mirror of
https://github.com/Buriburizaem0n/admin-frontend-domain.git
synced 2026-09-19 09:40:13 +00:00
naibaandcloudcode
dc0cfd0ecb
Covers the security fixes that landed across both repos: - auth.spec.ts: login persists nz-jwt cookie and getProfile succeeds; password change bumps TokenVersion + revokes the old cookie so the pre-change JWT can no longer auth (regression guard for the keyId+session backend rewrite). - cron-csrf.spec.ts: POST /api/v1/cron/:id/manual succeeds while GET is no longer routable (regression guard for the cron CSRF fix). - fm-csrf.spec.ts: POST /api/v1/file is reachable while GET is no longer routable (regression guard for the FM CSRF fix). - visibility.spec.ts: an anonymous caller cannot see a server-group that contains zero guest-visible servers (regression guard for the server-group leak fix). Fixtures wrap the noisy login + cleanup boilerplate. tsconfig is scoped to tests/e2e so the suite stays out of the production tsc project graph. Playwright config starts the Vite dev server (npm run dev) and expects a backend reachable at the URL Vite proxies to. CI workflow follow-up commit wires the backend up. Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
58 lines
2.1 KiB
TypeScript
58 lines
2.1 KiB
TypeScript
import { expect } from "@playwright/test"
|
|
|
|
import { defaultAdmin, expectAuthenticated, expectUnauthenticated, loginAs, test } from "./fixtures"
|
|
|
|
test("login persists session via cookie and getProfile succeeds", async ({ page }) => {
|
|
await loginAs(page, defaultAdmin)
|
|
await expectAuthenticated(page)
|
|
})
|
|
|
|
test("password change rotates TokenVersion and revokes existing session", async ({ page }) => {
|
|
await loginAs(page, defaultAdmin)
|
|
|
|
const originalCookies = await page.context().cookies()
|
|
const originalJWT = originalCookies.find((c) => c.name === "nz-jwt")?.value
|
|
expect(originalJWT, "login must set nz-jwt cookie").toBeTruthy()
|
|
|
|
const newPassword = `e2e-${Date.now().toString(36)}`
|
|
let isOnNewPassword = false
|
|
try {
|
|
const resp = await page.request.post("/api/v1/profile", {
|
|
data: {
|
|
original_password: defaultAdmin.password,
|
|
new_password: newPassword,
|
|
new_username: defaultAdmin.username,
|
|
reject_password: false,
|
|
},
|
|
})
|
|
expect(resp.ok(), "profile update must succeed").toBeTruthy()
|
|
isOnNewPassword = true
|
|
|
|
await page.context().clearCookies()
|
|
if (originalJWT) {
|
|
await page.context().addCookies([
|
|
{
|
|
name: "nz-jwt",
|
|
value: originalJWT,
|
|
url: page.url() || "http://localhost:5173",
|
|
},
|
|
])
|
|
}
|
|
await expectUnauthenticated(page)
|
|
} finally {
|
|
if (isOnNewPassword) {
|
|
await page.context().clearCookies()
|
|
await loginAs(page, { username: defaultAdmin.username, password: newPassword })
|
|
const restoreResp = await page.request.post("/api/v1/profile", {
|
|
data: {
|
|
original_password: newPassword,
|
|
new_password: defaultAdmin.password,
|
|
new_username: defaultAdmin.username,
|
|
reject_password: false,
|
|
},
|
|
})
|
|
expect(restoreResp.ok(), "password restore must succeed so other suites can still log in").toBeTruthy()
|
|
}
|
|
}
|
|
})
|