mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-07 04:12:04 +00:00
Marc-André Bombeck
a23ee61184
A spec that arms `page.route(...)` in a `beforeEach` and never drops the handler races its own teardown. The context closes, an async handler is still awaiting, its next call rejects with "Test ended.", and Playwright attributes that to the test that had just passed. With `retries: 2` plus `failOnFlakyTests`, which spec bites is a matter of timing. `e2e/setup/test.ts` re-exports Playwright's `test` extended with an auto fixture that unroutes every page and the context after each test, and clears the page event listeners a spec subscribes to; `expect` rides along so a spec needs one import. Auto means a spec author cannot forget it and does not have to know it exists. Every spec now takes `test` from there, and `e2e-route-cleanup-guard.test.ts` keeps the import boundary closed with an allowlist that carries its reason. The per-file `afterEach` on the cycle spec goes away — leaving both would read as not trusting the fixture. Not covered: a page inside a context a spec builds itself. Only `share-documents.spec.ts` does that, and it owns those contexts.
35 lines
1.2 KiB
TypeScript
35 lines
1.2 KiB
TypeScript
import { expect, test } from "./setup/test";
|
|
|
|
/**
|
|
* The proxy at src/proxy.ts is the single gate enforcing auth on every
|
|
* non-public path. A regression that accidentally adds a route to
|
|
* PUBLIC_PATHS, or breaks the redirect, would expose unauthenticated
|
|
* surfaces. Verify a few representative routes round-trip to /auth/login.
|
|
*/
|
|
test.describe("proxy auth gate", () => {
|
|
for (const path of [
|
|
"/",
|
|
"/dashboard",
|
|
"/medications",
|
|
"/admin",
|
|
"/insights",
|
|
]) {
|
|
test(`${path} redirects to /auth/login when no session`, async ({
|
|
page,
|
|
}) => {
|
|
const response = await page.goto(path, { waitUntil: "domcontentloaded" });
|
|
expect(response).not.toBeNull();
|
|
// Either the proxy hands back a 307/308, or the navigation lands
|
|
// at /auth/login after redirect; both are acceptable proof.
|
|
expect(page.url()).toMatch(/\/auth\/login(\?|$)/);
|
|
});
|
|
}
|
|
|
|
test("public paths are reachable without a session", async ({ page }) => {
|
|
// /auth/login is in PUBLIC_PATHS — must be served, not bounced anywhere.
|
|
await page.goto("/auth/login");
|
|
expect(page.url()).toMatch(/\/auth\/login(\?|$)/);
|
|
await expect(page.locator("body")).toBeVisible();
|
|
});
|
|
});
|