crank/apps/ui/tests/e2e/login.spec.js

const { test, expect } = require('@playwright/test');
const { ADMIN_EMAIL, ADMIN_PASSWORD, localized } = require('./helpers');

const SESSION_FIXTURE = {
  user: {
    id: 'user-test',
    email: ADMIN_EMAIL,
    display_name: 'Crank Owner',
  },
  memberships: [
    {
      role: 'owner',
      workspace: {
        id: 'workspace-test',
        slug: 'default',
        name: 'Default Workspace',
      },
    },
  ],
  current_workspace_id: 'workspace-test',
  csrf_token: 'csrf_test_token',
};

async function stubLoginPageSession(page, bootstrapRequired) {
  await page.route('**/api/auth/session', async (route) => {
    await route.fulfill({
      status: 401,
      contentType: 'application/json',
      body: JSON.stringify({ error: { message: 'unauthorized' } }),
    });
  });
  await page.route('**/api/auth/bootstrap/status', async (route) => {
    await route.fulfill({
      status: 200,
      contentType: 'application/json',
      body: JSON.stringify({ bootstrap_required: bootstrapRequired }),
    });
  });
}

test('login page rejects invalid credentials', async ({ page }) => {
  await page.goto('/login');
  await page.locator('#email').fill(ADMIN_EMAIL);
  await page.locator('#password').fill('wrong-password');
  await page.locator('.btn-signin').click();
  await expect(page.locator('#login-error')).toBeVisible();
});

test('login page signs in and redirects to operations', async ({ page }) => {
  let loggedIn = false;
  await page.route('**/api/auth/session', async (route) => {
    await route.fulfill({
      status: loggedIn ? 200 : 401,
      contentType: 'application/json',
      body: JSON.stringify(loggedIn ? SESSION_FIXTURE : { error: { message: 'unauthorized' } }),
    });
  });
  await page.route('**/api/auth/bootstrap/status', async (route) => {
    await route.fulfill({
      status: 200,
      contentType: 'application/json',
      body: JSON.stringify({ bootstrap_required: false }),
    });
  });
  await page.route('**/api/auth/login', async (route) => {
    loggedIn = true;
    await route.fulfill({
      status: 200,
      contentType: 'application/json',
      body: JSON.stringify(SESSION_FIXTURE),
    });
  });
  await page.goto('/login');
  await page.locator('#email').fill(ADMIN_EMAIL);
  await page.locator('#password').fill(ADMIN_PASSWORD);
  await page.locator('.btn-signin').click();
  await expect(page).toHaveURL(/\/$/);
  await expect(page.locator('.page-title, .page-heading').first()).toHaveText(localized('Operations', 'Операции'));
});

test('login page switches to bootstrap mode and submits one-time token', async ({ page }) => { // community-scope: allow=one-time-token
  await stubLoginPageSession(page, true);
  let completePayload = null;
  await page.route('**/api/auth/bootstrap/complete', async (route) => {
    completePayload = route.request().postDataJSON();
    await route.fulfill({
      status: 200,
      contentType: 'application/json',
      body: JSON.stringify(SESSION_FIXTURE),
    });
  });

  await page.goto('/login');
  await expect(page.locator('#login-form')).toHaveAttribute('data-bootstrap', 'true');
  await expect(page.locator('#login-email-field')).toBeHidden();
  await expect(page.locator('#login-bootstrap-token-field')).toBeVisible();
  await page.locator('#bootstrap-token').fill('boot_test_one_time_token'); // community-scope: allow=one-time-token
  await page.locator('#password').fill('new-admin-password');
  await page.locator('.btn-signin').click();

  await expect.poll(() => completePayload).toMatchObject({
    token: 'boot_test_one_time_token', // community-scope: allow=one-time-token
    password: 'new-admin-password',
  });
});

test('CrankApi attaches csrf token to unsafe auth requests', async ({ page }) => {
  await stubLoginPageSession(page, false);
  let csrfHeader = null;
  await page.route('**/api/auth/password', async (route) => {
    csrfHeader = route.request().headers()['x-csrf-token'] || null;
    await route.fulfill({
      status: 200,
      contentType: 'application/json',
      body: JSON.stringify({ ok: true }),
    });
  });

  await page.goto('/login');
  await page.evaluate((session) => {
    window.CrankAuth.replaceSession(session);
  }, SESSION_FIXTURE);
  await page.evaluate(() => window.CrankApi.changePassword({
    current_password: 'old-password',
    new_password: 'new-password',
  }));

  await expect.poll(() => csrfHeader).toBe('csrf_test_token');
});