From cae8b7fc7ea59a296e1934bd1659b7d0feb9e0be Mon Sep 17 00:00:00 2001 From: jhodgkin Date: Sun, 12 Jul 2026 22:38:25 -0600 Subject: [PATCH] docs: update e2e/README.md coverage list Co-Authored-By: Claude Sonnet 5 --- e2e/README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/e2e/README.md b/e2e/README.md index 5e844a5..3290c2c 100644 --- a/e2e/README.md +++ b/e2e/README.md @@ -25,6 +25,19 @@ These hit the live production dashboard and a live Authentik instance, and need credentials as secrets — deliberately not run automatically on every push. Run by hand after auth-related changes. +## Coverage + +- `local-login.spec.ts` — happy path (login/logout), wrong password rejected, session + survives a page reload. +- `oidc-login.spec.ts` — happy path through a real Authentik login, wrong password + rejected (stays on Authentik, never reaches the dashboard). +- `api-auth.spec.ts` — `/api/hosts`, `/api/devices`, `/api/auth/me` all reject + unauthenticated requests; a failed login grants no access even though a session + cookie gets issued (that's normal `@fastify/session` behavior, not a leak — what + matters is whether the cookie carries authentication, which it doesn't). + +9 tests, confirmed stable across repeated full-suite runs with parallel workers. + ## Bugs these caught on first write (all fixed, kept as regression coverage) 1. **Local logout silently failed.** Frontend always sent `Content-Type: