jhodgkin
48acfcd715
Added: wrong-password rejection (local + OIDC), session survives a page reload, and API-level checks that /api/hosts, /api/devices, /api/auth/me all reject unauthenticated requests regardless of what the UI does. No new app bugs found this round -- one test assertion was itself wrong (expected no session cookie on failed login; @fastify/session issues an anonymous cookie on any response by design, that's normal). Fixed to assert the property that actually matters: the cookie grants no access. 9/9 tests green across 4 consecutive full-suite runs with parallel workers, no flakiness. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
51 lines
2.0 KiB
TypeScript
51 lines
2.0 KiB
TypeScript
import { test, expect } from "@playwright/test";
|
|
|
|
const USERNAME = process.env.LOCAL_USERNAME ?? "admin";
|
|
const PASSWORD = process.env.LOCAL_PASSWORD ?? "";
|
|
|
|
test("local username/password login and logout", async ({ page }) => {
|
|
test.skip(!PASSWORD, "LOCAL_PASSWORD not set");
|
|
|
|
await page.goto("/");
|
|
await expect(page.getByRole("heading", { name: "Homelab Monitor" })).toBeVisible();
|
|
|
|
await page.getByPlaceholder("Username").fill(USERNAME);
|
|
await page.getByPlaceholder("Password").fill(PASSWORD);
|
|
await page.getByRole("button", { name: "Sign in" }).click();
|
|
|
|
await expect(page.getByText(USERNAME)).toBeVisible();
|
|
await expect(page.locator(".host-card").first()).toBeVisible({ timeout: 15_000 });
|
|
|
|
await page.getByRole("button", { name: "Sign out" }).click();
|
|
await expect(page.getByPlaceholder("Username")).toBeVisible();
|
|
});
|
|
|
|
test("wrong password is rejected with an error, no session", async ({ page }) => {
|
|
await page.goto("/");
|
|
await page.getByPlaceholder("Username").fill(USERNAME);
|
|
await page.getByPlaceholder("Password").fill("definitely-not-the-password");
|
|
await page.getByRole("button", { name: "Sign in" }).click();
|
|
|
|
await expect(page.getByText(/invalid credentials/i)).toBeVisible();
|
|
// Still on the login form, not the dashboard.
|
|
await expect(page.getByPlaceholder("Username")).toBeVisible();
|
|
await expect(page.locator(".host-card")).toHaveCount(0);
|
|
});
|
|
|
|
test("session persists across a page reload", async ({ page }) => {
|
|
test.skip(!PASSWORD, "LOCAL_PASSWORD not set");
|
|
|
|
await page.goto("/");
|
|
await page.getByPlaceholder("Username").fill(USERNAME);
|
|
await page.getByPlaceholder("Password").fill(PASSWORD);
|
|
await page.getByRole("button", { name: "Sign in" }).click();
|
|
await expect(page.locator(".host-card").first()).toBeVisible({ timeout: 15_000 });
|
|
|
|
await page.reload();
|
|
|
|
await expect(page.getByText(USERNAME)).toBeVisible();
|
|
await expect(page.locator(".host-card").first()).toBeVisible({ timeout: 15_000 });
|
|
|
|
await page.getByRole("button", { name: "Sign out" }).click();
|
|
});
|