mirror of
https://github.com/Buriburizaem0n/admin-frontend-domain.git
synced 2026-09-19 17:50:13 +00:00
naibaandcloudcode
22ebc51a08
The backend CSRF double-submit gate rejects unsafe methods unless
X-CSRF-Token mirrors the signed nz-csrf cookie. page.request bypasses the
SPA JS that does this, so every mutating E2E call got 403, failing the suite.
- Add csrfHeaders(page) helper that mirrors the nz-csrf cookie into the
header, polling until the cookie is readable to avoid the post-login race.
- Apply it to all cookie-authenticated POST/PATCH/DELETE calls (the /mcp
Bearer calls stay header-free since PAT requests are CSRF-exempt).
- loginAs waits for the nz-csrf cookie before returning.
- Fix the create-token dialog submit selector: the button is labelled
'Create API token' (t('CreateApiToken')), not 'Create'.
Verified 8/8 passing across repeated CI-mode runs against a real backend.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
59 lines
2.6 KiB
TypeScript
59 lines
2.6 KiB
TypeScript
import { expect } from "@playwright/test"
|
|
|
|
import { csrfHeaders, test } from "./fixtures"
|
|
|
|
test("server-group hides guest-empty groups from anonymous callers", async ({ adminPage: page, browser }) => {
|
|
const tag = Date.now().toString(36)
|
|
const visibleName = `e2e-visible-${tag}`
|
|
const hiddenName = `e2e-hidden-${tag}`
|
|
|
|
// Admin creates one group with no servers (will be guest-empty) and one with a public server.
|
|
// First make sure there's at least one public server visible to guests; if not, this whole
|
|
// scenario boils down to "no group is guest-visible", which the assertion below still covers.
|
|
const serversResp = await page.request.get("/api/v1/server")
|
|
expect(serversResp.ok()).toBeTruthy()
|
|
const serversBody = (await serversResp.json()) as { data: Array<{ id: number; hide_for_guest?: boolean }> }
|
|
const publicServer = serversBody.data?.find((s) => !s.hide_for_guest)
|
|
|
|
const createdGroupIDs: number[] = []
|
|
if (publicServer) {
|
|
const visibleResp = await page.request.post("/api/v1/server-group", {
|
|
headers: await csrfHeaders(page),
|
|
data: { name: visibleName, servers: [publicServer.id] },
|
|
})
|
|
expect(visibleResp.ok()).toBeTruthy()
|
|
createdGroupIDs.push(((await visibleResp.json()) as { data: number }).data)
|
|
}
|
|
const hiddenResp = await page.request.post("/api/v1/server-group", {
|
|
headers: await csrfHeaders(page),
|
|
data: { name: hiddenName, servers: [] },
|
|
})
|
|
expect(hiddenResp.ok()).toBeTruthy()
|
|
createdGroupIDs.push(((await hiddenResp.json()) as { data: number }).data)
|
|
|
|
try {
|
|
const guestCtx = await browser.newContext()
|
|
try {
|
|
const guestResp = await guestCtx.request.get("/api/v1/server-group")
|
|
expect(guestResp.ok()).toBeTruthy()
|
|
const guestBody = (await guestResp.json()) as {
|
|
data: Array<{ group: { name: string }; servers: number[] }>
|
|
}
|
|
const names = (guestBody.data || []).map((it) => it.group.name)
|
|
expect(names, "guest must NOT see groups with zero visible servers").not.toContain(hiddenName)
|
|
if (publicServer) {
|
|
expect(names, "guest still sees groups that contain a guest-visible server").toContain(visibleName)
|
|
}
|
|
} finally {
|
|
await guestCtx.close()
|
|
}
|
|
} finally {
|
|
if (createdGroupIDs.length > 0) {
|
|
await page.request.post("/api/v1/batch-delete/server-group", {
|
|
headers: await csrfHeaders(page),
|
|
data: createdGroupIDs,
|
|
})
|
|
}
|
|
}
|
|
})
|