mirror of
https://github.com/Buriburizaem0n/admin-frontend-domain.git
synced 2026-09-19 09:40:13 +00:00
naibaandcloudcode
22ebc51a08
The backend CSRF double-submit gate rejects unsafe methods unless
X-CSRF-Token mirrors the signed nz-csrf cookie. page.request bypasses the
SPA JS that does this, so every mutating E2E call got 403, failing the suite.
- Add csrfHeaders(page) helper that mirrors the nz-csrf cookie into the
header, polling until the cookie is readable to avoid the post-login race.
- Apply it to all cookie-authenticated POST/PATCH/DELETE calls (the /mcp
Bearer calls stay header-free since PAT requests are CSRF-exempt).
- loginAs waits for the nz-csrf cookie before returning.
- Fix the create-token dialog submit selector: the button is labelled
'Create API token' (t('CreateApiToken')), not 'Create'.
Verified 8/8 passing across repeated CI-mode runs against a real backend.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
45 lines
1.5 KiB
TypeScript
45 lines
1.5 KiB
TypeScript
import { expect } from "@playwright/test"
|
|
|
|
import { csrfHeaders, test } from "./fixtures"
|
|
|
|
test("manual cron trigger goes through POST, not GET", async ({ adminPage: page }) => {
|
|
const created = await page.request.post("/api/v1/cron", {
|
|
headers: await csrfHeaders(page),
|
|
data: {
|
|
name: "e2e-cron-csrf",
|
|
task_type: 0,
|
|
scheduler: "@every 1h",
|
|
command: "true",
|
|
servers: [],
|
|
cover: 0,
|
|
push_successful: false,
|
|
notification_group_id: 0,
|
|
},
|
|
})
|
|
expect(created.ok(), "create cron via POST must succeed").toBeTruthy()
|
|
const { data: cronID } = (await created.json()) as { data: number }
|
|
expect(typeof cronID).toBe("number")
|
|
|
|
try {
|
|
const getResp = await page.request.get(`/api/v1/cron/${cronID}/manual`, {
|
|
failOnStatusCode: false,
|
|
})
|
|
expect(
|
|
getResp.status() === 404 || getResp.status() === 405,
|
|
`GET must no longer be routable (got ${getResp.status()})`,
|
|
).toBeTruthy()
|
|
|
|
const postResp = await page.request.post(`/api/v1/cron/${cronID}/manual`, {
|
|
headers: await csrfHeaders(page),
|
|
})
|
|
expect(postResp.ok(), `POST must succeed (got ${postResp.status()})`).toBeTruthy()
|
|
const body = await postResp.json()
|
|
expect(body.success).toBe(true)
|
|
} finally {
|
|
await page.request.post("/api/v1/batch-delete/cron", {
|
|
headers: await csrfHeaders(page),
|
|
data: [cronID],
|
|
})
|
|
}
|
|
})
|