test_qt_aad_auth_helper Namespace Reference

Data Structures
class	HelperProcess
class	RedirectHandler

Functions
	skip (message)
	fail (message)
	main ()

Variables
int	HELLO_TIMEOUT = 20
int	REQUEST_TIMEOUT = 20
int	SKIP_EXIT_CODE = 125
str	BROKER_TARGET = "ms-appx-web://microsoft.aad.brokerplugin/test-client-id?code=TESTCODE123"

Detailed Description

Drives the real freerdp-qt-aad-helper binary over its JSON-RPC protocol (see
client/common/aad-auth-helper-protocol.md) against a local HTTP redirect fixture, under
QT_QPA_PLATFORM=offscreen. The protocol travels over a dedicated pair of pipes handed to the
helper via --cmdInFd=/--cmdOutFd= command line arguments (not stdin/stdout - see
client/common/aad_helper.c), so this test builds those pipes itself and passes them the same way
FreeRDP does (see HelperProcess below for the platform-specific handle encoding/inheritance).

This exists to catch, as a regression test, two bugs found while developing the helper: AAD's
native-broker redirect_uri uses the non-standard "ms-appx-web" scheme, which QtWebEngine (1)
never surfaces to navigationRequested() at all unless the scheme is registered first (Chromium
instead hands it off to the desktop environment and the redirect is lost), and (2) - even once
registered - refused with net::ERR_UNSAFE_REDIRECT to let a real https-shaped redirect into it
unless the scheme is also flagged CORS-enabled (see kBrokerScheme's comment in main.cpp for
both). A plain http(s) redirect_uri is exercised too, as a regression check that fix didn't
break the common case.

If the helper doesn't answer the initial "hello" handshake at all, the environment is assumed
unable to run Qt WebEngine (e.g. a minimal CI image missing GL/X11 libs) and the test is skipped
rather than failed.

Function Documentation

fail()

test_qt_aad_auth_helper.fail

(

message

)

Definition at line 169 of file test_qt_aad_auth_helper.py.

def fail(message):
    print(f"FAIL: {message}")
    sys.exit(1)
 
 

main()

test_qt_aad_auth_helper.main

(

void

)

Definition at line 174 of file test_qt_aad_auth_helper.py.

def main():
    if len(sys.argv) != 2:
        fail("usage: test_qt_aad_auth_helper.py <path-to-freerdp-qt-aad-helper>")
    helper_path = sys.argv[1]
    if not os.path.isfile(helper_path):
        fail(f"helper binary not found: {helper_path}")
 
    server = http.server.HTTPServer(("127.0.0.1", 0), RedirectHandler)
    server.last_user_agent = None
    port = server.server_port
    server_thread = threading.Thread(target=server.serve_forever, daemon=True)
    server_thread.start()
 
    env = dict(os.environ)
    env["QT_QPA_PLATFORM"] = "offscreen"
    env["QT_QUICK_BACKEND"] = "software"
    env["QTWEBENGINE_CHROMIUM_FLAGS"] = "--disable-gpu --disable-software-rasterizer"
 
    helper = HelperProcess(helper_path, env)
    try:
        try:
            hello = helper.request(
                "hello", {"protocol_version": 1, "client": "freerdp"}, timeout=HELLO_TIMEOUT
            )
        except TimeoutError:
            skip("helper did not answer 'hello' - environment likely can't run Qt WebEngine")
        if "error" in hello:
            fail(f"hello returned an error: {hello['error']}")
        print(f"hello ok: {hello['result']}")
 
        # Case 1: real HTTP redirect into AAD's ms-appx-web native-broker scheme - the exact
        # shape that broke twice during development (scheme not observed at all, then
        # ERR_UNSAFE_REDIRECT).
        nav = helper.request(
            "navigate",
            {
                "title": "test",
                "url": f"http://127.0.0.1:{port}/redirect",
                "redirect_uri": "ms-appx-web://microsoft.aad.brokerplugin/test-client-id",
                "timeout_ms": REQUEST_TIMEOUT * 1000,
            },
        )
        if "error" in nav:
            fail(f"navigate (broker redirect) failed: {nav['error']}")
        got = nav["result"].get("redirect_url")
        if got != BROKER_TARGET:
            fail(f"navigate (broker redirect): expected {BROKER_TARGET!r}, got {got!r}")
        print("broker redirect ok")
 
        # Case 2: plain http(s)-shaped redirect_uri - regression check, must keep working.
        plain_url = f"http://127.0.0.1:{port}/"
        nav2 = helper.request(
            "navigate",
            {
                "title": "test",
                "url": plain_url,
                "redirect_uri": plain_url,
                "timeout_ms": REQUEST_TIMEOUT * 1000,
            },
        )
        if "error" in nav2:
            fail(f"navigate (plain redirect_uri) failed: {nav2['error']}")
        got2 = nav2["result"].get("redirect_url")
        if got2 != plain_url:
            fail(f"navigate (plain redirect_uri): expected {plain_url!r}, got {got2!r}")
        print("plain redirect_uri ok")
 
        # Case 3: no user_agent supplied -> native (QtWebEngine) UA is used. Records the native
        # UA that Case 5/6 assert is restored after an override.
        default_nav = helper.request(
            "navigate",
            {
                "title": "test",
                "url": f"http://127.0.0.1:{port}/redirect",
                "redirect_uri": "ms-appx-web://microsoft.aad.brokerplugin/test-client-id",
                "timeout_ms": REQUEST_TIMEOUT * 1000,
            },
        )
        if "error" in default_nav:
            fail(f"navigate (default UA) failed: {default_nav['error']}")
        default_ua = server.last_user_agent
        if not default_ua:
            fail("server saw no User-Agent for the default case")
        if "TestAgent/1.0" in default_ua:
            fail(f"default UA unexpectedly equals the override: {default_ua!r}")
        print(f"default UA ok: {default_ua}")
 
        # Case 4: user_agent supplied -> helper presents it verbatim.
        override_ua = "TestAgent/1.0"
        ua_nav = helper.request(
            "navigate",
            {
                "title": "test",
                "url": f"http://127.0.0.1:{port}/redirect",
                "redirect_uri": "ms-appx-web://microsoft.aad.brokerplugin/test-client-id",
                "user_agent": override_ua,
                "timeout_ms": REQUEST_TIMEOUT * 1000,
            },
        )
        if "error" in ua_nav:
            fail(f"navigate (override UA) failed: {ua_nav['error']}")
        if server.last_user_agent != override_ua:
            fail(f"expected UA {override_ua!r}, server saw {server.last_user_agent!r}")
        print("override UA ok")
 
        # Case 5: an explicitly empty user_agent must also restore the native UA (contract:
        # absent OR empty means native, even after a previous override).
        empty_nav = helper.request(
            "navigate",
            {
                "title": "test",
                "url": f"http://127.0.0.1:{port}/redirect",
                "redirect_uri": "ms-appx-web://microsoft.aad.brokerplugin/test-client-id",
                "user_agent": "",
                "timeout_ms": REQUEST_TIMEOUT * 1000,
            },
        )
        if "error" in empty_nav:
            fail(f"navigate (empty UA) failed: {empty_nav['error']}")
        if server.last_user_agent != default_ua:
            fail(
                f"expected native UA after empty override {default_ua!r}, "
                f"saw {server.last_user_agent!r}"
            )
        print("empty UA restore ok")
 
        # Case 6: override again, then omit -> native UA restored. Covers the omitted path
        # transitioning from an override, not only from the native state Case 5 left behind.
        reoverride_nav = helper.request(
            "navigate",
            {
                "title": "test",
                "url": f"http://127.0.0.1:{port}/redirect",
                "redirect_uri": "ms-appx-web://microsoft.aad.brokerplugin/test-client-id",
                "user_agent": override_ua,
                "timeout_ms": REQUEST_TIMEOUT * 1000,
            },
        )
        if "error" in reoverride_nav:
            fail(f"navigate (re-override UA) failed: {reoverride_nav['error']}")
        omitted_nav = helper.request(
            "navigate",
            {
                "title": "test",
                "url": f"http://127.0.0.1:{port}/redirect",
                "redirect_uri": "ms-appx-web://microsoft.aad.brokerplugin/test-client-id",
                "timeout_ms": REQUEST_TIMEOUT * 1000,
            },
        )
        if "error" in omitted_nav:
            fail(f"navigate (omitted UA) failed: {omitted_nav['error']}")
        if server.last_user_agent != default_ua:
            fail(f"expected native UA restored {default_ua!r}, server saw {server.last_user_agent!r}")
        print("omitted UA restore ok")
 
        shut = helper.request("shutdown")
        if shut.get("result") is not None:
            fail(f"shutdown expected a null result, got {shut}")
        helper.notify("exit")
 
        rc = helper.wait(timeout=10)
        if rc != 0:
            fail(f"helper exited with code {rc}, expected 0")
        print("shutdown/exit ok")
    finally:
        server.shutdown()
        if helper.proc.poll() is None:
            helper.proc.kill()
 
    print("PASS")
 
 

skip()

test_qt_aad_auth_helper.skip

(

message

)

Definition at line 164 of file test_qt_aad_auth_helper.py.

def skip(message):
    print(f"SKIP: {message}")
    sys.exit(SKIP_EXIT_CODE)
 
 

Variable Documentation

BROKER_TARGET

str test_qt_aad_auth_helper.BROKER_TARGET = "ms-appx-web://microsoft.aad.brokerplugin/test-client-id?code=TESTCODE123"

Definition at line 55 of file test_qt_aad_auth_helper.py.

HELLO_TIMEOUT

int test_qt_aad_auth_helper.HELLO_TIMEOUT = 20

Definition at line 51 of file test_qt_aad_auth_helper.py.

REQUEST_TIMEOUT

int test_qt_aad_auth_helper.REQUEST_TIMEOUT = 20

Definition at line 52 of file test_qt_aad_auth_helper.py.

SKIP_EXIT_CODE

int test_qt_aad_auth_helper.SKIP_EXIT_CODE = 125

Definition at line 53 of file test_qt_aad_auth_helper.py.