dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

e2e: harden akLogin against Lit stage re-render; settle per hop in crawl/sso

Browse Source
This commit is contained in:
Frank
2026-09-01 17:09:40 -07:00
parent 912c0edeff
commit 4e1c8a873f
3 changed files with 70 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/e2e/lib/login.ts
+17 -3
View File
@@ -18,11 +18,25 @@ export async function akLogin(page: Page, baseUrl: string, user: string, pass: s
const pwd = page.locator('input[name="password"]');
await pwd.waitFor({ state: "visible", timeout: 30_000 });
await pwd.fill(pass);
await page.locator('button[type="submit"]').first().click();
// authentik's flow executor (Lit) can re-render the stage right after it
// mounts, wiping a programmatic fill; clicking the submit button then
// POSTs an empty form ("This field is required"). Fill, VERIFY the value
// survived, and submit via Enter (native form path), retrying if the
// stage reset under us.
for (let attempt = 0; attempt < 3; attempt++) {
await pwd.fill(pass);
await expect(pwd).toHaveValue(pass, { timeout: 5_000 });
await pwd.press("Enter");
try {
await page.waitForURL(/:\/\/www\.franksdank\.cloud\//, { timeout: 20_000 });
break;
} catch {
if (attempt === 2) throw new Error("password stage never advanced after 3 attempts");
}
}
// Back on the homepage with panels rendered.
await page.waitForURL(/:\/\/www\.franksdank\.cloud\//, { timeout: 60_000 });
await expect(page.locator("#grid .panel").first()).toBeVisible({ timeout: 30_000 });
}
tests/e2e/specs/12-crawl.spec.ts
+33 -32
View File
@@ -1,48 +1,49 @@
import { expect, test } from "@playwright/test";
import { expect, test, type Page } from "@playwright/test";
// Clicks every open link on the user homepage and asserts the destination is
// the real app, reached through the guard chain without an authentik prompt.
// The link set is read live from the rendered homepage (it mirrors
// shared/homepage/services.json), so registry edits flow into the crawl
// automatically. Apps with their own auth (Gitea, OpenWebUI, Calibre-Web,
// Plex, Jellyfin) must show THEIR OWN landing page; guarded apps must arrive
// via silent SSO.
// shared/homepage/services.json open entries) so a registry edit cannot leave
// this test asserting a stale world.
const CHALLENGE = "Making sure you're not a bot";
async function settleThroughGuard(page: Page, targetHost: string): Promise<void> {
// Each guarded vhost runs its own Anubis proof-of-work on first visit;
// wait for the challenge to clear before judging the destination.
await expect
.poll(async () => !(await page.locator("body").innerText()).includes(CHALLENGE), { timeout: 90_000 })
.toBe(true);
await expect
.poll(() => new URL(page.url()).hostname, { timeout: 60_000 })
.toBe(targetHost);
expect(await page.locator('input[name="uidField"]').count()).toBe(0);
}
test("every user open link reaches its app", async ({ page }) => {
test.setTimeout(420_000);
await page.goto("/");
const hrefs = await page.locator("#grid a.open").evaluateAll((els) =>
els.map((el) => (el as HTMLAnchorElement).href),
);
expect(hrefs.length).toBeGreaterThanOrEqual(8);
await expect(page.locator("#grid a.open")).toHaveCount(9);
const hrefs = await page
.locator("#grid a.open")
.evaluateAll((els) => els.map((el) => ({ href: (el as HTMLAnchorElement).href, label: el.textContent ?? "" })));
const failures: string[] = [];
for (const href of hrefs) {
const target = new URL(href);
for (const link of hrefs) {
const target = new URL(link.href);
try {
await page.locator(`#grid a.open[href="${href}"]`).click();
// Guarded hops pass through Anubis (auto-solves) and authentik (silent
// with a session); wait until we have landed off the IdP.
await expect
.poll(() => new URL(page.url()).hostname, { timeout: 60_000 })
.not.toBe("auth.franksdank.cloud");
expect(new URL(page.url()).hostname, `${target.hostname} should serve its own vhost`).toBe(
target.hostname,
);
expect(
await page.locator('input[name="uidField"]').count(),
`${target.hostname} must not re-prompt for authentik login`,
).toBe(0);
const body = await page.locator("body").innerText();
expect(body, `${target.hostname} must not show an Anubis interstitial`).not.toContain(
"Making sure you're not a bot",
);
await page.goto(link.href);
await settleThroughGuard(page, target.hostname);
const resp = await page.request.get(page.url());
expect(resp.status(), `${target.hostname} must answer, not error`).toBeLessThan(500);
if (resp.status() >= 500) {
failures.push(`${link.label}: ${page.url()} answered ${resp.status()}`);
}
} catch (err) {
failures.push(`${target.hostname}: ${err instanceof Error ? err.message : String(err)}`);
await page.goto("/");
await page.locator("#grid .panel").first().waitFor();
failures.push(`${link.label}: ${err instanceof Error ? err.message : String(err)}`);
}
await page.goto("/");
await expect(page.locator("#grid a.open")).toHaveCount(9);
}
expect(failures, failures.join("\n")).toEqual([]);
});
tests/e2e/specs/13-sso.spec.ts
+20 -11
View File
@@ -1,21 +1,30 @@
import { expect, test } from "@playwright/test";
// Single-login enforcement: with ONLY the homepage session cookies, a direct
// visit to every outpost-guarded vhost must resolve through Anubis +
// authentik silently and land on the app — no login form, no challenge, no
// IdP error page. Exercises the provider the outpost actually carries
// (fixed 2026-09-01: loki/grafana/seerr were missing from the outpost M2M).
// With ONLY the homepage session cookies, a direct visit to every
// outpost-guarded vhost must resolve through Anubis + authentik silently and
// land on the app - no login form, no challenge, no IdP error page.
// Single-login enforcement (SSO across hosts). Loki serves no web UI beyond
// its API surface, so a sub-500 answer is its pass condition.
const GUARDED = ["search", "romm", "files", "seerr", "grafana", "prometheus", "loki"];
const GUARDED = ["search", "romm", "files", "seerr", "grafana", "prometheus", "loki"].map(
(sub) => `https://${sub}.franksdank.cloud/`,
);
for (const host of GUARDED) {
test(`SSO passes silently for ${host}.franksdank.cloud`, async ({ page }) => {
await page.goto(`https://${host}.franksdank.cloud/`);
for (const vhost of GUARDED) {
test(`SSO passes silently for ${new URL(vhost).hostname}`, async ({ page }) => {
test.setTimeout(180_000);
await page.goto(vhost);
await expect
.poll(
async () => !(await page.locator("body").innerText()).includes("Making sure you're not a bot"),
{ timeout: 90_000 },
)
.toBe(true);
await expect
.poll(() => new URL(page.url()).hostname, { timeout: 60_000 })
.toBe(`${host}.franksdank.cloud`);
expect(await page.locator('input[name="uidField"]').count()).toBe(0);
.toBe(new URL(vhost).hostname);
const body = await page.locator("body").innerText();
expect(body).not.toContain("Sign in"); // authentik identification stage
expect(body).not.toContain("Making sure you're not a bot");
const resp = await page.request.get(page.url());
expect(resp.status()).toBeLessThan(500);