test(e2e): reconcile OIDC plumbing specs with Security-API auth UI - #359
Merged
Conversation
The "OIDC plumbing (local user, no Google)" job failed on master because the browser specs drifted from the reworked login UI (migrated to FuzeFront's Security API). The 7 API-level tests pass; the 3 browser tests asserted removed behaviour: - Native credentials form now posts POST /api/v1/security/session (authAPI.login), not the old /api/auth/oidc/password. Point the waitForResponse at the current endpoint. - The dedicated "Sign in with Authentik" redirect button was removed; the only redirect entry point is the Google button (-> /api/v1/security/social/google/start). In no-Google mode (empty GOOGLE_CLIENT_ID) a full interactive Authentik round-trip is unreachable, so the old full-OIDC-via-button test can't pass. Replace it with one asserting the button initiates the server-brokered social start. The real server-side OIDC token exchange against Authentik is still covered end-to-end by the passing API-level password test, and interactive social is covered by the separate tunnel-mode Google e2e. Remove the now-unused Authentik login-form helper. - Error-display test hit a Playwright strict-mode violation (the error surfaces in 2 elements); scope the locator to .first(). Test-only change; no app code touched (no regression found — the app behaviour the specs now assert is the current, intended behaviour). Co-Authored-By: Claude <claude-opus-4-8> <noreply@anthropic.com> Claude-Session-Id: a560dedc-819a-4776-bee0-3f8703ae66fe
Contributor
Automated code review (gate-code-review)Credit balance is too low Report-only — this check never blocks merge. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The "OIDC plumbing (local user, no Google)" CI job fails on
master, so every PR inherits the red check (observed on frames-only PR #335 and on #345). The 7 API-level tests pass; 3 browser tests infrontend/tests/oidc-plumbing.e2e.spec.tsassert behaviour the reworked login UI no longer has (auth migrated to FuzeFront's Security API inLoginPage.tsx/api.ts).Root cause: test drift (no app regression)
waitForURL(AUTHENTIK_URL/**)/api/v1/security/social/google/start. In no-Google mode (GOOGLE_CLIENT_IDempty — "inert when empty") a full interactive Authentik round-trip is unreachable.waitForResponse(/api/auth/oidc/password)POST /api/v1/security/session(authAPI.login).locator(...).toBeVisible()Changes (test-only)
POST /api/v1/security/session(the endpoint the UI actually calls)./api/v1/security/social/google/start). The real server-side OIDC token exchange against Authentik stays covered end-to-end by the passing API-level password test; interactive social is covered by the separate tunnel-mode Google e2e. Removed the now-unusedfillAuthentikLoginhelper..first()to resolve the strict-mode ambiguity (assert the error is shown, not that it's unique).No app code touched — the behaviour the specs now assert is the current, intended behaviour.
Verification
Authoritative check is the OIDC plumbing job on this PR (it runs the full docker-compose.e2e + Authentik stack). Watching it after open.
🤖 Generated with Claude Code