Frank
93d1181fee
- Migrate all 127 non-reserved docs to OKF v0.1 frontmatter (type/description/tags/timestamp); fix 13 YAML issues, 2 duplicate-FM blocks, strip reserved-page FM - Restructure log.md to OKF (## YYYY-MM-DD, newest-first) - Fact-check against scripts/AGENTS.md ground truth: fix 6 false 'Active' banners on retired runbooks, 96->114 GiB GTT, deployment.md vs deploy-plan.py/deploy-remote.sh, Deployment Flow frank-medium=Quadlet, Calibre 9.9.0->9.15.0 + CVE-2025-7404 conflation, Copyparty v1.20.24, RomM 5.3.0 breaking change - Move *arr docs to new FrankBook-Pro/ section (git mv, link-safe) - Write active runbook bodies from ground truth (frank-large, frank-small) - Add 3 research briefs + HTML report: Local TTS and Voice Cloning, AI Job Search and Resume Tools, Most Popular Self-Hosted AI Apps (Jun-Sep 2026) - Add upstream-version rows to ComfyUI/OpenWebUI/Hermes app docs - All 336 tests pass; 136 pages, 0 unresolved wikilinks
74 lines
3.4 KiB
Markdown
74 lines
3.4 KiB
Markdown
---
|
|
type: reference
|
|
description: "`tests/e2e/` drives the **live fleet** through a real browser: fresh contexts"
|
|
tags:
|
|
- architecture
|
|
- e2e
|
|
- homepage
|
|
timestamp: 2026-09-01
|
|
---
|
|
|
|
# E2E Suite — homepage + guard chain (Playwright)
|
|
|
|
`tests/e2e/` drives the **live fleet** through a real browser: fresh contexts
|
|
hit `https://www.franksdank.cloud`, log in through the authentik two-stage
|
|
flow, and crawl every service link through the Caddy → Anubis → outpost
|
|
guard chain. It is the only test in this repo that exercises the chain as a
|
|
user sees it; the `bats` seams assert config shape, not behavior.
|
|
|
|
## Layout
|
|
|
|
| Path | Role |
|
|
|------|------|
|
|
| `playwright.config.ts` | four projects (below), real-browser UA, trace on failure |
|
|
| `specs/00-auth.setup.ts` | setup project: two real authentik logins, saves storage states |
|
|
| `specs/10-homepage.spec.ts` | user panel set + open links derived from `services.json` (registry-derived — no hardcoded service lists) |
|
|
| `specs/11-admin.spec.ts` | `admin` project: admin grid + `/admin/` RBAC (403 for standard user, members-only 200) |
|
|
| `specs/12-crawl.spec.ts` | every user open link reaches its real app through the guard chain |
|
|
| `specs/13-sso.spec.ts` | direct guarded-vhost visits resolve silently with ONLY the homepage session (single-login enforcement) |
|
|
| `specs/14-guard.spec.ts` | `guest` project, no storage state: unauthenticated traffic lands on the IdP login |
|
|
| `lib/login.ts` | `akLogin` helper (two-stage flow, shadow-DOM locators) |
|
|
| `lib/env.ts` | loads `.env.local`, exports `REAL_UA` |
|
|
| `tests/e2e_scaffold.bats` | bats seam: structure + no-credentials-tracked (never drives the fleet) |
|
|
|
|
## Projects and auth
|
|
|
|
- **setup** — logs in as `qa-e2e` and `qa-e2e-admin` (fleet-managed IdP test
|
|
users; the admin is a `homepage-admins` member), writes
|
|
`.auth/qa-e2e{,-admin}.json` storage states.
|
|
- **standard** — 10/12/13 with the user state.
|
|
- **admin** — 11 with the admin state.
|
|
- **guest** — 14 with an empty state.
|
|
|
|
Credentials live in `tests/e2e/.env.local` (git-ignored; placeholders in
|
|
`.env.local.example`). The scaffold bats seam fails the commit if creds or
|
|
auth states are ever tracked.
|
|
|
|
## Run
|
|
|
|
```bash
|
|
cd tests/e2e && npx playwright test # all projects
|
|
npx playwright test --project=standard 12-crawl.spec.ts # one slice
|
|
```
|
|
|
|
Requires LAN reachability of `www.franksdank.cloud` (Pi-hole DNS or public).
|
|
The suite is **not** part of `./tests/run.sh` — it needs the live fleet and
|
|
real IdP credentials.
|
|
|
|
## Gotchas (all paid for live)
|
|
|
|
1. **Fresh context per login.** Reusing a half-finished flow poisons
|
|
authentik's `pending_user` stage and the second login hangs. The setup
|
|
spec runs each login in its own context.
|
|
2. **Lit stage re-render race.** authentik's flow executor can re-render the
|
|
password stage right after mount, wiping a programmatic `fill`; the submit
|
|
then POSTs an empty form ("This field is required"). `akLogin` fills,
|
|
**verifies the value survived**, submits via Enter, and retries.
|
|
3. **Headless UA = bot.** Anubis denies obvious headless UAs; the config
|
|
overrides `userAgent` with a real Chrome UA (`REAL_UA`).
|
|
4. **Cold Anubis PoW.** The first challenge in a fresh context can outlive
|
|
default assertion budgets; title asserts carry 60s budgets.
|
|
5. **Solve-once cookie.** Since Anubis v1.27.0 + `COOKIE_DOMAIN` (see
|
|
[[Anubis]]), one PoW per fresh context covers every guarded vhost — crawl
|
|
and SSO specs complete in ~0.5 s per vhost instead of a PoW each.
|