68 lines
3.6 KiB
TypeScript
68 lines
3.6 KiB
TypeScript
import { expect, loginAs, test } from "./fixtures";
|
|
|
|
test.describe("authentication", () => {
|
|
test("an unauthenticated visitor sees the sign-in panel, not management data", async ({ page }) => {
|
|
await page.goto("/");
|
|
await expect(page.getByRole("heading", { name: "Inspect your governed MCP estate." })).toBeVisible();
|
|
await expect(page.getByRole("link", { name: "Continue to sign in" })).toHaveAttribute("href", "/auth/login");
|
|
// No management chrome or data leaks before authentication.
|
|
await expect(page.getByRole("navigation", { name: "Primary navigation" })).toHaveCount(0);
|
|
await expect(page.getByRole("link", { name: "Open platform settings" })).toHaveCount(0);
|
|
await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toHaveCount(0);
|
|
});
|
|
|
|
test("a real PKCE/BFF login lands on an authenticated dashboard with real data", async ({ page }) => {
|
|
await loginAs(page, "hub-viewer");
|
|
await expect(page).toHaveURL(/\/$/);
|
|
await expect(page.getByText("Authenticated", { exact: true })).toBeVisible();
|
|
await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toBeVisible();
|
|
// Assert a real bounded dashboard row without depending on catalog ordering.
|
|
const snapshot = await (await page.request.get("/api/dashboard")).json();
|
|
expect(snapshot.projects.length).toBeGreaterThan(0);
|
|
await expect(page.locator(`[href="/projects/${snapshot.projects[0].slug}"]`).first()).toContainText(snapshot.projects[0].name);
|
|
});
|
|
|
|
test("an authenticated user can sign out and stale management data disappears", async ({ page }) => {
|
|
await loginAs(page, "hub-viewer");
|
|
await page.goto("/settings");
|
|
await page.getByRole("button", { name: "Sign out" }).click();
|
|
await expect(page.getByRole("heading", { name: "Inspect your governed MCP estate." })).toBeVisible();
|
|
await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toHaveCount(0);
|
|
});
|
|
|
|
test("an invalidated session cookie safely falls back to the sign-in panel, not stale data", async ({
|
|
page,
|
|
context,
|
|
}) => {
|
|
await loginAs(page, "hub-viewer");
|
|
await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toBeVisible();
|
|
|
|
const cookies = await context.cookies();
|
|
const sessionCookie = cookies.find((cookie) => cookie.name === "hub_session");
|
|
expect(sessionCookie).toBeDefined();
|
|
await context.addCookies([{ ...sessionCookie!, value: "tampered-session-value" }]);
|
|
|
|
await page.reload();
|
|
await expect(page.getByRole("heading", { name: "Inspect your governed MCP estate." })).toBeVisible();
|
|
// The stale dashboard from before tampering must not still be showing.
|
|
await expect(page.getByRole("heading", { name: "Governed MCP, with the current signal first." })).toHaveCount(0);
|
|
});
|
|
|
|
test("a mutating request with a missing CSRF token is safely rejected, not silently accepted", async ({
|
|
page,
|
|
}) => {
|
|
await loginAs(page, "hub-admin");
|
|
await page.goto("/policies");
|
|
await page.route("**/api/policies/simulate", async (route) => {
|
|
const headers = { ...route.request().headers() };
|
|
delete headers["x-csrf-token"];
|
|
await route.continue({ headers });
|
|
});
|
|
await page.getByLabel("Project").selectOption({ index: 0 });
|
|
await page.getByRole("button", { name: "Explain decision" }).click();
|
|
await expect(page.getByRole("alert")).toBeVisible();
|
|
// No decision card was rendered from an unauthenticated-CSRF response.
|
|
await expect(page.getByRole("status").filter({ hasText: "Matched:" })).toHaveCount(0);
|
|
});
|
|
});
|