Add Standalone Login Page Renderer

Add a hash-bound, no-store login document with focused C and Node host tests. Keep rendering inert until the 8D.3 authentication cutover.
2026-09-05 18:45:12 +02:00
parent 00f226dc59
commit 4435a7fddd
9 changed files with 542 additions and 4 deletions
@@ -0,0 +1,47 @@
+# Standalone login renderer host tests
+
+From the repository root:
+
+```sh
+python3 tests/web_login_ui/run.py
+# Optional compiler selection:
+CC=clang python3 tests/web_login_ui/run.py
+```
+
+Requires Python 3, a C11 compiler supporting Linux shared libraries, and Node.js
+24 on PATH. No pip/npm packages, ESP-IDF installation, network, device, or live
+HTTP routes are needed. Do not run Python with `-O` (checks use assertions).
+
+The runner compiles the actual `src/web_login_ui.c` and header with
+`-Wall -Wextra -Werror` and tiny ESP/httpd stubs in an automatically removed
+temporary directory. It checks NULL handling, all response setter failures
+(stop immediately without sending), send error propagation, content type,
+security headers, and the eight additional-header-slot budget. It parses the
+captured HTML to reject external assets and compares the CSP script hash against
+SHA256 of the exact rendered inline script bytes, including surrounding newlines.
+JavaScript tests still run on a hash mismatch so it does not hide behavioral
+test results.
+
+`browser.cjs` executes that rendered script in Node's VM using DOM/fetch doubles,
+real Response/ReadableStream, UTF-8 encoders/decoders, and AbortController. It
+covers no automatic requests, challenge/custom-header and CSRF JSON submission,
+redirect, wrong credentials/fresh challenges, status errors and manual-only
+Retry-After backoff, malformed/oversized responses, network failure/timeout,
+input byte limits, duplicate submission, and pagehide/pageshow generation safety
+(including late fetches and late body reads), attempt-abort cleanup on every
+error status, disabled pending inputs, and clearing re-entered passwords. Error
+bodies carry a marker that
+must never appear in displayed error text.
+
+Limitations: this is not a real browser, ESP-IDF HTTP server, authentication
+backend, or hardware test. It does not validate route registration, cookies,
+TLS, native form validation, browser CSP enforcement, layout/accessibility, or
+actual bfcache behavior. Timers and clock advancement are deterministic doubles;
+fetch doubles can intentionally ignore abort to exercise stale completion paths.
+Error-body stream abortion is modeled with fetch abort listeners, not real socket
+cleanup. Clearing DOM fields/JavaScript references is best-effort secret lifetime
+reduction, not guaranteed erasure of garbage-collected strings or browser internals.
+The 16/64-byte field limits bound maximally escaped JSON to 509 bytes, so the
+separate >512-byte request guard is not independently reachable with valid fields;
+the suite tests worst-case expansion rather than bypassing those field checks.
+Nothing here exposes a route or regenerates protected web assets.