fix(browser-bridge): don't send X-Verstak-Secret when empty/undefined; add integration tests

extension-firefox/background.js

@@ -175,6 +175,12 @@ function flushQueue() {
     const secret = config.secret || '';
     const deviceId = config.deviceId || DEFAULT_DEVICE_ID;
 
+    const headers = { 'Content-Type': 'application/json' };
+    // Only send secret header if it's a non-empty string
+    if (secret && typeof secret === 'string' && secret.length > 0) {
+      headers['X-Verstak-Secret'] = secret;
+    }
+
     const payload = {
       version: 1,
       device_id: 'firefox-' + deviceId,
@@ -183,10 +189,7 @@ function flushQueue() {
 
     fetch(`http://127.0.0.1:${port}/api/events`, {
       method: 'POST',
-      headers: {
+      headers,
-        'Content-Type': 'application/json',
-        'X-Verstak-Secret': secret,
-      },
       body: JSON.stringify(payload),
       signal: AbortSignal.timeout(5000),
     })

extension-firefox/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Verstak Bridge",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Отслеживает активные вкладки и отправляет события в Verstak",
   "author": "Verstak",
   "homepage_url": "https://git.mirv.top/mirivlad/verstak",

internal/core/bridge/bridge_integration_test.go

@@ -0,0 +1,144 @@
+package bridge
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"testing"
+	"time"
+)
+
+// TestServer_Events_FullFlow simulates exact browser extension behavior:
+// starts server with empty secret, sends ping, then sends events with various header configurations
+func TestServer_Events_FullFlow(t *testing.T) {
+	received := make(chan []Event, 1)
+	s := NewServer("", func(evts []Event) {
+		received <- evts
+	})
+	port, err := s.Start(Config{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Stop()
+
+	t.Logf("Server started on port %d (secret='%s')", port, s.Secret())
+
+	// Test 1: Ping
+	pingURL := fmt.Sprintf("http://127.0.0.1:%d/api/ping", port)
+	pingResp, err := http.Get(pingURL)
+	if err != nil {
+		t.Fatalf("ping failed: %v", err)
+	}
+	pingBody, _ := io.ReadAll(pingResp.Body)
+	pingResp.Body.Close()
+	t.Logf("Ping: status=%d body=%s", pingResp.StatusCode, string(pingBody))
+
+	if pingResp.StatusCode != 200 {
+		t.Fatalf("ping returned %d", pingResp.StatusCode)
+	}
+
+	// Test 2: Events WITHOUT any secret header (extension sends nothing when secret is empty)
+	events := []Event{
+		{ID: "evt_test_1", Type: "page_visit", URL: "https://example.com", Domain: "example.com", ActiveSeconds: 120},
+	}
+	batch := EventBatch{Version: 1, DeviceID: "firefox-test", Events: events}
+	b, _ := json.Marshal(batch)
+
+	eventsURL := fmt.Sprintf("http://127.0.0.1:%d/api/events", port)
+	req, _ := http.NewRequest("POST", eventsURL, bytes.NewReader(b))
+	req.Header.Set("Content-Type", "application/json")
+	// No X-Verstak-Secret header at all — empty secret on server should allow this
+
+	t.Logf("Sending %d events to %s (no auth header)", len(events), eventsURL)
+	t.Logf("Payload: %s", string(b))
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("events request failed: %v", err)
+	}
+	respBody, _ := io.ReadAll(resp.Body)
+	resp.Body.Close()
+
+	t.Logf("Events response: status=%d body=%s", resp.StatusCode, string(respBody))
+
+	if resp.StatusCode != 200 {
+		t.Errorf("expected 200, got %d. Body: %s", resp.StatusCode, string(respBody))
+	}
+
+	select {
+	case evts := <-received:
+		t.Logf("SUCCESS: handler received %d events", len(evts))
+	case <-time.After(2 * time.Second):
+		t.Fatal("TIMEOUT: handler did not receive events")
+	}
+
+	// Test 3: Events WITH undefined secret header (simulating JS undefined)
+	req2, _ := http.NewRequest("POST", eventsURL, bytes.NewReader(b))
+	req2.Header.Set("Content-Type", "application/json")
+	req2.Header.Set("X-Verstak-Secret", "undefined")  // JS: header when secret is undefined
+
+	resp2, err := http.DefaultClient.Do(req2)
+	if err != nil {
+		t.Fatalf("events request 2 failed: %v", err)
+	}
+	respBody2, _ := io.ReadAll(resp2.Body)
+	resp2.Body.Close()
+
+	t.Logf("Events with 'undefined' secret: status=%d body=%s", resp2.StatusCode, string(respBody2))
+
+	if resp2.StatusCode != 200 {
+		t.Errorf("expected 200 with 'undefined' secret, got %d", resp2.StatusCode)
+	}
+
+	// Test 4: Events WITH empty string secret header
+	req3, _ := http.NewRequest("POST", eventsURL, bytes.NewReader(b))
+	req3.Header.Set("Content-Type", "application/json")
+	req3.Header.Set("X-Verstak-Secret", "")
+
+	resp3, err := http.DefaultClient.Do(req3)
+	if err != nil {
+		t.Fatalf("events request 3 failed: %v", err)
+	}
+	respBody3, _ := io.ReadAll(resp3.Body)
+	resp3.Body.Close()
+
+	t.Logf("Events with empty secret: status=%d body=%s", resp3.StatusCode, string(respBody3))
+
+	if resp3.StatusCode != 200 {
+		t.Errorf("expected 200 with empty secret, got %d", resp3.StatusCode)
+	}
+}
+
+// TestServer_Events_WithTimeout tests that the server responds within timeout
+func TestServer_Events_WithTimeout(t *testing.T) {
+	s := NewServer("", func(evts []Event) {})
+	port, err := s.Start(Config{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Stop()
+
+	batch := EventBatch{Version: 1, DeviceID: "test", Events: []Event{{ID: "1", Type: "page_visit"}}}
+	b, _ := json.Marshal(batch)
+
+	client := &http.Client{Timeout: 3 * time.Second}
+	req, _ := http.NewRequest("POST", fmt.Sprintf("http://127.0.0.1:%d/api/events", port), bytes.NewReader(b))
+	req.Header.Set("Content-Type", "application/json")
+
+	start := time.Now()
+	resp, err := client.Do(req)
+	elapsed := time.Since(start)
+
+	if err != nil {
+		t.Fatalf("request timed out after %v: %v", elapsed, err)
+	}
+	resp.Body.Close()
+
+	t.Logf("Response: %d in %v", resp.StatusCode, elapsed)
+
+	if resp.StatusCode != 200 {
+		t.Errorf("expected 200, got %d", resp.StatusCode)
+	}
+}

internal/core/bridge/bridge_nosecret_test.go

@@ -0,0 +1,156 @@
+package bridge
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+)
+
+// TestServer_Events_NoSecret tests the exact scenario from the browser extension:
+// server with empty secret, POST /api/events without X-Verstak-Secret header
+func TestServer_Events_NoSecret(t *testing.T) {
+	received := make(chan []Event, 1)
+	s := NewServer("", func(evts []Event) {
+		received <- evts
+	})
+	port, err := s.Start(Config{Secret: ""})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Stop()
+
+	events := []Event{
+		{ID: "evt_1", Type: "page_visit", URL: "https://example.com", Title: "Example", Domain: "example.com", ActiveSeconds: 120},
+	}
+	batch := EventBatch{Version: 1, DeviceID: "firefox-test", Events: events}
+	b, _ := json.Marshal(batch)
+
+	// Exactly what the browser extension does: POST without X-Verstak-Secret
+	req, _ := http.NewRequest("POST", fmt.Sprintf("http://127.0.0.1:%d/api/events", port), bytes.NewReader(b))
+	req.Header.Set("Content-Type", "application/json")
+	// NOTE: No X-Verstak-Secret header — extension doesn't send it when secret is empty
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	t.Logf("Status: %d", resp.StatusCode)
+
+	if resp.StatusCode != 200 {
+		t.Errorf("expected 200, got %d", resp.StatusCode)
+	}
+
+	select {
+	case evts := <-received:
+		if len(evts) != 1 {
+			t.Errorf("expected 1 event, got %d", len(evts))
+		}
+		if evts[0].ID != "evt_1" {
+			t.Errorf("expected event ID 'evt_1', got %s", evts[0].ID)
+		}
+		t.Logf("Handler received %d events", len(evts))
+	case <-time.After(2 * time.Second):
+		t.Fatal("timeout waiting for event handler")
+	}
+}
+
+// TestServer_Events_WithEmptySecretHeader tests what happens when extension
+// sends X-Verstak-Secret: "" (empty string) — some versions do this
+func TestServer_Events_WithEmptySecretHeader(t *testing.T) {
+	received := make(chan []Event, 1)
+	s := NewServer("", func(evts []Event) {
+		received <- evts
+	})
+	port, err := s.Start(Config{Secret: ""})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Stop()
+
+	events := []Event{
+		{ID: "evt_2", Type: "page_visit", URL: "https://test.com", Domain: "test.com"},
+	}
+	batch := EventBatch{Version: 1, DeviceID: "firefox-test", Events: events}
+	b, _ := json.Marshal(batch)
+
+	req, _ := http.NewRequest("POST", fmt.Sprintf("http://127.0.0.1:%d/api/events", port), bytes.NewReader(b))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-Verstak-Secret", "")  // Extension sends empty secret
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	t.Logf("Status: %d", resp.StatusCode)
+
+	if resp.StatusCode != 200 {
+		t.Errorf("expected 200, got %d", resp.StatusCode)
+	}
+
+	select {
+	case evts := <-received:
+		t.Logf("Handler received %d events", len(evts))
+	case <-time.After(2 * time.Second):
+		t.Fatal("timeout waiting for event handler")
+	}
+}
+
+// TestServer_Ping_Then_Events simulates the exact flow: ping first, then send events
+func TestServer_Ping_Then_Events(t *testing.T) {
+	received := make(chan []Event, 1)
+	s := NewServer("", func(evts []Event) {
+		received <- evts
+	})
+	port, err := s.Start(Config{Secret: ""})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Stop()
+
+	// Step 1: Ping (like extension does)
+	pingResp, err := http.Get(fmt.Sprintf("http://127.0.0.1:%d/api/ping", port))
+	if err != nil {
+		t.Fatalf("ping failed: %v", err)
+	}
+	pingResp.Body.Close()
+	if pingResp.StatusCode != 200 {
+		t.Fatalf("ping returned %d", pingResp.StatusCode)
+	}
+	t.Log("Ping OK")
+
+	// Step 2: Send events (like extension does after ping)
+	events := []Event{
+		{ID: "evt_3", Type: "page_visit", URL: "https://flow-test.com", Domain: "flow-test.com", ActiveSeconds: 60},
+	}
+	batch := EventBatch{Version: 1, DeviceID: "firefox-abc123", Events: events}
+	b, _ := json.Marshal(batch)
+
+	req, _ := http.NewRequest("POST", fmt.Sprintf("http://127.0.0.1:%d/api/events", port), bytes.NewReader(b))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("events request failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	t.Logf("Events status: %d", resp.StatusCode)
+
+	if resp.StatusCode != 200 {
+		t.Errorf("expected 200, got %d", resp.StatusCode)
+	}
+
+	select {
+	case evts := <-received:
+		t.Logf("Handler received %d events", len(evts))
+	case <-time.After(2 * time.Second):
+		t.Fatal("timeout waiting for event handler")
+	}
+}