mirror of
https://github.com/penpot/penpot.git
synced 2026-08-06 21:08:34 +00:00
636bc22cc4
Add end-to-end HTTP tests under backend/test/e2e/ using Node.js built-in test runner (node:test) and native fetch. Tests run through the devenv nginx proxy on port 3450. Test suites (19 tests total): - auth-flow: demo profile creation, login, session cookies, access tokens - export-binfile: file creation, export to asset URL via SSE - asset-download: download with cookie/token auth, 401 without auth, S3 redirect behavior, full export-to-download flow Key findings documented in tests: - nginx @handle_redirect intercepts backend 307 and proxies to S3 directly, stripping the client Authorization header (bug does not reproduce in devenv) - SSE end event uses ~#uri tagged format for URLs - Unauthenticated RPC returns uuid/zero profile (not null) AI-assisted-by: mimo-v2.5-pro Signed-off-by: Andrey Antukh <niwi@niwi.nz>
79 lines
2.6 KiB
JavaScript
79 lines
2.6 KiB
JavaScript
import { describe, it } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import {
|
|
createDemoProfile,
|
|
login,
|
|
setupTestProfile,
|
|
} from "./helpers/auth.mjs";
|
|
import { rpcPost } from "./helpers/client.mjs";
|
|
|
|
describe("auth flow", () => {
|
|
it("creates a demo profile", async () => {
|
|
const { email, password } = await createDemoProfile();
|
|
assert.match(email, /^demo-.*\.demo@example\.com$/);
|
|
assert.ok(password.length > 0);
|
|
});
|
|
|
|
it("logs in with valid credentials", async () => {
|
|
const { email, password } = await createDemoProfile();
|
|
const { profile, cookie } = await login(email, password);
|
|
|
|
assert.equal(profile.email, email);
|
|
assert.equal(profile.isDemo, true);
|
|
assert.ok(profile.id, "profile should have id");
|
|
assert.ok(profile.defaultProjectId, "profile should have defaultProjectId");
|
|
assert.ok(profile.defaultTeamId, "profile should have defaultTeamId");
|
|
assert.ok(cookie, "cookie should be set");
|
|
});
|
|
|
|
it("login sets session cookie", async () => {
|
|
const { email, password } = await createDemoProfile();
|
|
const { cookie } = await login(email, password);
|
|
assert.ok(cookie, "auth-token cookie should be extracted");
|
|
assert.ok(cookie.length > 10, "cookie should have meaningful length");
|
|
});
|
|
|
|
it("login fails with wrong password", async () => {
|
|
const { email } = await createDemoProfile();
|
|
try {
|
|
await login(email, "wrong-password");
|
|
assert.fail("should have thrown");
|
|
} catch (e) {
|
|
assert.ok(e.message.includes("Login failed"));
|
|
}
|
|
});
|
|
|
|
it("login fails with non-existent email", async () => {
|
|
try {
|
|
await login("nonexistent@example.com", "some-password");
|
|
assert.fail("should have thrown");
|
|
} catch (e) {
|
|
assert.ok(e.message.includes("Login failed"));
|
|
}
|
|
});
|
|
|
|
it("authenticated RPC with cookie", async () => {
|
|
const { profile, cookie } = await setupTestProfile();
|
|
const res = await rpcPost("get-profile", {}, { cookieToken: cookie });
|
|
assert.equal(res.status, 200);
|
|
assert.equal(res.body.id, profile.id);
|
|
assert.equal(res.body.email, profile.email);
|
|
});
|
|
|
|
it("unauthenticated RPC returns anonymous profile", async () => {
|
|
const res = await rpcPost("get-profile", {});
|
|
assert.equal(res.status, 200);
|
|
// Anonymous profile has uuid/zero as id
|
|
assert.equal(res.body.id, "00000000-0000-0000-0000-000000000000");
|
|
});
|
|
|
|
it("setupTestProfile returns all fields", async () => {
|
|
const { profile, cookie, email, password } = await setupTestProfile();
|
|
assert.ok(profile.id);
|
|
assert.ok(profile.defaultProjectId);
|
|
assert.ok(cookie);
|
|
assert.ok(email);
|
|
assert.ok(password);
|
|
});
|
|
});
|