test(e2e): add Playwright suite for auth + CSRF + visibility fixes

Covers the security fixes that landed across both repos: - auth.spec.ts: login persists nz-jwt cookie and getProfile succeeds; password change bumps TokenVersion + revokes the old cookie so the pre-change JWT can no longer auth (regression guard for the keyId+session backend rewrite). - cron-csrf.spec.ts: POST /api/v1/cron/:id/manual succeeds while GET is no longer routable (regression guard for the cron CSRF fix). - fm-csrf.spec.ts: POST /api/v1/file is reachable while GET is no longer routable (regression guard for the FM CSRF fix). - visibility.spec.ts: an anonymous caller cannot see a server-group that contains zero guest-visible servers (regression guard for the server-group leak fix). Fixtures wrap the noisy login + cleanup boilerplate. tsconfig is scoped to tests/e2e so the suite stays out of the production tsc project graph. Playwright config starts the Vite dev server (npm run dev) and expects a backend reachable at the URL Vite proxies to. CI workflow follow-up commit wires the backend up. Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
2026-09-19 09:40:13 +00:00 · 2026-05-26 04:34:43 +00:00
parent c80899a753
commit dc0cfd0ecb
10 changed files with 345 additions and 1 deletions
@@ -0,0 +1,57 @@
+import { expect } from "@playwright/test"
+
+import { defaultAdmin, expectAuthenticated, expectUnauthenticated, loginAs, test } from "./fixtures"
+
+test("login persists session via cookie and getProfile succeeds", async ({ page }) => {
+    await loginAs(page, defaultAdmin)
+    await expectAuthenticated(page)
+})
+
+test("password change rotates TokenVersion and revokes existing session", async ({ page }) => {
+    await loginAs(page, defaultAdmin)
+
+    const originalCookies = await page.context().cookies()
+    const originalJWT = originalCookies.find((c) => c.name === "nz-jwt")?.value
+    expect(originalJWT, "login must set nz-jwt cookie").toBeTruthy()
+
+    const newPassword = `e2e-${Date.now().toString(36)}`
+    let isOnNewPassword = false
+    try {
+        const resp = await page.request.post("/api/v1/profile", {
+            data: {
+                original_password: defaultAdmin.password,
+                new_password: newPassword,
+                new_username: defaultAdmin.username,
+                reject_password: false,
+            },
+        })
+        expect(resp.ok(), "profile update must succeed").toBeTruthy()
+        isOnNewPassword = true
+
+        await page.context().clearCookies()
+        if (originalJWT) {
+            await page.context().addCookies([
+                {
+                    name: "nz-jwt",
+                    value: originalJWT,
+                    url: page.url() || "http://localhost:5173",
+                },
+            ])
+        }
+        await expectUnauthenticated(page)
+    } finally {
+        if (isOnNewPassword) {
+            await page.context().clearCookies()
+            await loginAs(page, { username: defaultAdmin.username, password: newPassword })
+            const restoreResp = await page.request.post("/api/v1/profile", {
+                data: {
+                    original_password: newPassword,
+                    new_password: defaultAdmin.password,
+                    new_username: defaultAdmin.username,
+                    reject_password: false,
+                },
+            })
+            expect(restoreResp.ok(), "password restore must succeed so other suites can still log in").toBeTruthy()
+        }
+    }
+})