dank
ee9eb353fb
A 304 carries no Content-Type by spec, and the OIDC bounce revalidates the entry script (Cache-Control: max-age=0 + ETag), so the blanket MIME assertion failed on a healthy bundle. The HTML-stub class is still caught: 200s are still judged, and the count floor now runs on the same filtered set.
96 lines
4.7 KiB
TypeScript
96 lines
4.7 KiB
TypeScript
import { expect, test } from "@playwright/test";
|
|
|
|
// Audiobookshelf: the SSO round trip must land a session with a real permission level.
|
|
//
|
|
// The service answers on a LAN address with no DNS name and no Caddy vhost, so it is in no
|
|
// guarded-vhost list and no other spec ever fetched a byte of it — every deploy gate passed
|
|
// while its login was dead. Two defect classes, both caught live on 2026-11-02:
|
|
//
|
|
// 1. The bundle must be BUILT for /audiobookshelf (ROUTER_BASE_PATH in the quadlet). Built
|
|
// for "/" the container still answers /healthcheck and still serves index.html, so the
|
|
// deploy health gate is green while the browser sees a blank page: every <script>
|
|
// resolves against the root, misses the static allowlist, and falls through to the SPA
|
|
// catch-all that returns index.html as text/html. Hence the MIME assertion below — the
|
|
// one thing that distinguishes a booted SPA from a served HTML stub.
|
|
// 2. The authentik provider row must carry grant_types AND the built-in OpenID scope
|
|
// mappings (provisioned by scripts/authentik-audiobookshelf-sso.sh). A blueprint
|
|
// re-import reverts hand-made provider rows silently, and the wire errors are generic:
|
|
// oauthlib's "The request is otherwise malformed" for an empty grant list, then
|
|
// "insufficient_scope" from ABS's /userinfo call for a short scope. Only the level
|
|
// assertion below — that the abs_groups claim granted site admin — sees either.
|
|
const HOST = "192.168.0.235:8000";
|
|
const ABS = `http://${HOST}/audiobookshelf`;
|
|
|
|
test("SSO round trip boots the SPA and grants a real Audiobookshelf session", async ({
|
|
page,
|
|
}) => {
|
|
test.setTimeout(180_000);
|
|
|
|
const scripts: { url: string; type: string; status: number }[] = [];
|
|
page.on("response", (res) => {
|
|
const u = new URL(res.url());
|
|
if (u.host === HOST && u.pathname.endsWith(".js")) {
|
|
scripts.push({ url: u.pathname, type: res.headers()["content-type"] ?? "", status: res.status() });
|
|
}
|
|
});
|
|
|
|
await page.goto(`${ABS}/login`, { waitUntil: "domcontentloaded" });
|
|
const sso = page.getByText("Sign in with Authentik");
|
|
await expect(sso).toBeVisible();
|
|
await sso.click();
|
|
|
|
// The admin project's storageState carries a live authentik session, so this is a silent
|
|
// round trip: authorize -> code -> callback -> token. Still on /login means the IdP
|
|
// refused the authorize request or ABS rejected the code exchange.
|
|
await expect
|
|
.poll(() => !new URL(page.url()).pathname.endsWith("/login"), { timeout: 90_000 })
|
|
.toBe(true);
|
|
|
|
await expect
|
|
.poll(
|
|
async () => {
|
|
const u = new URL(page.url());
|
|
return u.host === HOST && u.pathname.startsWith("/audiobookshelf");
|
|
},
|
|
{ timeout: 30_000 },
|
|
)
|
|
.toBe(true);
|
|
|
|
// Defect 1 gate: nothing the app loaded may be HTML dressed as a script. The render proof
|
|
// is the SSO button above — it only exists once the bundle has executed, so no DOM-shape
|
|
// guess is needed (the shell's own mount markup says nothing about whether it booted).
|
|
// Only responses that carried a body can be judged: the OIDC bounce re-validates the entry
|
|
// script (Cache-Control: max-age=0 + ETag) and a 304 carries no Content-Type by spec.
|
|
const bodies = scripts.filter((s) => s.status === 200);
|
|
expect(bodies.length, "the SPA loaded no JavaScript").toBeGreaterThan(2);
|
|
for (const s of bodies) {
|
|
expect(s.type, `${s.url} arrived as ${s.type}`).toContain("javascript");
|
|
}
|
|
|
|
// The token the app landed on is the credential its own API must accept. Give the SPA a
|
|
// moment to finish the exchange: the URL leaves /login the instant authentik bounces back
|
|
// through the callback route, which is BEFORE the app has stored what it exchanged.
|
|
const grabToken = () =>
|
|
page.evaluate(() => {
|
|
for (let i = 0; i < localStorage.length; i++) {
|
|
const v = localStorage.getItem(localStorage.key(i) as string) || "";
|
|
if (/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(v)) return v;
|
|
}
|
|
const c = document.cookie.match(/(?:^|;\s*)abs_token=([^;]+)/);
|
|
return c ? decodeURIComponent(c[1]) : "";
|
|
});
|
|
await expect.poll(grabToken, { timeout: 60_000 }).not.toBe("");
|
|
const token = await grabToken();
|
|
|
|
const me = await page.request.get(`${ABS}/api/me`, {
|
|
headers: { Authorization: `Bearer ${token}` },
|
|
});
|
|
expect(me.status()).toBe(200);
|
|
const user = await me.json();
|
|
expect(user.username).toBe("qa-e2e-admin");
|
|
// Site role, derived ONLY from the abs_groups claim: it says "admin" if and only if the
|
|
// scope mapping reached ABS with audiobookshelf_admins in the list. A short token scope
|
|
// (missing OpenID mappings) never gets this far — the exchange dies before it.
|
|
expect(user.type).toBe("admin");
|
|
});
|