vliaudatandClaude Opus 5
446021cd75
Twenty-six tests across two viewports, covering what the spec asks for: changing today's hours reaches the panel, a message survives the translation service being unavailable, a closure period closes the days it covers — plus the authorisation paths and the sign-out regression. They run against the standalone build served the way the container serves it, not `next start`, which refuses to work with standalone output anyway. The suite therefore exercises the artifact that ships rather than a second arrangement that could drift from it. Sign-in mints the session cookie Auth.js would have issued rather than driving Authentik. What is under test is the application's behaviour for a given role; the handshake itself is verified against the live provider separately, and standing up an identity provider per run would trade a lot of machinery for coverage of somebody else's code. The secret lives in one module imported by both the config and the fixtures — when it differed, every signed-in test failed at once while looking like an authorisation bug. Database access goes through plain SQL rather than the Prisma client, whose generated module format Playwright's loader and Next's bundler disagree about. That traded one problem for a subtler one: node-postgres parses a DATE column into a local-midnight Date, so reading it back shifted the day at UTC+2. Dates are read as text now. The mobile profile runs on Chromium: WebKit needs system packages only root can install, and a suite nobody can run locally is a suite nobody runs. The config says how to switch to the real engine. Two real defects surfaced, both found by the tests rather than by reading. The seven "Ouvert" checkboxes on the hours page were indistinguishable to a screen reader; each now names its day. And on a phone the signed-in address appeared nowhere at all — the header hides it to save room — so nobody could tell which account was about to sign an audit entry on a device the shop shares. It is on the dashboard now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012cSY9pVhZmJUKNN7wf1Myd
53 lines
2.1 KiB
TypeScript
53 lines
2.1 KiB
TypeScript
import { expect, resetDatabase, signIn, test } from './fixtures';
|
|
|
|
test.beforeEach(async () => {
|
|
await resetDatabase();
|
|
});
|
|
|
|
test('an anonymous visitor is sent to the sign-in screen', async ({ page }) => {
|
|
await page.goto('/admin/horaires');
|
|
await expect(page).toHaveURL(/\/login/);
|
|
await expect(page.getByRole('button', { name: /Se connecter/ })).toBeVisible();
|
|
});
|
|
|
|
test('an anonymous fetch of an admin route gets a status, not a login page', async ({ request }) => {
|
|
const response = await request.post('/api/admin/holidays/sync');
|
|
expect(response.status()).toBe(401);
|
|
});
|
|
|
|
test('an administrator reaches the dashboard', async ({ page }) => {
|
|
await signIn(page, 'admin');
|
|
await page.goto('/admin');
|
|
await expect(page.getByRole('heading', { name: 'Tableau de bord' })).toBeVisible();
|
|
// The header also carries the address but hides it on a narrow screen, so
|
|
// the assertion targets the line under the heading, which is always shown.
|
|
await expect(page.getByText(/Connecté en tant que admin@ita-ito\.test/)).toBeVisible();
|
|
});
|
|
|
|
test('a read-only account can look but not change', async ({ page }) => {
|
|
await signIn(page, 'viewer');
|
|
await page.goto('/admin/horaires');
|
|
|
|
await expect(page.getByText(/lecture seule/i).first()).toBeVisible();
|
|
// The save button is not merely disabled; it is not rendered at all.
|
|
await expect(page.getByRole('button', { name: 'Enregistrer' })).toHaveCount(0);
|
|
});
|
|
|
|
test('a read-only account is refused a write by the API', async ({ page, request }) => {
|
|
await signIn(page, 'viewer');
|
|
const cookies = await page.context().cookies();
|
|
const response = await request.post('/api/admin/holidays/sync', {
|
|
headers: { cookie: cookies.map((c) => `${c.name}=${c.value}`).join('; ') },
|
|
});
|
|
expect(response.status()).toBe(403);
|
|
});
|
|
|
|
test('a read-only account can still sign out', async ({ page }) => {
|
|
// Regression: gating page POSTs by role broke every form for viewers,
|
|
// sign-out included.
|
|
await signIn(page, 'viewer');
|
|
await page.goto('/admin');
|
|
await page.getByRole('button', { name: 'Se déconnecter' }).click();
|
|
await expect(page).toHaveURL(/\/login/);
|
|
});
|