auth.spec.ts · Source

auth.spec.tstests/e2e/specs/auth.spec.tsraw ← specs9,466 B← Back to the app
1/**
2 * AI Software Factory — E2E: Authentication (Phase 1)
3 *
4 * Covers the full auth flow: registration, login, logout, session handling,
5 * wrong-password errors, password reset, and rate limiting. These are the
6 * canonical auth E2E tests from AGENTS.md (Phase 1 exit criteria).
7 *
8 * Selector convention (documented in tests/README.md):
9 *   data-testid="auth-email"          login/register email input
10 *   data-testid="auth-password"       login/register password input
11 *   data-testid="auth-submit"         login/register submit button
12 *   data-testid="auth-error"          error message under the form
13 *   data-testid="user-menu"           top-right user menu
14 *   data-testid="user-menu-logout"    logout item in the user menu
15 *   data-testid="sidebar"             workspace sidebar (visible when logged in)
16 */
17import { test, expect, DEMO_EMAIL, DEMO_PASSWORD } from "../fixtures";
18import { register, login, me } from "../utils/api";
19 
20const uniqueEmail = () =>
21  `e2e-auth-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@factory.local`;
22 
23test.describe("Authentication — Phase 1", () => {
24  test("register → verify email → login lands in personal workspace", async ({
25    browser,
26  }) => {
27    // NOTE: email verification itself is SKIPPED in this flow — dev has no
28    // mail server. The register response in dev mode auto-verifies (or the
29    // seeded user is already verified); we assert the downstream behavior
30    // (login works, personal workspace exists). See "verify email" test below.
31    const email = uniqueEmail();
32    const password = "correct-horse-battery-9";
33    const name = "Auth E2E User";
34 
35    // Register + login through the API (the API is the contract).
36    const plain = await browser.newContext();
37    const plainApi = plain.request;
38    await register(plainApi, email, password, name);
39    await login(plainApi, email, password);
40 
41    // Now drive the UI with the new user's session: the cookies from the
42    // login jar (the httpOnly `factory_refresh` cookie is the source of
43    // truth). The access token is NOT mirrored into localStorage — the web
44    // client keeps it in JS memory and re-issues it from the cookie on load
45    // (silent refresh; security-architecture.md — S10 dropped the stale
46    // Phase-1 localStorage mirror).
47    const context = await browser.newContext();
48    await context.addCookies(
49      (await plain.cookies()).map((c) => ({
50        name: c.name,
51        value: c.value,
52        domain: c.domain,
53        path: c.path,
54        expires: c.expires,
55        httpOnly: c.httpOnly,
56        secure: c.secure,
57        sameSite: c.sameSite,
58      })),
59    );
60    const page = await context.newPage();
61    await page.goto("/");
62    // After login the app lands in the user's (auto-created) personal
63    // workspace: the sidebar must be visible.
64    await expect(page.getByTestId("sidebar")).toBeVisible({ timeout: 20_000 });
65    await context.close();
66    await plain.close();
67  });
68 
69  test("login → redirect to personal workspace", async ({ browser }) => {
70    // Fresh context: no auth state at all.
71    const context = await browser.newContext();
72    const page = await context.newPage();
73    await page.goto("/login");
74 
75    await page.getByTestId("auth-email").fill(DEMO_EMAIL);
76    await page.getByTestId("auth-password").fill(DEMO_PASSWORD);
77    await page.getByTestId("auth-submit").click();
78 
79    // Login succeeds → redirected away from /login into the workspace shell.
80    await page.waitForURL((url) => !url.pathname.startsWith("/login"), {
81      timeout: 20_000,
82    });
83    await expect(page.getByTestId("sidebar")).toBeVisible();
84    await context.close();
85  });
86 
87  test("logout → redirect to login page", async ({ authPage }) => {
88    await authPage.goto("/");
89    await expect(authPage.getByTestId("sidebar")).toBeVisible();
90 
91    await authPage.getByTestId("user-menu").click();
92    await authPage.getByTestId("user-menu-logout").click();
93 
94    await authPage.waitForURL((url) => url.pathname.startsWith("/login"), {
95      timeout: 15_000,
96    });
97    // The sidebar must be gone after logout.
98    await expect(authPage.getByTestId("sidebar")).toHaveCount(0);
99  });
100 
101  test("wrong password shows error and does not log in", async ({ browser }) => {
102    const context = await browser.newContext();
103    const page = await context.newPage();
104    await page.goto("/login");
105 
106    await page.getByTestId("auth-email").fill(DEMO_EMAIL);
107    await page.getByTestId("auth-password").fill("definitely-wrong-password-123");
108    await page.getByTestId("auth-submit").click();
109 
110    // Error message visible, still on the login page.
111    const error = page.getByTestId("auth-error");
112    await expect(error).toBeVisible({ timeout: 10_000 });
113    await expect(error).toContainText(/invalid|incorrect|wrong/i);
114    await expect(page).toHaveURL(/\/login/);
115    await expect(page.getByTestId("sidebar")).toHaveCount(0);
116    await context.close();
117  });
118 
119  test("registering an existing email is rejected", async ({ api }) => {
120    // DEMO_EMAIL already exists (seeded).
121    const res = await api.post("/api/v1/auth/register", {
122      data: { email: DEMO_EMAIL, password: "another-password-123", name: "Dupe" },
123    });
124    expect([400, 409]).toContain(res.status());
125  });
126 
127  test("verify email (skip: no mail server in dev)", async () => {
128    // Email verification (Phase 1) sends a magic link. Local dev has no SMTP
129    // sink, so this test is intentionally skipped until a mail-capture
130    // service (e.g. Mailpit) is added to docker-compose.
131    test.skip(true, "lands with a mail sink in dev (Mailpit in docker-compose) — Phase 1");
132    // When unskipped: register, read the verification link from the captured
133    // mail, open it, and assert GET /api/v1/auth/me reports verified=true.
134  });
135 
136  test("password reset flow (skip: token not exposed to the client in dev)", async () => {
137    // The reset token is sent by email; without a mail sink the E2E cannot
138    // complete the loop. The integration suite covers the full contract
139    // (request → token → single-use → expiry) via the DB.
140    test.skip(true, "covered by tests/integration (auth.integration.test.ts) — Phase 1");
141    // When unskipped: request reset → grab token (mail sink or admin API) →
142    // POST /api/v1/auth/password-reset/confirm → old password invalid,
143    // new password valid, token single-use (second confirm fails).
144  });
145 
146  test("rate limit kicks in after 10+ failed logins", async ({ browser }) => {
147    // The API rate-limits /api/v1/auth/login (auth edge zone: 10 req/min per
148    // IP at nginx; the API applies its own limit). After 10+ rapid failures
149    // from one IP the endpoint must return 429.
150    const context = await browser.newContext();
151    const api = context.request;
152    const email = uniqueEmail();
153 
154    // Register the user first so failures are "wrong password", not
155    // "unknown user" (both are rate-limited, but this is the documented case).
156    const regApi = await browser.newContext();
157    await register(regApi.request, email, "pw-12345678", "Rate Limit User");
158    await regApi.close();
159 
160    let got429 = false;
161    let lastStatus = 0;
162    for (let i = 0; i < 12; i++) {
163      const res = await api.post("/api/v1/auth/login", {
164        data: { email, password: "wrong-password-" + i },
165      });
166      lastStatus = res.status();
167      if (res.status() === 429) {
168        got429 = true;
169        break;
170      }
171    }
172    expect(
173      got429,
174      `expected a 429 within 12 failed logins (last status: ${lastStatus}) — ` +
175        "check RATE_LIMIT_* env / auth rate limiter config",
176    ).toBe(true);
177 
178    // A correct password is ALSO rejected while limited (the limiter does
179    // not inspect the body).
180    const resAfter = await api.post("/api/v1/auth/login", {
181      data: { email, password: "pw-12345678" },
182    });
183    expect(resAfter.status()).toBe(429);
184    await context.close();
185  });
186 
187  test("refresh token rotation: reuse of a rotated token is rejected", async ({
188    api,
189  }) => {
190    // API-level proof of rotation (the UI inherits it). Login → rotate →
191    // reusing the FIRST refresh token must be rejected (reuse detection).
192    const context = api; // already the demo user's context
193    const email = uniqueEmail();
194    // Use a fresh user so rotation state is clean.
195    const reg = await register(context, email, "rotate-pw-12345678", "Rotation User");
196    void reg;
197    const l1 = await login(context, email, "rotate-pw-12345678");
198    const first = l1.refreshToken;
199    expect(first, "login response must include a refresh token").toBeTruthy();
200 
201    // Rotate once (the /refresh endpoint returns a NEW token and invalidates
202    // the old one).
203    const r1 = await context.post("/api/v1/auth/refresh", {
204      data: { refreshToken: first },
205    });
206    expect(r1.status()).toBe(200);
207    const r1body = await r1.json();
208    const second: string | undefined =
209      r1body?.refreshToken ?? r1body?.refresh_token;
210    expect(second).toBeTruthy();
211    expect(second).not.toBe(first);
212 
213    // Reusing the FIRST (already rotated) token must fail — reuse detection.
214    const reuse = await context.post("/api/v1/auth/refresh", {
215      data: { refreshToken: first },
216    });
217    expect([400, 401, 403]).toContain(reuse.status());
218  });
219 
220  test("me endpoint reflects the authenticated user", async ({ api, user }) => {
221    const who = await me(api);
222    expect(who.email).toBe(user.email);
223  });
224});
225