38 lines
2.0 KiB
TypeScript
38 lines
2.0 KiB
TypeScript
import { test as base, expect, type Page } from "@playwright/test";
|
|
|
|
/** Matches services/control_api/auth/models.py's ManagementRole group names,
|
|
* and tests/e2e/harness.py's ROLE_GROUPS -- these are the only group names
|
|
* the real per-endpoint RBAC matrix (services/control_api/authz.py) maps to
|
|
* a role at all; anything else is denied by default. */
|
|
export type Persona = "hub-viewer" | "hub-auditor" | "hub-operator" | "hub-admin";
|
|
|
|
/** Drives the real PKCE/BFF login flow through a real browser navigation:
|
|
* GET /auth/login (real 307 to the fake OIDC provider's real HTTPS
|
|
* /authorize), rewriting only the *outbound request URL* to add a
|
|
* `persona` hint the fake provider reads (see fake_provider.py) -- no
|
|
* production auth code is touched or bypassed, only the request this test
|
|
* harness itself sends to a fake dependency. */
|
|
export async function loginAs(page: Page, persona: Persona): Promise<void> {
|
|
// Rewriting the *navigation request itself* to /authorize (page.route
|
|
// continue({url})) does not reliably apply to a same-navigation redirect
|
|
// hop in Chromium -- verified by hand: the outbound request to
|
|
// /authorize still carried no persona param, and the fake provider fell
|
|
// back to its default group. Instead, intercept the /auth/login response
|
|
// (a 307), fetch it with redirects disabled, and rewrite the outgoing
|
|
// Location header before letting the browser follow it.
|
|
await page.route("**/auth/login", async (route) => {
|
|
const response = await route.fetch({ maxRedirects: 0 });
|
|
const headers = response.headers();
|
|
if (!headers.location) throw new Error("expected /auth/login to redirect with a Location header");
|
|
const location = new URL(headers.location);
|
|
location.searchParams.set("persona", persona);
|
|
await route.fulfill({ status: response.status(), headers: { ...headers, location: location.toString() } });
|
|
});
|
|
await page.goto("/auth/login");
|
|
await page.waitForLoadState("networkidle");
|
|
await page.unroute("**/auth/login");
|
|
}
|
|
|
|
export const test = base;
|
|
export { expect };
|