ESP32_Serial_Swiss_Army_Knife/tests/web_cookie_auth/README.md

Cookie authentication and HTTPD adapter host checks

Run from the project root:

python3 tests/web_cookie_auth/run.py

Requires Python 3, a C11 compiler (cc), OpenSSL headers/libcrypto, and the pinned ESP-IDF source installation. The runner uses IDF_PATH when set, otherwise ~/.platformio/packages/framework-espidf. It writes only an automatically removed temporary directory. No network, device, pip/npm packages or server is needed. Do not disable C assertions.

The runner compiles production web_cookie_auth, web_session_store, web_auth_parse and web_httpd_adapter with bounded HTTPD/database/time/RNG doubles. It also executes the session-store public API suite. The installed IDF header getters, append-only response-header setter and right-aligned pending-data reader are extracted verbatim and compiled into the harness.

Coverage includes challenge reuse/consumption/expiry, capacities without eviction, global throttle, fragmented login bodies, secure cookie attributes and two simultaneous Set-Cookie fields, session-specific logout, duplicate fields/cookies, Origin/CSRF/method/Fetch Metadata rejection, Basic denial, currentness, stop/login and failure paths, six-header login budget, upgrade-state installation, and request cleanup preserving all 0–128 pending lengths through partial reads.

This is not the full IDF parser/dispatcher, real handshake/TLS/socket, browser, multicore task or hardware test. The private struct doubles do not prove binary layout; firmware compilation uses the actual pinned headers, and the version guard requires a new audit on SDK changes. Handshake sending and transport revocation are doubled. Actual on-wire pre-101 rejection, frame routing, pipelining/early bytes, cookie/CSP/browser recovery and loaded expiry latency require real-target evidence beyond this harness; M1 and the retained Phase 8D scope have since been accepted. No sanitizer or runtime memory-reserve result is implied.

See authentication contracts, acceptance evidence and limits, and regression procedures.

Accounts (8D.10)

python3 tests/web_cookie_auth/run.py --accounts
python3 tests/admin_console_boundary/accounts.py

The first command adds nine account HTTP/operation groups using production cookie/store/handler/parser and the canonical generated-value helper. Queue, database mutations, timer scheduling and revocation are doubles; authorization is real. Covers max-width eight-account projection, strict 768-byte/four-receive credential schemas, decoded printable-ASCII passwords, bodyless generated-value authorization/currentness/no-mutation/cleanup, timer creation/start failure, queued expiry/replacement/executing fences, self success revocation and protected failure, pending/result isolation, stale IDs, submission/execution failure, target-only notifications, session invalidation and missed revocation/DB failure. Historical 8D.10 reports recorded PASS for these nine groups plus shared regressions; the following counts and build sizes describe that slice, not current totals. Direct-handler tests do not prove route registration; the missing registration is now fixed as an independent optional endpoint (23 handlers), and the route agent reports 15 lifecycle groups passing for registration, failure isolation and restart. Implementation is host-tested/build-verified (parent pio run PASS, 25.61 s, 95,908 B RAM / 1,694,237 B flash); target acceptance was pending at that time and is superseded by the 8D.22 signoff. Timer runtime costs remain unmeasured; no sanitizer result is implied. The second command separately exercises production conditional database mutation and zero-wait list bodies with NVS/RTOS doubles, including last-admin protection, target generation/recreation checks and commit-failure cleanup. It retains the canonical CLI account tests. These are not end-to-end RTOS/flash/TLS tests. See Accounts contracts and acceptance evidence. Timer doubles do not prove hard cleanup latency.

Read-only Serial Settings

python3 tests/web_cookie_auth/run.py --settings

Runs the existing auth/store suite plus five 8D.8 groups. Compiles exact extracted production server handler/helpers, serial snapshot getter and enum formatters, with the real cookie/store/parser/private adapter. Serial locking/state and HTTP IO are doubled; authorization is not. Exercises normal-role/stale/expired/revoked denial, DB failure, body/query/method/header/framing/Origin rejection before any serial read, working values, zero-wait busy/uninitialized failure, no-store and header/send errors. Adapter-only allocator substitution injects both staged registration failures; the installed IDF unregister function frees successful registration. No SDK files are modified. Lifecycle registration/optional failure orchestration is separately tested by tests/web_admin_transport/server_lifecycle.py.

This does not run the full serial task/UART driver, TLS/network dispatcher or a real browser. See typed Settings contracts and Serial semantics. Acceptance evidence records the 8D.22 signoff without inferring individual target comparisons or runtime memory/stack margins.