# BDR — Real-time extension testing (load a real extension, watch it get caught)

This is the **live** test: you load a real extension into Chrome and the BDR scanner catches it the
instant it installs (`chrome.management.onInstalled` → scan → dashboard, ~2 seconds). No dashboard
buttons, no inject, no waiting.

## One-time setup
1. Open **`chrome://extensions`**.
2. Toggle **Developer mode** ON (top-right).
3. Keep the SOAR dashboard open at **`localhost:3000/bdr/extensions`** (Inventory tab) — it auto-refreshes
   every ~8s, so loaded extensions appear on their own.

## The loop (per extension)
1. Click **Load unpacked** → pick one of the folders below.
2. Within ~2 seconds the BDR service worker scans it. Watch:
   - **Dashboard** → the extension appears in **Inventory** with its red risk label, and as an incident on **`/bdr`**.
   - For **block-tier** detections it's also **disabled immediately** + you get a **VIYUH OS notification**.
3. **Remove** it from `chrome://extensions` when done (it drops out of the inventory).

## What each folder triggers (live)

| Folder | Loads as | Live detection | Feature |
|--------|----------|----------------|---------|
| `aitopia-clone/` | "Aitopia – AI Assistant" | **known-malicious** | #10 |
| `fake-ublock/` | "uBlock 0rigin" | **clone-impersonation** → blocked + notified | #8 |
| `fake-chatgpt/` | "ChatGPT for Chrome – Assistant" | **ai-impersonation** (or **reputation** if its ID is on the feed) → blocked + notified | #7 / #9 |
| `risky-coupon/` | "Mega Coupon Saver" | **risky-permissions** (see note) | #2 |
| `clean-notes/` | "Simple Notes" | **sideloaded** only | #6 |
| `creep-demo/` | "Coupon Helper" | see permission-creep steps below | #3 |

### Note — every Load-unpacked extension is also "sideloaded"
A Load-unpacked extension is by definition off-store (`installType: development`), so **#6 sideload always
applies**. The dashboard badge shows the *strongest* signal: a stronger match (known-malicious, clone,
ai-impersonation, reputation) is shown instead of sideload; a plain extension (clean-notes) shows
sideload alone. So `risky-coupon` shows **sideloaded** as the headline, with **risky-permissions** in the
detection evidence — both are real.

## Features that need a slightly different live action

- **#3 Permission-creep** — load `creep-demo/` (v1 baseline). Wait ~3s for it to be scanned/snapshotted.
  Then `cp creep-demo/manifest.v2.json creep-demo/manifest.json` (v2 adds `debugger`) and hit the
  **reload ↻** on its card in `chrome://extensions`. → live **permission-creep** detection.
  *(Restore afterward: `git checkout creep-demo/manifest.json`.)*

- **#4 Allow-list / #5 Block-list** — load any folder, copy its **ID** from `chrome://extensions`, paste it
  into the **Lists** tab (Allow-list or Block-list) on the dashboard. On the next refresh the extension is
  **disabled** (block-list) or everything-else is blocked (allow-only). This is policy-driven, so it takes
  ~1 min (the policy-refresh interval), not instant.

- **#9 Reputation** — load `fake-chatgpt/`, copy its assigned ID, and (if not already) add that ID to the
  threat feed (`bdr-backend/src/services/extension-threat-feed.js`) + restart the backend. → **reputation**
  (deny-wins, blocked).

- **#11 Negative-review / #12 Unpopular** — these read the **real Chrome Web Store** page, which a
  Load-unpacked extension doesn't have. To test live, install a **real** low-rated / low-install extension
  from the Web Store (e.g. a 0★ or <1K-user extension) → "Reset → scan real" picks it up and flags it.

## Fastest live demo
Load **`fake-ublock/`** → within ~2s it's flagged **clone-impersonation**, **disabled**, and you get a
**🛡️ VIYUH BDR — extension blocked** notification. That's the whole real-time enforcement loop in one click.