Add Playwright e2e tests; fix two real bugs they caught

fix: OIDC_ISSUER_URL used Authentik's LAN IP (192.168.1.208:9443). Authentik's discovery doc echoes back whichever host you query it through, so that LAN IP got baked into authorization_endpoint -- the URL the *browser* gets redirected to. Anyone off the LAN got sent to an address they couldn't reach. Authentik was already publicly exposed at auth.jerodrigged.com (pre-existing NPM proxy host); switched to that, which also has a real cert so OIDC_ALLOW_INSECURE_TLS could go back to false. Reported as "signed in via Authentik, redirected to the local IP, failed." fix: frontend's request() helper always sent Content-Type: application/json, even for logout's bodyless POST. Fastify's default JSON parser rejects an empty body under that content-type (400) -- sign-out silently failed to log the user out. curl-based testing missed this because curl doesn't set that header without -d. Caught immediately by the new Playwright local-login test. e2e/: Playwright suite for local auth and OIDC login. OIDC test uses a dedicated Authentik test user (blueprint-provisioned, never a real personal login) so the whole flow can run unattended and repeatedly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-12 22:22:34 -06:00
parent a49ce0ab5b
commit 9b5051d3ac
10 changed files with 229 additions and 10 deletions
@@ -0,0 +1,13 @@
+# Copy to .env, fill in, never commit the real one.
+
+BASE_URL=https://monitor.jerodrigged.com
+
+# Local auth (bcrypt) admin login.
+LOCAL_USERNAME=admin
+LOCAL_PASSWORD=
+
+# Dedicated Authentik test account (authentik_core.user blueprint on CT121,
+# path users/service-accounts, not a real person's login) — see
+# docs/oidc-setup.md. Never use a real personal Authentik password here.
+OIDC_USERNAME=playwright-test
+OIDC_PASSWORD=
@@ -0,0 +1,93 @@
+{
+  "name": "@homelab-monitor/e2e",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@homelab-monitor/e2e",
+      "version": "0.1.0",
+      "dependencies": {
+        "dotenv": "^16.4.7"
+      },
+      "devDependencies": {
+        "@playwright/test": "^1.49.1"
+      }
+    },
+    "node_modules/@playwright/test": {
+      "version": "1.61.1",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.61.1.tgz",
+      "integrity": "sha512-8nKv6+0RJSL9FE4jYOEGXnPeM/Hg12qZpmqzZjRh3qM0Y7c3z1mrOTfFLids72RDQYVh9WpLEfR5WdpNX4fkig==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.61.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/dotenv": {
+      "version": "16.6.1",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
+      "integrity": "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/playwright": {
+      "version": "1.61.1",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.61.1.tgz",
+      "integrity": "sha512-DWnY5o3YbLWK4GovuAVwpqL+1VwGNdUGrRr++8j8PtQQzvAVZUIMjKQ90fY689sEJZJBbZVw1rXaOKSTitkzPQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.61.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.61.1",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.61.1.tgz",
+      "integrity": "sha512-h7Qlt6m4REp25qvIdvbDtVmD4LqVXfpRxhORv9L0jzETM05p4fuPJ3dKyuSXQxDSbXnmS79HAgi9589lGSpLkg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    }
+  }
+}
@@ -0,0 +1,16 @@
+{
+  "name": "@homelab-monitor/e2e",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "test": "playwright test",
+    "test:headed": "playwright test --headed"
+  },
+  "dependencies": {
+    "dotenv": "^16.4.7"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.49.1"
+  }
+}
@@ -0,0 +1,14 @@
+import { defineConfig } from "@playwright/test";
+import "dotenv/config";
+
+export default defineConfig({
+  testDir: "./tests",
+  timeout: 30_000,
+  retries: 1,
+  reporter: [["list"]],
+  use: {
+    baseURL: process.env.BASE_URL ?? "https://monitor.jerodrigged.com",
+    trace: "retain-on-failure",
+    screenshot: "only-on-failure",
+  },
+});
@@ -0,0 +1,21 @@
+import { test, expect } from "@playwright/test";
+
+const USERNAME = process.env.LOCAL_USERNAME ?? "admin";
+const PASSWORD = process.env.LOCAL_PASSWORD ?? "";
+
+test("local username/password login and logout", async ({ page }) => {
+  test.skip(!PASSWORD, "LOCAL_PASSWORD not set");
+
+  await page.goto("/");
+  await expect(page.getByRole("heading", { name: "Homelab Monitor" })).toBeVisible();
+
+  await page.getByPlaceholder("Username").fill(USERNAME);
+  await page.getByPlaceholder("Password").fill(PASSWORD);
+  await page.getByRole("button", { name: "Sign in" }).click();
+
+  await expect(page.getByText(USERNAME)).toBeVisible();
+  await expect(page.locator(".host-card").first()).toBeVisible({ timeout: 15_000 });
+
+  await page.getByRole("button", { name: "Sign out" }).click();
+  await expect(page.getByPlaceholder("Username")).toBeVisible();
+});
@@ -0,0 +1,33 @@
+import { test, expect } from "@playwright/test";
+
+const USERNAME = process.env.OIDC_USERNAME ?? "playwright-test";
+const PASSWORD = process.env.OIDC_PASSWORD ?? "";
+
+test("OIDC login via Authentik stays on public domains throughout", async ({ page }) => {
+  test.skip(!PASSWORD, "OIDC_PASSWORD not set");
+
+  await page.goto("/");
+  const oidcButton = page.getByRole("link", { name: "Sign in with Authentik" });
+  await expect(oidcButton).toBeVisible();
+  await oidcButton.click();
+
+  // Regression check for the actual bug reported: the authorization endpoint
+  // must be the public auth.jerodrigged.com, never a LAN IP a browser off the
+  // LAN can't reach.
+  await page.waitForURL(/^https:\/\/auth\.jerodrigged\.com\//, { timeout: 10_000 });
+  expect(page.url()).not.toMatch(/192\.168\./);
+
+  await page.getByPlaceholder(/email or username/i).fill(USERNAME);
+  await page.getByRole("button", { name: /log in|continue|next/i }).click();
+
+  await page.getByLabel(/password/i).fill(PASSWORD);
+  await page.getByRole("button", { name: /log in|continue|sign in/i }).click();
+
+  await page.waitForURL(/^https:\/\/monitor\.jerodrigged\.com\//, { timeout: 15_000 });
+  expect(page.url()).not.toMatch(/192\.168\./);
+
+  await expect(page.locator(".host-card").first()).toBeVisible({ timeout: 15_000 });
+
+  await page.getByRole("button", { name: "Sign out" }).click();
+  await expect(page.getByPlaceholder("Username")).toBeVisible();
+});