jhodgkin/homelab-monitor
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Broaden e2e coverage: invalid credentials, session persistence, API auth
CI / web (push) Successful in 17s
Details
CI / api (push) Successful in 32s
Details

Browse Source 
Added: wrong-password rejection (local + OIDC), session survives a
page reload, and API-level checks that /api/hosts, /api/devices,
/api/auth/me all reject unauthenticated requests regardless of what
the UI does.

No new app bugs found this round -- one test assertion was itself
wrong (expected no session cookie on failed login; @fastify/session
issues an anonymous cookie on any response by design, that's normal).
Fixed to assert the property that actually matters: the cookie grants
no access. 9/9 tests green across 4 consecutive full-suite runs with
parallel workers, no flakiness.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
jhodgkin
2026-07-12 22:38:10 -06:00
parent 13f69ea1aa
commit 48acfcd715
3 changed files with 76 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
e2e/tests/local-login.spec.ts
+29
View File
@@ -19,3 +19,32 @@ test("local username/password login and logout", async ({ page }) => {
await page.getByRole("button", { name: "Sign out" }).click();
await expect(page.getByPlaceholder("Username")).toBeVisible();
});
test("wrong password is rejected with an error, no session", async ({ page }) => {
await page.goto("/");
await page.getByPlaceholder("Username").fill(USERNAME);
await page.getByPlaceholder("Password").fill("definitely-not-the-password");
await page.getByRole("button", { name: "Sign in" }).click();
await expect(page.getByText(/invalid credentials/i)).toBeVisible();
// Still on the login form, not the dashboard.
await expect(page.getByPlaceholder("Username")).toBeVisible();
await expect(page.locator(".host-card")).toHaveCount(0);
});
test("session persists across a page reload", async ({ page }) => {
test.skip(!PASSWORD, "LOCAL_PASSWORD not set");
await page.goto("/");
await page.getByPlaceholder("Username").fill(USERNAME);
await page.getByPlaceholder("Password").fill(PASSWORD);
await page.getByRole("button", { name: "Sign in" }).click();
await expect(page.locator(".host-card").first()).toBeVisible({ timeout: 15_000 });
await page.reload();
await expect(page.getByText(USERNAME)).toBeVisible();
await expect(page.locator(".host-card").first()).toBeVisible({ timeout: 15_000 });
await page.getByRole("button", { name: "Sign out" }).click();
});