tests/e2e/specs/14-guard.spec.ts

@@ -15,9 +15,12 @@ const BASE = "https://www.franksdank.cloud";
 // Every vhost that Caddy routes through anubis:8923 (see dankclaw/Caddyfile).
 // Keep this list in lockstep with the Caddyfile: a new guarded vhost must be
 // added here or the guard-chain audit is incomplete.
-const GUARDED = ["www", "search", "romm", "files", "seerr", "grafana", "prometheus", "loki", "notebook"];
+const GUARDED = ["www", "search", "romm", "files", "seerr", "grafana", "prometheus", "loki", "notebook", "abs"];
 
-// Markers that prove app content leaked past the guard to an anonymous user.
+// Markers that prove app content leaked past the guard to an anonymous user. Each
+// marker must be a string the APP renders that the gate itself could never print —
+// for abs that is the Audiobookshelf login's own SSO button label (the app's OIDC
+// door), which authentik's gate never renders because it IS the IdP.
 const LEAK_MARKERS: Record<string, string[]> = {
   "search.franksdank.cloud": ["SearXNG preferences"],
   "romm.franksdank.cloud": ["RomM"],
@@ -26,6 +29,7 @@ const LEAK_MARKERS: Record<string, string[]> = {
   "grafana.franksdank.cloud": ["Dashboards"],
   "prometheus.franksdank.cloud": ["Expression Browser", "Graph"],
   "notebook.franksdank.cloud": ["Open Notebook"],
+  "abs.franksdank.cloud": ["Sign in with Authentik"],
 };
 
 test("homepage root (/) is guarded for unauthenticated users", async ({ page }) => {