mirror of
https://github.com/Buriburizaem0n/admin-frontend-domain.git
synced 2026-09-19 09:40:13 +00:00
naibaandcloudcode
76b9eb6a54
The backend CSRF double-submit gate rejects unsafe methods unless
X-CSRF-Token mirrors the signed nz-csrf cookie. page.request bypasses the
SPA JS that does this, so every mutating E2E call got 403, failing the suite.
- Add csrfHeaders(page) helper that mirrors the nz-csrf cookie into the
header, polling until the cookie is readable to avoid the post-login race.
- Apply it to all cookie-authenticated POST/PATCH/DELETE calls (the /mcp
Bearer calls stay header-free since PAT requests are CSRF-exempt).
- loginAs waits for the nz-csrf cookie before returning.
- Fix the create-token dialog submit selector: the button is labelled
'Create API token' (t('CreateApiToken')), not 'Create'.
Verified 8/8 passing across repeated CI-mode runs against a real backend.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
83 lines
3.0 KiB
TypeScript
83 lines
3.0 KiB
TypeScript
import { Page, Request, expect, test as base } from "@playwright/test"
|
|
|
|
export type LoginContext = {
|
|
username: string
|
|
password: string
|
|
}
|
|
|
|
export const defaultAdmin: LoginContext = {
|
|
username: process.env.E2E_ADMIN_USER || "admin",
|
|
password: process.env.E2E_ADMIN_PASS || "admin",
|
|
}
|
|
|
|
export async function loginAs(page: Page, creds: LoginContext) {
|
|
await page.goto("/dashboard/login")
|
|
await page.locator('input[autocomplete="username"]').fill(creds.username)
|
|
await page.locator('input[autocomplete="current-password"]').fill(creds.password)
|
|
await page.locator('button[type="submit"]').click()
|
|
await page.waitForURL(/\/dashboard\/?(?:$|\?|#)/, { timeout: 10_000 })
|
|
// Block until the signed nz-csrf cookie is readable. csrfHeaders() reads it
|
|
// synchronously; without this wait a mutating request fired right after
|
|
// login can race the Set-Cookie and send no token, getting a 403.
|
|
await expect
|
|
.poll(async () => (await page.context().cookies()).some((c) => c.name === "nz-csrf"), {
|
|
timeout: 10_000,
|
|
})
|
|
.toBe(true)
|
|
}
|
|
|
|
export async function logout(page: Page) {
|
|
await page.context().clearCookies()
|
|
}
|
|
|
|
// csrfHeaders mirrors the signed nz-csrf cookie into the X-CSRF-Token header.
|
|
// The backend's double-submit CSRF gate rejects unsafe methods unless the two
|
|
// match; the SPA does this in api.ts, but page.request bypasses that JS, so
|
|
// E2E mutating calls must replicate it or every POST/PATCH/DELETE gets 403.
|
|
export async function csrfHeaders(page: Page): Promise<Record<string, string>> {
|
|
let value = ""
|
|
await expect
|
|
.poll(
|
|
async () => {
|
|
value = (await page.context().cookies()).find((c) => c.name === "nz-csrf")?.value ?? ""
|
|
return value
|
|
},
|
|
{ timeout: 10_000 },
|
|
)
|
|
.not.toBe("")
|
|
return { "X-CSRF-Token": value }
|
|
}
|
|
|
|
export async function expectAuthenticated(page: Page) {
|
|
const resp = await page.request.get("/api/v1/profile")
|
|
expect(resp.status(), "profile must respond 2xx while authenticated").toBeLessThan(400)
|
|
const body = await resp.json()
|
|
expect(body.success, "profile.success must be true").toBe(true)
|
|
expect(body.data?.id, "profile.data.id must be present").toBeTruthy()
|
|
}
|
|
|
|
export async function expectUnauthenticated(page: Page) {
|
|
const resp = await page.request.get("/api/v1/profile")
|
|
const body = await resp.json()
|
|
expect(body.success, "profile must NOT be authorized after revoke").not.toBe(true)
|
|
expect(body.error, "profile must surface an error after revoke").toBeTruthy()
|
|
}
|
|
|
|
export async function findRequest(
|
|
page: Page,
|
|
matcher: (req: Request) => boolean,
|
|
trigger: () => Promise<void>,
|
|
timeoutMs = 5000,
|
|
): Promise<Request> {
|
|
const waiter = page.waitForRequest(matcher, { timeout: timeoutMs })
|
|
await trigger()
|
|
return await waiter
|
|
}
|
|
|
|
export const test = base.extend<{ adminPage: Page }>({
|
|
adminPage: async ({ page }, use) => {
|
|
await loginAs(page, defaultAdmin)
|
|
await use(page)
|
|
},
|
|
})
|