Import AITURK IDE 1.0.0-beta.1 from Hermes 63279301; preserve MIT license

tests-js/desktop-mac-entitlements.test.ts

@@ -0,0 +1,134 @@
+/**
+ * Regression for #37718: macOS microphone entitlement must be inherited.
+ *
+ * Hermes Desktop signs with ``hardenedRuntime: true`` and points
+ * electron-builder at two entitlement files (see ``apps/desktop/package.json``):
+ *
+ * - ``entitlements`` → ``electron/entitlements.mac.plist`` (the main app), and
+ * - ``entitlementsInherit`` → ``electron/entitlements.mac.inherit.plist``
+ *   (the Electron Helper / Setup processes).
+ *
+ * Under the hardened runtime, the process that actually opens the microphone
+ * is a Helper, which inherits the *inherit* plist.
+ * ``com.apple.security.device.audio-input`` lived only in the main plist, so
+ * macOS' TCC layer refused the microphone with:
+ *
+ *     Prompting policy for hardened runtime; service: kTCCServiceMicrophone
+ *     requires entitlement com.apple.security.device.audio-input but it is missing
+ *
+ * and never showed the permission prompt. These tests pin that every device
+ * entitlement granted to the main app is also granted to the inherited helpers.
+ *
+ * (Ported from tests/test_desktop_mac_entitlements.py — plist assertions about
+ * apps/desktop/electron/*.plist belong in the JS lane because the CI change
+ * classifier skips the Python suite on apps/-only PRs.)
+ */
+
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+
+import * as plist from 'plist'
+import { test } from 'vitest'
+
+const REPO_ROOT = path.resolve(__dirname, '..')
+const ELECTRON_DIR = path.join(REPO_ROOT, 'apps', 'desktop', 'electron')
+const MAIN_PLIST = path.join(ELECTRON_DIR, 'entitlements.mac.plist')
+const INHERIT_PLIST = path.join(ELECTRON_DIR, 'entitlements.mac.inherit.plist')
+const BOOTSTRAP_TAURI_DIR = path.join(REPO_ROOT, 'apps', 'bootstrap-installer', 'src-tauri')
+const BOOTSTRAP_TAURI_CONFIG = path.join(BOOTSTRAP_TAURI_DIR, 'tauri.conf.json')
+const BOOTSTRAP_ENTITLEMENTS = path.join(BOOTSTRAP_TAURI_DIR, 'entitlements.plist')
+const BOOTSTRAP_INFO_PLIST = path.join(BOOTSTRAP_TAURI_DIR, 'Info.plist')
+
+const DEVICE_PREFIX = 'com.apple.security.device.'
+
+function loadEntitlements(plistPath: string): Record<string, unknown> {
+  assert.ok(fs.existsSync(plistPath), `missing entitlements file: ${plistPath}`)
+  const data = plist.parse(fs.readFileSync(plistPath, 'utf-8'))
+  assert.ok(
+    typeof data === 'object' && data !== null && !Array.isArray(data),
+    `${path.basename(plistPath)} should parse to a dict`
+  )
+
+  return data as Record<string, unknown>
+}
+
+test('inherit plist grants microphone (regression #37718)', () => {
+  const inherit = loadEntitlements(INHERIT_PLIST)
+  assert.equal(
+    inherit['com.apple.security.device.audio-input'],
+    true,
+    'entitlements.mac.inherit.plist must grant ' +
+      '`com.apple.security.device.audio-input`; without it the ' +
+      'hardened-runtime Helper process is denied the microphone and no ' +
+      'TCC prompt appears (#37718).'
+  )
+})
+
+test('every device.* entitlement on the main app is also inherited', () => {
+  const main = loadEntitlements(MAIN_PLIST)
+  const inherit = loadEntitlements(INHERIT_PLIST)
+
+  const missing = Object.entries(main)
+    .filter(([key, val]) => key.startsWith(DEVICE_PREFIX) && val === true)
+    .map(([key]) => key)
+    .filter((key) => inherit[key] !== true)
+
+  assert.deepEqual(
+    missing,
+    [],
+    'Device entitlements present in entitlements.mac.plist but missing from ' +
+      `entitlements.mac.inherit.plist: ${JSON.stringify(missing)}. ` +
+      'Helper/Setup processes inherit the latter under hardenedRuntime, so ' +
+      'any device access the app needs must be listed in both (#37718).'
+  )
+})
+
+for (const plist of [MAIN_PLIST, INHERIT_PLIST]) {
+  test(`${path.basename(plist)} is a well-formed non-empty entitlement dict`, () => {
+    const data = loadEntitlements(plist)
+    assert.ok(
+      Object.keys(data).length > 0,
+      `${path.basename(plist)} should be a non-empty dict`
+    )
+  })
+}
+
+test('bootstrap installer carries microphone entitlement for launcher attribution', () => {
+  const config = JSON.parse(fs.readFileSync(BOOTSTRAP_TAURI_CONFIG, 'utf-8'))
+  assert.equal(
+    config.bundle?.macOS?.entitlements,
+    'entitlements.plist',
+    'the macOS bootstrap installer must sign with its entitlements.plist. ' +
+      'When /Applications/Hermes.app is the setup launcher, macOS TCC treats ' +
+      'com.nousresearch.hermes.setup as the responsible process for the desktop ' +
+      'app it opens; without audio-input on the setup app, microphone access is ' +
+      'denied before a permission prompt can appear.'
+  )
+
+  const entitlements = loadEntitlements(BOOTSTRAP_ENTITLEMENTS)
+  assert.equal(
+    entitlements['com.apple.security.device.audio-input'],
+    true,
+    'bootstrap installer entitlements must grant audio-input because it is the ' +
+      'TCC responsible process for the desktop app launched from the setup fast path'
+  )
+})
+
+test('bootstrap installer Info.plist explains microphone usage', () => {
+  const info = plist.parse(fs.readFileSync(BOOTSTRAP_INFO_PLIST, 'utf-8')) as Record<
+    string,
+    unknown
+  >
+
+  assert.equal(
+    typeof info.NSMicrophoneUsageDescription,
+    'string',
+    'macOS requires NSMicrophoneUsageDescription before it can prompt for microphone access'
+  )
+  assert.match(
+    info.NSMicrophoneUsageDescription as string,
+    /microphone/i,
+    'microphone usage description should be user-visible and specific'
+  )
+})