From 4e1c8a873f5e91ab75f81da2787f71ab65f76224 Mon Sep 17 00:00:00 2001 From: Frank Date: Tue, 1 Sep 2026 17:09:40 -0700 Subject: [PATCH] e2e: harden akLogin against Lit stage re-render; settle per hop in crawl/sso --- tests/e2e/lib/login.ts | 20 ++++++++-- tests/e2e/specs/12-crawl.spec.ts | 65 ++++++++++++++++---------------- tests/e2e/specs/13-sso.spec.ts | 31 +++++++++------ 3 files changed, 70 insertions(+), 46 deletions(-) diff --git a/tests/e2e/lib/login.ts b/tests/e2e/lib/login.ts index d9ec69e..c2ef0d3 100644 --- a/tests/e2e/lib/login.ts +++ b/tests/e2e/lib/login.ts @@ -18,11 +18,25 @@ export async function akLogin(page: Page, baseUrl: string, user: string, pass: s const pwd = page.locator('input[name="password"]'); await pwd.waitFor({ state: "visible", timeout: 30_000 }); - await pwd.fill(pass); - await page.locator('button[type="submit"]').first().click(); + + // authentik's flow executor (Lit) can re-render the stage right after it + // mounts, wiping a programmatic fill; clicking the submit button then + // POSTs an empty form ("This field is required"). Fill, VERIFY the value + // survived, and submit via Enter (native form path), retrying if the + // stage reset under us. + for (let attempt = 0; attempt < 3; attempt++) { + await pwd.fill(pass); + await expect(pwd).toHaveValue(pass, { timeout: 5_000 }); + await pwd.press("Enter"); + try { + await page.waitForURL(/:\/\/www\.franksdank\.cloud\//, { timeout: 20_000 }); + break; + } catch { + if (attempt === 2) throw new Error("password stage never advanced after 3 attempts"); + } + } // Back on the homepage with panels rendered. - await page.waitForURL(/:\/\/www\.franksdank\.cloud\//, { timeout: 60_000 }); await expect(page.locator("#grid .panel").first()).toBeVisible({ timeout: 30_000 }); } diff --git a/tests/e2e/specs/12-crawl.spec.ts b/tests/e2e/specs/12-crawl.spec.ts index 4fc552c..88297cb 100644 --- a/tests/e2e/specs/12-crawl.spec.ts +++ b/tests/e2e/specs/12-crawl.spec.ts @@ -1,48 +1,49 @@ -import { expect, test } from "@playwright/test"; +import { expect, test, type Page } from "@playwright/test"; // Clicks every open link on the user homepage and asserts the destination is // the real app, reached through the guard chain without an authentik prompt. // The link set is read live from the rendered homepage (it mirrors -// shared/homepage/services.json), so registry edits flow into the crawl -// automatically. Apps with their own auth (Gitea, OpenWebUI, Calibre-Web, -// Plex, Jellyfin) must show THEIR OWN landing page; guarded apps must arrive -// via silent SSO. +// shared/homepage/services.json open entries) so a registry edit cannot leave +// this test asserting a stale world. + +const CHALLENGE = "Making sure you're not a bot"; + +async function settleThroughGuard(page: Page, targetHost: string): Promise { + // Each guarded vhost runs its own Anubis proof-of-work on first visit; + // wait for the challenge to clear before judging the destination. + await expect + .poll(async () => !(await page.locator("body").innerText()).includes(CHALLENGE), { timeout: 90_000 }) + .toBe(true); + await expect + .poll(() => new URL(page.url()).hostname, { timeout: 60_000 }) + .toBe(targetHost); + expect(await page.locator('input[name="uidField"]').count()).toBe(0); +} test("every user open link reaches its app", async ({ page }) => { + test.setTimeout(420_000); await page.goto("/"); - const hrefs = await page.locator("#grid a.open").evaluateAll((els) => - els.map((el) => (el as HTMLAnchorElement).href), - ); - expect(hrefs.length).toBeGreaterThanOrEqual(8); + await expect(page.locator("#grid a.open")).toHaveCount(9); + const hrefs = await page + .locator("#grid a.open") + .evaluateAll((els) => els.map((el) => ({ href: (el as HTMLAnchorElement).href, label: el.textContent ?? "" }))); const failures: string[] = []; - for (const href of hrefs) { - const target = new URL(href); + + for (const link of hrefs) { + const target = new URL(link.href); try { - await page.locator(`#grid a.open[href="${href}"]`).click(); - // Guarded hops pass through Anubis (auto-solves) and authentik (silent - // with a session); wait until we have landed off the IdP. - await expect - .poll(() => new URL(page.url()).hostname, { timeout: 60_000 }) - .not.toBe("auth.franksdank.cloud"); - expect(new URL(page.url()).hostname, `${target.hostname} should serve its own vhost`).toBe( - target.hostname, - ); - expect( - await page.locator('input[name="uidField"]').count(), - `${target.hostname} must not re-prompt for authentik login`, - ).toBe(0); - const body = await page.locator("body").innerText(); - expect(body, `${target.hostname} must not show an Anubis interstitial`).not.toContain( - "Making sure you're not a bot", - ); + await page.goto(link.href); + await settleThroughGuard(page, target.hostname); const resp = await page.request.get(page.url()); - expect(resp.status(), `${target.hostname} must answer, not error`).toBeLessThan(500); + if (resp.status() >= 500) { + failures.push(`${link.label}: ${page.url()} answered ${resp.status()}`); + } } catch (err) { - failures.push(`${target.hostname}: ${err instanceof Error ? err.message : String(err)}`); - await page.goto("/"); - await page.locator("#grid .panel").first().waitFor(); + failures.push(`${link.label}: ${err instanceof Error ? err.message : String(err)}`); } + await page.goto("/"); + await expect(page.locator("#grid a.open")).toHaveCount(9); } expect(failures, failures.join("\n")).toEqual([]); }); diff --git a/tests/e2e/specs/13-sso.spec.ts b/tests/e2e/specs/13-sso.spec.ts index 9f05b3f..03ca4b3 100644 --- a/tests/e2e/specs/13-sso.spec.ts +++ b/tests/e2e/specs/13-sso.spec.ts @@ -1,21 +1,30 @@ import { expect, test } from "@playwright/test"; -// Single-login enforcement: with ONLY the homepage session cookies, a direct -// visit to every outpost-guarded vhost must resolve through Anubis + -// authentik silently and land on the app — no login form, no challenge, no -// IdP error page. Exercises the provider the outpost actually carries -// (fixed 2026-09-01: loki/grafana/seerr were missing from the outpost M2M). +// With ONLY the homepage session cookies, a direct visit to every +// outpost-guarded vhost must resolve through Anubis + authentik silently and +// land on the app - no login form, no challenge, no IdP error page. +// Single-login enforcement (SSO across hosts). Loki serves no web UI beyond +// its API surface, so a sub-500 answer is its pass condition. -const GUARDED = ["search", "romm", "files", "seerr", "grafana", "prometheus", "loki"]; +const GUARDED = ["search", "romm", "files", "seerr", "grafana", "prometheus", "loki"].map( + (sub) => `https://${sub}.franksdank.cloud/`, +); -for (const host of GUARDED) { - test(`SSO passes silently for ${host}.franksdank.cloud`, async ({ page }) => { - await page.goto(`https://${host}.franksdank.cloud/`); +for (const vhost of GUARDED) { + test(`SSO passes silently for ${new URL(vhost).hostname}`, async ({ page }) => { + test.setTimeout(180_000); + await page.goto(vhost); + await expect + .poll( + async () => !(await page.locator("body").innerText()).includes("Making sure you're not a bot"), + { timeout: 90_000 }, + ) + .toBe(true); await expect .poll(() => new URL(page.url()).hostname, { timeout: 60_000 }) - .toBe(`${host}.franksdank.cloud`); - expect(await page.locator('input[name="uidField"]').count()).toBe(0); + .toBe(new URL(vhost).hostname); const body = await page.locator("body").innerText(); + expect(body).not.toContain("Sign in"); // authentik identification stage expect(body).not.toContain("Making sure you're not a bot"); const resp = await page.request.get(page.url()); expect(resp.status()).toBeLessThan(500);