mirror of
https://github.com/Buriburizaem0n/admin-frontend-domain.git
synced 2026-09-19 17:50:13 +00:00
naibaandcloudcode
76b9eb6a54
The backend CSRF double-submit gate rejects unsafe methods unless
X-CSRF-Token mirrors the signed nz-csrf cookie. page.request bypasses the
SPA JS that does this, so every mutating E2E call got 403, failing the suite.
- Add csrfHeaders(page) helper that mirrors the nz-csrf cookie into the
header, polling until the cookie is readable to avoid the post-login race.
- Apply it to all cookie-authenticated POST/PATCH/DELETE calls (the /mcp
Bearer calls stay header-free since PAT requests are CSRF-exempt).
- loginAs waits for the nz-csrf cookie before returning.
- Fix the create-token dialog submit selector: the button is labelled
'Create API token' (t('CreateApiToken')), not 'Create'.
Verified 8/8 passing across repeated CI-mode runs against a real backend.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
60 lines
2.2 KiB
TypeScript
60 lines
2.2 KiB
TypeScript
import { expect } from "@playwright/test"
|
|
|
|
import { csrfHeaders, defaultAdmin, expectAuthenticated, expectUnauthenticated, loginAs, test } from "./fixtures"
|
|
|
|
test("login persists session via cookie and getProfile succeeds", async ({ page }) => {
|
|
await loginAs(page, defaultAdmin)
|
|
await expectAuthenticated(page)
|
|
})
|
|
|
|
test("password change rotates TokenVersion and revokes existing session", async ({ page }) => {
|
|
await loginAs(page, defaultAdmin)
|
|
|
|
const originalCookies = await page.context().cookies()
|
|
const originalJWT = originalCookies.find((c) => c.name === "nz-jwt")?.value
|
|
expect(originalJWT, "login must set nz-jwt cookie").toBeTruthy()
|
|
|
|
const newPassword = `e2e-${Date.now().toString(36)}`
|
|
let isOnNewPassword = false
|
|
try {
|
|
const resp = await page.request.post("/api/v1/profile", {
|
|
headers: await csrfHeaders(page),
|
|
data: {
|
|
original_password: defaultAdmin.password,
|
|
new_password: newPassword,
|
|
new_username: defaultAdmin.username,
|
|
reject_password: false,
|
|
},
|
|
})
|
|
expect(resp.ok(), "profile update must succeed").toBeTruthy()
|
|
isOnNewPassword = true
|
|
|
|
await page.context().clearCookies()
|
|
if (originalJWT) {
|
|
await page.context().addCookies([
|
|
{
|
|
name: "nz-jwt",
|
|
value: originalJWT,
|
|
url: page.url() || "http://localhost:5173",
|
|
},
|
|
])
|
|
}
|
|
await expectUnauthenticated(page)
|
|
} finally {
|
|
if (isOnNewPassword) {
|
|
await page.context().clearCookies()
|
|
await loginAs(page, { username: defaultAdmin.username, password: newPassword })
|
|
const restoreResp = await page.request.post("/api/v1/profile", {
|
|
headers: await csrfHeaders(page),
|
|
data: {
|
|
original_password: newPassword,
|
|
new_password: defaultAdmin.password,
|
|
new_username: defaultAdmin.username,
|
|
reject_password: false,
|
|
},
|
|
})
|
|
expect(restoreResp.ok(), "password restore must succeed so other suites can still log in").toBeTruthy()
|
|
}
|
|
}
|
|
})
|