fix: prevent tokio runtime deadlock in credential issue/verify

The credential issuance and verification handlers used Handle::block_on() directly inside the tokio runtime, causing a deadlock. Wrapped with block_in_place() to properly yield the runtime thread. Also completed full feature verification across all 25 test groups (~175 checks) on live server. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-09 07:43:12 +00:00
parent 5ce8b7965c
commit e3aa95a103
81 changed files with 11492 additions and 649 deletions
@@ -0,0 +1,119 @@
+#!/bin/bash
+set -euo pipefail
+# TEST-203: iframe/new-tab verification for all apps.
+# Checks X-Frame-Options headers and verifies mustOpenInNewTab() mapping.
+
+SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
+TARGET="archipelago@192.168.1.228"
+SSH_CMD="ssh -i $SSH_KEY -o StrictHostKeyChecking=no $TARGET"
+
+# Apps that MUST open in new tab (X-Frame-Options: DENY or SAMEORIGIN)
+MUST_NEW_TAB="btcpay-server homeassistant nextcloud immich"
+
+# All apps and their ports for checking
+declare -A APP_PORTS=(
+  [bitcoin-knots]="8332"
+  [electrs]="50001"
+  [btcpay-server]="23000"
+  [lnd]="8080"
+  [mempool]="18080"
+  [homeassistant]="8123"
+  [grafana]="3033"
+  [searxng]="18888"
+  [ollama]="11434"
+  [onlyoffice]="8044"
+  [penpot]="9001"
+  [nextcloud]="8085"
+  [vaultwarden]="8099"
+  [jellyfin]="8096"
+  [photoprism]="2342"
+  [immich]="2283"
+  [filebrowser]="18082"
+  [nginx-proxy-manager]="8181"
+  [portainer]="9443"
+  [uptime-kuma]="3001"
+  [fedimint]="8174"
+)
+
+PASS=0
+FAIL=0
+SKIP=0
+RESULTS=()
+
+log() { echo -e "\033[1;34m[TEST]\033[0m $*"; }
+pass() { echo -e "\033[1;32m[PASS]\033[0m $*"; PASS=$((PASS + 1)); RESULTS+=("PASS: $*"); }
+fail() { echo -e "\033[1;31m[FAIL]\033[0m $*"; FAIL=$((FAIL + 1)); RESULTS+=("FAIL: $*"); }
+skip() { echo -e "\033[1;33m[SKIP]\033[0m $*"; SKIP=$((SKIP + 1)); RESULTS+=("SKIP: $*"); }
+
+check_app() {
+  local app_id="$1"
+  local port="${APP_PORTS[$app_id]}"
+  local should_newtab=false
+
+  for nt in $MUST_NEW_TAB; do
+    if [ "$nt" = "$app_id" ]; then
+      should_newtab=true
+      break
+    fi
+  done
+
+  # Check if port responds
+  local headers
+  headers=$($SSH_CMD "curl -sI --connect-timeout 5 http://localhost:$port/ 2>/dev/null" || echo "")
+
+  if [ -z "$headers" ]; then
+    skip "$app_id (port $port) — not responding (app may not be running)"
+    return
+  fi
+
+  # Check X-Frame-Options header
+  local xfo
+  xfo=$(echo "$headers" | grep -i "x-frame-options" | head -1 | tr -d '\r' || echo "")
+  local csp_frame
+  csp_frame=$(echo "$headers" | grep -i "content-security-policy" | grep -i "frame-ancestors" | head -1 | tr -d '\r' || echo "")
+
+  local blocks_iframe=false
+  if echo "$xfo" | grep -qi "deny\|sameorigin"; then
+    blocks_iframe=true
+  fi
+  if echo "$csp_frame" | grep -qi "frame-ancestors.*none\|frame-ancestors.*self"; then
+    blocks_iframe=true
+  fi
+
+  if [ "$blocks_iframe" = true ]; then
+    if [ "$should_newtab" = true ]; then
+      pass "$app_id — correctly marked as new-tab (blocks iframe: $xfo)"
+    else
+      fail "$app_id — blocks iframe ($xfo) but NOT in mustOpenInNewTab()"
+    fi
+  else
+    if [ "$should_newtab" = true ]; then
+      log "  INFO: $app_id is in mustOpenInNewTab() but doesn't block iframes (safe to keep)"
+      pass "$app_id — marked as new-tab (conservative, OK)"
+    else
+      pass "$app_id — loads in iframe OK (no frame restrictions)"
+    fi
+  fi
+}
+
+main() {
+  log "=== iframe/new-tab Verification Test ==="
+  echo ""
+
+  for app_id in $(echo "${!APP_PORTS[@]}" | tr ' ' '\n' | sort); do
+    check_app "$app_id"
+  done
+
+  echo ""
+  log "=== RESULTS ==="
+  for r in "${RESULTS[@]}"; do
+    echo "  $r"
+  done
+  echo ""
+  log "Pass: $PASS | Fail: $FAIL | Skip: $SKIP"
+
+  [ $FAIL -gt 0 ] && exit 1
+  exit 0
+}
+
+main "$@"