feat: complete Epic 1 production foundation

2026-08-25 01:24:11 +03:00
parent 767428436d
commit 182bde8ac0
298 changed files with 35719 additions and 5299 deletions
@@ -1,6 +1,43 @@
 const { test, expect } = require('@playwright/test');
 const { ADMIN_EMAIL, ADMIN_PASSWORD, localized } = require('./helpers');

+const SESSION_FIXTURE = {
+  user: {
+    id: 'user-test',
+    email: ADMIN_EMAIL,
+    display_name: 'Crank Owner',
+  },
+  memberships: [
+    {
+      role: 'owner',
+      workspace: {
+        id: 'workspace-test',
+        slug: 'default',
+        name: 'Default Workspace',
+      },
+    },
+  ],
+  current_workspace_id: 'workspace-test',
+  csrf_token: 'csrf_test_token',
+};
+
+async function stubLoginPageSession(page, bootstrapRequired) {
+  await page.route('**/api/auth/session', async (route) => {
+    await route.fulfill({
+      status: 401,
+      contentType: 'application/json',
+      body: JSON.stringify({ error: { message: 'unauthorized' } }),
+    });
+  });
+  await page.route('**/api/auth/bootstrap/status', async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({ bootstrap_required: bootstrapRequired }),
+    });
+  });
+}
+
 test('login page rejects invalid credentials', async ({ page }) => {
  await page.goto('/login');
  await page.locator('#email').fill(ADMIN_EMAIL);
@@ -10,6 +47,29 @@ test('login page rejects invalid credentials', async ({ page }) => {
 });

 test('login page signs in and redirects to operations', async ({ page }) => {
+  let loggedIn = false;
+  await page.route('**/api/auth/session', async (route) => {
+    await route.fulfill({
+      status: loggedIn ? 200 : 401,
+      contentType: 'application/json',
+      body: JSON.stringify(loggedIn ? SESSION_FIXTURE : { error: { message: 'unauthorized' } }),
+    });
+  });
+  await page.route('**/api/auth/bootstrap/status', async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({ bootstrap_required: false }),
+    });
+  });
+  await page.route('**/api/auth/login', async (route) => {
+    loggedIn = true;
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify(SESSION_FIXTURE),
+    });
+  });
  await page.goto('/login');
  await page.locator('#email').fill(ADMIN_EMAIL);
  await page.locator('#password').fill(ADMIN_PASSWORD);
@@ -17,3 +77,53 @@ test('login page signs in and redirects to operations', async ({ page }) => {
  await expect(page).toHaveURL(/\/$/);
  await expect(page.locator('.page-title, .page-heading').first()).toHaveText(localized('Operations', 'Операции'));
 });
+
+test('login page switches to bootstrap mode and submits one-time token', async ({ page }) => { // community-scope: allow=one-time-token
+  await stubLoginPageSession(page, true);
+  let completePayload = null;
+  await page.route('**/api/auth/bootstrap/complete', async (route) => {
+    completePayload = route.request().postDataJSON();
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify(SESSION_FIXTURE),
+    });
+  });
+
+  await page.goto('/login');
+  await expect(page.locator('#login-form')).toHaveAttribute('data-bootstrap', 'true');
+  await expect(page.locator('#login-email-field')).toBeHidden();
+  await expect(page.locator('#login-bootstrap-token-field')).toBeVisible();
+  await page.locator('#bootstrap-token').fill('boot_test_one_time_token'); // community-scope: allow=one-time-token
+  await page.locator('#password').fill('new-admin-password');
+  await page.locator('.btn-signin').click();
+
+  await expect.poll(() => completePayload).toMatchObject({
+    token: 'boot_test_one_time_token', // community-scope: allow=one-time-token
+    password: 'new-admin-password',
+  });
+});
+
+test('CrankApi attaches csrf token to unsafe auth requests', async ({ page }) => {
+  await stubLoginPageSession(page, false);
+  let csrfHeader = null;
+  await page.route('**/api/auth/password', async (route) => {
+    csrfHeader = route.request().headers()['x-csrf-token'] || null;
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({ ok: true }),
+    });
+  });
+
+  await page.goto('/login');
+  await page.evaluate((session) => {
+    window.CrankAuth.replaceSession(session);
+  }, SESSION_FIXTURE);
+  await page.evaluate(() => window.CrankApi.changePassword({
+    current_password: 'old-password',
+    new_password: 'new-password',
+  }));
+
+  await expect.poll(() => csrfHeader).toBe('csrf_test_token');
+});