Commander1024/ESP32_Serial_Swiss_Army_Knife

Files

T

Commander1024 5a609fa40b Replace Web Basic Auth With Cookie Sessions

Add bounded login challenges, CSRF/origin enforcement, logout, and
session-bound WebSocket admission. Isolate private HTTPD access behind a
version-guarded adapter and add focused host coverage. Also let empty
admin
SSH input reach the normal console handler.

2026-09-05 23:55:05 +02:00

README.md

Bind Serial Transports To Web Sessions

2026-09-05 18:01:39 +02:00

run.py

Replace Web Basic Auth With Cookie Sessions

2026-09-05 23:55:05 +02:00

serial_headers.py

Replace Web Basic Auth With Cookie Sessions

2026-09-05 23:55:05 +02:00

serial_test.c

Replace Web Basic Auth With Cookie Sessions

2026-09-05 23:55:05 +02:00

test.c

Bind Serial Transports To Web Sessions

2026-09-05 18:01:39 +02:00

README.md

Focused web session store host tests

From the repository root, run:

python3 tests/web_session_store/run.py
python3 tests/web_session_store/run.py --serial
python3 tests/web_session_store/run.py --serial --sanitize

Requires Python 3 and cc. Builds the actual src/web_session_store.c against its production headers; generated dependency stubs and binaries live only in an automatically removed temporary directory. Compilation and execution have finite timeouts. No ESP-IDF build, device, network, or general test framework is used.

The runner probes OpenSSL headers/linking and uses real SHA-256 when available. Otherwise it explicitly reports a deterministic non-cryptographic digest stub; that fallback verifies store behavior, not cryptography. RNG is always a deterministic test double, never a test of secure randomness. RNG/SHA/DB callbacks assert they run outside the simulated state lock. DB callbacks inject invalidate/user-invalidate/ stop operations to exercise revalidation, but do not model real concurrent threads.

The default store tests use only the public API: output wiping and record retirement are checked, but private record bytes, allocator failures, hardware locking, and timing under real concurrency are not inspected. Rejections without a specified error contract are checked as non-success; absent tokens, readiness, and capacity use exact errors. Counters are checked with deltas where lifecycle reset semantics are unspecified.

--serial also compiles the production serial transport into the test translation unit to step its private ticket/admission/input/currentness/cleanup boundaries. It links the real session store separately and uses minimal HTTPD/broker/task doubles, not real sockets or a running scheduler. Unused firmware functions are linker-garbage-collected. Tests cover matching-session single-use tickets, every principal field, same-account session isolation, account-wide ticket/socket/store cleanup, serial-init failure isolation, close-queue failure/retry, slot reuse, expiry and database failure without notification, logout during mint/admission, stale periodic work, and Basic operation with the store disabled. No secrets are printed. --sanitize enables compiler AddressSanitizer and UndefinedBehaviorSanitizer. Real HTTPD task ordering, queued sends, target timing/stack/heap and browser cookie policy remain outside this harness; cookie routes do not exist in 8D.2.