lussierj
8b0d32cd6b
Bind Agent observations, review, enrichment and telemetry to current Zone
and inventory authority. Preserve immutable MAC ownership and historical
snapshots with stale-result rejection and transactional security audits.
Retire unbound direct/range/scheduled discovery and one/bulk legacy summary
writes in both modes. Require reconciled exact inventory identity or
explicit Zone-scoped IP selection for CSV metadata imports.
Independent Blocker #1 application-security re-audit: PASS on tree
cf863aadc9. Evidence: 141 focused PostgreSQL/HTTP
tests passed; Chromium and PowerShell checks passed. Two documented baseline
source assertions remain unchanged. Production deployment is not approved.
50 lines
3.6 KiB
JavaScript
50 lines
3.6 KiB
JavaScript
// Actual Chromium; every HTTP request is fulfilled or aborted, with disposable data only.
|
|
const {chromium}=require('playwright');
|
|
const fs=require('fs');const assert=require('node:assert/strict');
|
|
(async()=>{
|
|
const browser=await chromium.launch({headless:true,args:['--no-sandbox','--disable-background-networking']});
|
|
try {
|
|
const context=await browser.newContext({serviceWorkers:'block'});
|
|
const page=await context.newPage();
|
|
const marker='<img src="data:," onerror="window.__discoveryAudit=1">';
|
|
const commands=[];const unexpected=[];
|
|
const observations=[0,1].map(n=>({id:'00000000-0000-4000-8000-00000000000'+(n+1),agent_id:'Agent '+n,agent_zone_id:'Zone '+n,version:'2026-01-01T00:00:00.00000'+n+'+00:00',created_at:'2026-01-01T00:00:00Z',ip_address:'198.51.100.10',room_name:marker,model:marker,mac_address:marker,discovery_status:'new'}));
|
|
await page.route('**/*',async route=>{
|
|
const url=new URL(route.request().url());
|
|
if(url.origin!=='http://minerops.invalid'){unexpected.push(url.href);return route.abort();}
|
|
const path=url.pathname;
|
|
if(path==='/agent/control')return route.fulfill({contentType:'text/html',body:fs.readFileSync(process.argv[2],'utf8')});
|
|
if(path==='/api/agent/status-summary')return route.fulfill({json:{live_database_counts:{total:2,online:2},latest_snapshot:{},agent:{agent_id:marker,hostname:marker,version:marker},recent_commands:[{command_type:marker,command_status:'failed',requested_by_username:marker,error_message:marker}]}});
|
|
if(path==='/api/agent/discoveries')return route.fulfill({json:{discoveries:observations}});
|
|
if(path==='/api/agent/discoveries/summary')return route.fulfill({json:{total:2,counts:{new:2}}});
|
|
if(path==='/api/agent/discoveries/review'||path==='/api/agent/discoveries/enrich-match'){
|
|
commands.push({path,body:route.request().postDataJSON()});return route.fulfill({json:{ok:true,message:'Saved'}});
|
|
}
|
|
return route.abort();
|
|
});
|
|
await context.addInitScript(()=>localStorage.setItem('minerops_token','disposable-browser-token'));
|
|
page.on('dialog',dialog=>dialog.accept());
|
|
await page.goto('http://minerops.invalid/agent/control');
|
|
await page.waitForSelector('#discoveriesBody tr button');
|
|
if(process.argv[3]==='baseline'){
|
|
await page.waitForFunction(()=>window.__discoveryAudit===1);
|
|
console.log('Baseline positive control: harmless stored event handler executed.');
|
|
} else {
|
|
assert.equal(await page.evaluate(()=>window.__discoveryAudit),undefined);
|
|
assert.equal(await page.locator('#discoveriesBody img,#commandsBody img,[onerror]').count(),0);
|
|
assert.ok((await page.locator('#discoveriesBody').innerText()).includes(marker));
|
|
await page.locator('#discoveriesBody tr').nth(0).getByRole('button',{name:'Add as New',exact:true}).click();
|
|
await page.waitForFunction(()=>document.getElementById('statusBox').textContent==='Agent status loaded.');
|
|
await page.locator('#discoveriesBody tr').nth(1).getByRole('button',{name:'Enrich / Match',exact:true}).click();
|
|
assert.equal(commands.length,2);
|
|
assert.equal(commands[0].body.discovery_id,observations[0].id);
|
|
assert.equal(commands[0].body.version,observations[0].version);
|
|
assert.equal(commands[1].body.discovery_id,observations[1].id);
|
|
assert.equal(commands[1].body.version,observations[1].version);
|
|
assert.ok(commands.every(c=>!Object.hasOwn(c.body,'ip_address')));
|
|
assert.deepEqual(unexpected,[]);
|
|
console.log('Chromium passed: stored markup inert; Agent/status/error data escaped; same-IP actions retain exact observation IDs/versions; no external requests.');
|
|
}
|
|
} finally {await browser.close();}
|
|
})().catch(e=>{console.error(e);process.exitCode=1});
|