Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

apps/web/tests/e2e/auth.spec.ts

@@ -0,0 +1,65 @@
+import { expect, loginAs, test } from "./fixtures";
+
+test.describe("authentication", () => {
+  test("an unauthenticated visitor sees the sign-in panel, not management data", async ({ page }) => {
+    await page.goto("/");
+    await expect(page.getByRole("heading", { name: "Inspect your governed MCP estate." })).toBeVisible();
+    await expect(page.getByRole("link", { name: "Continue to sign in" })).toHaveAttribute("href", "/auth/login");
+    // No management chrome or data leaks before authentication.
+    await expect(page.getByRole("navigation", { name: "Primary navigation" })).toHaveCount(0);
+    await expect(page.getByRole("link", { name: "Open platform settings" })).toHaveCount(0);
+    await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toHaveCount(0);
+  });
+
+  test("a real PKCE/BFF login lands on an authenticated dashboard with real data", async ({ page }) => {
+    await loginAs(page, "hub-viewer");
+    await expect(page).toHaveURL(/\/$/);
+    await expect(page.getByText("Authenticated", { exact: true })).toBeVisible();
+    await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toBeVisible();
+    // Real backend data, not a placeholder: Ludarium is the seeded catalog project.
+    await expect(page.getByText("Ludarium", { exact: true })).toBeVisible();
+  });
+
+  test("an authenticated user can sign out and stale management data disappears", async ({ page }) => {
+    await loginAs(page, "hub-viewer");
+    await page.goto("/settings");
+    await page.getByRole("button", { name: "Sign out" }).click();
+    await expect(page.getByRole("heading", { name: "Inspect your governed MCP estate." })).toBeVisible();
+    await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toHaveCount(0);
+  });
+
+  test("an invalidated session cookie safely falls back to the sign-in panel, not stale data", async ({
+    page,
+    context,
+  }) => {
+    await loginAs(page, "hub-viewer");
+    await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toBeVisible();
+
+    const cookies = await context.cookies();
+    const sessionCookie = cookies.find((cookie) => cookie.name === "hub_session");
+    expect(sessionCookie).toBeDefined();
+    await context.addCookies([{ ...sessionCookie!, value: "tampered-session-value" }]);
+
+    await page.reload();
+    await expect(page.getByRole("heading", { name: "Inspect your governed MCP estate." })).toBeVisible();
+    // The stale dashboard from before tampering must not still be showing.
+    await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toHaveCount(0);
+  });
+
+  test("a mutating request with a missing CSRF token is safely rejected, not silently accepted", async ({
+    page,
+  }) => {
+    await loginAs(page, "hub-admin");
+    await page.goto("/policies");
+    await page.route("**/api/policies/simulate", async (route) => {
+      const headers = { ...route.request().headers() };
+      delete headers["x-csrf-token"];
+      await route.continue({ headers });
+    });
+    await page.getByLabel("Project").selectOption({ index: 0 });
+    await page.getByRole("button", { name: "Explain decision" }).click();
+    await expect(page.getByRole("alert")).toBeVisible();
+    // No decision card was rendered from an unauthenticated-CSRF response.
+    await expect(page.getByRole("status").filter({ hasText: "Matched:" })).toHaveCount(0);
+  });
+});