notandClaude Opus 5
27f2607e4e
`medewerker-login.ts` becomes `keycloak-login.ts`: the three citizen specs each duplicated the same three-line password login, so a fix to the login path had to be made four times. They now call `loginBurger`, and both realms share `submitPassword`. No behaviour change — all 6 specs green against a live stack. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
75 lines
3.5 KiB
TypeScript
75 lines
3.5 KiB
TypeScript
import { createHmac } from 'node:crypto';
|
|
import { readFileSync, writeFileSync } from 'node:fs';
|
|
import { tmpdir } from 'node:os';
|
|
import { join } from 'node:path';
|
|
import type { Page } from '@playwright/test';
|
|
|
|
// Every portal login in the suite goes through this module — citizen realms (mock DigiD) and the
|
|
// medewerker realm alike — so the shared Keycloak form handling lives in exactly one place.
|
|
|
|
// The medewerker realm enforces MFA (S-15c), so a staff login is two steps: password, then a TOTP
|
|
// code. The realm export seeds every medewerker with this fixture secret — Keycloak HMACs the raw
|
|
// secret bytes — so the e2e can compute a valid code instead of enrolling an authenticator.
|
|
const OTP_SECRET = 'BIGMEDEWERKEROTPSEED';
|
|
|
|
export const OTP_PERIOD_MS = 30_000;
|
|
|
|
// RFC 6238 TOTP: HMAC-SHA1 over the 30-second counter, dynamically truncated to 6 digits.
|
|
export function totp(secret = OTP_SECRET, at = Date.now()): string {
|
|
const counter = Buffer.alloc(8);
|
|
counter.writeBigUInt64BE(BigInt(Math.floor(at / OTP_PERIOD_MS)));
|
|
const mac = createHmac('sha1', secret).update(counter).digest();
|
|
const offset = mac[mac.length - 1] & 0x0f;
|
|
return String((mac.readUInt32BE(offset) & 0x7fffffff) % 1_000_000).padStart(6, '0');
|
|
}
|
|
|
|
// Keycloak refuses a TOTP code it has already accepted (its otpPolicyCodeReusable defaults to
|
|
// false), so two logins as the same medewerker inside one 30-second window would both submit the
|
|
// same code and the second is rejected. Spend the first counter this medewerker has left.
|
|
export function nextUnusedCounter(now: number, spent: number): number {
|
|
return Math.max(Math.floor(now / OTP_PERIOD_MS), spent + 1);
|
|
}
|
|
|
|
// The spent counter lives on disk rather than in module state: Playwright starts a fresh worker
|
|
// process for a retry, which would otherwise forget it and resubmit the rejected code.
|
|
function spendCounter(username: string): number {
|
|
const file = join(tmpdir(), `otp-counter-${username}`);
|
|
let spent = -1;
|
|
try {
|
|
spent = Number(readFileSync(file, 'utf8')) || -1;
|
|
} catch {
|
|
// first login as this medewerker in this run
|
|
}
|
|
const counter = nextUnusedCounter(Date.now(), spent);
|
|
writeFileSync(file, String(counter));
|
|
return counter;
|
|
}
|
|
|
|
/**
|
|
* Fill Keycloak's login form. Every portal is guarded, so the first navigation redirects here; the
|
|
* form ids are stable across themes.
|
|
*/
|
|
async function submitPassword(page: Page, username: string): Promise<void> {
|
|
await page.locator('#username').fill(username);
|
|
await page.locator('#password').fill('test123');
|
|
await page.locator('#kc-login').click();
|
|
}
|
|
|
|
/** A citizen login on a mock-DigiD realm — no second factor (ADR-0031). */
|
|
export async function loginBurger(page: Page, username: string): Promise<void> {
|
|
await submitPassword(page, username);
|
|
}
|
|
|
|
/** A staff login on the medewerker realm: password, then the enforced TOTP second factor. */
|
|
export async function loginMedewerker(page: Page, username: string): Promise<void> {
|
|
await submitPassword(page, username);
|
|
|
|
// Keycloak's conditional-OTP step. Wait out the rest of the window if the counter we may spend is
|
|
// still in the future; its lookAheadWindow would accept the code a moment early, but only by one
|
|
// counter — waiting keeps a third login in the same window valid too.
|
|
const counter = spendCounter(username);
|
|
await page.waitForTimeout(Math.max(0, counter * OTP_PERIOD_MS - Date.now()));
|
|
await page.locator('#otp').fill(totp(OTP_SECRET, counter * OTP_PERIOD_MS));
|
|
await page.locator('#kc-login').click();
|
|
}
|