Resolve all high-severity architecture review findings

2026-09-09 16:13:58 -04:00
parent 8bfe65512e
commit 146a13238f
192 changed files with 3160 additions and 753 deletions
@@ -0,0 +1,66 @@
+using System.Collections.Concurrent;
+using Microsoft.Playwright;
+
+namespace ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests;
+
+/// <summary>Exercises the deployed activity listener with browser-trusted input and real antiforgery.</summary>
+[Collection("Playwright")]
+public class SessionActivityTrustedInputTests(PlaywrightFixture fixture)
+{
+    [Fact]
+    public async Task UI2_SyntheticInputAndPingStayPassive_TrustedKeyRenewsWithAntiforgery()
+    {
+        // The fixture logs in using fetch, so this fresh context has no prior trusted input
+        // and no activity request consuming the listener's 15-second throttle window.
+        var page = await fixture.NewAuthenticatedPageAsync();
+        try
+        {
+            await page.WaitForFunctionAsync("""
+                () => performance.getEntriesByType('resource').some(
+                    r => r.name.includes('/js/session-expiry.js'))
+                """, null, new() { Timeout = 15000 });
+            var token = page.Locator("input[name='__RequestVerificationToken']").First;
+            await Assertions.Expect(token).ToHaveAttributeAsync("value", new System.Text.RegularExpressions.Regex(".+"));
+
+            var activityRequests = new ConcurrentQueue<IRequest>();
+            page.Request += (_, request) =>
+            {
+                if (new Uri(request.Url).AbsolutePath == "/auth/activity") activityRequests.Enqueue(request);
+            };
+
+            var pingStatus = await page.EvaluateAsync<int>("""
+                async () => {
+                    for (const type of ['pointerdown', 'keydown', 'wheel', 'touchstart'])
+                        document.dispatchEvent(new Event(type, { bubbles: true }));
+                    return (await fetch('/auth/ping', { cache: 'no-store' })).status;
+                }
+                """);
+            Assert.Equal(200, pingStatus);
+            // This bounded observation catches fetch scheduled by synthetic events without
+            // waiting for the real 30-minute idle expiry (covered by fake-clock HTTP tests).
+            await page.WaitForTimeoutAsync(500);
+            Assert.Empty(activityRequests);
+
+            var responseTask = page.WaitForResponseAsync(
+                response => new Uri(response.Url).AbsolutePath == "/auth/activity",
+                new() { Timeout = 10000 });
+            await page.Keyboard.PressAsync("Shift"); // Browser-generated keydown has isTrusted=true.
+            var response = await responseTask;
+            Assert.Equal(204, response.Status);
+            var request = Assert.Single(activityRequests);
+            Assert.Equal("POST", request.Method);
+            var headers = await request.AllHeadersAsync();
+            Assert.True(headers.TryGetValue("requestverificationtoken", out var sentToken));
+            Assert.Equal(await token.InputValueAsync(), sentToken);
+
+            // A second trusted key inside 15 seconds must not flood the activity endpoint.
+            await page.Keyboard.PressAsync("Shift");
+            await page.WaitForTimeoutAsync(500);
+            Assert.Single(activityRequests);
+        }
+        finally
+        {
+            await page.Context.CloseAsync();
+        }
+    }
+}