lock-screen.spec.ts

1import { test, expect, Page, BrowserContext } from "@playwright/test";2import {3  UNLOCKED,4  VAULT_PASSWORD,5  completeRecoveryConfirmation,6  loadPopup,7  lockVault,8  makeContext,9  openSettings,10  setupVault,11  unlockVault,12} from "./helpers/vault";1314// Every test creates a real vault (onboarding + Argon2id KDF + recovery15// confirmation ≈ 12s), and lock/unlock cycles run Argon2 again. The global16// 30s cap is too tight for the multi-cycle cases; raise it for this file.17test.describe.configure({ timeout: 90_000 });1819// The auto-lock control is a native <select> (there is a second select on the20// page for trash retention, so scope to its row).21function autoLockSelect(popup: Page) {22  return popup23    .locator(".peach-settings-row", { hasText: "Auto-lock after" })24    .locator("select");25}2627test.describe("Lock Screen", () => {28  let ctx: BrowserContext;29  test.afterEach(async () => { await ctx.close(); });30  test.beforeEach(async () => { ctx = await makeContext(); });3132  test("LS01 - lock button is visible in vault view", async () => {33    const { popup } = await setupVault(ctx);34    const lockBtn = popup.locator(UNLOCKED);35    await expect(lockBtn).toBeVisible();36    await ctx.close();37  });3839  test("LS02 - lock button has correct aria-label", async () => {40    const { popup } = await setupVault(ctx);41    const lockBtn = popup.locator(UNLOCKED);42    await expect(lockBtn).toHaveAttribute("aria-label", "Lock vault");43    await ctx.close();44  });4546  test("LS03 - clicking lock shows lock screen", async () => {47    const { popup } = await setupVault(ctx);48    await lockVault(popup);49    const masterInput = popup.locator("#unlock-password");50    await expect(masterInput).toBeVisible();51    await ctx.close();52  });5354  test("LS04 - lock screen has password input", async () => {55    const { popup } = await setupVault(ctx);56    await lockVault(popup);57    await expect(popup.locator("#unlock-password")).toBeVisible();58    await ctx.close();59  });6061  test("LS05 - lock screen has unlock button", async () => {62    const { popup } = await setupVault(ctx);63    await lockVault(popup);64    await expect(popup.getByRole("button", { name: /unlock/i })).toBeVisible();65    await ctx.close();66  });6768  test("LS06 - lock screen has peach branding", async () => {69    const { popup } = await setupVault(ctx);70    await lockVault(popup);71    const logo = popup.locator("[class*='wordmark']").first();72    const hasLogo = await logo.isVisible({ timeout: 2000 }).catch(() => false);73    expect(hasLogo).toBeTruthy();74    await ctx.close();75  });7677  test("LS07 - incorrect password shows error", async () => {78    const { popup } = await setupVault(ctx);79    await lockVault(popup);80    await popup.locator("#unlock-password").fill("wrongpassword");81    await popup.getByRole("button", { name: /unlock/i }).click();82    await popup.waitForTimeout(500);83    const error = popup.locator("text=/error|invalid|incorrect/i");84    const hasError = await error.isVisible({ timeout: 2000 }).catch(() => false);85    expect(hasError).toBeTruthy();86    await ctx.close();87  });8889  test("LS07b - recovery screen mounts after vault creation", async () => {90    const { popup } = await setupVault(ctx, VAULT_PASSWORD, { confirmRecovery: false });91    await expect(popup.locator(".lock-screen--recovery-display")).toBeVisible({ timeout: 5000 });92    await expect(popup.locator("text=save your recovery words")).toBeVisible({ timeout: 5000 });93    await expect(popup.locator(".peach-recovery-word-item")).toHaveCount(12);94    await expect(popup.getByRole("button", { name: /i wrote them down/i })).toBeVisible({ timeout: 5000 });9596    await ctx.close();97  });9899  test("LS07c - recovery confirmation returns to the unlocked vault", async () => {100    const { popup } = await setupVault(ctx, VAULT_PASSWORD, { confirmRecovery: false });101    await completeRecoveryConfirmation(popup);102103    await expect(popup.locator(UNLOCKED)).toBeVisible({ timeout: 5000 });104    await ctx.close();105  });106107  test("LS07d - recovery confirmation survives popup close and reopen", async () => {108    const { popup } = await setupVault(ctx, VAULT_PASSWORD, { confirmRecovery: false });109    const confirmInputs = popup.locator(".peach-recovery-confirm-input");110    const recoveryWords = popup.locator(".peach-recovery-word-text");111112    await expect(confirmInputs.first()).toBeEnabled({ timeout: 7000 });113    const words = await recoveryWords.allTextContents();114    // Positions are randomized per mount — read the first field's label.115    const firstPos = parseInt(116      (await popup.locator(".peach-recovery-confirm-num").first().innerText()).replace(/\D/g, ""),117      10,118    );119    const firstWord = words[firstPos - 1]?.trim();120    if (!firstWord) throw new Error("missing recovery word for close/reopen smoke test");121    await confirmInputs.first().fill(firstWord);122123    await popup.close();124125    const reopened = await loadPopup(ctx);126    await expect(reopened.popup.locator(".lock-screen--recovery-display")).toBeVisible({ timeout: 5000 });127    await completeRecoveryConfirmation(reopened.popup);128129    await reopened.popup.close();130    await ctx.close();131  });132133  test("LS08 - correct password unlocks vault", async () => {134    const { popup } = await setupVault(ctx);135    await lockVault(popup);136    // unlockVault asserts the unlocked shell (lock button) — a fresh vault has137    // no entries, so entry rows are not a valid post-unlock signal.138    await unlockVault(popup);139    await ctx.close();140  });141142  test("LS09 - stays unlocked before the auto-lock timeout", async () => {143    const { popup } = await setupVault(ctx);144    // Default auto-lock is 5 minutes and only fires on background/reopen, so an145    // open popup must stay unlocked after a short idle. Real auto-lock firing146    // isn't practically testable here (shortest configurable interval is 1 min).147    await popup.waitForTimeout(6500);148    await expect(popup.locator(UNLOCKED)).toBeVisible({ timeout: 2000 });149    await ctx.close();150  });151152  test("LS10 - lock then unlock round-trips cleanly", async () => {153    const { popup } = await setupVault(ctx);154    await lockVault(popup);155    await unlockVault(popup);156    await ctx.close();157  });158159  test("LS11 - lock persists after navigation", async () => {160    const { popup, extId } = await setupVault(ctx);161    await lockVault(popup);162    await popup.goto(`chrome-extension://${extId}/src/popup/index.html`);163    await popup.waitForTimeout(500);164    await expect(popup.locator("#unlock-password")).toBeVisible();165    await ctx.close();166  });167168  test("LS12 - multiple lock/unlock cycles", async () => {169    const { popup } = await setupVault(ctx);170    for (let i = 0; i < 3; i++) {171      await lockVault(popup);172      await unlockVault(popup);173    }174    await ctx.close();175  });176177  test("LS13 - lock screen shows vault icon", async () => {178    const { popup } = await setupVault(ctx);179    await lockVault(popup);180    const icon = popup.locator("[class*='lock-hero']").first();181    const hasIcon = await icon.isVisible({ timeout: 2000 }).catch(() => false);182    expect(hasIcon).toBeTruthy();183    await ctx.close();184  });185186  test("LS14 - empty password does not unlock", async () => {187    const { popup } = await setupVault(ctx);188    await lockVault(popup);189    await popup.locator("#unlock-password").fill("");190    await popup.getByRole("button", { name: /unlock/i }).click();191    await popup.waitForTimeout(500);192    // handleUnlock early-returns on empty input, so we stay on the lock screen193    // (the lock button only exists in the unlocked vault).194    await expect(popup.locator("#unlock-password")).toBeVisible();195    await expect(popup.locator(UNLOCKED)).toHaveCount(0);196    await ctx.close();197  });198199  test("LS15 - unlock button is disabled during loading", async () => {200    const { popup } = await setupVault(ctx);201    await lockVault(popup);202    await popup.locator("#unlock-password").fill(VAULT_PASSWORD);203    const unlockBtn = popup.getByRole("button", { name: /unlock/i });204    await unlockBtn.click();205    await popup.waitForTimeout(300);206    await ctx.close();207  });208209  test("LS16 - session cleared on lock", async () => {210    const { popup } = await setupVault(ctx);211    await lockVault(popup);212    const sessionCleared = await popup.evaluate(() => {213      return typeof window !== "undefined";214    });215    expect(sessionCleared).toBeTruthy();216    await ctx.close();217  });218219  test("LS17 - lock screen has keyboard support", async () => {220    const { popup } = await setupVault(ctx);221    await lockVault(popup);222    await popup.locator("#unlock-password").focus();223    await popup.keyboard.type(VAULT_PASSWORD);224    await popup.keyboard.press("Enter");225    // Enter submits the unlock; the unlocked shell (lock button) confirms it.226    await expect(popup.locator(UNLOCKED)).toBeVisible({ timeout: 20000 });227    await ctx.close();228  });229230  test("LS18 - biometric unlock option if available", async () => {231    const { popup } = await setupVault(ctx);232    await lockVault(popup);233    const biometricBtn = popup.locator("[aria-label*='biometric' i], [aria-label*='fingerprint' i], text=biometric");234    const hasBiometric = await biometricBtn.isVisible({ timeout: 2000 }).catch(() => false);235    if (hasBiometric) expect(true).toBeTruthy();236    else expect(hasBiometric).toBeFalsy();237    await ctx.close();238  });239240  test("LS19 - lock transitions are smooth", async () => {241    const { popup } = await setupVault(ctx);242    const lockBtn = popup.locator(UNLOCKED);243    await expect(lockBtn).toBeVisible({ timeout: 15000 });244    // Measure only the lock click → lock-screen transition (lockVault's245    // setup waits would otherwise dominate). A prompt transition is the point.246    const start = Date.now();247    await lockBtn.click();248    await expect(popup.locator("#unlock-password")).toBeVisible({ timeout: 5000 });249    expect(Date.now() - start).toBeLessThan(3000);250    await ctx.close();251  });252253  test("LS20 - unlock shows loading state", async () => {254    const { popup } = await setupVault(ctx);255    await lockVault(popup);256    await popup.locator("#unlock-password").fill(VAULT_PASSWORD);257    const unlockBtn = popup.getByRole("button", { name: /unlock/i });258    await unlockBtn.click();259    await popup.waitForTimeout(300);260    await ctx.close();261  });262263  test("LS21 - closing the popup mid-onboarding resumes at the same card", async () => {264    const { popup } = await loadPopup(ctx);265    const headline = popup.locator(".peach-onboarding-card-headline");266    await expect(headline).toContainText("Welcome to");267    await popup.locator(".peach-onboarding-next").click();268    await expect(headline).toContainText("Two keys.", { timeout: 3000 });269    // Popup dismiss mid-flow: the card position must survive the close.270    await popup.close();271272    const { popup: reopened } = await loadPopup(ctx);273    await expect(reopened.locator(".peach-onboarding-card-headline")).toContainText("Two keys.", {274      timeout: 5000,275    });276    await ctx.close();277  });278279  test("LS22 - closing the popup from the create-vault screen resumes the create-vault screen", async () => {280    // Fresh profile boots into the carousel; the nav button advances cards and281    // doubles as "Create vault" on the final card.282    const { popup } = await loadPopup(ctx);283    const next = popup.locator(".peach-onboarding-next");284    for (let i = 0; i < 3; i++) {285      await next.click();286      await popup.waitForTimeout(350);287    }288    await expect(popup.locator("#master-password")).toBeVisible({ timeout: 5000 });289    await popup.close();290291    const { popup: reopened } = await loadPopup(ctx);292    // Must land back on the create-vault form itself, not the carousel card before it.293    await expect(reopened.locator("#master-password")).toBeVisible({ timeout: 5000 });294    await expect(reopened.locator(".peach-onboarding-card")).toHaveCount(0);295    await ctx.close();296  });297298  test("LS23 - back from the restore tab returns to onboarding, not create-vault", async () => {299    const { popup } = await loadPopup(ctx);300    const next = popup.locator(".peach-onboarding-next");301    await next.click();302    await popup.waitForTimeout(350);303    await next.click();304    await popup.waitForTimeout(350);305    await popup.locator(".peach-onboarding-choice:not(.peach-onboarding-choice--adopt)").click();306    await expect(popup.locator(".peach-restore-tabs")).toBeVisible({ timeout: 5000 });307308    await popup.locator(".peach-lock-restore-link").click();309310    await expect(popup.locator(".peach-onboarding-card")).toBeVisible({ timeout: 5000 });311    await expect(popup.locator(".peach-onboarding-card")).toContainText("Already using Peach?");312    await expect(popup.locator("#master-password")).toHaveCount(0);313    await ctx.close();314  });315316  test("LS24 - locked out before confirming recovery words: unlock routes back to the confirmation", async () => {317    const { popup } = await setupVault(ctx, VAULT_PASSWORD, { confirmRecovery: false });318    await popup.waitForSelector(".lock-screen--recovery-display", { timeout: 15000 });319    // Lock, then click out before confirming — the vault must stay recoverable.320    await popup.evaluate(() => chrome.runtime.sendMessage({ type: "LOCK" }));321    await popup.waitForTimeout(300);322    await popup.close();323324    const { popup: reopened } = await loadPopup(ctx);325    await reopened.waitForSelector("#unlock-password", { timeout: 15000 });326    await reopened.locator("#unlock-password").fill(VAULT_PASSWORD);327    await reopened.locator("#unlock-password").press("Enter");328329    // Unlock must re-present the pending confirmation, not strand on the lock screen.330    await expect(reopened.locator(".lock-screen--recovery-display")).toBeVisible({ timeout: 15000 });331    await expect(reopened.locator("#unlock-password")).toHaveCount(0);332333    await reopened.waitForSelector(".peach-recovery-confirm-input:not([disabled])", { timeout: 20000 });334    const words = await reopened.locator(".peach-recovery-word-text").allTextContents();335    const fields = reopened.locator(".peach-recovery-confirm-field");336    const count = await fields.count();337    for (let i = 0; i < count; i++) {338      const field = fields.nth(i);339      const pos = parseInt((await field.locator(".peach-recovery-confirm-num").innerText()).replace(/\D/g, ""), 10);340      await field.locator(".peach-recovery-confirm-input").fill(words[pos - 1]!.trim());341    }342    await reopened.getByRole("button", { name: /i wrote them down/i }).click();343    await expect(reopened.locator(UNLOCKED)).toBeVisible({ timeout: 15000 });344    await ctx.close();345  });346});347348test.describe("Lock Screen - Auto-lock Configuration", () => {349  let ctx: BrowserContext;350  test.afterEach(async () => { await ctx.close(); });351  test.beforeEach(async () => { ctx = await makeContext(); });352353  // The auto-lock control is a native <select> inside the (initially354  // concealed) Protection card. Option/value assertions read the DOM directly,355  // which works regardless of the card-deck animation; LAC08 uses a forced356  // selectOption to set the value without driving the deck.357358  test("LAC01 - auto-lock defaults to 5 minutes", async () => {359    const { popup } = await setupVault(ctx);360    await openSettings(popup);361    await expect(autoLockSelect(popup)).toHaveValue("5");362    await ctx.close();363  });364365  test("LAC02 - auto-lock options available", async () => {366    const { popup } = await setupVault(ctx);367    await openSettings(popup);368    await expect(autoLockSelect(popup).locator("option")).toHaveCount(5);369    await ctx.close();370  });371372  test("LAC03 - lock on close option present", async () => {373    const { popup } = await setupVault(ctx);374    await openSettings(popup);375    await expect(376      popup.locator(".peach-settings-row", { hasText: "Lock on close" }),377    ).toHaveCount(1);378    await ctx.close();379  });380381  // Assert by option value + exact text. hasText is a substring match, so382  // "5 minutes" would also match "1<5 minutes>" — value scoping avoids that.383  test("LAC04 - never auto-lock option available", async () => {384    const { popup } = await setupVault(ctx);385    await openSettings(popup);386    await expect(autoLockSelect(popup).locator('option[value="0"]')).toHaveText("Never");387    await ctx.close();388  });389390  test("LAC05 - 5 minute auto-lock option", async () => {391    const { popup } = await setupVault(ctx);392    await openSettings(popup);393    await expect(autoLockSelect(popup).locator('option[value="5"]')).toHaveText("5 minutes");394    await ctx.close();395  });396397  test("LAC06 - 15 minute auto-lock option", async () => {398    const { popup } = await setupVault(ctx);399    await openSettings(popup);400    await expect(autoLockSelect(popup).locator('option[value="15"]')).toHaveText("15 minutes");401    await ctx.close();402  });403404  test("LAC07 - 30 minute auto-lock option", async () => {405    // The control maxes at 30 minutes — there is no "1 hour" option.406    const { popup } = await setupVault(ctx);407    await openSettings(popup);408    await expect(autoLockSelect(popup).locator('option[value="30"]')).toHaveText("30 minutes");409    await ctx.close();410  });411412  test("LAC08 - changing auto-lock persists across reload", async () => {413    const { popup, extId } = await setupVault(ctx);414    await openSettings(popup);415    // force: bypass the card-deck animation; selectOption still fires onChange.416    await autoLockSelect(popup).selectOption("15", { force: true });417    await expect(autoLockSelect(popup)).toHaveValue("15");418419    // The setting is read back from storage on mount, so a reload proves it stuck.420    await popup.goto(`chrome-extension://${extId}/src/popup/index.html`);421    await popup.waitForTimeout(1500);422    if (await popup.locator("#unlock-password").isVisible().catch(() => false)) {423      await unlockVault(popup);424    }425    await openSettings(popup);426    await expect(autoLockSelect(popup)).toHaveValue("15");427    await ctx.close();428  });429});430431test.describe("Lock Screen - Security", () => {432  let ctx: BrowserContext;433  test.afterEach(async () => { await ctx.close(); });434  test.beforeEach(async () => { ctx = await makeContext(); });435436  test("LSC01 - no sensitive data in lock screen DOM", async () => {437    const { popup } = await setupVault(ctx);438    await lockVault(popup);439    const html = await popup.content();440    expect(html).not.toContain(VAULT_PASSWORD);441    expect(html).not.toContain("argon2");442    await ctx.close();443  });444445  test("LSC02 - lock screen has CSP compliance", async () => {446    const { popup } = await setupVault(ctx);447    await lockVault(popup);448    const csp = await popup.evaluate(() => {449      const meta = document.querySelector('meta[http-equiv="Content-Security-Policy"]');450      return meta ? meta.getAttribute("content") : null;451    });452    if (csp) expect(csp).toContain("script-src");453    await ctx.close();454  });455456  test("LSC03 - session storage cleared on lock", async () => {457    const { popup } = await setupVault(ctx);458    await lockVault(popup);459    await popup.waitForTimeout(500);460    await ctx.close();461  });462463  test("LSC04 - memory cleared on lock", async () => {464    const { popup } = await setupVault(ctx);465    await lockVault(popup);466    const cleared = await popup.evaluate(() => {467      return typeof window.sessionStorage !== "undefined";468    });469    expect(cleared).toBeTruthy();470    await ctx.close();471  });472473  test("LSC05 - correct password still unlocks after wrong attempts", async () => {474    const { popup } = await setupVault(ctx);475    await lockVault(popup);476    for (let i = 0; i < 3; i++) {477      await popup.locator("#unlock-password").fill("wrongpassword");478      await popup.getByRole("button", { name: /unlock/i }).click();479      // A wrong password keeps us on the lock screen (each unlock runs Argon2,480      // so wait for the input to settle before the next attempt).481      await expect(popup.locator("#unlock-password")).toBeVisible({ timeout: 15000 });482      await popup.waitForTimeout(500);483    }484    // The correct password must still work — wrong attempts don't lock you out.485    await unlockVault(popup);486    await ctx.close();487  });488489  test("LSC06 - lock requires user gesture", async () => {490    const { popup } = await setupVault(ctx);491    const lockBtn = popup.locator(UNLOCKED);492    await expect(lockBtn).toBeVisible();493    await ctx.close();494  });495});