Buriburizaemon/admin-frontend-domain
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/admin-frontend-domain.git synced 2026-09-19 17:50:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(e2e): send CSRF token on mutating requests and fix PAT UI selectors

Browse Source 
The backend CSRF double-submit gate rejects unsafe methods unless
X-CSRF-Token mirrors the signed nz-csrf cookie. page.request bypasses the
SPA JS that does this, so every mutating E2E call got 403, failing the suite.

- Add csrfHeaders(page) helper that mirrors the nz-csrf cookie into the
  header, polling until the cookie is readable to avoid the post-login race.
- Apply it to all cookie-authenticated POST/PATCH/DELETE calls (the /mcp
  Bearer calls stay header-free since PAT requests are CSRF-exempt).
- loginAs waits for the nz-csrf cookie before returning.
- Fix the create-token dialog submit selector: the button is labelled
  'Create API token' (t('CreateApiToken')), not 'Create'.

Verified 8/8 passing across repeated CI-mode runs against a real backend.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
This commit is contained in:
naiba
2026-05-31 08:17:15 +00:00
co-authored by cloudcode
parent c9bed85a91
commit 76b9eb6a54
6 changed files with 59 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/e2e/visibility.spec.ts
+7 -2
View File
@@ -1,6 +1,6 @@
import { expect } from "@playwright/test"
import { test } from "./fixtures"
import { csrfHeaders, test } from "./fixtures"
test("server-group hides guest-empty groups from anonymous callers", async ({ adminPage: page, browser }) => {
const tag = Date.now().toString(36)
@@ -18,12 +18,14 @@ test("server-group hides guest-empty groups from anonymous callers", async ({ ad
const createdGroupIDs: number[] = []
if (publicServer) {
const visibleResp = await page.request.post("/api/v1/server-group", {
headers: await csrfHeaders(page),
data: { name: visibleName, servers: [publicServer.id] },
})
expect(visibleResp.ok()).toBeTruthy()
createdGroupIDs.push(((await visibleResp.json()) as { data: number }).data)
}
const hiddenResp = await page.request.post("/api/v1/server-group", {
headers: await csrfHeaders(page),
data: { name: hiddenName, servers: [] },
})
expect(hiddenResp.ok()).toBeTruthy()
@@ -47,7 +49,10 @@ test("server-group hides guest-empty groups from anonymous callers", async ({ ad
}
} finally {
if (createdGroupIDs.length > 0) {
await page.request.post("/api/v1/batch-delete/server-group", { data: createdGroupIDs })
await page.request.post("/api/v1/batch-delete/server-group", {
headers: await csrfHeaders(page),
data: createdGroupIDs,
})
}
}
})