Marc-André Bombeck
50a65b6f80
Enrol TOTP from the settings surface, sign out, sign back in through the challenge, and step up for a recovery-code rotation — in a browser, against a real server, on a throwaway account the journey seeds and drops itself. Four refusals ride alongside the four positives: a wrong code at the challenge (401, no session cookie, and the ticket's attempt counter moved), the enrolment code replayed (401, refused by the monotonic totpLastStep floor), the rotation once the session's mfaVerifiedAt has aged past the five-minute window (401 with meta.errorCode auth.stepup.required), and a recovery code presented a second time (401). Each was proved to fail by removing the control it stands on and watching that one assertion break. Codes are computed from the enrolment secret with the otpauth dependency the server verifies against, at explicit timestamps, so nothing waits on a step boundary: the sign-in code is generated one step ahead of now, inside the ±1 drift window and necessarily above the replay floor. The fixture reaches Postgres for the two things that have no endpoint by design — ageing the step-up stamp, and emptying the per-IP auth buckets this journey would otherwise exhaust. The account carries the Playwright project name so the two browser projects never drive one factor state. Adds data-testid hooks on the TOTP card, the login step, and the password form so the spec asserts on stable attributes instead of rendered text.
e2e/
End-to-end browser tests. Playwright 1.60 drives a production build of the app against a real PostgreSQL, with @axe-core/playwright for accessibility assertions. This is the heaviest test tier; CI runs it on every PR, and locally it is worth running when a change touches a UI flow.
Running
pnpm e2e
The Playwright config (../playwright.config.ts) builds the app (next build) and brings up Postgres before the specs run; setup/global-setup.ts seeds the auth + fixture state. The suite is not part of the fast local gate (typecheck / lint / test) — it surfaces at PR CI, so expect responsive/wizard/nav reworks to flag here first.
Layout
setup/—test.ts(the suite'stest+expectentry point),global-setup.ts(auth + DB seeding),test-helpers.ts(shared login + navigation helpers).utils/— fixtures such asmock-dashboard-snapshot.ts.*.spec.ts— one spec per flow: auth/login/redirect, dashboard, charts, the medication-wizard cadences (medications-wizard-*), insights generation + scroll restoration, doctor report, settings, mobile-viewport consistency, locale switch, accessibility (a11y.spec.ts), and thev1427-*regression set.
Conventions
Import test and expect from ./setup/test, never from @playwright/test — types (Page, Route, …) still come from the package. The entry point extends Playwright's test with an automatic fixture that drops route handlers and page listeners after every test, so a handler left in flight cannot fail the test it belonged to once the context closes. src/__tests__/e2e-route-cleanup-guard.test.ts enforces the import boundary.
Assert against stable data-* attributes (data-slot, data-display-step, root display attrs), not viewport-dependent visible text. Responsive sm:hidden UI changes break getByText on desktop while the underlying element is still present — anchoring on data attributes keeps the specs stable across breakpoints. See ../CLAUDE.md.