Upgrade Playwright suite to v2.5.1 SQLite deep testing
This commit is contained in:
A R R R Associates
@@ -0,0 +1,373 @@
|
||||
|
||||
const { test, expect } = require('@playwright/test');
|
||||
require('dotenv').config();
|
||||
const { login } = require('../fixtures/auth');
|
||||
const { expectNoBackendError, readBody, blockedOrNotFound } = require('../fixtures/v204-helpers');
|
||||
const { expectBlockedOrSafe } = require('../fixtures/assertions');
|
||||
|
||||
async function safeGoto(page, route) {
|
||||
const resp = await page.goto(route).catch(() => null);
|
||||
await page.waitForLoadState('domcontentloaded').catch(() => {});
|
||||
return resp;
|
||||
}
|
||||
|
||||
async function expectRouteAvailable(page, resp) {
|
||||
await expectNoBackendError(page);
|
||||
if (resp) {
|
||||
expect(resp.status(), `Expected route to exist but got ${resp.status()} at ${page.url()}`).not.toBe(404);
|
||||
expect(resp.status()).toBeLessThan(500);
|
||||
}
|
||||
}
|
||||
|
||||
async function expectNoSecrets(page) {
|
||||
const body = await readBody(page);
|
||||
expect(body).not.toMatch(/Password@123|Pass@123|smtp_password|IMAP_PASSWORD|SMTP_PASSWORD|otp\s*[:=]\s*\d{4,8}|reset_token|access_token|refresh_token/i);
|
||||
}
|
||||
|
||||
async function expectPublicNoSensitive(page) {
|
||||
await expectNoBackendError(page);
|
||||
const body = await readBody(page);
|
||||
expect(body).not.toMatch(/tenant_id|branch_id|internal note|audit log|smtp|password|secret|token/i);
|
||||
}
|
||||
|
||||
async function apiCall(request, method, route) {
|
||||
const url = `${process.env.BASE_URL}${route}`;
|
||||
const opts = { data: { csrf_token: '', test_payload: 'uat-vapt' }, headers: { 'Content-Type': 'application/json' } };
|
||||
if (method === 'GET') return await request.get(url).catch(() => null);
|
||||
if (method === 'POST') return await request.post(url, opts).catch(() => null);
|
||||
if (method === 'PUT') return await request.put(url, opts).catch(() => null);
|
||||
if (method === 'DELETE') return await request.delete(url).catch(() => null);
|
||||
if (method === 'OPTIONS') return await request.fetch(url, { method: 'OPTIONS' }).catch(() => null);
|
||||
return await request.fetch(url, { method }).catch(() => null);
|
||||
}
|
||||
|
||||
async function expectApiSafe(resp) {
|
||||
expect(resp, 'API response should be available').toBeTruthy();
|
||||
expect(resp.status()).toBeLessThan(500);
|
||||
const text = await resp.text().catch(() => '');
|
||||
expect(text).not.toMatch(/Traceback|Exception in ASGI application|OperationalError|ProgrammingError|AttributeError|UndefinedError|Password@123|Pass@123/i);
|
||||
}
|
||||
|
||||
|
||||
const cases = [
|
||||
{
|
||||
"variantId": "V251-MKT-001",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Firm Admin",
|
||||
"scenario": "Marketplace dashboard loads",
|
||||
"type": "UAT",
|
||||
"route": "/marketplace",
|
||||
"_kind": "page",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": "Firm Admin"
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-002",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Firm Admin",
|
||||
"scenario": "Leads list loads",
|
||||
"type": "UAT",
|
||||
"route": "/marketplace/leads",
|
||||
"_kind": "page",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": "Firm Admin"
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-003",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Firm Admin",
|
||||
"scenario": "New lead page loads",
|
||||
"type": "UAT",
|
||||
"route": "/marketplace/leads/new",
|
||||
"_kind": "page",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": "Firm Admin"
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-004",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Public",
|
||||
"scenario": "Public lead page loads without auth",
|
||||
"type": "UAT",
|
||||
"route": "/marketplace/public-lead",
|
||||
"_kind": "public",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": null
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-005",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Firm Admin",
|
||||
"scenario": "Invalid lead detail safe",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads/999999",
|
||||
"_kind": "safe-page",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": "Firm Admin"
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-006",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Firm Admin",
|
||||
"scenario": "Lead assign invalid ID safe",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads/999999/assign",
|
||||
"_kind": "safe-page",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": "Firm Admin"
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-007",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Firm Admin",
|
||||
"scenario": "Lead status invalid ID safe",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads/999999/status",
|
||||
"_kind": "safe-page",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": "Firm Admin"
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-008",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Firm Admin",
|
||||
"scenario": "Lead convert invalid ID safe",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads/999999/convert-client",
|
||||
"_kind": "safe-page",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": "Firm Admin"
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-009",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Staff",
|
||||
"scenario": "Staff lead list access blocked or safe",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads",
|
||||
"_kind": "safe-page",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": "Staff"
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-010",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Client",
|
||||
"scenario": "Client lead list access blocked",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads",
|
||||
"_kind": "safe-page",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": "Client"
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-011",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Consultant",
|
||||
"scenario": "Consultant internal leads access blocked",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads",
|
||||
"_kind": "safe-page",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": "Consultant"
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-012",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Public",
|
||||
"scenario": "Public route does not expose internal list",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/public-lead",
|
||||
"_kind": "public-no-sensitive",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": null
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-013",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Anonymous/Attacker",
|
||||
"scenario": "Public lead blank CSRF-less POST handled safely",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/public-lead",
|
||||
"_kind": "post",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": null
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-014",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Anonymous/Attacker",
|
||||
"scenario": "Internal lead create CSRF-less POST rejected",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads/new",
|
||||
"_kind": "post",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": null
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-015",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Anonymous/Attacker",
|
||||
"scenario": "Lead assign CSRF-less POST rejected",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads/999999/assign",
|
||||
"_kind": "post",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": null
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-016",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Anonymous/Attacker",
|
||||
"scenario": "Lead status CSRF-less POST rejected",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads/999999/status",
|
||||
"_kind": "post",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": null
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-017",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Anonymous/Attacker",
|
||||
"scenario": "Lead convert-client CSRF-less POST rejected",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads/999999/convert-client",
|
||||
"_kind": "post",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": null
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-018",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Anonymous/Attacker",
|
||||
"scenario": "Lead duplicate check invalid POST safe",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads/check-duplicate",
|
||||
"_kind": "post",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": null
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-019",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Anonymous/Attacker",
|
||||
"scenario": "Lead note add CSRF-less POST rejected",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads/999999/notes",
|
||||
"_kind": "post",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": null
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-020",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Anonymous/Attacker",
|
||||
"scenario": "Lead attachment upload CSRF-less POST rejected",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads/999999/upload",
|
||||
"_kind": "post",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": null
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-021",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Anonymous/Attacker",
|
||||
"scenario": "Cross-tenant lead probe safe",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads/999999?tenant_id=999999",
|
||||
"_kind": "post",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": null
|
||||
},
|
||||
{
|
||||
"variantId": "V251-MKT-022",
|
||||
"module": "Marketplace / Leads",
|
||||
"role": "Anonymous/Attacker",
|
||||
"scenario": "Lead export requires authorization",
|
||||
"type": "VAPT",
|
||||
"route": "/marketplace/leads/export",
|
||||
"_kind": "safe-page",
|
||||
"_method": "GET",
|
||||
"_file": "marketplace-leads.spec.js",
|
||||
"_login_role": null
|
||||
}
|
||||
];
|
||||
|
||||
test.describe("v2.5.1 Additions - Marketplace / Leads", () => {
|
||||
|
||||
for (const c of cases) {
|
||||
test(`[${c.variantId}] ${c.scenario}`, async ({ page, request }) => {
|
||||
const role = c._login_role || c.role;
|
||||
const kind = c._kind;
|
||||
const method = c._method || 'GET';
|
||||
|
||||
if (kind === 'api') {
|
||||
const resp = await apiCall(request, method, c.route);
|
||||
await expectApiSafe(resp);
|
||||
return;
|
||||
}
|
||||
|
||||
if (kind === 'post') {
|
||||
const resp = await apiCall(request, method || 'POST', c.route);
|
||||
await expectApiSafe(resp);
|
||||
const safe = [400, 401, 403, 404, 405, 409, 422, 429].includes(resp.status());
|
||||
expect(safe, `Unsafe POST status ${resp.status()} for ${c.route}`).toBeTruthy();
|
||||
return;
|
||||
}
|
||||
|
||||
if (role && role !== 'Public' && !/Anonymous|Attacker|API/.test(role)) {
|
||||
await login(page, role);
|
||||
}
|
||||
|
||||
const resp = await safeGoto(page, c.route);
|
||||
|
||||
if (kind === 'page') {
|
||||
await expectRouteAvailable(page, resp);
|
||||
if (/password|secret|token|otp/i.test(c.scenario)) await expectNoSecrets(page);
|
||||
return;
|
||||
}
|
||||
|
||||
if (kind === 'public') {
|
||||
await expectRouteAvailable(page, resp);
|
||||
return;
|
||||
}
|
||||
|
||||
if (kind === 'public-no-sensitive') {
|
||||
await expectPublicNoSensitive(page);
|
||||
return;
|
||||
}
|
||||
|
||||
if (kind === 'no-secret') {
|
||||
await expectRouteAvailable(page, resp);
|
||||
await expectNoSecrets(page);
|
||||
return;
|
||||
}
|
||||
|
||||
await expectNoBackendError(page);
|
||||
await expectBlockedOrSafe(page, resp);
|
||||
});
|
||||
}
|
||||
});
|
||||
Reference in New Issue
Block a user