jhodgkin/lisilou-portfolio
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

Add Authentik OIDC auth (issue #10) + client portal /my-bookings (issue #13)

Browse Source 
- api/auth.js: zero-dep OIDC authorization-code flow with PKCE against
  Authentik; HMAC-signed HttpOnly session cookies (SESSION_SECRET)
- requireAdmin now accepts an OIDC session in the admin group; legacy
  ADMIN_SECRET bearer kept for n8n and scripts
- New client endpoints: GET /api/my-bookings, owner-gated contract download
- Bookings created while signed in are bound to the client's OIDC sub
- Dashboard: "Sign in with SSO" alongside passphrase fallback
- New /my-bookings portal page (nginx route + themed page)
- Fix booking modal: content area now scrolls; nav no longer overlaps the
  calendar on short viewports (was swallowing clicks on date cells)
- 10 new Playwright tests; suite green at 67

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Jerod Hodgkin
2026-07-16 00:24:57 -06:00
parent bfe374206c
commit 84fdfdfdb8
9 changed files with 647 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/dashboard.spec.js
+4 -4
View File
@@ -13,14 +13,14 @@ test.describe('Admin dashboard — auth', () => {
test('wrong passphrase shows error message', async ({ page }) => {
await page.goto('/dashboard');
await page.locator('#login-input').fill('wrongpassphrase');
await page.locator('button:has-text("Sign In")').click();
await page.locator('[id=login-btn]').click();
await expect(page.locator('#login-error')).toBeVisible({ timeout: 6_000 });
});
test('correct passphrase shows the app', async ({ page }) => {
await page.goto('/dashboard');
await page.locator('#login-input').fill(ADMIN_SECRET);
await page.locator('button:has-text("Sign In")').click();
await page.locator('[id=login-btn]').click();
await expect(page.locator('#app')).toBeVisible({ timeout: 8_000 });
await expect(page.locator('#login-screen')).not.toBeVisible();
});
@@ -35,7 +35,7 @@ test.describe('Admin dashboard — auth', () => {
test('Sign Out returns to login screen', async ({ page }) => {
await page.goto('/dashboard');
await page.locator('#login-input').fill(ADMIN_SECRET);
await page.locator('button:has-text("Sign In")').click();
await page.locator('[id=login-btn]').click();
await expect(page.locator('#app')).toBeVisible({ timeout: 8_000 });
await page.locator('button:has-text("Sign Out")').click();
await expect(page.locator('#login-screen')).toBeVisible();
@@ -46,7 +46,7 @@ test.describe('Admin dashboard — panels', () => {
test.beforeEach(async ({ page }) => {
await page.goto('/dashboard');
await page.locator('#login-input').fill(ADMIN_SECRET);
await page.locator('button:has-text("Sign In")').click();
await page.locator('[id=login-btn]').click();
await expect(page.locator('#app')).toBeVisible({ timeout: 8_000 });
});