From ab807faf26c06cfab7c8fc1931e99fd51d24a3b5 Mon Sep 17 00:00:00 2001 From: Gabriel Diaz Date: Thu, 21 May 2026 16:12:10 -0300 Subject: [PATCH 1/4] chore(browser): write opened URL to auth-url.txt under #if ALTTESTER Cross-stack tests in explorer-automation need the auth URL the client opens in the system browser to drive the Playwright side of the device-pairing flow. The URL is otherwise never logged, never surfaced in the Unity scene, and only readable from the system browser via osascript (CI-hostile). This patch writes the opened URL to a known file at the same moment Application.OpenURL is called, so the Playwright orchestrator can detect the auth flow has begun and navigate its own browser to the same URL. Compile-time gated to #if ALTTESTER so shipping builds have ZERO information-leak surface. Same pattern as data-testid annotations in DCL dapp tests: an explicit test affordance owned by production code, only active in instrumented builds. --- .../Browser/UnityAppWebBrowser.cs | 32 ++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs b/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs index 32928a00c52..0e532412be0 100644 --- a/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs +++ b/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs @@ -1,6 +1,9 @@ using DCL.Multiplayer.Connections.DecentralandUrls; using System; using UnityEngine; +#if ALTTESTER +using System.IO; +#endif namespace DCL.Browser { @@ -15,7 +18,34 @@ public UnityAppWebBrowser(IDecentralandUrlsSource decentralandUrlsSource) public void OpenUrl(string url) { - Application.OpenURL(Uri.EscapeUriString(url)); + var escaped = Uri.EscapeUriString(url); + Application.OpenURL(escaped); + +#if ALTTESTER + // Test-affordance: write the URL we just opened to a known path so + // AltTester-driven cross-stack tests (in + // `explorer-automation/web/tests/auth/specs/client-to-web-handoff.spec.ts`) + // can pick it up without scraping the system browser. Compile-time + // gated to ALTTESTER builds, so production binaries have zero + // information-leak surface (the `#if` strips the entire block). + // + // Same pattern as `data-testid` annotations in DCL's dapp tests: a + // small, explicit test affordance owned by production code, + // active only in instrumented builds. + try + { + var path = Path.Combine( + Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), + "Library", "Application Support", "DecentralandLauncherLight", + "auth-url.txt"); + Directory.CreateDirectory(Path.GetDirectoryName(path)!); + File.WriteAllText(path, escaped); + } + catch (Exception e) + { + Debug.LogWarning($"UnityAppWebBrowser: failed to write auth-url.txt for tests: {e}"); + } +#endif } public void OpenUrl(DecentralandUrl url) From cb0c4ae6bfe773e4bef32616aabd2c727ad1df43 Mon Sep 17 00:00:00 2001 From: Gabriel Diaz Date: Thu, 21 May 2026 19:13:49 -0300 Subject: [PATCH 2/4] chore(browser): suppress Application.OpenURL in #if ALTTESTER builds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cross-stack Playwright tests navigate to the auth URL themselves (they read auth-url.txt and drive their own Chromium). Letting Application.OpenURL also fire just pops a stale system-browser tab the test ignores — and confuses anyone watching the test run. ALTTESTER builds now only write the URL to disk; production builds retain the full system-browser open path. Compile-time gated, zero behaviour change in shipped binaries. --- .../Browser/UnityAppWebBrowser.cs | 26 ++++++++++++------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs b/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs index 0e532412be0..d4d5175690d 100644 --- a/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs +++ b/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs @@ -19,19 +19,23 @@ public UnityAppWebBrowser(IDecentralandUrlsSource decentralandUrlsSource) public void OpenUrl(string url) { var escaped = Uri.EscapeUriString(url); - Application.OpenURL(escaped); #if ALTTESTER - // Test-affordance: write the URL we just opened to a known path so - // AltTester-driven cross-stack tests (in - // `explorer-automation/web/tests/auth/specs/client-to-web-handoff.spec.ts`) - // can pick it up without scraping the system browser. Compile-time - // gated to ALTTESTER builds, so production binaries have zero - // information-leak surface (the `#if` strips the entire block). + // Test-affordance: write the URL to a known path AND skip the + // actual `Application.OpenURL` call. Cross-stack tests in + // `explorer-automation/web/tests/auth/specs/client-to-web-handoff.spec.ts` + // poll for the file, parse the URL, and drive a Playwright- + // controlled browser to the same destination. Letting the system + // browser open here would just pop a stale tab the test ignores + // (and confuse the human watching the test run). // - // Same pattern as `data-testid` annotations in DCL's dapp tests: a - // small, explicit test affordance owned by production code, - // active only in instrumented builds. + // Compile-time gated to ALTTESTER builds, so production binaries + // retain the full `Application.OpenURL` behaviour with zero + // information-leak surface — the entire block is stripped at + // compile time when ALTTESTER isn't defined. Same pattern as + // `data-testid` annotations in DCL's dapp tests: a small, explicit + // test affordance owned by production code, active only in + // instrumented builds. try { var path = Path.Combine( @@ -45,6 +49,8 @@ public void OpenUrl(string url) { Debug.LogWarning($"UnityAppWebBrowser: failed to write auth-url.txt for tests: {e}"); } +#else + Application.OpenURL(escaped); #endif } From 1a78c8227bb70318bd53f41e932878b0c2432539 Mon Sep 17 00:00:00 2001 From: Gabriel Diaz Date: Thu, 21 May 2026 21:42:12 -0300 Subject: [PATCH 3/4] chore(browser): cross-platform path + ReportHub for ALTTESTER auth-url write - switch hardcoded mac-only Library/Application Support path to Application.persistentDataPath - route I/O failures through ReportHub.LogException(ReportCategory.AUTHENTICATION) instead of Debug.LogWarning - trim verbose comment block --- .../Browser/UnityAppWebBrowser.cs | 26 ++++--------------- 1 file changed, 5 insertions(+), 21 deletions(-) diff --git a/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs b/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs index d4d5175690d..04340dad6a6 100644 --- a/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs +++ b/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs @@ -2,6 +2,7 @@ using System; using UnityEngine; #if ALTTESTER +using DCL.Diagnostics; using System.IO; #endif @@ -21,33 +22,16 @@ public void OpenUrl(string url) var escaped = Uri.EscapeUriString(url); #if ALTTESTER - // Test-affordance: write the URL to a known path AND skip the - // actual `Application.OpenURL` call. Cross-stack tests in - // `explorer-automation/web/tests/auth/specs/client-to-web-handoff.spec.ts` - // poll for the file, parse the URL, and drive a Playwright- - // controlled browser to the same destination. Letting the system - // browser open here would just pop a stale tab the test ignores - // (and confuse the human watching the test run). - // - // Compile-time gated to ALTTESTER builds, so production binaries - // retain the full `Application.OpenURL` behaviour with zero - // information-leak surface — the entire block is stripped at - // compile time when ALTTESTER isn't defined. Same pattern as - // `data-testid` annotations in DCL's dapp tests: a small, explicit - // test affordance owned by production code, active only in - // instrumented builds. + // ALTTESTER builds redirect the auth URL to disk and suppress the system browser + // so cross-stack Playwright tests can drive their own browser to the same target. try { - var path = Path.Combine( - Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), - "Library", "Application Support", "DecentralandLauncherLight", - "auth-url.txt"); - Directory.CreateDirectory(Path.GetDirectoryName(path)!); + var path = Path.Combine(Application.persistentDataPath, "auth-url.txt"); File.WriteAllText(path, escaped); } catch (Exception e) { - Debug.LogWarning($"UnityAppWebBrowser: failed to write auth-url.txt for tests: {e}"); + ReportHub.LogException(e, ReportCategory.AUTHENTICATION); } #else Application.OpenURL(escaped); From eb79cc6586f0bd9a6e87063f77156562e1baa976 Mon Sep 17 00:00:00 2001 From: Gabriel Diaz Date: Fri, 22 May 2026 12:09:46 -0300 Subject: [PATCH 4/4] chore(browser): collapse two-line comment to single line per review --- .../DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs b/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs index 04340dad6a6..5153d42aba2 100644 --- a/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs +++ b/Explorer/Assets/DCL/NetworkDefinitions/Browser/UnityAppWebBrowser.cs @@ -22,8 +22,7 @@ public void OpenUrl(string url) var escaped = Uri.EscapeUriString(url); #if ALTTESTER - // ALTTESTER builds redirect the auth URL to disk and suppress the system browser - // so cross-stack Playwright tests can drive their own browser to the same target. + // ALTTESTER builds write auth URL to disk and suppress the system browser so Playwright tests can drive their own browser to it. try { var path = Path.Combine(Application.persistentDataPath, "auth-url.txt");