potiuk opened a new pull request, #68:
URL: https://github.com/apache/comdev/pull/68
With `PONYMAIL_BROWSER_PROFILE=persistent`, the `login` browser profile is
kept between logins so the browser's password manager can save the ASF
password. It also kept the profile's cookies, including the ASF OAuth session.
So a later `login` could complete without the password or 2FA, and anything
able to start the browser on that profile could do the same.
This change clears the kept profile's cookies at the end of every login, on
success, failure and timeout alike. Saved passwords are stored separately from
cookies, so they survive. The PonyMail session cookie has already been copied
to `session.json` at that point, so the current session is unaffected. The next
`login` fills in the saved password and asks for 2FA again.
- `browser-login.js`:
- `shutDown()` sends `Storage.clearCookies` over the DevTools pipe before
`Browser.close`, bounded to 2 s so a browser that does not answer cannot stall
the close.
- That cannot run when the user closed the window themselves, so
`clearCookieStore()` also deletes the cookie files (`Cookies`,
`Network/Cookies` and their journals, in `Default` and every `Profile N`), both
after the browser exits and before the next one starts. `Login Data`, where
saved passwords live, is left alone.
- The deletion is skipped while a running browser holds the profile, so a
live cookie database is never pulled out from under it. On macOS and Linux that
means a `SingletonLock` naming a live process on this host; a lock left by a
crash does not count. On Windows it means a `lockfile` that cannot be deleted.
- Startup fails closed: when the cleanup is skipped or a delete fails,
`login` refuses to launch the kept profile and asks the user to close any
window still using it.
- A kept profile is launched with `--profile-directory=Default`. A
throwaway profile is still deleted, as before.
- `auth.test.js`: the fake browser answers `Storage.clearCookies` and writes
a cookie file and a `Login Data` file into its profile. The persistent-profile
test asserts that `Storage.clearCookies` is sent right before `Browser.close`,
the cookie file is gone afterwards, `Login Data` is kept, and
`--profile-directory=Default` is passed. The throwaway-profile test asserts
that `Storage.clearCookies` is not sent. The persistent test fails without the
`browser-login.js` change.
- `browser-login.test.js`: `clearCookieStore()` removes the four cookie
files in `Default` and in `Profile 1`, keeps `Login Data`, is a no-op on an
empty profile, leaves a profile held by a live process alone, and cleans one
whose lock was left by a crash. `loginInBrowser` rejects a kept profile it
cannot clear, without launching a browser.
- `index.js`, `README.md`: describe the kept profile as saving the password
only, with 2FA still asked on every login.
Known limits: if a crashed browser's PID is reused by another process,
`login` stays refused until that process exits. Two concurrent logins sharing
one kept profile are not serialised.
Tested with `npm test` in `mcp/ponymail-mcp` (94 pass).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
