bot-hermes
a60b75f075
Phase 0 (CI/CD): fix root typecheck to cover api+worker+web; reconcile migration story into idempotent db:migrate (db:sync + db:triggers); add Gitea Actions quality/deploy/smoke workflow; rewrite README/AGENTS/DEPLOY docs; add requireWorkspaceAccess + recordActivityForEntity conventions. Phase 1 (critical fixes): calendar delete + drag/resize DnD; canvas card CRUD + bulk save + debounced autosave; logout route; graph edge workspaceId derivation; real analytics endpoints (drop Math.random); task board droppable columns + reorder persistence; Tiptap notes editor with sanitized HTML rendering; remove insecure passkey auth; domain/owner scoping (IDOR) on all by-ID routes + search/ export/realtime scoping; command palette routing + agent mention fetch; agent activity SSE handler; graph fly-to with tracked positions. Phase 2 (UX polish): login on design system; Sonner toasts app-wide; shared Loading/Empty/Error state components; working density/sidebarPos/reduce-motion settings; Inter typography; consolidated status-colors lib; unified detail routes; dashboard sort/realtime/responsive fixes; mobile responsive; a11y (radiogroups, sanitized snippets, badge labels). Phase 3 (features): daily notes timezone fix + delete + autosave + mood/energy create; active-domain store + topbar picker; graph domain picker + navigable entity links; tag assign/remove UI + server-side tag filter; real CSV export + import validation; custom fields on tasks. Phase 4 (advanced): migrate job worker into apps/worker (webhook delivery with HMAC, recurring spawn, ai_dispatch disabled); webhook queue helper + entity event enqueuing + test endpoint fix; recurring scheduledJobs pipeline; agents CRUD + permission editing + activity filters; real notifications feed; MCP polish (validation, error codes, domain scoping, dead sql leftover). Phase 5 (E2E + docs): rewrite Playwright suite for the Vite SPA (15 specs, new auth helpers, chromium-only in CI); add ephemeral-Postgres e2e CI job; rewrite docs/API.md for the real Hono API.
66 lines
2.6 KiB
TypeScript
66 lines
2.6 KiB
TypeScript
import { test, expect } from '@playwright/test';
|
|
import { login, logout, goToLogin } from './helpers/auth';
|
|
import { TEST_USER, INVALID_USER } from './helpers/fixtures';
|
|
|
|
test.describe('Authentication Flow', () => {
|
|
test('logs in with valid credentials and redirects to the dashboard', async ({ page }) => {
|
|
await goToLogin(page);
|
|
|
|
// The login page renders a Card titled "Sign in".
|
|
await expect(page.getByRole('heading', { name: 'Sign in' })).toBeVisible();
|
|
await expect(page.getByRole('button', { name: /sign in/i })).toBeVisible();
|
|
|
|
await page.getByLabel('Email').fill(TEST_USER.email);
|
|
await page.getByLabel('Password').fill(TEST_USER.password);
|
|
await page.getByRole('button', { name: /sign in/i }).click();
|
|
|
|
// Successful login navigates to the "/" dashboard.
|
|
await page.waitForURL('**/', { timeout: 15_000 });
|
|
await expect(page.getByRole('heading', { name: /dashboard/i })).toBeVisible();
|
|
});
|
|
|
|
test('shows an error for invalid credentials', async ({ page }) => {
|
|
await goToLogin(page);
|
|
|
|
await page.getByLabel('Email').fill(INVALID_USER.email);
|
|
await page.getByLabel('Password').fill(INVALID_USER.password);
|
|
await page.getByRole('button', { name: /sign in/i }).click();
|
|
|
|
// Stay on the login page and surface the API error in a role="alert" box.
|
|
await expect(page).toHaveURL(/\/login/);
|
|
await expect(page.getByRole('alert')).toContainText('Invalid email or password', {
|
|
timeout: 10_000,
|
|
});
|
|
});
|
|
|
|
test('logs out from the user menu and returns to the login page', async ({ page }) => {
|
|
await login(page);
|
|
await expect(page.getByRole('heading', { name: /dashboard/i })).toBeVisible();
|
|
|
|
// The topbar avatar dropdown works on every viewport (the sidebar user menu
|
|
// is desktop-only), so use it for the logout flow.
|
|
const avatarButton = page.getByRole('banner').getByRole('button').last();
|
|
await avatarButton.click();
|
|
await page.getByRole('menuitem', { name: /log out/i }).click();
|
|
|
|
await page.waitForURL('**/login', { timeout: 15_000 });
|
|
await expect(page.getByRole('heading', { name: 'Sign in' })).toBeVisible();
|
|
});
|
|
|
|
test('keeps the session after a page reload', async ({ page }) => {
|
|
await login(page);
|
|
|
|
await page.reload();
|
|
|
|
await expect(page.getByRole('heading', { name: /dashboard/i })).toBeVisible();
|
|
});
|
|
|
|
test('redirects unauthenticated users from protected pages to login', async ({ page }) => {
|
|
await logout(page);
|
|
|
|
await page.goto('/tasks');
|
|
await page.waitForURL('**/login', { timeout: 15_000 });
|
|
await expect(page).toHaveURL(/\/login/);
|
|
});
|
|
});
|