From bba5a8c44a14afe6a8a78a246922c4b7431bb74f Mon Sep 17 00:00:00 2001
From: naiba <hi@nai.ba>
Date: Sun, 31 May 2026 08:45:19 +0000
Subject: [PATCH] test(e2e): fix revoke empty-list crash and password-restore
 CSRF cascade

Two CI-only failures surfaced against a fresh backend DB:

- The revoke test read after.data.find(), but the list endpoint omits data
  entirely when the admin has zero tokens, throwing on undefined. Default to [].
- The password-change test's restore POST hit a 403: changing the password
  triggers a refresh-token that re-mints the nz-csrf cookie, so the X-CSRF-Token
  read just before the request can be stale. A failed restore left the admin on
  the rotated password and cascaded into cron/fm/visibility login failures.
  Add csrfRequest(), which retries once on 403 after re-reading the cookie, and
  use it for both profile mutations.

Verified 8/8 passing across repeated fresh-DB CI-mode runs.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
---
 tests/e2e/api-tokens.spec.ts |  5 ++++-
 tests/e2e/auth.spec.ts       |  8 +++-----
 tests/e2e/fixtures.ts        | 23 +++++++++++++++++++++++
 3 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/tests/e2e/api-tokens.spec.ts b/tests/e2e/api-tokens.spec.ts
index b3b2d78..f5ce45d 100644
--- a/tests/e2e/api-tokens.spec.ts
+++ b/tests/e2e/api-tokens.spec.ts
@@ -58,8 +58,11 @@ test("admin can revoke an API token via UI revoke button", async ({ page }) => {
 
     await expect(row).toHaveCount(0)
 
+    // The list endpoint omits `data` entirely when the admin has zero tokens,
+    // so default to [] before searching for the revoked id.
     const after = await page.request.get("/api/v1/api-tokens").then((r) => r.json())
-    expect(after.data.find((t: { id: number }) => t.id === tokenID)).toBeUndefined()
+    const tokens: Array<{ id: number }> = after.data ?? []
+    expect(tokens.find((t) => t.id === tokenID)).toBeUndefined()
 })
 
 test("an API token can authenticate /mcp", async ({ page }) => {
diff --git a/tests/e2e/auth.spec.ts b/tests/e2e/auth.spec.ts
index c07cbfd..1e3aae7 100644
--- a/tests/e2e/auth.spec.ts
+++ b/tests/e2e/auth.spec.ts
@@ -1,6 +1,6 @@
 import { expect } from "@playwright/test"
 
-import { csrfHeaders, defaultAdmin, expectAuthenticated, expectUnauthenticated, loginAs, test } from "./fixtures"
+import { csrfRequest, defaultAdmin, expectAuthenticated, expectUnauthenticated, loginAs, test } from "./fixtures"
 
 test("login persists session via cookie and getProfile succeeds", async ({ page }) => {
     await loginAs(page, defaultAdmin)
@@ -17,8 +17,7 @@ test("password change rotates TokenVersion and revokes existing session", async
     const newPassword = `e2e-${Date.now().toString(36)}`
     let isOnNewPassword = false
     try {
-        const resp = await page.request.post("/api/v1/profile", {
-            headers: await csrfHeaders(page),
+        const resp = await csrfRequest(page, "post", "/api/v1/profile", {
             data: {
                 original_password: defaultAdmin.password,
                 new_password: newPassword,
@@ -44,8 +43,7 @@ test("password change rotates TokenVersion and revokes existing session", async
         if (isOnNewPassword) {
             await page.context().clearCookies()
             await loginAs(page, { username: defaultAdmin.username, password: newPassword })
-            const restoreResp = await page.request.post("/api/v1/profile", {
-                headers: await csrfHeaders(page),
+            const restoreResp = await csrfRequest(page, "post", "/api/v1/profile", {
                 data: {
                     original_password: newPassword,
                     new_password: defaultAdmin.password,
diff --git a/tests/e2e/fixtures.ts b/tests/e2e/fixtures.ts
index bc1cc16..24ee9a3 100644
--- a/tests/e2e/fixtures.ts
+++ b/tests/e2e/fixtures.ts
@@ -48,6 +48,29 @@ export async function csrfHeaders(page: Page): Promise<Record<string, string>> {
     return { "X-CSRF-Token": value }
 }
 
+// csrfRequest issues a mutating request with the X-CSRF-Token header, retrying
+// once if the backend re-mints the nz-csrf cookie between read and send. A
+// password change triggers a refresh-token that rotates the cookie, so a single
+// read can race the new value and 403; re-reading on 403 closes that window.
+export async function csrfRequest(
+    page: Page,
+    method: "post" | "patch" | "delete" | "put",
+    url: string,
+    options: { data?: unknown; failOnStatusCode?: boolean } = {},
+): Promise<import("@playwright/test").APIResponse> {
+    let resp = await page.request[method](url, {
+        ...options,
+        headers: await csrfHeaders(page),
+    })
+    if (resp.status() === 403) {
+        resp = await page.request[method](url, {
+            ...options,
+            headers: await csrfHeaders(page),
+        })
+    }
+    return resp
+}
+
 export async function expectAuthenticated(page: Page) {
     const resp = await page.request.get("/api/v1/profile")
     expect(resp.status(), "profile must respond 2xx while authenticated").toBeLessThan(400)