freezmo/tests
Martin Dvorak 8822baf4b7 Security: model budget + concurrency caps, SSRF guards, spoof-proof limits
Audit pass with the threats that actually apply to a self-hosted, account-less
app: getting the Ollama key throttled or banned, and someone grinding the app
down. Per-route windows already existed; these are the missing layers.

- lib/model-guard.ts: every route that spends a model call now takes a slot —
  60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight
  per IP, 6 in total — and the slot is released when the call finishes, on
  errors and on client disconnects. Over the concurrency cap answers 429
  kind=busy, not a punishment. Slots are taken after every cheap rejection so
  a malformed request cannot hold one (found by the new suite: early 400s
  were leaking slots).
- Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL
  in an images field made Ollama fetch an arbitrary address on our behalf.
- Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting
  to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored.
- The rate-limit identity is the LAST x-forwarded-for hop. Reading the first
  let a client spoof its own IP and dodge every per-IP limit.
- Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder
  devices cap at PUSH_MAX_SUBSCRIPTIONS (50).
- Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a
  referrer policy and a Permissions-Policy without camera/mic/geo/payment.

New tests/security-test.mjs (13 checks, registered in run-all) proves each
guard against a slow stub Ollama with deliberately tiny limits. README:
security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.
2026-10-12 20:40:57 +00:00
..
bubble-perf.mjs Stop blurring the animated scene on static glass (2x frame time) 2026-10-12 19:47:36 +00:00
bubbles-test.mjs Ice scene: the glossy orbs become rising bubbles, ~38% more transparent 2026-10-11 15:50:17 +00:00
chat-test.mjs One-pill study chrome, toggling chat pickers, readable homework steps 2026-10-12 14:21:11 +00:00
freeze-loading-test.mjs Move the e2e suites into the repo (tests/), out of /tmp 2026-10-11 15:11:06 +00:00
i18n-test.mjs Move the e2e suites into the repo (tests/), out of /tmp 2026-10-11 15:11:06 +00:00
lib.mjs Infra: split dev and production (releases, services, deploy script) 2026-10-11 19:25:29 +00:00
mobile-test.mjs Ice scene: the glossy orbs become rising bubbles, ~38% more transparent 2026-10-11 15:50:17 +00:00
model-compare.mjs Chat mode, phase 1: grounded streaming chat over your notes 2026-10-11 18:32:11 +00:00
native-test.mjs App versioning + the create page's missing top padding 2026-10-12 20:04:26 +00:00
phase1-test.mjs Deck/homework writes sync themselves when sync is on 2026-10-12 16:40:49 +00:00
phase2-test.mjs Security: model budget + concurrency caps, SSRF guards, spoof-proof limits 2026-10-12 20:40:57 +00:00
phase3-test.mjs Deck/homework writes sync themselves when sync is on 2026-10-12 16:40:49 +00:00
README.md Chat mode, phase 2: local history, answer actions, motion polish 2026-10-11 19:03:48 +00:00
regression.mjs Move the e2e suites into the repo (tests/), out of /tmp 2026-10-11 15:11:06 +00:00
review-test.mjs Link loading overlay escapes the glass card (portal to body) 2026-10-12 19:04:38 +00:00
run-all.mjs Security: model budget + concurrency caps, SSRF guards, spoof-proof limits 2026-10-12 20:40:57 +00:00
security-test.mjs Security: model budget + concurrency caps, SSRF guards, spoof-proof limits 2026-10-12 20:40:57 +00:00
wizard-test.mjs App versioning + the create page's missing top padding 2026-10-12 20:04:26 +00:00

Browser suites

End-to-end checks for Freezmo, driven by Playwright against a running production build. Everything lives in this repo (nothing in /tmp), so a reboot cannot wipe the harness.

Requirements

  • The app is running on http://127.0.0.1:3207 (systemctl --user start freezmo).
  • A Chromium build. The suites auto-detect the newest Playwright Chromium in ~/.cache/ms-playwright/; override with CHROME=/path/to/chrome.
  • npm install (dev deps: playwright-core, axe-core).

Running

npm run build && systemctl --user restart freezmo   # fresh build first
npm run test:e2e                 # every suite, in order
npm run test:e2e -- phase1       # only suites whose name contains "phase1"

Each suite prints PASS/FAIL lines and exits non-zero on failure; the runner prints a per-suite summary at the end.

Suites

Suite Covers
regression.mjs Library, deck card + menu, study feed to results, homework entry, desktop shell + settings/health panel.
bubbles-test.mjs Ice-scene bubbles: stacking/layout contract, keyframes only transform+opacity, rise/sway/scale/fade phases, per-breakpoint counts (5/3/2), phone pacing, reduced motion, tab-hidden parking.
mobile-test.mjs Five-tab bar at 360/390 × EN/CS × dark/light × reduced motion (labels, targets, no hamburger/drawer), the library ⋯ sheet (Import JSON / New folder), the settings sheet (touch targets, key flow, drag-to-close, backdrop), axe contrast audits.
wizard-test.mjs Deck 3-step flow and homework flow, flat action bar, in-page mode switch, the loading lock, abort-on-leave.
native-test.mjs Manifest/PWA head, offline banner + disabled generate, share target GET + POST, Back-gesture layers, undo toast, tab re-tap, haptics, draft restore.
i18n-test.mjs EN/CS dictionary parity, locale switch, Czech desktop shell, Czech phone tab labels and plurals.
freeze-loading-test.mjs The generation loading screen appears immediately, hides the action bar, Cancel returns with the notice.
review-test.mjs Smart Review loading feedback under a stalled request, the session end-to-end, mistakes, and the health-probe cache.
phase1-test.mjs Backup export/import, persistence row, nudge, encrypted sync (enable/join/push/delete + API validation), usage-limit handling (client + a stub Ollama).
phase2-test.mjs Answer history + SRS from a real study run, review/mistakes, stats, exam mode, push reminders hidden without VAPID and validated with it.
phase3-test.mjs Check my work (API + phone/desktop UI), follow-ups, guide step explain, turn-into-a-study-deck.
chat-test.mjs Chat: streaming API (validation, allowlist, context travel, history window, thinking separation, usage-limit mapping), attachment extraction, entry points, streaming/stop, markdown + KaTeX, model/scope pickers, edit/regenerate, offline, reduced motion, plus history (IDB persistence, reload, rename/search/delete/undo, scope+model memory), assistant actions, the export payload and a two-device sync round-trip.

Extra instances

phase1, phase2 and phase3 start their own next start instance with a stub Ollama (or VAPID keys) on a spare port (3208/3209). Each suite checks the port is free first and kills the whole process group on exit, so ports do not leak between suites. Scratch data for the VAPID test lives in tests/.tmp/ (gitignored).

Diagnostics (not part of the run)

node tests/bubble-perf.mjs [label] measures the ice-scene frame cost with a CDP performance trace (rAF frame timing, long tasks, main-thread busy time, style recalcs) on a 4× throttled phone profile and a 2× desktop profile. It always exits 0; the numbers are for tuning the bubble count/speed.