OpenCode/Flight-Ops
2
0
Fork 0
Code Issues Pull Requests Actions Activity

v1.1.0: session guard on all game routes + register + sign-in screen (ISS-107)
CI / build + unit + e2e (pull_request) Failing after 26m20s
Details

Browse Source
This commit is contained in:
kamilkrzywda
2026-09-26 14:40:56 +00:00
parent 21dd37f88c
commit b0f1bd8b67
54 changed files with 1002 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
e2e/admin.spec.ts
+24 -22
View File
@@ -1,12 +1,13 @@
import { expect, test } from '@playwright/test';
// v0.71.0 — Admin panel e2e: top-bar button → modal with login form; wrong credentials show an
// error; a session minted by the /api/test/admin-session hook (FLIGHT_TEST_HOOKS=1) authenticates
// WITHOUT the real admin password ever appearing in test code; then the generic DB grid is
// exercised end-to-end: table list → edit + save a cell (verified by an independent re-fetch) →
// add a row → delete it → logout back to the login form.
// v0.71.0 — Admin panel e2e: top-bar button → modal; wrong credentials show an error; a session
// minted by the /api/test/admin-session hook (FLIGHT_TEST_HOOKS=1) authenticates WITHOUT the real
// admin password ever appearing in test code; then the generic DB grid is exercised end-to-end:
// table list → edit + save a cell (verified by an independent re-fetch) → add a row → delete it →
// logout. v1.1.0 (ISS-107): the whole app now sits behind the sign-in screen — unauthenticated
// visitors see IT instead of the shell, and logout drops back to it.
const SESSION_KEY = 'flight.session'; // must match components/AdminPanel.tsx
const SESSION_KEY = 'flight.session'; // must match lib/authClient.ts
async function mintAdminSession(page: import('@playwright/test').Page): Promise<string> {
const res = await page.request.post('/api/test/admin-session');
@@ -14,31 +15,32 @@ async function mintAdminSession(page: import('@playwright/test').Page): Promise<
return ((await res.json()) as { sessionId: string }).sessionId;
}
test('admin panel: login form, wrong-creds error, session auth, DB grid CRUD, logout', async ({ page }) => {
test('admin panel: sign-in gate, wrong-creds error, session auth, DB grid CRUD, logout', async ({ page }) => {
await page.goto('/');
const adminBtn = page.getByTestId('admin-btn');
await expect(adminBtn).toBeVisible({ timeout: 30_000 });
// --- Open the modal: no stored session → login form.
await adminBtn.click();
const dialog = page.locator('[role="dialog"]');
await expect(dialog).toBeVisible();
await expect(page.getByTestId('admin-username')).toBeVisible();
await expect(page.getByTestId('admin-password')).toBeVisible();
// --- Unauthenticated → the sign-in screen replaces the whole shell (v1.1.0, ISS-107).
const signIn = page.getByTestId('sign-in-form');
await expect(signIn).toBeVisible({ timeout: 30_000 });
await expect(page.getByTestId('app-header')).toHaveCount(0);
// --- Wrong credentials → error line (the seeded admin's plaintext is never used here).
await page.getByTestId('admin-username').fill('kamilkrzywda');
await page.getByTestId('admin-password').fill('wrong-password-on-purpose');
await page.getByTestId('admin-login-submit').click();
await expect(page.getByTestId('admin-error')).toBeVisible({ timeout: 10_000 });
await page.getByTestId('sign-in-username').fill('kamilkrzywda');
await page.getByTestId('sign-in-password').fill('wrong-password-on-purpose');
await page.getByTestId('sign-in-submit').click();
await expect(page.getByTestId('auth-error')).toBeVisible({ timeout: 10_000 });
// --- Authenticate via the test hook + localStorage, then reopen the panel.
// --- Authenticate via the test hook + localStorage, then reload into the shell.
const sessionId = await mintAdminSession(page);
// Both values must be passed as arguments — the function runs in the browser, where Node-side
// variables are not in scope.
await page.evaluate(([key, sid]) => window.localStorage.setItem(key, sid), [SESSION_KEY, sessionId]);
// The independent re-fetch below goes through page.request → needs the header at context level.
await page.context().setExtraHTTPHeaders({ 'X-Flight-Session': sessionId });
await page.reload();
const adminBtn = page.getByTestId('admin-btn');
await expect(adminBtn).toBeVisible({ timeout: 30_000 });
// --- Open the modal: stored session is valid → straight to the table list.
await adminBtn.click();
// --- Authenticated admin → table list including packages and users.
@@ -104,8 +106,8 @@ test('admin panel: login form, wrong-creds error, session auth, DB grid CRUD, lo
await page.getByTestId(`admin-delete-${addedIdx}`).click();
await expect.poll(findUserRow, { timeout: 15_000 }).toBe(-1);
// --- Logout returns to the login form.
// --- Logout drops back to the sign-in screen (v1.1.0, ISS-107 — onLogout unmounts the shell).
await page.getByTestId('admin-logout').click();
await expect(page.getByTestId('admin-username')).toBeVisible({ timeout: 10_000 });
await expect(page.getByTestId('sign-in-form')).toBeVisible({ timeout: 10_000 });
await expect(tables).toBeHidden();
});