4.0 KiB
Browser Session and Terminal Selector Tests
Run from the repository root:
python3 tests/web_ui_session/run.py
Requires a host C compiler, Python 3, and Node with Fetch/Response/ReadableStream support (Node 18+). All compiler outputs and rendered scripts are temporary; no firmware build, generated assets, or device writes are performed.
The runner compiles production src/web_ui.c with HTTPD and vendored-asset data
doubles. It reuses the HTTPD stub text from tests/web_login_ui/run.py, without
importing/executing that runner. Node executes the actual C-rendered application
and inline asset-failure script, not a separately maintained implementation.
Coverage:
- Resource selection, NULL/invalid input, setter/send failure propagation, eight-header ceiling, no-store document/application, unchanged vendor caching, nosniff/no-referrer/frame denial, exact inline-loader CSP hash and login fallback.
- Session validation before initial/retried/restored connections; memory-only CSRF header and empty ticket/logout bodies; safe-text username/absolute expiry.
- 401 shutdown and navigation once; manual recovery on 403; bounded Retry-After display/backoff for capacity; network errors never assert successful logout.
- Confirmed 204 logout, lost response confirmed by session 401, uncertain logout, cancellation, explicit recovery, and stale session/ticket/status/logout/WS work.
- Pagehide/bfcache restoration, late response bodies, and superseded session checks.
- Existing writer controls, 1,024-byte binary input chunks, raw binary output, observer input gating, and explicit Disconnect pausing reconnect.
- Authentication/ticket response cap 512 bytes, existing status cap 3,072 bytes, 15-second request deadline, single status request in flight, bounded retry delay, and unchanged 5,000-line terminal scrollback.
- Admin-only navigation, explicit protected-ticket open, 20 switches preserving serial socket/client/writer IDs, separate output and selected-only input.
- Independent 64 KiB pending output limits, visible dropped-byte counters and resumed hidden output draining; 512-byte admin input frames and overflow close.
- Admin close/reopen/remote exit isolation, 401/logout/expiry/pagehide cancellation, late tickets/callbacks, handshake timeout, selected resize and three listener cleanup/restore cycles.
- Session identity changes (username, role or session-stable CSRF) force a clean document before view adoption, close old admin and prevent replacement-session logout; same-session restore retains both scrollbacks behind validation gating.
- Undefined initial dimensions recover at unchanged bounds; failed fits never populate the cache, readiness retries stop at three, and teardown fences stale callbacks even after restore.
- Read-only admin Settings/Serial: 10 selection cycles preserve both sockets/IDs, drain hidden output and block terminal input; exact eight-field/256-byte schema, explicit refresh, error/timeout containment, late cancellation/restore/identity, and concurrent serial reconnect without superseding admission. 21 Node groups total.
Integration and known gaps
This covers 8D.3 session behavior, the 8D.6 selector and 8D.8 Settings. The renderer still relies on its caller to authenticate resources; protected asset failures must be 401, never a redirect to HTML served as JavaScript. No Basic fallback is implemented here. Existing 8D.5 server authorization/protocols are unchanged.
These tests model DOM, timers, fetch cancellation and WebSocket events. They do
not prove real-browser CSP enforcement, script-loading errors, TLS/HTTPD behavior,
actual bfcache policy, cookie expiry, server revocation, or hardware serial byte
integrity, actual xterm escape parsing, hidden prompts, or desktop/mobile layout.
Prior 8D.6 signoff stands; the new Settings build and pending target checklist are in
docs/phase8d8_implementation.md. No target resource reserve is claimed. Browser secret
references are dropped and never persisted/logged, but JavaScript cannot securely
wipe engine-managed strings.