in]'); - await page.evaluate(() => { const e = [...document.querySelectorAll('*')].find((n) => n.children.length === 0 && /Wallet 1/.test(n.textContent) && n.closest('button, .item, .acct')); if (e) e.closest('button, .item, .acct').click(); }); - await sleep(2000); - check('one tap returns to the wallet', await waitText('receive', 15000)); + console.log('\n[the padlock still asks — locking needs a password]'); + await page.evaluate(() => { const b = [...document.querySelectorAll('button')].find((n) => n.title === 'Lock wallet'); if (b) b.click(); }); + await sleep(600); + txt = await body(); + check('padlock asks even after "Not now"', /protect this device/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | ')); + await click('button', 'Not now'); + await sleep(600); + check('and declining lands home', await waitText('receive')); console.log('\n[now with a password]'); - // "Change password" lives on the Wallets screen, behind the header selector - await page.evaluate(() => { const b = [...document.querySelectorAll('.row.between button')].find((e) => /Wallet/.test(e.textContent)); if (b) b.click(); }); - await sleep(1200); - check('on the wallets screen', /wallets/i.test(await body())); + await click('button', 'Wallets'); + await sleep(800); await click('button', 'Change password'); - await sleep(1000); + await sleep(800); const fields = await page.$$('input[type=password]'); check('the change-password form is up', fields.length >= 3, `${fields.length} field(s)`); // current (empty) / new / confirm @@ -91,76 +102,40 @@ try { const pwSet = await waitText('password changed', 8000); check('a password is actually set', pwSet, (await body()).slice(0, 120).replace(/\n+/g, ' | ')); - // back into the wallet — the Wallets screen has no avatar menu to log out from await click('button', 'Back'); - await sleep(1500); - check('back in the wallet', await waitText('receive', 15000)); + await sleep(1200); + check('back in the wallet', await waitText('receive')); await logout(); txt = await body(); - check('now it does ask', /unlock saved wallets|enter your password/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | ')); + check('logout is still the front door', /create new|get started|sign in/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | ')); check('the wallet is still saved', (await vaultSize()) > 0); + await page.reload({ waitUntil: 'domcontentloaded' }); + await sleep(800); + txt = await body(); + check('now re-entry asks for the password', /unlock saved wallets|enter your password/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | ')); + const pwField = await page.$('input[type=password]'); + await pwField.type('hunter22'); + await click('button', 'Unlock'); + check('the password opens it', await waitText('receive')); + await sleep(1000); console.log('\n[clear all is the destructive one]'); - await click('button', 'Use another wallet'); - await sleep(1500); - await page.evaluate(() => { const b = [...document.querySelectorAll('.row.between button')].find((e) => /Wallet/.test(e.textContent)); if (b) b.click(); }); - await sleep(1200); - await click('button', 'Clear all'); + await click('button', 'Wallets'); await sleep(800); - const txt2 = await body(); - check('it warns before wiping', /removes every wallet/i.test(txt2), txt2.slice(0, 140).replace(/\n+/g, ' | ')); - check('and it has not wiped anything yet', (await vaultSize()) > 0); - // A clean profile, because the offer is once-per-device and the run above - // already answered it. - console.log('\n[taking the offer, on a fresh device]'); - const ctx = await browser.createBrowserContext(); - const p2 = await ctx.newPage(); - const body2 = () => p2.evaluate(() => document.body.innerText); - const click2 = (sel, x) => p2.evaluate((s, t) => { const e = [...document.querySelectorAll(s)].find((n) => n.textContent.trim().toLowerCase().includes(t.toLowerCase())); if (e) { e.click(); return true; } return false; }, sel, x); - const wait2 = async (x, ms = 20000) => { for (let i = 0; i < ms / 250; i++) { if ((await body2()).toLowerCase().includes(x.toLowerCase())) return true; await sleep(250); } return false; }; - await p2.goto('http://localhost:5235/', { waitUntil: 'domcontentloaded' }); - await p2.evaluate(() => localStorage.setItem('btc-wallet-network', 'regtest')); - await p2.reload({ waitUntil: 'domcontentloaded' }); - await sleep(400); - await click2('button', 'I already have a wallet'); - await sleep(300); - await click2('button', 'Import existing'); - await sleep(300); - await p2.waitForSelector('textarea'); - await p2.type('textarea', generateMnemonic(wordlist)); - await click2('button', 'Open wallet'); - await wait2('receive', 15000); - await sleep(2500); - await p2.evaluate(() => document.querySelector('.header-avatar')?.click()); - await sleep(400); - await click2('.icon-select-item', 'Lock wallet'); + await click('button', 'Clear all'); + await sleep(600); + txt = await body(); + check('it warns first', /clear all/i.test(txt) && /(delete|remove|erase|wipe|lose)/i.test(txt), txt.slice(0, 160).replace(/\n+/g, ' | ')); + await page.evaluate(() => { const b = [...document.querySelectorAll('.btn-primary')].find((e) => /clear all/i.test(e.textContent)); if (b) b.click(); }); await sleep(1200); - check('offered on this device too', /protect this device/i.test(await body2())); - - const f2 = await p2.$$('input[type=password]'); - check('a new password and a confirmation', f2.length === 2, `${f2.length} field(s)`); - await f2[0].type('correct horse'); - await f2[1].type('correct horse'); - await click2('button', 'Save'); - await sleep(1500); - check('accepting it locks for real', /unlock saved wallets/i.test(await body2()), (await body2()).slice(0, 110).replace(/\n+/g, ' | ')); - - const wrong = await p2.$('input[type=password]'); - await wrong.type('not the password'); - await click2('button', 'Unlock'); - await sleep(800); - check('the wrong password is refused', /wrong password/i.test(await body2())); - await p2.evaluate(() => { const i = document.querySelector('input[type=password]'); if (i) { i.value = ''; i.dispatchEvent(new Event('input', { bubbles: true })); } }); - const right = await p2.$('input[type=password]'); - await right.type('correct horse'); - await click2('button', 'Unlock'); - check('the right one opens it', await wait2('receive', 15000)); - await ctx.close(); + txt = await body(); + check('everything is gone', (await vaultSize()) === 0); + check('back at the start page', /get started/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | ')); } catch (e) { check('run completed', false, e.message); } finally { await browser.close(); server.stop(true); } -console.log(ok ? '\n✅ locking keeps your wallets' : '\n❌ failures above'); -process.exit(ok ? 0 : 1); +console.log(fails ? '\n❌ failures above' : '\n✅ log out locks, clear all deletes'); +process.exit(fails ? 1 : 0); |