57 lines
2.2 KiB
JavaScript
57 lines
2.2 KiB
JavaScript
/**
|
|
* Puppeteer auth script used by Lighthouse-CI to log in before collecting
|
|
* audits against authenticated/admin routes. The script is loaded via
|
|
* `.lighthouserc.json`'s `puppeteerScript` field; LHCI invokes it with the
|
|
* browser instance and the URL it is about to audit.
|
|
*
|
|
* Auth strategy:
|
|
* - The cookie is injected only when the audited hostname matches the
|
|
* configured cookie host. This supports host-aware tenant paths without
|
|
* ever reusing an app credential on the admin sibling host.
|
|
*
|
|
* Required env vars (set by the CI workflow):
|
|
* - `LIGHTHOUSE_SESSION_COOKIE` — value of the staging session cookie for a
|
|
* Lighthouse test user. Minted by the CI workflow before LHCI starts.
|
|
* - `LIGHTHOUSE_SESSION_COOKIE_NAME` (optional) — session cookie name.
|
|
* Defaults to `__Host-hivegrid_app_session`.
|
|
* - `LIGHTHOUSE_COOKIE_DOMAIN` (optional) — overrides the cookie domain.
|
|
* Defaults to the host of the audited URL.
|
|
*
|
|
* Refs: docs/architecture/lighthouse.md.
|
|
*/
|
|
|
|
/** @type {(browser: import('puppeteer').Browser, ctx: { url: string, options: object }) => Promise<void>} */
|
|
module.exports = async (browser, context) => {
|
|
const sessionCookie = process.env.LIGHTHOUSE_SESSION_COOKIE;
|
|
const sessionCookieName = process.env.LIGHTHOUSE_SESSION_COOKIE_NAME || "__Host-hivegrid_app_session";
|
|
const targetUrl = context && context.url ? context.url : "";
|
|
if (!targetUrl || !sessionCookie) {
|
|
return;
|
|
}
|
|
|
|
const parsed = new URL(targetUrl);
|
|
const domain = process.env.LIGHTHOUSE_COOKIE_DOMAIN || parsed.hostname;
|
|
if (parsed.hostname !== domain) {
|
|
return;
|
|
}
|
|
|
|
// Set the session cookie before LHCI navigates to the URL.
|
|
const page = await browser.newPage();
|
|
const cookie = {
|
|
name: sessionCookieName,
|
|
value: sessionCookie,
|
|
path: "/",
|
|
httpOnly: true,
|
|
secure: parsed.protocol === "https:",
|
|
};
|
|
if (sessionCookieName.startsWith("__Host-")) {
|
|
// Puppeteer must receive a URL rather than a Domain attribute; the latter
|
|
// would invalidate the browser-enforced __Host- contract.
|
|
cookie.url = parsed.origin;
|
|
} else {
|
|
cookie.domain = domain;
|
|
}
|
|
await page.setCookie(cookie);
|
|
await page.close();
|
|
};
|