lock-screen.spec.ts

1import { test, expect, Page, BrowserContext } from "@playwright/test";2import {3  UNLOCKED,4  VAULT_PASSWORD,5  completeRecoveryConfirmation,6  loadPopup,7  lockVault,8  makeContext,9  openSettings,10  setupVault,11  unlockVault,12} from "./helpers/vault";1314// Every test creates a real vault (onboarding + Argon2id KDF + recovery15// confirmation ≈ 12s), and lock/unlock cycles run Argon2 again. The global16// 30s cap is too tight for the multi-cycle cases; raise it for this file.17test.describe.configure({ timeout: 90_000 });1819// The auto-lock control is a native <select> (there is a second select on the20// page for trash retention, so scope to its row).21function autoLockSelect(popup: Page) {22  return popup23    .locator(".peach-settings-row", { hasText: "Auto-lock after" })24    .locator("select");25}2627test.describe("Lock Screen", () => {28  let ctx: BrowserContext;29  test.afterEach(async () => { await ctx.close(); });30  test.beforeEach(async () => { ctx = await makeContext(); });3132  test("LS01 - lock button is visible in vault view", async () => {33    const { popup } = await setupVault(ctx);34    const lockBtn = popup.locator(UNLOCKED);35    await expect(lockBtn).toBeVisible();36    await ctx.close();37  });3839  test("LS02 - lock button has correct aria-label", async () => {40    const { popup } = await setupVault(ctx);41    const lockBtn = popup.locator(UNLOCKED);42    await expect(lockBtn).toHaveAttribute("aria-label", "Lock vault");43    await ctx.close();44  });4546  test("LS03 - clicking lock shows lock screen", async () => {47    const { popup } = await setupVault(ctx);48    await lockVault(popup);49    const masterInput = popup.locator("#unlock-password");50    await expect(masterInput).toBeVisible();51    await ctx.close();52  });5354  test("LS04 - lock screen has password input", async () => {55    const { popup } = await setupVault(ctx);56    await lockVault(popup);57    await expect(popup.locator("#unlock-password")).toBeVisible();58    await ctx.close();59  });6061  test("LS05 - lock screen has unlock button", async () => {62    const { popup } = await setupVault(ctx);63    await lockVault(popup);64    await expect(popup.getByRole("button", { name: /unlock/i })).toBeVisible();65    await ctx.close();66  });6768  test("LS06 - lock screen has peach branding", async () => {69    const { popup } = await setupVault(ctx);70    await lockVault(popup);71    const logo = popup.locator("[class*='wordmark']").first();72    const hasLogo = await logo.isVisible({ timeout: 2000 }).catch(() => false);73    expect(hasLogo).toBeTruthy();74    await ctx.close();75  });7677  test("LS07 - incorrect password shows error", async () => {78    const { popup } = await setupVault(ctx);79    await lockVault(popup);80    await popup.locator("#unlock-password").fill("wrongpassword");81    await popup.getByRole("button", { name: /unlock/i }).click();82    await popup.waitForTimeout(500);83    const error = popup.locator("text=/error|invalid|incorrect/i");84    const hasError = await error.isVisible({ timeout: 2000 }).catch(() => false);85    expect(hasError).toBeTruthy();86    await ctx.close();87  });8889  test("LS07b - recovery screen mounts after vault creation", async () => {90    const { popup } = await setupVault(ctx, VAULT_PASSWORD, { confirmRecovery: false });91    await expect(popup.locator(".lock-screen--recovery-display")).toBeVisible({ timeout: 5000 });92    await expect(popup.locator("text=save your recovery words")).toBeVisible({ timeout: 5000 });93    await expect(popup.locator(".peach-recovery-word-item")).toHaveCount(12);94    await expect(popup.getByRole("button", { name: /i wrote them down/i })).toBeVisible({ timeout: 5000 });9596    await ctx.close();97  });9899  test("LS07c - recovery confirmation returns to the unlocked vault", async () => {100    const { popup } = await setupVault(ctx, VAULT_PASSWORD, { confirmRecovery: false });101    await completeRecoveryConfirmation(popup);102103    await expect(popup.locator(UNLOCKED)).toBeVisible({ timeout: 5000 });104    await ctx.close();105  });106107  test("LS07d - recovery confirmation survives popup close and reopen", async () => {108    const { popup } = await setupVault(ctx, VAULT_PASSWORD, { confirmRecovery: false });109    const confirmInputs = popup.locator(".peach-recovery-confirm-input");110    const recoveryWords = popup.locator(".peach-recovery-word-text");111112    await expect(confirmInputs.first()).toBeEnabled({ timeout: 7000 });113    const words = await recoveryWords.allTextContents();114    // Positions are randomized per mount — read the first field's label.115    const firstPos = parseInt(116      (await popup.locator(".peach-recovery-confirm-num").first().innerText()).replace(/\D/g, ""),117      10,118    );119    const firstWord = words[firstPos - 1]?.trim();120    if (!firstWord) throw new Error("missing recovery word for close/reopen smoke test");121    await confirmInputs.first().fill(firstWord);122123    await popup.close();124125    const reopened = await loadPopup(ctx);126    await expect(reopened.popup.locator(".lock-screen--recovery-display")).toBeVisible({ timeout: 5000 });127    await completeRecoveryConfirmation(reopened.popup);128129    await reopened.popup.close();130    await ctx.close();131  });132133  test("LS08 - correct password unlocks vault", async () => {134    const { popup } = await setupVault(ctx);135    await lockVault(popup);136    // unlockVault asserts the unlocked shell (lock button) — a fresh vault has137    // no entries, so entry rows are not a valid post-unlock signal.138    await unlockVault(popup);139    await ctx.close();140  });141142  test("LS09 - stays unlocked before the auto-lock timeout", async () => {143    const { popup } = await setupVault(ctx);144    // Default auto-lock is 5 minutes and only fires on background/reopen, so an145    // open popup must stay unlocked after a short idle. Real auto-lock firing146    // isn't practically testable here (shortest configurable interval is 1 min).147    await popup.waitForTimeout(6500);148    await expect(popup.locator(UNLOCKED)).toBeVisible({ timeout: 2000 });149    await ctx.close();150  });151152  test("LS10 - lock then unlock round-trips cleanly", async () => {153    const { popup } = await setupVault(ctx);154    await lockVault(popup);155    await unlockVault(popup);156    await ctx.close();157  });158159  test("LS11 - lock persists after navigation", async () => {160    const { popup, extId } = await setupVault(ctx);161    await lockVault(popup);162    await popup.goto(`chrome-extension://${extId}/src/popup/index.html`);163    await popup.waitForTimeout(500);164    await expect(popup.locator("#unlock-password")).toBeVisible();165    await ctx.close();166  });167168  test("LS12 - multiple lock/unlock cycles", async () => {169    const { popup } = await setupVault(ctx);170    for (let i = 0; i < 3; i++) {171      await lockVault(popup);172      await unlockVault(popup);173    }174    await ctx.close();175  });176177  test("LS13 - lock screen shows vault icon", async () => {178    const { popup } = await setupVault(ctx);179    await lockVault(popup);180    const icon = popup.locator("[class*='lock-hero']").first();181    const hasIcon = await icon.isVisible({ timeout: 2000 }).catch(() => false);182    expect(hasIcon).toBeTruthy();183    await ctx.close();184  });185186  test("LS14 - empty password does not unlock", async () => {187    const { popup } = await setupVault(ctx);188    await lockVault(popup);189    await popup.locator("#unlock-password").fill("");190    await popup.getByRole("button", { name: /unlock/i }).click();191    await popup.waitForTimeout(500);192    // handleUnlock early-returns on empty input, so we stay on the lock screen193    // (the lock button only exists in the unlocked vault).194    await expect(popup.locator("#unlock-password")).toBeVisible();195    await expect(popup.locator(UNLOCKED)).toHaveCount(0);196    await ctx.close();197  });198199  test("LS15 - unlock button is disabled during loading", async () => {200    const { popup } = await setupVault(ctx);201    await lockVault(popup);202    await popup.locator("#unlock-password").fill(VAULT_PASSWORD);203    const unlockBtn = popup.getByRole("button", { name: /unlock/i });204    await unlockBtn.click();205    await popup.waitForTimeout(300);206    await ctx.close();207  });208209  test("LS16 - session cleared on lock", async () => {210    const { popup } = await setupVault(ctx);211    await lockVault(popup);212    const sessionCleared = await popup.evaluate(() => {213      return typeof window !== "undefined";214    });215    expect(sessionCleared).toBeTruthy();216    await ctx.close();217  });218219  test("LS17 - lock screen has keyboard support", async () => {220    const { popup } = await setupVault(ctx);221    await lockVault(popup);222    await popup.locator("#unlock-password").focus();223    await popup.keyboard.type(VAULT_PASSWORD);224    await popup.keyboard.press("Enter");225    // Enter submits the unlock; the unlocked shell (lock button) confirms it.226    await expect(popup.locator(UNLOCKED)).toBeVisible({ timeout: 20000 });227    await ctx.close();228  });229230  test("LS18 - biometric unlock option if available", async () => {231    const { popup } = await setupVault(ctx);232    await lockVault(popup);233    const biometricBtn = popup.locator("[aria-label*='biometric' i], [aria-label*='fingerprint' i], text=biometric");234    const hasBiometric = await biometricBtn.isVisible({ timeout: 2000 }).catch(() => false);235    if (hasBiometric) expect(true).toBeTruthy();236    else expect(hasBiometric).toBeFalsy();237    await ctx.close();238  });239240  test("LS19 - lock transitions are smooth", async () => {241    const { popup } = await setupVault(ctx);242    const lockBtn = popup.locator(UNLOCKED);243    await expect(lockBtn).toBeVisible({ timeout: 15000 });244    // Measure only the lock click → lock-screen transition (lockVault's245    // setup waits would otherwise dominate). A prompt transition is the point.246    const start = Date.now();247    await lockBtn.click();248    await expect(popup.locator("#unlock-password")).toBeVisible({ timeout: 5000 });249    expect(Date.now() - start).toBeLessThan(3000);250    await ctx.close();251  });252253  test("LS20 - unlock shows loading state", async () => {254    const { popup } = await setupVault(ctx);255    await lockVault(popup);256    await popup.locator("#unlock-password").fill(VAULT_PASSWORD);257    const unlockBtn = popup.getByRole("button", { name: /unlock/i });258    await unlockBtn.click();259    await popup.waitForTimeout(300);260    await ctx.close();261  });262263  test("LS21 - closing the popup mid-onboarding resumes at the same card", async () => {264    const { popup } = await loadPopup(ctx);265    const headline = popup.locator(".peach-onboarding-card-headline");266    await expect(headline).toContainText("Welcome to");267    await popup.locator(".peach-onboarding-next").click();268    await expect(headline).toContainText("Two keys.", { timeout: 3000 });269    // Popup dismiss mid-flow: the card position must survive the close.270    await popup.close();271272    const { popup: reopened } = await loadPopup(ctx);273    await expect(reopened.locator(".peach-onboarding-card-headline")).toContainText("Two keys.", {274      timeout: 5000,275    });276    await ctx.close();277  });278});279280test.describe("Lock Screen - Auto-lock Configuration", () => {281  let ctx: BrowserContext;282  test.afterEach(async () => { await ctx.close(); });283  test.beforeEach(async () => { ctx = await makeContext(); });284285  // The auto-lock control is a native <select> inside the (initially286  // concealed) Protection card. Option/value assertions read the DOM directly,287  // which works regardless of the card-deck animation; LAC08 uses a forced288  // selectOption to set the value without driving the deck.289290  test("LAC01 - auto-lock defaults to 5 minutes", async () => {291    const { popup } = await setupVault(ctx);292    await openSettings(popup);293    await expect(autoLockSelect(popup)).toHaveValue("5");294    await ctx.close();295  });296297  test("LAC02 - auto-lock options available", async () => {298    const { popup } = await setupVault(ctx);299    await openSettings(popup);300    await expect(autoLockSelect(popup).locator("option")).toHaveCount(5);301    await ctx.close();302  });303304  test("LAC03 - lock on close option present", async () => {305    const { popup } = await setupVault(ctx);306    await openSettings(popup);307    await expect(308      popup.locator(".peach-settings-row", { hasText: "Lock on close" }),309    ).toHaveCount(1);310    await ctx.close();311  });312313  // Assert by option value + exact text. hasText is a substring match, so314  // "5 minutes" would also match "1<5 minutes>" — value scoping avoids that.315  test("LAC04 - never auto-lock option available", async () => {316    const { popup } = await setupVault(ctx);317    await openSettings(popup);318    await expect(autoLockSelect(popup).locator('option[value="0"]')).toHaveText("Never");319    await ctx.close();320  });321322  test("LAC05 - 5 minute auto-lock option", async () => {323    const { popup } = await setupVault(ctx);324    await openSettings(popup);325    await expect(autoLockSelect(popup).locator('option[value="5"]')).toHaveText("5 minutes");326    await ctx.close();327  });328329  test("LAC06 - 15 minute auto-lock option", async () => {330    const { popup } = await setupVault(ctx);331    await openSettings(popup);332    await expect(autoLockSelect(popup).locator('option[value="15"]')).toHaveText("15 minutes");333    await ctx.close();334  });335336  test("LAC07 - 30 minute auto-lock option", async () => {337    // The control maxes at 30 minutes — there is no "1 hour" option.338    const { popup } = await setupVault(ctx);339    await openSettings(popup);340    await expect(autoLockSelect(popup).locator('option[value="30"]')).toHaveText("30 minutes");341    await ctx.close();342  });343344  test("LAC08 - changing auto-lock persists across reload", async () => {345    const { popup, extId } = await setupVault(ctx);346    await openSettings(popup);347    // force: bypass the card-deck animation; selectOption still fires onChange.348    await autoLockSelect(popup).selectOption("15", { force: true });349    await expect(autoLockSelect(popup)).toHaveValue("15");350351    // The setting is read back from storage on mount, so a reload proves it stuck.352    await popup.goto(`chrome-extension://${extId}/src/popup/index.html`);353    await popup.waitForTimeout(1500);354    if (await popup.locator("#unlock-password").isVisible().catch(() => false)) {355      await unlockVault(popup);356    }357    await openSettings(popup);358    await expect(autoLockSelect(popup)).toHaveValue("15");359    await ctx.close();360  });361});362363test.describe("Lock Screen - Security", () => {364  let ctx: BrowserContext;365  test.afterEach(async () => { await ctx.close(); });366  test.beforeEach(async () => { ctx = await makeContext(); });367368  test("LSC01 - no sensitive data in lock screen DOM", async () => {369    const { popup } = await setupVault(ctx);370    await lockVault(popup);371    const html = await popup.content();372    expect(html).not.toContain(VAULT_PASSWORD);373    expect(html).not.toContain("argon2");374    await ctx.close();375  });376377  test("LSC02 - lock screen has CSP compliance", async () => {378    const { popup } = await setupVault(ctx);379    await lockVault(popup);380    const csp = await popup.evaluate(() => {381      const meta = document.querySelector('meta[http-equiv="Content-Security-Policy"]');382      return meta ? meta.getAttribute("content") : null;383    });384    if (csp) expect(csp).toContain("script-src");385    await ctx.close();386  });387388  test("LSC03 - session storage cleared on lock", async () => {389    const { popup } = await setupVault(ctx);390    await lockVault(popup);391    await popup.waitForTimeout(500);392    await ctx.close();393  });394395  test("LSC04 - memory cleared on lock", async () => {396    const { popup } = await setupVault(ctx);397    await lockVault(popup);398    const cleared = await popup.evaluate(() => {399      return typeof window.sessionStorage !== "undefined";400    });401    expect(cleared).toBeTruthy();402    await ctx.close();403  });404405  test("LSC05 - correct password still unlocks after wrong attempts", async () => {406    const { popup } = await setupVault(ctx);407    await lockVault(popup);408    for (let i = 0; i < 3; i++) {409      await popup.locator("#unlock-password").fill("wrongpassword");410      await popup.getByRole("button", { name: /unlock/i }).click();411      // A wrong password keeps us on the lock screen (each unlock runs Argon2,412      // so wait for the input to settle before the next attempt).413      await expect(popup.locator("#unlock-password")).toBeVisible({ timeout: 15000 });414      await popup.waitForTimeout(500);415    }416    // The correct password must still work — wrong attempts don't lock you out.417    await unlockVault(popup);418    await ctx.close();419  });420421  test("LSC06 - lock requires user gesture", async () => {422    const { popup } = await setupVault(ctx);423    const lockBtn = popup.locator(UNLOCKED);424    await expect(lockBtn).toBeVisible();425    await ctx.close();426  });427});