Dmitry VerkhoturovandGitHub
2640aaee9e
Every service in the suite spoke http, and the browser gates a whole class of behaviour on the page protocol: Secure cookies, SameSite=None, Partitioned, and any code reading location.protocol. None of it was executed, which is how setAuthCookie came to decorate its cookies with __Host- on https pages and survive for years. A TLS pair joins the stack: remark42 with SSL_TYPE=static on 8443, and an nginx serving a host page on its own name on 8444, both on a self-signed certificate that e2e/tls/generate.sh makes and .gitignore keeps out. Every context accepts it, and so does the readiness client, since those are the only servers either talks to. The instance also runs with AUTH_SEND_JWT_HEADER, which is what makes the widget write cookies of its own: without it the client-side writer never runs on any https page here and every assertion about the attributes it chooses is vacuous. Three cases. Signing in across origins and then reloading, which is the one the http cross-origin case cannot make: the widget holds its token in memory for the life of a page, so signing in and posting says nothing about persistence and only the reload asks whether the cookie was delivered, stored under a name the backend reads and sent back from a third-party frame. The cookies themselves, read out of the browser store while the widget is embedded elsewhere, since a cookie the browser refused is absent from that list entirely and one it kept but will not send is worse than useless: every copy of both names has to be Secure and SameSite=None, at least one has to be partitioned, and none may carry a __Host- prefix nothing on either side reads. And the same reload under a browser that blocks third-party cookies, which the widget's own partitioned pair is the only reason to survive. That last one needs a browser playwright does not offer: its default arguments disable ThirdPartyStoragePartitioning outright, so a run configured wrongly keeps every third-party cookie and the case would pass while asserting nothing. IgnoreDefaultArgs drops that list and re-supplies it without the one feature, and a control cookie set from inside the frame has to be refused before anything else is read, so a playwright release that changes the list fails as itself instead of going quietly vacuous. All three pass against master. What TLS still cannot reach, the OAuth popup above all, is written down in the README.
60 lines
2.2 KiB
Makefile
60 lines
2.2 KiB
Makefile
OS=linux
|
|
ARCH=amd64
|
|
GITHUB_REF=$(shell git rev-parse --symbolic-full-name HEAD)
|
|
GITHUB_SHA=$(shell git rev-parse --short HEAD)
|
|
CLEANUP_RELEASE_ASSETS=$(CURDIR)/scripts/cleanup-release-assets.sh
|
|
|
|
bin:
|
|
@set -e; \
|
|
./scripts/prepare-release-assets.sh; \
|
|
trap '$(CLEANUP_RELEASE_ASSETS)' EXIT; \
|
|
cd backend && CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build -o ../remark42 -ldflags "-X main.revision=$(GITHUB_REF)-$(GITHUB_SHA) -s -w" ./app
|
|
|
|
docker:
|
|
DOCKER_BUILDKIT=1 docker build -t umputun/remark42 -t ghcr.io/umputun/remark42 --build-arg GITHUB_REF=$(GITHUB_REF) --build-arg GITHUB_SHA=$(GITHUB_SHA) \
|
|
--build-arg CI=true --build-arg SKIP_FRONTEND_TEST=true --build-arg SKIP_BACKEND_TEST=true .
|
|
|
|
dockerx:
|
|
docker buildx build --build-arg GITHUB_REF=$(GITHUB_REF) --build-arg GITHUB_SHA=$(GITHUB_SHA) --build-arg CI=true \
|
|
--build-arg SKIP_FRONTEND_TEST=true --build-arg SKIP_BACKEND_TEST=true \
|
|
--progress=plain --platform linux/amd64,linux/arm64 \
|
|
-t ghcr.io/umputun/remark42:master -t umputun/remark42:master .
|
|
|
|
release:
|
|
@set -e; \
|
|
trap '$(CLEANUP_RELEASE_ASSETS)' EXIT; \
|
|
goreleaser release --snapshot --clean --skip=publish
|
|
|
|
race_test:
|
|
cd backend/app && go test -race -timeout=300s -count 1 ./...
|
|
|
|
backend:
|
|
docker compose -f compose-dev-backend.yml build
|
|
|
|
frontend:
|
|
docker compose -f compose-dev-frontend.yml build
|
|
|
|
rundev:
|
|
SKIP_BACKEND_TEST=true SKIP_FRONTEND_TEST=true GITHUB_REF=$(GITHUB_REF) GITHUB_SHA=$(GITHUB_SHA) CI=true \
|
|
docker compose -f compose-private.yml build
|
|
docker compose -f compose-private.yml up
|
|
|
|
# stamped the same way the suite stamps a stack it starts itself, so one brought up here is
|
|
# accepted instead of rejected as belonging to another checkout
|
|
e2e-up:
|
|
./e2e/tls/generate.sh
|
|
E2E_STAMP=$$(./e2e/stamp.sh) docker compose -f compose-e2e-test.yml up -d --build --quiet-pull --wait
|
|
|
|
e2e-down:
|
|
docker compose -f compose-e2e-test.yml down -v
|
|
|
|
# the suite brings the stack up itself when it finds none, so e2e-up is only worth running
|
|
# to keep the containers between invocations
|
|
e2e:
|
|
cd e2e && go test -tags=e2e -count 1 -timeout 20m ./...
|
|
|
|
e2e-ui:
|
|
cd e2e && E2E_HEADLESS=false E2E_KEEP=1 go test -tags=e2e -count 1 -v -timeout 20m ./...
|
|
|
|
.PHONY: bin docker dockerx release race_test backend frontend rundev e2e e2e-up e2e-down e2e-ui
|