Marc-André Bombeck
b428fcf74f
The replay control submitted the enrolment code at the login challenge and asserted a 401. That 401 is the same answer the route gives a code that has simply drifted out of its ±1-step window, and by the time the journey reached the challenge — a rotation, a refused rotation, a sign-out, a page load and an Argon2id verify later — the enrolment code usually had. Out of window, the refusal happens before the monotonic floor is ever consulted, so the control could pass with the floor deleted. Both TOTP refusals now assert the verdict the route records itself, auth.mfa.failed with details.replay, written and awaited before it answers: false for a code that never matched the secret, true for the replay. Flipping that verdict while leaving the refusal in place turns the positive half red, which is what the old assertion could not do. The replayed code is the one the previous sign-in just spent, so the window is a property of the journey rather than of the wall clock: the accept is taken at a step boundary when the current step has too little left, which bounds the wait by one period and leaves the pair at least two. The rotation stages no longer press Escape to get the confirmation out of the way. They assert the card closes it, by test id.
e2e/
End-to-end browser tests. Playwright 1.60 drives a production build of the app against a real PostgreSQL, with @axe-core/playwright for accessibility assertions. This is the heaviest test tier; CI runs it on every PR, and locally it is worth running when a change touches a UI flow.
Running
pnpm e2e
The Playwright config (../playwright.config.ts) builds the app (next build) and brings up Postgres before the specs run; setup/global-setup.ts seeds the auth + fixture state. The suite is not part of the fast local gate (typecheck / lint / test) — it surfaces at PR CI, so expect responsive/wizard/nav reworks to flag here first.
Layout
setup/—test.ts(the suite'stest+expectentry point),global-setup.ts(auth + DB seeding),test-helpers.ts(shared login + navigation helpers).utils/— fixtures such asmock-dashboard-snapshot.ts.*.spec.ts— one spec per flow: auth/login/redirect, dashboard, charts, the medication-wizard cadences (medications-wizard-*), insights generation + scroll restoration, doctor report, settings, mobile-viewport consistency, locale switch, accessibility (a11y.spec.ts), and thev1427-*regression set.
Conventions
Import test and expect from ./setup/test, never from @playwright/test — types (Page, Route, …) still come from the package. The entry point extends Playwright's test with an automatic fixture that drops route handlers and page listeners after every test, so a handler left in flight cannot fail the test it belonged to once the context closes. src/__tests__/e2e-route-cleanup-guard.test.ts enforces the import boundary.
Assert against stable data-* attributes (data-slot, data-display-step, root display attrs), not viewport-dependent visible text. Responsive sm:hidden UI changes break getByText on desktop while the underlying element is still present — anchoring on data attributes keeps the specs stable across breakpoints. See ../CLAUDE.md.