Use isolated native Windows browser for attended WSL login

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1abf1-7e95-7141-87c9-ee78332bf790

tests/test_operator_windows_browser.py

@@ -0,0 +1,114 @@
+"""Native WSL opener boundaries; no GUI, identity request or real profile."""
+
+import base64
+import importlib.machinery
+import importlib.util
+import io
+import json
+import runpy
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1] / "scripts/operator-browser"
+loader = importlib.machinery.SourceFileLoader("native_browser_fixture", str(ROOT / "windows_browser.py"))
+spec = importlib.util.spec_from_loader(loader.name, loader)
+native = importlib.util.module_from_spec(spec)
+loader.exec_module(native)
+launcher = runpy.run_path(str(ROOT / "xdg-open"))
+URL = "https://kc.coulomb.social/authorize?redirect_uri=http%3A%2F%2Flocalhost%3A8250%2Foidc%2Fcallback&state=synthetic"
+
+
+class SavedPipe(io.BytesIO):
+    def close(self):
+        self.saved = self.getvalue()
+        super().close()
+
+
+class WindowsBrowserBoundary(unittest.TestCase):
+    def process(self, marker=b"opened\r\n"):
+        return SimpleNamespace(stdin=SavedPipe(), stdout=SavedPipe(marker))
+
+    def test_worker_receives_url_only_via_pipe(self):
+        process = self.process()
+        with patch.object(native.subprocess, "Popen", return_value=process) as popen, \
+                patch.object(native.select, "select", return_value=([process.stdout], [], [])):
+            self.assertTrue(native.launch(URL))
+        argv = popen.call_args.args[0]
+        self.assertEqual(json.loads(process.stdin.saved), {"url": URL})
+        self.assertNotIn(URL, " ".join(argv))
+        source = base64.b64decode(argv[-1]).decode("utf-16le")
+        self.assertNotIn("state=synthetic", source)
+        self.assertIn("[Console]::In.ReadToEnd()", source)
+
+    def test_uses_numeric_owner_sid_and_verifies_protection_before_launch(self):
+        source = base64.b64decode(native.command()[-1]).decode("utf-16le")
+        self.assertIn("$grant='*'+$sid.Value+':(OI)(CI)F'", source)
+        self.assertIn("'/inheritance:r'", source)
+        self.assertIn("$rules.Count -ne 1", source)
+        self.assertIn("$rules[0].IdentityReference.Value -ne $sid.Value", source)
+        self.assertLess(source.index("$verified=Get-Acl"), source.index("Start-Process"))
+        self.assertNotIn("Set-Acl", source)
+
+    def test_worker_rechecks_same_issuer_and_both_approved_callbacks(self):
+        source = native.SCRIPT
+        self.assertIn("$uri.Host -ne 'kc.coulomb.social'", source)
+        self.assertIn("$callbacks.Count -ne 1", source)
+        self.assertIn("http://localhost:8250/oidc/callback", source)
+        self.assertIn("http://127.0.0.1:8250/oidc/callback", source)
+        self.assertIn("'code','access_token','id_token','refresh_token','mfa_token','password','client_secret'", source)
+        for banned in ("--no-sandbox", "--disable-web-security", "--ignore-certificate-errors", "--remote-debugging"):
+            self.assertNotIn(banned, source)
+
+    def test_cleanup_checks_exact_pid_start_and_executable(self):
+        self.assertIn("$current.StartTime.ToUniversalTime().Ticks -eq $startTicks", native.SCRIPT)
+        self.assertIn("$current.Path -eq $browser", native.SCRIPT)
+        self.assertIn("$current.Kill()", native.SCRIPT)
+        self.assertNotIn("Stop-Process -Name", native.SCRIPT)
+        for value in (True, 0, 601, "600"):
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                native.command(value)
+
+    def test_unknown_output_failure_and_timeout_do_not_become_opened(self):
+        for marker in (b"failed\r\n", b"unexpected synthetic output\n", b""):
+            process = self.process(marker)
+            with self.subTest(marker=marker), patch.object(native.subprocess, "Popen", return_value=process), \
+                    patch.object(native.select, "select", return_value=([process.stdout], [], [])):
+                self.assertFalse(native.launch(URL))
+        process = self.process()
+        with patch.object(native.subprocess, "Popen", return_value=process), \
+                patch.object(native.select, "select", return_value=([], [], [])):
+            self.assertFalse(native.launch(URL))
+
+    def test_wsl_uses_native_before_display_check_without_changing_url(self):
+        process = self.process()
+        markers = []
+        with patch.dict(launcher["open_url"].__globals__, {"stamp": markers.append}), \
+                patch.object(launcher["platform"], "release", return_value="6.18-microsoft-standard-WSL2"), \
+                patch.dict(launcher["os"].environ, {}, clear=True), \
+                patch.object(native.subprocess, "Popen", return_value=process), \
+                patch.object(native.select, "select", return_value=([process.stdout], [], [])):
+            self.assertEqual(launcher["open_url"](URL), 0)
+        self.assertEqual(markers, ["opened"])
+        self.assertEqual(json.loads(process.stdin.saved), {"url": URL})
+
+    def test_foreign_url_never_reaches_native_and_failure_never_falls_back(self):
+        markers = []
+        with patch.dict(launcher["open_url"].__globals__, {"stamp": markers.append}), \
+                patch.object(launcher["platform"], "release", return_value="microsoft"), \
+                patch.object(native.subprocess, "Popen") as popen:
+            self.assertEqual(launcher["open_url"]("https://foreign.invalid/"), 1)
+            popen.assert_not_called()
+        process = self.process(b"failed\n")
+        with patch.dict(launcher["open_url"].__globals__, {"stamp": markers.append}), \
+                patch.object(launcher["platform"], "release", return_value="microsoft"), \
+                patch.object(native.subprocess, "Popen", return_value=process) as popen, \
+                patch.object(native.select, "select", return_value=([process.stdout], [], [])):
+            self.assertEqual(launcher["open_url"](URL), 1)
+            self.assertEqual(popen.call_count, 1)
+        self.assertEqual(markers, ["rejected", "windows-open-failed"])
+
+
+if __name__ == "__main__":
+    unittest.main()