test(dev): live ceremonies for GitHub, X and Google from the dev app

.github/workflows/live-e2e.yml

@@ -0,0 +1,151 @@
+name: Live end-to-end
+
+# Proves real platform identities from the dev app's UI (ts/apps/dev/README.md).
+# Not a required check: it depends on the platforms, their accounts and the
+# network. Third-party actions are pinned by commit SHA, the tag in a comment.
+
+on:
+  pull_request:
+    # What a live ceremony runs: the dev app, its packages and their build.
+    paths:
+      - "ts/apps/dev/**"
+      - "ts/packages/ceremony/**"
+      - "ts/packages/popup/**"
+      - "ts/packages/ledger/**"
+      - "ts/scripts/build-package.ts"
+      - "ts/package.json"
+      - "ts/pnpm-lock.yaml"
+      - "ts/pnpm-workspace.yaml"
+      - "ts/.node-version"
+      - "ts/tsconfig.base.json"
+      - "brand/**"
+      - ".github/workflows/live-e2e.yml"
+      - ".github/actions/setup-ts/**"
+  workflow_dispatch:
+  schedule:
+    - cron: "23 3 * * *"
+
+permissions:
+  contents: read
+
+env:
+  # Where the stack's output goes; a failed job prints its end.
+  LIBID_STACK_LOGS: /tmp/libid-live-stack.log
+
+jobs:
+  ceremony:
+    name: GitHub and X ceremonies (live)
+    # A pull request from a fork or from Dependabot gets no secrets.
+    if: >-
+      github.event_name != 'pull_request' ||
+      (github.event.pull_request.head.repo.full_name == github.repository &&
+      github.actor != 'dependabot[bot]')
+    runs-on: ubuntu-latest
+    # One run at a time per account: two could submit one TOTP code twice.
+    concurrency:
+      group: live-e2e-github-x
+      cancel-in-progress: false
+    timeout-minutes: 60 # test step 45: stack 10 + 2 tests × 15 + stop 2
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup-ts
+
+      - name: Install Chromium
+        run: pnpm -C ts --filter @libid/dev exec playwright install --with-deps chromium
+
+      - name: Prove GitHub and X identities end to end
+        id: test
+        timeout-minutes: 45
+        env:
+          LIBID_LIVE_PLATFORMS: github,x
+          GH_TEST_ALICE_USERNAME: ${{ secrets.GH_TEST_ALICE_USERNAME }}
+          GH_TEST_ALICE_PASSWORD: ${{ secrets.GH_TEST_ALICE_PASSWORD }}
+          GH_TEST_ALICE_TOTP_SECRET: ${{ secrets.GH_TEST_ALICE_TOTP_SECRET }}
+          X_TEST_ALICE_USERNAME: ${{ secrets.X_TEST_ALICE_USERNAME }}
+          X_TEST_ALICE_COOKIES: ${{ secrets.X_TEST_ALICE_COOKIES }}
+        run: pnpm -C ts/apps/dev test:live
+
+      # The stack gets no secret (playwright.live.config.ts); GitHub masks them anyway.
+      - name: Show the stack log
+        if: ${{ !cancelled() && steps.test.outcome != 'success' }}
+        run: tail -n 300 "$LIBID_STACK_LOGS" || true
+
+      - name: Keep the screenshots
+        if: ${{ !cancelled() && steps.test.outcome != 'success' }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: live-e2e-github-x
+          path: ts/apps/dev/test-results/**/*.png
+          retention-days: 7
+          if-no-files-found: ignore
+
+  google-ssm:
+    name: Google ceremony through an SSM-reached proxy (live)
+    # Google challenges a session from a runner's address, so the browser goes
+    # through an EC2 proxy LIBID_GOOGLE_PROXY_ROLE reaches only by SSM.
+    # Runs while LIBID_GOOGLE_RUNNER is `ssm`, on main only: the role trusts
+    # this workflow on main and nothing else.
+    if: >-
+      vars.LIBID_GOOGLE_RUNNER == 'ssm' && github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    concurrency:
+      group: live-e2e-google
+      cancel-in-progress: false
+    timeout-minutes: 45 # test step 30: stack 10 + 1 test × 15 + stop 2
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup-ts
+
+      - name: Install Chromium
+        run: pnpm -C ts --filter @libid/dev exec playwright install --with-deps chromium
+
+      - uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
+        with:
+          role-to-assume: ${{ vars.LIBID_GOOGLE_PROXY_ROLE }}
+          aws-region: eu-central-1
+
+      # The port-forward runs for the rest of the job; the step fails unless the proxy answers.
+      - name: Reach the Google proxy over SSM
+        env:
+          INSTANCE: ${{ vars.LIBID_GOOGLE_PROXY_INSTANCE }}
+        run: |
+          aws ssm start-session --target "$INSTANCE" \
+            --document-name AWS-StartPortForwardingSession \
+            --parameters portNumber=3128,localPortNumber=3128 >"$RUNNER_TEMP/port-forward.log" 2>&1 &
+          for _ in $(seq 1 30); do
+            ip=$(curl -fs --max-time 5 -x http://127.0.0.1:3128 https://api.ipify.org) && break
+            sleep 2
+          done
+          echo "Google sees ${ip:?the proxy did not answer; see $RUNNER_TEMP/port-forward.log}"
+
+      - name: Prove a Google identity end to end
+        id: test
+        timeout-minutes: 30
+        env:
+          LIBID_LIVE_PLATFORMS: google
+          LIBID_TEST_PROXY: http://127.0.0.1:3128
+          GOOGLE_TEST_ALICE_EMAIL: ${{ secrets.GOOGLE_TEST_ALICE_EMAIL }}
+          GOOGLE_TEST_ALICE_COOKIES: ${{ secrets.GOOGLE_TEST_ALICE_COOKIES }}
+        run: pnpm -C ts/apps/dev test:live
+
+      - name: Show the stack log
+        if: ${{ !cancelled() && steps.test.outcome != 'success' }}
+        run: tail -n 300 "$LIBID_STACK_LOGS" || true
+
+      - name: Keep the screenshots
+        if: ${{ !cancelled() && steps.test.outcome != 'success' }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: live-e2e-google
+          path: ts/apps/dev/test-results/**/*.png
+          retention-days: 7
+          if-no-files-found: ignore

.gitignore

@@ -4,9 +4,11 @@ ts/packages/*/node_modules/
 ts/apps/*/node_modules/
 ts/packages/*/dist/
 ts/apps/*/dist/
-# Local development environment files
+# Local development environment files and test secrets
 .env
 .env.local
+.env.*.local
+*.env.test
 
 # @libid/popup e2e bundles and Playwright output
 ts/packages/popup/e2e/dist/

ts/.oxlintrc.json

@@ -1,5 +1,6 @@
 {
   "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "ignorePatterns": ["apps/dev/e2e/stealth.js"],
   "plugins": ["typescript"],
   "categories": {
     "correctness": "off"

ts/apps/dev/README.md

@@ -37,8 +37,8 @@ Edit configuration directly where it is used:
 
 - [compose.yaml](compose.yaml): services.
 - [bridge-config.toml](bridge-config.toml): Bridge configuration and development OAuth credentials.
-- [src/app.ts](src/app.ts): Bridge URL and the local ledger/notary fixture; Bridge configuration selects CCDP.
-- [vite.config.ts](vite.config.ts): frontend port.
+- [local.ts](local.ts): the app origin (frontend port), and the Bridge and notary URLs.
+- [src/app.ts](src/app.ts): the local ledger fixture; Bridge configuration selects CCDP.
 
 The setup includes shared development OAuth credentials and a public development
 notary signing key; no environment file is needed. Bridge publishes the GitHub
@@ -105,3 +105,56 @@ When isolation fallback occurs, **Prover fallback** shows navigation through Pro
 readiness, using `prover-fallback` and `prover.started` occurrence timestamps. It
 excludes work before navigation and does not measure the difference from a run
 without fallback. Direct runs have no fallback row.
+
+## Live tests
+
+The live suite proves real GitHub, X and Google accounts from this app's UI.
+It starts its own `pnpm dev` and stops it after, so the ports above must be
+free.
+
+```sh
+LIBID_TEST_ENV_FILE=path/to/.env.test pnpm --filter @libid/dev test:live
+```
+
+The variables carry the names libid-server-rs' ceremony-tests uses, so one
+`.env.test` serves both suites; keep it outside the repository, or name it
+`.env.test`, which git ignores. Unless `LIBID_LIVE_PLATFORMS` lists it, a
+platform whose variables are missing is skipped.
+
+| Variable | Platform | What |
+|---|---|---|
+| `GH_TEST_ALICE_USERNAME`, `GH_TEST_ALICE_PASSWORD` | GitHub | The test account. |
+| `GH_TEST_ALICE_TOTP_SECRET` | GitHub | The base32 key of its authenticator app. |
+| `X_TEST_ALICE_USERNAME` | X | The test account's handle. |
+| `X_TEST_ALICE_COOKIES` or `X_TEST_ALICE_COOKIES_FILE` | X | A saved session: base64 of the JSON cookie list from `ceremony export x`, or a path to that JSON, relative to the env file. |
+| `GOOGLE_TEST_ALICE_EMAIL` | Google | The test account. |
+| `GOOGLE_TEST_ALICE_COOKIES` or `GOOGLE_TEST_ALICE_COOKIES_FILE` | Google | A saved session, made by hand: see [Google's session](#googles-session). |
+| `LIBID_TEST_ENV_FILE` | — | A dotenv file with the variables above; exported values win. |
+| `LIBID_LIVE_PLATFORMS` | — | Comma-separated platforms to prove, such as `github,x`; each one listed must have its variables. Unset, every platform with its variables runs. |
+| `LIBID_TEST_PROXY` | — | A proxy for the browser's traffic, loopback aside. |
+| `LIBID_STACK_LOGS` | — | A file all of the stack's output, the build's included, is appended to. |
+| `HEADED` | — | Set: show the browser. |
+
+In CI, [live-e2e.yml](../../../.github/workflows/live-e2e.yml) runs GitHub and X
+daily in one job, and Google in another through a proxy whose address Google
+accepts. Each job gets only its own platforms' secrets. On a failure it prints
+the end of the stack log to the job log, where GitHub masks the secrets, and
+uploads the screenshots.
+
+### Google's session
+
+Google challenges a saved session used from an address other than the one it
+was signed in from, and refuses sign-in in an automated browser. So the session
+is made once by hand, through the same proxy CI uses:
+
+1. Open the proxy locally:
+   `aws ssm start-session --target <LIBID_GOOGLE_PROXY_INSTANCE> --document-name AWS-StartPortForwardingSession --parameters portNumber=3128,localPortNumber=3128`.
+2. In plain Chrome with a fresh profile, sign in to the test account through it:
+   `google-chrome --user-data-dir=/tmp/google-session --password-store=basic --proxy-server=http://127.0.0.1:3128 https://myaccount.google.com/`.
+   Then close Chrome.
+3. Export and store it: `node e2e/export-session.ts /tmp/google-session google.json`,
+   then `base64 -w0 google.json | gh secret set GOOGLE_TEST_ALICE_COOKIES`, and
+   delete `google.json` and the profile.
+
+Do this again when the Google job reports an expired session, or when the
+proxy's address changes.

ts/apps/dev/e2e/ceremony.live.spec.ts

@@ -0,0 +1,92 @@
+import type { PlatformId } from '@libid/ceremony'
+import { type BrowserContext, expect, type Page, test } from '@playwright/test'
+import { expectReady, launch, newestRun } from '../src/app.fixtures.ts'
+import { authorizeOnGitHub } from './github.ts'
+import { authorizeOnGoogle } from './google.ts'
+import { presentAsPerson } from './person.ts'
+import { watchAppFailure, watchReturn } from './popup.ts'
+import { googleSession, restoreSession, xSession } from './session.ts'
+import { env, missing, runnablePlatforms } from './settings.ts'
+import { authorizeOnX } from './x.ts'
+
+/**
+ * Start `name`'s ceremony from the app, let `authorize` drive the popup, then
+ * check the run's result: accepted, for `user` on `platform`. The ceremony
+ * itself validates the proof, the nodes and the ids.
+ */
+async function proveThroughTheUi(
+  page: Page,
+  context: BrowserContext,
+  name: string,
+  platform: PlatformId,
+  user: string,
+  authorize: (popup: Page) => Promise<void>,
+) {
+  await page.goto('/')
+  await expectReady(page, 60_000)
+  // Watched as it appears: a platform may return it at once.
+  context.on('page', watchReturn)
+  const popup = await launch(page, name)
+  const row = newestRun(page)
+  const id = (await row.getAttribute('data-ceremony-id'))!
+  const result = () =>
+    page.evaluate((id) => {
+      const result = window.results.get(id)
+      const identity = result && 'identity' in result ? result.identity : undefined
+      return (
+        result && {
+          status: result.status,
+          platform: identity?.platformId,
+          user: identity?.userName,
+        }
+      )
+    }, id)
+  const message = async () => (await row.locator('.run-status').textContent()) ?? ''
+  watchAppFailure(popup, async () => {
+    const status = (await result())?.status
+    return status && status !== 'accepted' ? await message() : undefined
+  })
+  await authorize(popup)
+
+  await expect.poll(result, { timeout: 8 * 60_000 }).toBeDefined()
+  const outcome = (await result())!
+  if (outcome.status !== 'accepted') expect(outcome.status, await message()).toBe('accepted')
+  expect(outcome.platform).toBe(platform)
+  expect(outcome.user?.toLowerCase()).toBe(user.toLowerCase())
+}
+
+/** Skip `platform`'s test unless it runs: listed, or with its variables set. */
+const skipUnlessLive = (platform: PlatformId) =>
+  test.skip(
+    !runnablePlatforms().includes(platform),
+    `not listed in LIBID_LIVE_PLATFORMS, or ${missing(platform).join(', ')} not set`,
+  )
+
+test('a GitHub identity is proved in the browser', async ({ page, context }) => {
+  skipUnlessLive('github')
+  const account = {
+    username: env('GH_TEST_ALICE_USERNAME')!,
+    password: env('GH_TEST_ALICE_PASSWORD')!,
+    totpSecret: env('GH_TEST_ALICE_TOTP_SECRET')!,
+  }
+  await proveThroughTheUi(page, context, 'GitHub', 'github', account.username, (popup) =>
+    authorizeOnGitHub(popup, account),
+  )
+})
+
+test('an X identity is proved in the browser', async ({ page, context }) => {
+  skipUnlessLive('x')
+  await presentAsPerson(context)
+  await restoreSession(context, xSession()!)
+  await proveThroughTheUi(page, context, 'X', 'x', env('X_TEST_ALICE_USERNAME')!, authorizeOnX)
+})
+
+test('a Google identity is proved in the browser', async ({ page, context }) => {
+  skipUnlessLive('google')
+  const email = env('GOOGLE_TEST_ALICE_EMAIL')!
+  await presentAsPerson(context)
+  await restoreSession(context, googleSession()!)
+  await proveThroughTheUi(page, context, 'Google', 'google', email, (popup) =>
+    authorizeOnGoogle(popup, email),
+  )
+})

ts/apps/dev/e2e/export-session.ts

@@ -0,0 +1,24 @@
+// Saves a Chrome profile's session as the JSON GOOGLE_TEST_ALICE_COOKIES holds
+// (base64-encoded). Google refuses sign-in in an automated browser, so a person
+// signs in first, in plain Chrome, through the proxy CI uses:
+//
+//   google-chrome --user-data-dir=/tmp/google-session --password-store=basic \
+//     --proxy-server=http://127.0.0.1:3128 https://myaccount.google.com/
+//
+// Close that Chrome, then: node e2e/export-session.ts /tmp/google-session out.json
+import { chromium } from '@playwright/test'
+
+const [profile, out] = process.argv.slice(2)
+if (!profile || !out) throw new Error('Usage: node e2e/export-session.ts <profile-dir> <out.json>')
+
+// The same Chrome and password store that wrote the profile, so its cookies decrypt.
+const context = await chromium.launchPersistentContext(profile, {
+  channel: 'chrome',
+  headless: true,
+  args: ['--password-store=basic'],
+})
+await context.storageState({ path: out })
+await context.close()
+console.log(
+  `Saved ${out}. It is a credential: keep it out of the repository and delete it after use.`,
+)

ts/apps/dev/e2e/github.test.ts

@@ -0,0 +1,9 @@
+// The TOTP code against the reference vector libid-server-rs' github.rs checks.
+import assert from 'node:assert/strict'
+import { test } from 'node:test'
+import { totp } from './github.ts'
+
+test('the TOTP code matches the reference vector, spaces and case aside', () => {
+  assert.equal(totp('JBSWY3DPEHPK3PXP', 1_700_000_000_000), '324550')
+  assert.equal(totp('jbsw y3dp ehpk 3pxp', 1_700_000_000_000), '324550')
+})