Initial Playwright ERP UAT VAPT test suite v2.4.1 IMAP

2026-06-22 12:52:00 +05:30
parent 970d5df926
commit 865f19cb84
29 changed files with 26786 additions and 0 deletions
@@ -0,0 +1,43 @@
+const { test, expect, request } = require('@playwright/test');
+require('dotenv').config();
+const { login, fillFirst, clickFirst } = require('../fixtures/auth');
+const { expectBlockedOrSafe, expectNoServerError, expectSecurityHeaders } = require('../fixtures/assertions');
+
+test('VAPT-TARGET-001 security headers on login', async ({ page }) => {
+  const resp = await page.goto('/login');
+  await expectSecurityHeaders(resp);
+});
+
+test('VAPT-TARGET-002 unauthorized protected URL redirects or blocks', async ({ page }) => {
+  const resp = await page.goto('/notice-cases');
+  await expectBlockedOrSafe(page, resp);
+});
+
+test('VAPT-TARGET-003 CSRF negative request should not create case', async () => {
+  const api = await request.newContext({ baseURL: process.env.BASE_URL });
+  const resp = await api.post('/notice-cases/new', { form: { title: 'csrf-negative', reference_no: 'CSRF-NEG' } });
+  expect([400,401,403,404,405,422,303].includes(resp.status())).toBeTruthy();
+});
+
+test('VAPT-TARGET-004 basic XSS payload should not execute in notice case list', async ({ page }) => {
+  await login(page, 'System Admin');
+  await page.goto('/notice-cases');
+  await expectNoServerError(page);
+  const body = await page.locator('body').innerText().catch(()=>'');
+  expect(body).not.toContain('<script>alert(1)</script>');
+});
+
+test('VAPT-TARGET-005 OTP brute force does not crash and should throttle/block', async ({ page }) => {
+  await page.goto('/login');
+  await fillFirst(page, ['input[name="email"]','input[name="login_id"]','input[type="email"]'], process.env.SYSTEM_ADMIN_EMAIL || 'admin@auditfirm.local');
+  await fillFirst(page, ['input[name="password"]','input[type="password"]'], process.env.SYSTEM_ADMIN_PASSWORD || 'admin123');
+  await clickFirst(page, ['button[type="submit"]','input[type="submit"]']);
+  await page.waitForLoadState('domcontentloaded').catch(()=>{});
+  if (!page.url().includes('/otp')) test.skip(true, 'OTP page not enabled in this environment');
+  for (let i=0;i<8;i++) {
+    await fillFirst(page, ['input[name="otp"]','input[name="code"]','input[type="text"]'], '000000');
+    await clickFirst(page, ['button[type="submit"]','input[type="submit"]']);
+    await page.waitForLoadState('domcontentloaded').catch(()=>{});
+  }
+  await expectNoServerError(page);
+});