Buriburizaemon/admin-frontend-domain
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/admin-frontend-domain.git synced 2026-09-19 17:50:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(e2e): fix revoke empty-list crash and password-restore CSRF cascade

Browse Source 
Two CI-only failures surfaced against a fresh backend DB:

- The revoke test read after.data.find(), but the list endpoint omits data
  entirely when the admin has zero tokens, throwing on undefined. Default to [].
- The password-change test's restore POST hit a 403: changing the password
  triggers a refresh-token that re-mints the nz-csrf cookie, so the X-CSRF-Token
  read just before the request can be stale. A failed restore left the admin on
  the rotated password and cascaded into cron/fm/visibility login failures.
  Add csrfRequest(), which retries once on 403 after re-reading the cookie, and
  use it for both profile mutations.

Verified 8/8 passing across repeated fresh-DB CI-mode runs.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
This commit is contained in:
naiba
2026-05-31 08:45:19 +00:00
co-authored by cloudcode
parent 76b9eb6a54
commit bba5a8c44a
3 changed files with 30 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/e2e/auth.spec.ts
+3 -5
View File
@@ -1,6 +1,6 @@
import { expect } from "@playwright/test"
import { csrfHeaders, defaultAdmin, expectAuthenticated, expectUnauthenticated, loginAs, test } from "./fixtures"
import { csrfRequest, defaultAdmin, expectAuthenticated, expectUnauthenticated, loginAs, test } from "./fixtures"
test("login persists session via cookie and getProfile succeeds", async ({ page }) => {
await loginAs(page, defaultAdmin)
@@ -17,8 +17,7 @@ test("password change rotates TokenVersion and revokes existing session", async
const newPassword = `e2e-${Date.now().toString(36)}`
let isOnNewPassword = false
try {
const resp = await page.request.post("/api/v1/profile", {
headers: await csrfHeaders(page),
const resp = await csrfRequest(page, "post", "/api/v1/profile", {
data: {
original_password: defaultAdmin.password,
new_password: newPassword,
@@ -44,8 +43,7 @@ test("password change rotates TokenVersion and revokes existing session", async
if (isOnNewPassword) {
await page.context().clearCookies()
await loginAs(page, { username: defaultAdmin.username, password: newPassword })
const restoreResp = await page.request.post("/api/v1/profile", {
headers: await csrfHeaders(page),
const restoreResp = await csrfRequest(page, "post", "/api/v1/profile", {
data: {
original_password: newPassword,
new_password: defaultAdmin.password,