mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-27 21:07:01 -06:00
Vincent Koc
0dc9970624
* test(ui): cover control ui auth transports * test(qa): register control ui auth transport scenarios * test(ui): allow loaded control ui startup * test(ui): allow loaded screenshot capture * test(ui): scrub loopback proof URLs * test(ui): keep transport proof assertion-focused * test(ui): capture auth transport proof directly * test(ui): gate auth transport proof media * test(ui): scope auth transport evidence * test(ui): fix auth transport frame typing * test(ui): stabilize auth transport QA * test(ui): separate auth UI navigation readiness
34 lines
1.7 KiB
YAML
34 lines
1.7 KiB
YAML
title: Control UI trusted-proxy authentication
|
|
|
|
scenario:
|
|
id: control-ui-trusted-proxy-auth
|
|
surface: control-ui
|
|
category: control-ui.browser-access-and-trust
|
|
coverage:
|
|
primary:
|
|
- control-ui.trusted-proxy-auth
|
|
objective: >-
|
|
Prove real Chromium connects through a task-owned reverse proxy whose
|
|
trusted path supplies the configured identity, while the same proxy's
|
|
untrusted path is rejected by the real Gateway with visible recovery.
|
|
successCriteria:
|
|
- A task-owned real Gateway runs with temporary home, state, and trusted-proxy configuration.
|
|
- Real Chromium reaches the connected Control UI shell through the proxy path that injects the configured identity and required header.
|
|
- The proxy path that omits proxy-owned auth headers receives a Gateway unauthorized rejection with the exact required-header reason captured from the protocol frame.
|
|
- Captured browser connect frames and Gateway responses distinguish UI behavior from server-side enforcement.
|
|
- The run always writes redacted transport and process-cleanup evidence; when OPENCLAW_CAPTURE_UI_PROOF=1, it also writes screenshots and video under the configured artifact directory.
|
|
docsRefs:
|
|
- docs/gateway/trusted-proxy-auth.md
|
|
- docs/web/control-ui.md
|
|
codeRefs:
|
|
- ui/src/e2e/control-ui-auth-transports.e2e.test.ts
|
|
- src/gateway/auth.ts
|
|
- src/gateway/server/ws-connection/connect-admission.ts
|
|
execution:
|
|
kind: playwright
|
|
path: ui/src/e2e/control-ui-auth-transports.e2e.test.ts
|
|
testNamePattern: connects through the trusted path and rejects the untrusted proxy path
|
|
summary: >-
|
|
Real Chromium, reverse-proxy, and Gateway proof for successful
|
|
trusted-proxy identity admission and required-header rejection.
|