Frank
54239294b7
The loki/grafana/seerr proxy providers were script-provisioned with no flows and no Application: null flows made the embedded outpost's Rust deserializer reject the whole config (all guarded vhosts down after any outpost reload), and the missing apps bounced post-login to authentik's user UI instead of the app. Backfilled both live; documented the two provisioning rules and updated the provider inventory. SSO e2e now asserts the app landing (pathname leaves /if/, no IdP markers in body) instead of only the hostname.
40 lines
1.7 KiB
TypeScript
40 lines
1.7 KiB
TypeScript
import { expect, test } from "@playwright/test";
|
|
|
|
// With ONLY the homepage session cookies, a direct visit to every
|
|
// outpost-guarded vhost must resolve through Anubis + authentik silently and
|
|
// land on the app - no login form, no challenge, no IdP error page.
|
|
// Single-login enforcement (SSO across hosts). Loki serves no web UI beyond
|
|
// its API surface, so a sub-500 answer is its pass condition.
|
|
|
|
const GUARDED = ["search", "romm", "files", "seerr", "grafana", "prometheus", "loki"].map(
|
|
(sub) => `https://${sub}.franksdank.cloud/`,
|
|
);
|
|
|
|
for (const vhost of GUARDED) {
|
|
test(`SSO passes silently for ${new URL(vhost).hostname}`, async ({ page }) => {
|
|
test.setTimeout(180_000);
|
|
await page.goto(vhost);
|
|
await expect
|
|
.poll(
|
|
async () => !(await page.locator("body").innerText()).includes("Making sure you're not a bot"),
|
|
{ timeout: 90_000 },
|
|
)
|
|
.toBe(true);
|
|
await expect
|
|
.poll(() => new URL(page.url()).hostname, { timeout: 60_000 })
|
|
.toBe(new URL(vhost).hostname);
|
|
// A bounce to authentik's UI would satisfy the hostname assert above (the
|
|
// outpost serves /if/flow on the guarded vhost itself), so require the
|
|
// path to have left authentik's namespace and the page to not be the IdP.
|
|
await expect
|
|
.poll(() => new URL(page.url()).pathname.startsWith("/if/"), { timeout: 60_000 })
|
|
.toBe(false);
|
|
const body = await page.locator("body").innerText();
|
|
expect(body).not.toContain("Powered by authentik"); // authentik flow shell
|
|
expect(body).not.toContain("Sign in"); // generic login form
|
|
expect(body).not.toContain("Making sure you're not a bot");
|
|
const resp = await page.request.get(page.url());
|
|
expect(resp.status()).toBeLessThan(500);
|
|
});
|
|
}
|