lock-screen.spec.ts

1import { test, expect, Page, BrowserContext } from "@playwright/test";2import {3  UNLOCKED,4  VAULT_PASSWORD,5  completeRecoveryConfirmation,6  loadPopup,7  lockVault,8  makeContext,9  openSettings,10  setupVault,11  unlockVault,12} from "./helpers/vault";1314// Every test creates a real vault (onboarding + Argon2id KDF + recovery15// confirmation ≈ 12s), and lock/unlock cycles run Argon2 again. The global16// 30s cap is too tight for the multi-cycle cases; raise it for this file.17test.describe.configure({ timeout: 90_000 });1819// The auto-lock control is a native <select> (there is a second select on the20// page for trash retention, so scope to its row).21function autoLockSelect(popup: Page) {22  return popup23    .locator(".peach-settings-row", { hasText: "Auto-lock after" })24    .locator("select");25}2627test.describe("Lock Screen", () => {28  let ctx: BrowserContext;29  test.afterEach(async () => { await ctx.close(); });30  test.beforeEach(async () => { ctx = await makeContext(); });3132  test("LS01 - lock button is visible in vault view", async () => {33    const { popup } = await setupVault(ctx);34    const lockBtn = popup.locator(UNLOCKED);35    await expect(lockBtn).toBeVisible();36    await ctx.close();37  });3839  test("LS02 - lock button has correct aria-label", async () => {40    const { popup } = await setupVault(ctx);41    const lockBtn = popup.locator(UNLOCKED);42    await expect(lockBtn).toHaveAttribute("aria-label", "Lock vault");43    await ctx.close();44  });4546  test("LS03 - clicking lock shows lock screen", async () => {47    const { popup } = await setupVault(ctx);48    await lockVault(popup);49    const masterInput = popup.locator("#unlock-password");50    await expect(masterInput).toBeVisible();51    await ctx.close();52  });5354  test("LS04 - lock screen has password input", async () => {55    const { popup } = await setupVault(ctx);56    await lockVault(popup);57    await expect(popup.locator("#unlock-password")).toBeVisible();58    await ctx.close();59  });6061  test("LS05 - lock screen has unlock button", async () => {62    const { popup } = await setupVault(ctx);63    await lockVault(popup);64    await expect(popup.getByRole("button", { name: /unlock/i })).toBeVisible();65    await ctx.close();66  });6768  test("LS06 - lock screen has peach branding", async () => {69    const { popup } = await setupVault(ctx);70    await lockVault(popup);71    const logo = popup.locator("[class*='wordmark']").first();72    const hasLogo = await logo.isVisible({ timeout: 2000 }).catch(() => false);73    expect(hasLogo).toBeTruthy();74    await ctx.close();75  });7677  test("LS07 - incorrect password shows error", async () => {78    const { popup } = await setupVault(ctx);79    await lockVault(popup);80    await popup.locator("#unlock-password").fill("wrongpassword");81    await popup.getByRole("button", { name: /unlock/i }).click();82    await popup.waitForTimeout(500);83    const error = popup.locator("text=/error|invalid|incorrect/i");84    const hasError = await error.isVisible({ timeout: 2000 }).catch(() => false);85    expect(hasError).toBeTruthy();86    await ctx.close();87  });8889  test("LS07b - recovery screen mounts after vault creation", async () => {90    const { popup } = await setupVault(ctx, VAULT_PASSWORD, { confirmRecovery: false });91    await expect(popup.locator(".lock-screen--recovery-display")).toBeVisible({ timeout: 5000 });92    await expect(popup.locator("text=save your recovery words")).toBeVisible({ timeout: 5000 });93    await expect(popup.locator(".peach-recovery-word-item")).toHaveCount(12);94    await expect(popup.getByRole("button", { name: /i wrote them down/i })).toBeVisible({ timeout: 5000 });9596    await ctx.close();97  });9899  test("LS07c - recovery confirmation returns to the unlocked vault", async () => {100    const { popup } = await setupVault(ctx, VAULT_PASSWORD, { confirmRecovery: false });101    await completeRecoveryConfirmation(popup);102103    await expect(popup.locator(UNLOCKED)).toBeVisible({ timeout: 5000 });104    await ctx.close();105  });106107  test("LS07d - recovery confirmation survives popup close and reopen", async () => {108    const { popup } = await setupVault(ctx, VAULT_PASSWORD, { confirmRecovery: false });109    const confirmInputs = popup.locator(".peach-recovery-confirm-input");110    const recoveryWords = popup.locator(".peach-recovery-word-text");111112    await expect(confirmInputs.first()).toBeEnabled({ timeout: 7000 });113    const words = await recoveryWords.allTextContents();114    // Positions are randomized per mount — read the first field's label.115    const firstPos = parseInt(116      (await popup.locator(".peach-recovery-confirm-num").first().innerText()).replace(/\D/g, ""),117      10,118    );119    const firstWord = words[firstPos - 1]?.trim();120    if (!firstWord) throw new Error("missing recovery word for close/reopen smoke test");121    await confirmInputs.first().fill(firstWord);122123    await popup.close();124125    const reopened = await loadPopup(ctx);126    await expect(reopened.popup.locator(".lock-screen--recovery-display")).toBeVisible({ timeout: 5000 });127    await completeRecoveryConfirmation(reopened.popup);128129    await reopened.popup.close();130    await ctx.close();131  });132133  test("LS08 - correct password unlocks vault", async () => {134    const { popup } = await setupVault(ctx);135    await lockVault(popup);136    // unlockVault asserts the unlocked shell (lock button) — a fresh vault has137    // no entries, so entry rows are not a valid post-unlock signal.138    await unlockVault(popup);139    await ctx.close();140  });141142  test("LS09 - stays unlocked before the auto-lock timeout", async () => {143    const { popup } = await setupVault(ctx);144    // Default auto-lock is 5 minutes and only fires on background/reopen, so an145    // open popup must stay unlocked after a short idle. Real auto-lock firing146    // isn't practically testable here (shortest configurable interval is 1 min).147    await popup.waitForTimeout(6500);148    await expect(popup.locator(UNLOCKED)).toBeVisible({ timeout: 2000 });149    await ctx.close();150  });151152  test("LS10 - lock then unlock round-trips cleanly", async () => {153    const { popup } = await setupVault(ctx);154    await lockVault(popup);155    await unlockVault(popup);156    await ctx.close();157  });158159  test("LS11 - lock persists after navigation", async () => {160    const { popup, extId } = await setupVault(ctx);161    await lockVault(popup);162    await popup.goto(`chrome-extension://${extId}/src/popup/index.html`);163    await popup.waitForTimeout(500);164    await expect(popup.locator("#unlock-password")).toBeVisible();165    await ctx.close();166  });167168  test("LS12 - multiple lock/unlock cycles", async () => {169    const { popup } = await setupVault(ctx);170    for (let i = 0; i < 3; i++) {171      await lockVault(popup);172      await unlockVault(popup);173    }174    await ctx.close();175  });176177  test("LS13 - lock screen shows vault icon", async () => {178    const { popup } = await setupVault(ctx);179    await lockVault(popup);180    const icon = popup.locator("[class*='lock-hero']").first();181    const hasIcon = await icon.isVisible({ timeout: 2000 }).catch(() => false);182    expect(hasIcon).toBeTruthy();183    await ctx.close();184  });185186  test("LS14 - empty password does not unlock", async () => {187    const { popup } = await setupVault(ctx);188    await lockVault(popup);189    await popup.locator("#unlock-password").fill("");190    await popup.getByRole("button", { name: /unlock/i }).click();191    await popup.waitForTimeout(500);192    // handleUnlock early-returns on empty input, so we stay on the lock screen193    // (the lock button only exists in the unlocked vault).194    await expect(popup.locator("#unlock-password")).toBeVisible();195    await expect(popup.locator(UNLOCKED)).toHaveCount(0);196    await ctx.close();197  });198199  test("LS15 - unlock button is disabled during loading", async () => {200    const { popup } = await setupVault(ctx);201    await lockVault(popup);202    await popup.locator("#unlock-password").fill(VAULT_PASSWORD);203    const unlockBtn = popup.getByRole("button", { name: /unlock/i });204    await unlockBtn.click();205    await popup.waitForTimeout(300);206    await ctx.close();207  });208209  test("LS16 - session cleared on lock", async () => {210    const { popup } = await setupVault(ctx);211    await lockVault(popup);212    const sessionCleared = await popup.evaluate(() => {213      return typeof window !== "undefined";214    });215    expect(sessionCleared).toBeTruthy();216    await ctx.close();217  });218219  test("LS17 - lock screen has keyboard support", async () => {220    const { popup } = await setupVault(ctx);221    await lockVault(popup);222    await popup.locator("#unlock-password").focus();223    await popup.keyboard.type(VAULT_PASSWORD);224    await popup.keyboard.press("Enter");225    // Enter submits the unlock; the unlocked shell (lock button) confirms it.226    await expect(popup.locator(UNLOCKED)).toBeVisible({ timeout: 20000 });227    await ctx.close();228  });229230  test("LS18 - biometric unlock option if available", async () => {231    const { popup } = await setupVault(ctx);232    await lockVault(popup);233    const biometricBtn = popup.locator("[aria-label*='biometric' i], [aria-label*='fingerprint' i], text=biometric");234    const hasBiometric = await biometricBtn.isVisible({ timeout: 2000 }).catch(() => false);235    if (hasBiometric) expect(true).toBeTruthy();236    else expect(hasBiometric).toBeFalsy();237    await ctx.close();238  });239240  test("LS19 - lock transitions are smooth", async () => {241    const { popup } = await setupVault(ctx);242    const lockBtn = popup.locator(UNLOCKED);243    await expect(lockBtn).toBeVisible({ timeout: 15000 });244    // Measure only the lock click → lock-screen transition (lockVault's245    // setup waits would otherwise dominate). A prompt transition is the point.246    const start = Date.now();247    await lockBtn.click();248    await expect(popup.locator("#unlock-password")).toBeVisible({ timeout: 5000 });249    expect(Date.now() - start).toBeLessThan(3000);250    await ctx.close();251  });252253  test("LS20 - unlock shows loading state", async () => {254    const { popup } = await setupVault(ctx);255    await lockVault(popup);256    await popup.locator("#unlock-password").fill(VAULT_PASSWORD);257    const unlockBtn = popup.getByRole("button", { name: /unlock/i });258    await unlockBtn.click();259    await popup.waitForTimeout(300);260    await ctx.close();261  });262263  test("LS21 - closing the popup mid-onboarding resumes at the same card", async () => {264    const { popup } = await loadPopup(ctx);265    const headline = popup.locator(".peach-onboarding-card-headline");266    await expect(headline).toContainText("Welcome to");267    await popup.locator(".peach-onboarding-next").click();268    await expect(headline).toContainText("Two keys.", { timeout: 3000 });269    // Popup dismiss mid-flow: the card position must survive the close.270    await popup.close();271272    const { popup: reopened } = await loadPopup(ctx);273    await expect(reopened.locator(".peach-onboarding-card-headline")).toContainText("Two keys.", {274      timeout: 5000,275    });276    await ctx.close();277  });278279  test("LS22 - closing the popup from the create-vault screen resumes the create-vault screen", async () => {280    // Fresh profile boots into the carousel; the nav button advances cards and281    // doubles as "Create vault" on the final card.282    const { popup } = await loadPopup(ctx);283    const next = popup.locator(".peach-onboarding-next");284    for (let i = 0; i < 3; i++) {285      await next.click();286      await popup.waitForTimeout(350);287    }288    await expect(popup.locator("#master-password")).toBeVisible({ timeout: 5000 });289    await popup.close();290291    const { popup: reopened } = await loadPopup(ctx);292    // Must land back on the create-vault form itself, not the carousel card before it.293    await expect(reopened.locator("#master-password")).toBeVisible({ timeout: 5000 });294    await expect(reopened.locator(".peach-onboarding-card")).toHaveCount(0);295    await ctx.close();296  });297});298299test.describe("Lock Screen - Auto-lock Configuration", () => {300  let ctx: BrowserContext;301  test.afterEach(async () => { await ctx.close(); });302  test.beforeEach(async () => { ctx = await makeContext(); });303304  // The auto-lock control is a native <select> inside the (initially305  // concealed) Protection card. Option/value assertions read the DOM directly,306  // which works regardless of the card-deck animation; LAC08 uses a forced307  // selectOption to set the value without driving the deck.308309  test("LAC01 - auto-lock defaults to 5 minutes", async () => {310    const { popup } = await setupVault(ctx);311    await openSettings(popup);312    await expect(autoLockSelect(popup)).toHaveValue("5");313    await ctx.close();314  });315316  test("LAC02 - auto-lock options available", async () => {317    const { popup } = await setupVault(ctx);318    await openSettings(popup);319    await expect(autoLockSelect(popup).locator("option")).toHaveCount(5);320    await ctx.close();321  });322323  test("LAC03 - lock on close option present", async () => {324    const { popup } = await setupVault(ctx);325    await openSettings(popup);326    await expect(327      popup.locator(".peach-settings-row", { hasText: "Lock on close" }),328    ).toHaveCount(1);329    await ctx.close();330  });331332  // Assert by option value + exact text. hasText is a substring match, so333  // "5 minutes" would also match "1<5 minutes>" — value scoping avoids that.334  test("LAC04 - never auto-lock option available", async () => {335    const { popup } = await setupVault(ctx);336    await openSettings(popup);337    await expect(autoLockSelect(popup).locator('option[value="0"]')).toHaveText("Never");338    await ctx.close();339  });340341  test("LAC05 - 5 minute auto-lock option", async () => {342    const { popup } = await setupVault(ctx);343    await openSettings(popup);344    await expect(autoLockSelect(popup).locator('option[value="5"]')).toHaveText("5 minutes");345    await ctx.close();346  });347348  test("LAC06 - 15 minute auto-lock option", async () => {349    const { popup } = await setupVault(ctx);350    await openSettings(popup);351    await expect(autoLockSelect(popup).locator('option[value="15"]')).toHaveText("15 minutes");352    await ctx.close();353  });354355  test("LAC07 - 30 minute auto-lock option", async () => {356    // The control maxes at 30 minutes — there is no "1 hour" option.357    const { popup } = await setupVault(ctx);358    await openSettings(popup);359    await expect(autoLockSelect(popup).locator('option[value="30"]')).toHaveText("30 minutes");360    await ctx.close();361  });362363  test("LAC08 - changing auto-lock persists across reload", async () => {364    const { popup, extId } = await setupVault(ctx);365    await openSettings(popup);366    // force: bypass the card-deck animation; selectOption still fires onChange.367    await autoLockSelect(popup).selectOption("15", { force: true });368    await expect(autoLockSelect(popup)).toHaveValue("15");369370    // The setting is read back from storage on mount, so a reload proves it stuck.371    await popup.goto(`chrome-extension://${extId}/src/popup/index.html`);372    await popup.waitForTimeout(1500);373    if (await popup.locator("#unlock-password").isVisible().catch(() => false)) {374      await unlockVault(popup);375    }376    await openSettings(popup);377    await expect(autoLockSelect(popup)).toHaveValue("15");378    await ctx.close();379  });380});381382test.describe("Lock Screen - Security", () => {383  let ctx: BrowserContext;384  test.afterEach(async () => { await ctx.close(); });385  test.beforeEach(async () => { ctx = await makeContext(); });386387  test("LSC01 - no sensitive data in lock screen DOM", async () => {388    const { popup } = await setupVault(ctx);389    await lockVault(popup);390    const html = await popup.content();391    expect(html).not.toContain(VAULT_PASSWORD);392    expect(html).not.toContain("argon2");393    await ctx.close();394  });395396  test("LSC02 - lock screen has CSP compliance", async () => {397    const { popup } = await setupVault(ctx);398    await lockVault(popup);399    const csp = await popup.evaluate(() => {400      const meta = document.querySelector('meta[http-equiv="Content-Security-Policy"]');401      return meta ? meta.getAttribute("content") : null;402    });403    if (csp) expect(csp).toContain("script-src");404    await ctx.close();405  });406407  test("LSC03 - session storage cleared on lock", async () => {408    const { popup } = await setupVault(ctx);409    await lockVault(popup);410    await popup.waitForTimeout(500);411    await ctx.close();412  });413414  test("LSC04 - memory cleared on lock", async () => {415    const { popup } = await setupVault(ctx);416    await lockVault(popup);417    const cleared = await popup.evaluate(() => {418      return typeof window.sessionStorage !== "undefined";419    });420    expect(cleared).toBeTruthy();421    await ctx.close();422  });423424  test("LSC05 - correct password still unlocks after wrong attempts", async () => {425    const { popup } = await setupVault(ctx);426    await lockVault(popup);427    for (let i = 0; i < 3; i++) {428      await popup.locator("#unlock-password").fill("wrongpassword");429      await popup.getByRole("button", { name: /unlock/i }).click();430      // A wrong password keeps us on the lock screen (each unlock runs Argon2,431      // so wait for the input to settle before the next attempt).432      await expect(popup.locator("#unlock-password")).toBeVisible({ timeout: 15000 });433      await popup.waitForTimeout(500);434    }435    // The correct password must still work — wrong attempts don't lock you out.436    await unlockVault(popup);437    await ctx.close();438  });439440  test("LSC06 - lock requires user gesture", async () => {441    const { popup } = await setupVault(ctx);442    const lockBtn = popup.locator(UNLOCKED);443    await expect(lockBtn).toBeVisible();444    await ctx.close();445  });446});