Initial Playwright ERP UAT VAPT test suite v2.4.1 IMAP

2026-06-22 12:52:00 +05:30
parent 970d5df926
commit 865f19cb84
29 changed files with 26786 additions and 0 deletions
@@ -0,0 +1,132 @@
+const { test, expect, request } = require('@playwright/test');
+require('dotenv').config();
+const matrix = require('../data/generated-test-matrix.json');
+const { login, logout, fillFirst, clickFirst } = require('../fixtures/auth');
+const { expectNoServerError, expectBlockedOrSafe, expectSecurityHeaders, expectCookieFlags } = require('../fixtures/assertions');
+
+function title(v) {
+  return `[${v.variantId}] ${v.sheet} :: ${v.scenario} :: ${v.variantName}`;
+}
+
+function unauthorizedRole(v) {
+  const r = (v.role || '').toLowerCase();
+  if (r.includes('client')) return 'Staff';
+  if (r.includes('staff') || r.includes('employee')) return 'Client';
+  if (r.includes('consultant')) return 'Client';
+  return 'Staff';
+}
+
+async function safeGoto(page, route) {
+  const resp = await page.goto(route || '/employee/dashboard');
+  await page.waitForLoadState('domcontentloaded');
+  return resp;
+}
+
+async function submitBlankFormIfAny(page) {
+  const submit = page.locator('form button[type="submit"], form input[type="submit"]').first();
+  if (await submit.count()) {
+    await submit.click().catch(() => {});
+    await page.waitForLoadState('domcontentloaded').catch(() => {});
+  }
+}
+
+async function boundaryInputIfAny(page) {
+  const longText = 'X'.repeat(2048);
+  const input = page.locator('form input[type="text"], form textarea').first();
+  if (await input.count()) await input.fill(longText).catch(() => {});
+  await submitBlankFormIfAny(page);
+}
+
+async function runSecuritySpecific(page, context, v) {
+  const id = v.sourceId;
+  if (/SEC-001/i.test(id)) {
+    await page.goto('/login');
+    for (let i = 0; i < 5; i++) {
+      await fillFirst(page, ['input[name="email"]','input[name="login_id"]','input[type="email"]'], process.env.SYSTEM_ADMIN_EMAIL || 'admin@auditfirm.local');
+      await fillFirst(page, ['input[name="password"]','input[type="password"]'], 'wrong-password-' + i);
+      await clickFirst(page, ['button[type="submit"]','input[type="submit"]']);
+      await page.waitForLoadState('domcontentloaded').catch(() => {});
+    }
+    await expectNoServerError(page);
+    return;
+  }
+  if (/SEC-002/i.test(id)) {
+    await login(page, 'System Admin');
+    await logout(page);
+    const resp = await safeGoto(page, '/employee/dashboard');
+    await expectBlockedOrSafe(page, resp);
+    return;
+  }
+  if (/SEC-007|GEN-011/i.test(id)) {
+    const api = await request.newContext({ baseURL: process.env.BASE_URL });
+    const resp = await api.post('/notice-cases/new', { form: { title: 'csrf-test-no-token' } });
+    expect([400,401,403,404,405,422,303].includes(resp.status())).toBeTruthy();
+    return;
+  }
+  if (/SEC-017/i.test(id)) {
+    await login(page, 'System Admin');
+    await expectCookieFlags(context);
+    return;
+  }
+  if (/SEC-026/i.test(id)) {
+    const resp = await page.goto('/login');
+    await expectSecurityHeaders(resp);
+    return;
+  }
+  if (/SEC-010|SEC-103|SEC-104|SEC-110|SEC-111|DOM-VAPT/i.test(id)) {
+    await login(page, 'Staff');
+    const probes = ['/documents/../../app/main.py','/documents/999999/download','/notice-cases/999999999','/notice-cases/999999999/documents/999999/download','/domains/999999999/edit'];
+    for (const p of probes) {
+      const resp = await safeGoto(page, p);
+      await expectBlockedOrSafe(page, resp);
+    }
+    return;
+  }
+  await login(page, v.role || 'System Admin');
+  const resp = await safeGoto(page, v.route);
+  await expectNoServerError(page);
+  if (v.variantType === 'headers') await expectCookieFlags(context);
+}
+
+for (const v of matrix) {
+  test(title(v), async ({ page, context }) => {
+    test.info().annotations.push({ type: 'sourceId', description: v.sourceId });
+    test.info().annotations.push({ type: 'variantType', description: v.variantType });
+    test.info().annotations.push({ type: 'expected', description: String(v.expected || '').slice(0, 250) });
+
+    if (v.automation === 'manual') {
+      test.skip(true, v.manualReason || 'Marked manual in generated matrix');
+    }
+
+    if (v.variantType === 'security' || v.sheet.startsWith('VAPT_')) {
+      await runSecuritySpecific(page, context, v);
+      return;
+    }
+
+    if (v.variantType === 'rbac') {
+      await login(page, unauthorizedRole(v));
+      const resp = await safeGoto(page, v.route);
+      await expectNoServerError(page);
+      // A safe result may be allowed page for common dashboards, but must not leak obvious restricted data or crash.
+      if (!['/login','/employee/dashboard'].includes(v.route)) {
+        const body = await page.locator('body').innerText().catch(()=>'');
+        expect(body).not.toMatch(/Traceback|Internal Server Error|Exception/i);
+      }
+      return;
+    }
+
+    await login(page, v.role || 'System Admin');
+    const resp = await safeGoto(page, v.route);
+    await expectNoServerError(page);
+
+    if (v.variantType === 'positive') {
+      expect(resp.status()).toBeLessThan(500);
+    } else if (v.variantType === 'negative' || v.variantType === 'validation') {
+      await submitBlankFormIfAny(page);
+      await expectNoServerError(page);
+    } else if (v.variantType === 'boundary') {
+      await boundaryInputIfAny(page);
+      await expectNoServerError(page);
+    }
+  });
+}