Initial Playwright ERP UAT VAPT test suite v2.4.1 IMAP

fixtures/assertions.js

@@ -0,0 +1,33 @@
+const { expect } = require('@playwright/test');
+
+async function expectNoServerError(page) {
+  const body = await page.locator('body').innerText().catch(()=>'');
+  expect(page.url()).not.toContain('500');
+  expect(body).not.toMatch(/Internal Server Error|Traceback|Exception in ASGI application|AttributeError|UndefinedError/i);
+}
+
+async function expectBlockedOrSafe(page, response) {
+  const status = response ? response.status() : 0;
+  const body = await page.locator('body').innerText().catch(()=>'');
+  const safeStatus = [401,403,404,405,422].includes(status);
+  const safeText = /access denied|forbidden|unauthorized|not found|permission|login|required|invalid/i.test(body);
+  const redirectedLogin = page.url().includes('/login');
+  expect(safeStatus || safeText || redirectedLogin).toBeTruthy();
+  await expectNoServerError(page);
+}
+
+async function expectSecurityHeaders(response) {
+  const headers = response.headers();
+  expect(headers['x-frame-options'] || headers['content-security-policy']).toBeTruthy();
+  expect(headers['x-content-type-options'] || '').toMatch(/nosniff/i);
+}
+
+async function expectCookieFlags(context) {
+  const cookies = await context.cookies();
+  const session = cookies.find(c => /session|auth|token/i.test(c.name));
+  if (!session) return;
+  expect(session.httpOnly).toBeTruthy();
+  expect(['Lax','Strict','None'].includes(session.sameSite)).toBeTruthy();
+}
+
+module.exports = { expectNoServerError, expectBlockedOrSafe, expectSecurityHeaders, expectCookieFlags };