The Authentik blueprint that provisions the OAuth2 Provider/Application only
lived on CT121's filesystem via ad-hoc scp/pct push -- deploy/authentik/ is
now the source of truth, with redeploy steps in docs/oidc-setup.md.
Also documents two bugs found and fixed while implementing issue #19: the
first RP-Initiated Logout attempt only ended the app-scoped session, and the
provider had no property_mappings so the ID token's username claim was
missing (fell back to a raw sub hash that looked like a leaked session
token). Both are covered by new Playwright regression tests.
The deep-check Fingerbank test now skips instead of failing when its target
device (192.168.1.106) has since been manually labeled known via the
dashboard, rather than assuming it stays unlabeled forever.
- deep-check.spec.ts: new test asserting a Fingerbank ID + confidence
label appears (targets the Nintendo device specifically, skips if
it's not currently on the network -- not something the test suite
controls). First run false-skipped because it checked row.count()
before waiting for the device table to actually render.
- device-ratio.spec.ts: badge counts and displayed text were read as
two separate one-shot queries (.count()/.textContent() don't
auto-retry like expect() matchers), which raced a background poll
once and failed. Wrapped the whole comparison in expect().toPass()
so it retries atomically instead. Confirmed fixed: 4/4 clean runs
with retries disabled.
15/15 e2e tests green across 8 spec files.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Verified via real HTTP path (not just the direct SSH test done while
building it): correctly identified Home Assistant via SSDP, 400 on
malformed IP, 401 unauthenticated, clean empty result for a device
with nothing to find (Echo-type devices deliberately minimize their
LAN footprint -- expected, not a bug).
Fixed the same substring-matching mistake caught earlier in
device-labeling.spec.ts, this time on "known" being a substring of
"unknown" -- switched to matching .device-badge.known specifically.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
jhodgkin