mirror of
https://github.com/hanzoai/id-worker.git
synced 2026-10-30 18:33:58 +00:00
zeekayandGitHub
5ed75779e8
* corona→corona: academic Corona now only in lp-220-p3q-corona
* chore: restore upstream attribution + NOTICE (OSS compliance)
* auth: migrate front-door worker IAM calls to canonical /v1/iam/*
Every IAM-targeted path the hanzo.id/lux.id/zoo.id/pars.id front-door
worker emits now uses the canonical /v1/iam/* surface (HIP-0111), off the
legacy /api/*, /login/oauth/*, and bare /oauth/* shapes. Proven against
the IAM router: PathRewriteFilter collapses /api/<ep>->/v1/iam/<ep> and
the oauth aliases ->/v1/iam/oauth/<ep>; every target route exists.
Emitted-path changes (worker.js):
- inline login JS: /api/get-app-login->/v1/iam/get-app-login;
social ->/v1/iam/oauth/authorize; password+web3 ->/v1/iam/login
- inline signup JS: get-app-login, social ->/v1/iam/oauth/authorize;
web3 ->/v1/iam/login; /api/signup->/v1/iam/signup
- inline forgot JS: get-app-login; /api/send-verification-code
->/v1/iam/send-verification-code
- platform+MPC IAM callback token exchange: /api/login/oauth/access_token
->/v1/iam/oauth/token
- /oauth/{token,introspect,revoke,userinfo,logout} public facades now hop
to /v1/iam/oauth/{token,introspect,revoke,userinfo,logout} internally
- /callback social handler: /api/login->/v1/iam/login
- provider-aware authorize handler now matches the canonical
/v1/iam/oauth/authorize (and legacy /login/oauth/authorize), targets
IAM /v1/iam/oauth/authorize, keeps the _oauth_ctx cookie + branded page
- /logout: /api/logout->/v1/iam/logout
Kept (worker public contract; IAM canonicalizes inbound): the worker own
/oauth/* facade routes, the OIDC discovery rewrite, and IAM_PATHS legacy
inbound tolerance. Untouched (separate concern, flagged): the github.com
platform OAuth bridge.
Verified per brand (hanzo/lux/zoo/pars) with Playwright network
interception against worker.js under workerd (wrangler dev, local):
login renders -> password POST hits /v1/iam/login -> Google button
-> /v1/iam/oauth/authorize?provider=provider-google; zero /api/* and
zero bare /oauth/authorize across the session. /oauth/token facade probe
returns IAM token-endpoint JSON (invalid_client), proving the
/v1/iam/oauth/token hop is live. 36/36 + 7/7 checks pass.
---------
Co-authored-by: zeekay <[email protected]>
71 lines
3.3 KiB
Python
71 lines
3.3 KiB
Python
#!/usr/bin/env python3
|
|
"""Cover the signup + forgot pages: assert their inline JS emits the
|
|
canonical /v1/iam/signup and /v1/iam/send-verification-code (and the
|
|
social buttons emit /v1/iam/oauth/authorize), with no /api/ leakage."""
|
|
import sys
|
|
from urllib.parse import urlparse
|
|
from playwright.sync_api import sync_playwright
|
|
|
|
BASE = sys.argv[1] if len(sys.argv) > 1 else "http://127.0.0.1:8787"
|
|
results = []
|
|
def check(name, cond, detail=""):
|
|
results.append((name, bool(cond))); print(f" {'PASS' if cond else 'FAIL'} {name}" + (f" -- {detail}" if detail else ""))
|
|
|
|
with sync_playwright() as p:
|
|
browser = p.chromium.launch(headless=True)
|
|
page = browser.new_page()
|
|
seen = []
|
|
page.on("request", lambda r: seen.append((r.method, urlparse(r.url).path)))
|
|
st = {"signup": None, "authorize": None, "verif": None}
|
|
def h_signup(route):
|
|
st["signup"] = urlparse(route.request.url)
|
|
route.fulfill(status=200, content_type="application/json", body='{"status":"error","msg":"e2e"}')
|
|
def h_authorize(route):
|
|
st["authorize"] = urlparse(route.request.url)
|
|
route.fulfill(status=200, content_type="text/plain", body="e2e")
|
|
def h_verif(route):
|
|
st["verif"] = urlparse(route.request.url)
|
|
route.fulfill(status=200, content_type="application/json", body='{"status":"ok"}')
|
|
page.route("**/v1/iam/signup*", h_signup)
|
|
page.route("**/oauth/authorize*", h_authorize)
|
|
page.route("**/v1/iam/send-verification-code*", h_verif)
|
|
|
|
# ---- signup page ----
|
|
print("\n=== SIGNUP page ===")
|
|
page.goto(f"{BASE}/signup?client_id=hanzo-app-client-id&redirect_uri={BASE}/callback", wait_until="domcontentloaded")
|
|
check("signup page renders", "Create" in page.content())
|
|
page.fill("#name", "E2E User")
|
|
page.fill("#contact", "[email protected]")
|
|
page.fill("#password", "supersecret8")
|
|
page.click("#submitBtn")
|
|
page.wait_for_timeout(1500)
|
|
su = st["signup"]
|
|
check("signup POST hit /v1/iam/signup", su and su.path == "/v1/iam/signup", f"path={su.path}" if su else "none")
|
|
# signup social
|
|
page.click("#btn-github")
|
|
page.wait_for_timeout(1000)
|
|
az = st["authorize"]
|
|
check("signup Github -> /v1/iam/oauth/authorize", az and az.path == "/v1/iam/oauth/authorize", f"path={az.path}" if az else "none")
|
|
|
|
# ---- forgot page ----
|
|
print("\n=== FORGET page ===")
|
|
st["authorize"] = None
|
|
page.goto(f"{BASE}/forget?client_id=hanzo-app-client-id&redirect_uri={BASE}/callback", wait_until="domcontentloaded")
|
|
check("forget page renders", "Reset" in page.content())
|
|
page.fill("#email", "[email protected]")
|
|
page.click("#submitBtn")
|
|
page.wait_for_timeout(1500)
|
|
vf = st["verif"]
|
|
check("forget POST hit /v1/iam/send-verification-code", vf and vf.path == "/v1/iam/send-verification-code", f"path={vf.path}" if vf else "none")
|
|
|
|
# session-wide leakage
|
|
api_leaks = [f"{m} {pa}" for (m, pa) in seen if pa.startswith("/api/")]
|
|
bare = [pa for (m, pa) in seen if pa == "/oauth/authorize"]
|
|
check("zero /api/* across signup+forget", len(api_leaks) == 0, ", ".join(api_leaks) if api_leaks else "clean")
|
|
check("zero bare /oauth/authorize", len(bare) == 0, ", ".join(bare) if bare else "clean")
|
|
browser.close()
|
|
|
|
passed = sum(1 for _n, ok in results if ok)
|
|
print(f"\n {passed}/{len(results)} checks passed (signup+forget)")
|
|
sys.exit(0 if passed == len(results) else 1)
|