Repository navigation
feat(webdriver): W3C Actions API (key, pointer, wheel) - #13
Merged
Merged
Conversation
Extend the single global --allow-domains list into layered policies:
- internal/policy: domain rules (allow/deny, *.sub, *), principals and a
JSON --policy-file defining named tokens with their own rules, an admin
flag and a scripts permission. --deny-domains adds a global denylist.
- Auth attaches the token's principal to the request context; --token is
the admin "default" principal.
- Tab ownership: non-admin tokens only see their own tabs, get their own
per-site default tabs, and cannot adopt existing tabs.
- core.RulesPolicy checks global ∩ requester ∩ owner ∩ session rules,
re-checks the final URL, and guards restricted tabs in the browser via
the DevTools Fetch domain so redirects, clicks and page script obey the
same rules.
- API: session rules on tab create, GET/PUT /tabs/{id}/policy, /whoami.
WebDriver: tether:options.policy, ownership on every command, and
Execute Script gated by the scripts permission.
- Docs: docs/POLICIES.md, SECURITY.md, ARCHITECTURE.md, README, example
policy file. Integration test drives a real Chrome as a restricted token.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UfsJJgC4Jp8VqckdcChH4W
POST/DELETE /session/{id}/actions dispatch key, mouse, pen, touch and
wheel input as real CDP events, tick by tick, with element/pointer/viewport
origins, animated moves and scrolls, click counting, US-layout Shift, and
input state that persists until Release Actions.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EnJnokVdV3oFBMpLc45zcJ
Resolves conflicts with #7 (console logs): Tab gets both Guard and Logs, the API keeps the policy routes and adds /tabs/{id}/logs, and docs list both features. Also makes TestConsoleLogs tolerate a late favicon 404 between the two WebDriver log reads (it asserted the second read was empty; it should assert no entry repeats). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X9CEjRcHsJmgWdtz6ZTKsk
Tab gains Mouse/Touch alongside Guard and Logs; the WebDriver session keeps the log cursor and the Actions input state; docs list everything. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X9CEjRcHsJmgWdtz6ZTKsk
# Conflicts: # README.md # internal/cdp/cdptest/cdptest.go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
What
Before:
POST /session/{id}/actionsreturnedunknown command, so SeleniumActionChains(hover, drag and drop, double/context click, key chords, scroll) failed.After:
POSTandDELETE /session/{id}/actionsimplement the W3C Actions API. Key, mouse, pen, touch and wheel actions become real CDP input events, so pages see trusted events.pause, andpointerMove/scrollwithdurationanimate frame by frame.viewport,pointerand element origins (element in-view centre; off-screen elements are scrolled into view). Out-of-viewport targets givemove target out of bounds.Why
Part of the first-release feature set: "most Selenium scripts just work" needs ActionChains.
How
New
internal/webdriver/actions.goparses and validates the body (sources are only created once the whole body is valid), then dispatches through two newcdp.Tabprimitives,MouseandTouch. Touch brings the tab to the front first, because Chrome never acknowledges touch input in a background tab (the dispatch hangs).cdptest.Tabnow records input events and can return a script result, for unit tests.How tested
make checkequivalents: gofmt,go vet(with and withoutintegrationtag), golangci-lint (0 issues),go test -race ./...make test-integration: newTestWebDriverActionsagainst real headless Chrome covers double click, context click, ctrl-click, drag, shifted typing, touch tap, element below the fold, wheel scroll, out-of-bounds error and releaseSecurity
🤖 Generated with Claude Code
https://claude.ai/code/session_01EnJnokVdV3oFBMpLc45zcJ
Generated by Claude Code