Bug 2062629 - Add browser lock-on-restart marionette test

Author: jporter-dev

testing/enterprise/felt_lock_tests.py

@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+import os
+import sys
+
+sys.path.append(os.path.dirname(__file__))
+
+from base_test import Environment
+from felt_tests import FeltTests
+
+
+class FeltLockTests(FeltTests):
+    """Shared setup for the FELT lock-on-close and lock-on-restart suites.
+
+    Both decide lock-vs-signout and inspect FELT-side persisted state, so they
+    share keystore stubbing, sign-in, resume-token inspection, and settling.
+    Subclasses provide their own _hold_felt_after_child_exit (the restart suite
+    additionally forces the update path) plus their own trigger and assertions.
+    """
+
+    def _prepare_felt_keystore(self):
+        """Stub OSKeyStore on the FELT process and clear any leftover tokens.
+
+        Token encrypt/decrypt otherwise hits the real OS key store (a macOS
+        Keychain password prompt), which stalls or fails headless; a reversible
+        in-memory transform keeps the round-trip testable. Clearing felt.json
+        (shared via UAppData, so it survives the per-test profile) prevents a
+        prior test's token from turning this sign-in into an unlock."""
+        driver = self.get_driver(Environment.FELT)
+        driver.set_context("chrome")
+        try:
+            driver.execute_script(
+                """
+                const { OSKeyStore } = ChromeUtils.importESModule(
+                    "resource://gre/modules/OSKeyStore.sys.mjs"
+                );
+                OSKeyStore.encrypt = async plaintext => "enc:" + plaintext;
+                OSKeyStore.decrypt = async ciphertext =>
+                    String(ciphertext).replace(/^enc:/, "");
+
+                const { FeltStorage } = ChromeUtils.importESModule(
+                    "resource://gre/modules/enterprise/FeltStorage.sys.mjs"
+                );
+                if (FeltStorage._feltStorage?.data) {
+                    FeltStorage._feltStorage.data.lockingTokens = {};
+                }
+                """
+            )
+        finally:
+            driver.set_context("content")
+
+    def _felt_has_locking_token(self):
+        """Whether FELT persisted an encrypted resume token for the signed-in user.
+
+        Uses the synchronous hasLockingToken: getLockingToken is async and would
+        return an always-truthy Promise through execute_script."""
+        driver = self.get_driver(Environment.FELT)
+        driver.set_context("chrome")
+        try:
+            return driver.execute_script(
+                """
+                const { FeltStorage } = ChromeUtils.importESModule(
+                    "resource://gre/modules/enterprise/FeltStorage.sys.mjs"
+                );
+                const email = FeltStorage.getLastSignedInUser();
+                return !!(email && FeltStorage.hasLockingToken(email));
+                """
+            )
+        finally:
+            driver.set_context("content")
+
+    def _settle_after_child_exit(self, browser_pid):
+        self.wait_process_exit(browser_pid)
+        self.await_felt_auth_window()
+        self.force_window()
+
+    def _start_signed_in(self):
+        self._hold_felt_after_child_exit()
+        self.run_felt_base()
+        self._prepare_felt_keystore()
+        self.connect_child_browser()
+        self.assert_user_signed_in(env=Environment.FIREFOX)
+        return self._child_driver.session_capabilities["moz:processID"]

testing/enterprise/manifest-browser.toml

@@ -33,6 +33,8 @@ disabled = "Bug 1996558: scaffolding for the browsing-child encryption-mismatch
 
 ["test_felt_browser_lock_on_close.py"]
 
+["test_felt_browser_lock_on_restart.py"]
+
 ["test_felt_browser_new_window_from_cli.py"]
 
 ["test_felt_browser_rapid_new_tabs_from_cli.py"]

testing/enterprise/test_felt_browser_lock_on_close.py

@@ -9,13 +9,13 @@
 sys.path.append(os.path.dirname(__file__))
 
 from base_test import Environment
-from felt_tests import FeltTests
+from felt_lock_tests import FeltLockTests
 
 PREF_LOCK_ON_CLOSE = "enterprise.locking.browser_close"
 PREF_PROMPT_ON_SIGNOUT = "enterprise.prompt_on_signout"
 
 
-class BrowserLockOnClose(FeltTests):
+class BrowserLockOnClose(FeltLockTests):
     """Verify the lock-vs-signout decision when closing a FELT browser.
 
     The distinguishing signal is whether a server signout is posted (a lock
@@ -104,44 +104,28 @@ def _accept_close_dialog(self):
             """
         )
 
-    def _felt_has_locking_token(self):
-        """Whether FELT persisted an encrypted resume token for the signed-in user."""
-        driver = self.get_driver(Environment.FELT)
-        driver.set_context("chrome")
-        try:
-            return driver.execute_script(
-                """
-                const { FeltStorage } = ChromeUtils.importESModule(
-                    "resource://gre/modules/enterprise/FeltStorage.sys.mjs"
-                );
-                const email = FeltStorage.getLastSignedInUser();
-                return !!(email && FeltStorage.getLockingToken(email));
-                """
-            )
-        finally:
-            driver.set_context("content")
-
-    def _settle_after_close(self, browser_pid):
-        self.wait_process_exit(browser_pid)
-        self.await_felt_auth_window()
-        self.force_window()
-
-    def _start_signed_in(self):
-        self._hold_felt_after_child_exit()
-        self.run_felt_base()
-        self.connect_child_browser()
-        self.assert_user_signed_in(env=Environment.FIREFOX)
-        return self._child_driver.session_capabilities["moz:processID"]
+    def _set_locking_enabled(self, enabled):
+        """enterprise.locking.browser_close is locked in firefox.js; Marionette
+        can't override a locked pref the way the policy engine does (it unlocks
+        first), so unlock it here to emulate the policy-applied value."""
+        self._child_driver.set_context("chrome")
+        self._child_driver.execute_script(
+            """
+            const pref = arguments[0];
+            Services.prefs.unlockPref(pref);
+            Services.prefs.setBoolPref(pref, arguments[1]);
+            """,
+            script_args=(PREF_LOCK_ON_CLOSE, enabled),
+        )
+        self._child_driver.set_context("content")
 
     def _begin_close_test(self, *, locking_enabled, prompt_enabled):
         """Sign in, set the locking/prompt prefs, and assert no signout yet.
 
-        Returns the child browser pid for _settle_after_close."""
+        Returns the child browser pid for _settle_after_child_exit."""
         browser_pid = self._start_signed_in()
-        self._child_driver.set_prefs({
-            PREF_LOCK_ON_CLOSE: locking_enabled,
-            PREF_PROMPT_ON_SIGNOUT: prompt_enabled,
-        })
+        self._set_locking_enabled(locking_enabled)
+        self._child_driver.set_pref(PREF_PROMPT_ON_SIGNOUT, prompt_enabled)
         assert self.signout_count.value == 0, "No signout should have been posted yet"
         return browser_pid
 
@@ -169,16 +153,18 @@ def test_lock_on_close_persists_session_without_signout(self):
         browser_pid = self._begin_close_test(locking_enabled=True, prompt_enabled=False)
 
         self._trigger_browser_closure()
-        self._settle_after_close(browser_pid)
+        self._settle_after_child_exit(browser_pid)
 
         self._assert_locked()
 
     def test_signout_on_close_when_locking_disabled(self):
         """Locking disabled, prompt disabled: closing signs out (no token kept)."""
-        browser_pid = self._begin_close_test(locking_enabled=False, prompt_enabled=False)
+        browser_pid = self._begin_close_test(
+            locking_enabled=False, prompt_enabled=False
+        )
 
         self._trigger_browser_closure()
-        self._settle_after_close(browser_pid)
+        self._settle_after_child_exit(browser_pid)
 
         self._assert_signed_out()
 
@@ -192,7 +178,7 @@ def test_prompt_lock_dialog_accept_locks(self):
             expected_reauth="You can resume your session after authenticating on this device.",
         )
         self._accept_close_dialog()
-        self._settle_after_close(browser_pid)
+        self._settle_after_child_exit(browser_pid)
 
         self._assert_locked()
 
@@ -206,6 +192,6 @@ def test_prompt_signout_dialog_accept_signs_out(self):
             expected_reauth="To use Firefox Enterprise again, you’ll need to reauthenticate through your organization’s SSO provider.",
         )
         self._accept_close_dialog()
-        self._settle_after_close(browser_pid)
+        self._settle_after_child_exit(browser_pid)
 
         self._assert_signed_out()

testing/enterprise/test_felt_browser_lock_on_restart.py

@@ -0,0 +1,98 @@
+#!/usr/bin/env python3
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+import os
+import sys
+
+sys.path.append(os.path.dirname(__file__))
+
+from base_test import Environment
+from felt_lock_tests import FeltLockTests
+
+PREF_FORCE_PENDING_UPDATE = "enterprise.felt_tests.force_pending_update"
+
+
+class BrowserLockOnRestart(FeltLockTests):
+    """Verify locking the FELT session on an update-driven restart.
+
+    Applying an update relaunches the whole application, so FELT must persist
+    the session behind OS auth (rather than sign out) to resume it afterwards.
+    Only the update path locks; a plain restart keeps the session in memory and
+    is not exercised here. Since a real update-driven restart (signed MAR +
+    relaunch) is unreachable under Marionette, the update path is forced with a
+    test pref, and FELT is held after the child exits (is_blocking_shutdown) so
+    the persisted state can be inspected in place of the real relaunch.
+    """
+
+    def _hold_felt_after_child_exit(self):
+        # Keep FELT alive after the child exits so we can inspect FELT-side state,
+        # and force the update path since a real update-driven restart is not
+        # reachable under Marionette.
+        self.get_driver(Environment.FELT).set_prefs(
+            {
+                "enterprise.felt_tests.should_not_close_window": True,
+                "enterprise.felt_tests.is_blocking_shutdown": True,
+                PREF_FORCE_PENDING_UPDATE: True,
+            },
+            default_branch=True,
+        )
+
+    def _trigger_browser_restart(self):
+        """Restart the browser the way an update would: a plain eRestart quit.
+        The browser's Felt IPC client observes it and tags the restart with the
+        cached lock intent; no BrowserGlue interception is involved."""
+        self._child_driver.set_context("chrome")
+        self._manually_closed_child = True
+        self._child_driver.execute_script(
+            """
+            Services.startup.quit(
+                Ci.nsIAppStartup.eAttemptQuit | Ci.nsIAppStartup.eRestart
+            );
+            """
+        )
+
+    def _begin_restart_test(self, *, locking_enabled):
+        """Sign in, set the restart-lock intent, and assert no signout yet.
+
+        Returns the child browser pid for _settle_after_child_exit."""
+        browser_pid = self._start_signed_in()
+        # Set the intent directly: it normally derives from a locked pref, which
+        # Marionette can't toggle the way the policy engine (which unlocks) does.
+        self._child_driver.set_context("chrome")
+        self._child_driver.execute_script(
+            "Services.felt.setRestartLockIntent(arguments[0]);",
+            script_args=(locking_enabled,),
+        )
+        self._child_driver.set_context("content")
+        assert self.signout_count.value == 0, "No signout should have been posted yet"
+        return browser_pid
+
+    def test_lock_on_update_restart_persists_session_without_signout(self):
+        """Locking enabled: an update-driven restart locks (no signout, token kept)."""
+        browser_pid = self._begin_restart_test(locking_enabled=True)
+
+        self._trigger_browser_restart()
+        self._settle_after_child_exit(browser_pid)
+
+        assert self.signout_count.value == 0, (
+            f"Locking on restart must not post a signout, got {self.signout_count.value}"
+        )
+        assert self._felt_has_locking_token(), (
+            "Locking on update-restart must persist an encrypted resume token"
+        )
+
+    def test_update_restart_without_locking_keeps_no_token(self):
+        """Locking disabled: an update-driven restart neither locks nor signs out."""
+        browser_pid = self._begin_restart_test(locking_enabled=False)
+
+        self._trigger_browser_restart()
+        self._settle_after_child_exit(browser_pid)
+
+        assert not self._felt_has_locking_token(), (
+            "Without locking, an update-restart must not persist a resume token"
+        )
+        assert self.signout_count.value == 0, (
+            f"An update-restart must not post a signout, got {self.signout_count.value}"
+        )