Rakseeibra/arrr-erp-test-v2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Playwright BASE_URL handling and failed UAT report tests

Browse Source
This commit is contained in:
A R R R Associates
2026-06-26 20:38:14 +05:30
parent 21c90749fb
commit ce9935c684
21 changed files with 98 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/v204-security-additions.spec.js
+8 -7
View File
@@ -1,5 +1,6 @@
const { test, expect, request } = require('@playwright/test');
require('dotenv').config();
const { BASE_URL, absoluteUrl } = require('../fixtures/url');
const { login, fillFirst, clickFirst } = require('../fixtures/auth');
const { expectBlockedOrSafe, expectCookieFlags, expectSecurityHeaders } = require('../fixtures/assertions');
const {
@@ -17,7 +18,7 @@ const tenantBName = process.env.TENANT_B_NAME || 'UAT Tenant B';
test.describe('v2.0.4 additional security / FY / context checks', () => {
test('V204-SEC-001 forgot-password API must not expose reset token', async () => {
const api = await request.newContext({ baseURL: process.env.BASE_URL });
const api = await request.newContext({ baseURL: BASE_URL });
const email = process.env.FIRM_ADMIN_EMAIL || process.env.SYSTEM_ADMIN_EMAIL || 'admin@auditfirm.local';
const candidates = [
{ url: '/auth/forgot-password', opts: { data: { email } } },
@@ -39,7 +40,7 @@ test.describe('v2.0.4 additional security / FY / context checks', () => {
});
test('V204-SEC-002 reset-password with random token is rejected safely', async () => {
const api = await request.newContext({ baseURL: process.env.BASE_URL });
const api = await request.newContext({ baseURL: BASE_URL });
const resp = await api.post('/auth/reset-password', {
data: { token: 'invalid-token-for-vapt', password: 'NewPassword@123' },
}).catch(() => null);
@@ -49,7 +50,7 @@ test.describe('v2.0.4 additional security / FY / context checks', () => {
});
test('V204-SEC-003 API token/login brute force attempts do not create 500 errors', async () => {
const api = await request.newContext({ baseURL: process.env.BASE_URL });
const api = await request.newContext({ baseURL: BASE_URL });
const email = process.env.SYSTEM_ADMIN_EMAIL || 'admin@auditfirm.local';
for (let i = 0; i < 6; i++) {
const resp = await api.post('/auth/token', {
@@ -63,7 +64,7 @@ test.describe('v2.0.4 additional security / FY / context checks', () => {
test('V204-CTX-001 public tenant/branch/FY headers are ignored without secret', async ({ browser }) => {
const context = await browser.newContext({
baseURL: process.env.BASE_URL,
baseURL: BASE_URL,
extraHTTPHeaders: {
'X-Tenant-Code': process.env.TENANT_B_CODE || 'UAT-B',
'X-Branch-Code': process.env.BRANCH_B_CODE || 'UAT-BB',
@@ -82,7 +83,7 @@ test.describe('v2.0.4 additional security / FY / context checks', () => {
test('V204-CTX-002 wrong context secret must not enable spoofed headers', async ({ browser }) => {
const context = await browser.newContext({
baseURL: process.env.BASE_URL,
baseURL: BASE_URL,
extraHTTPHeaders: {
'X-Tenant-Code': process.env.TENANT_B_CODE || 'UAT-B',
'X-Branch-Code': process.env.BRANCH_B_CODE || 'UAT-BB',
@@ -106,7 +107,7 @@ test.describe('v2.0.4 additional security / FY / context checks', () => {
}
if (!process.env.CONTEXT_HEADER_SECRET) test.fail(true, 'TRUST_CONTEXT_HEADERS=true but CONTEXT_HEADER_SECRET is empty');
const context = await browser.newContext({
baseURL: process.env.BASE_URL,
baseURL: BASE_URL,
extraHTTPHeaders: {
'X-Tenant-Code': process.env.TENANT_A_CODE || 'UAT-A',
'X-Branch-Code': process.env.BRANCH_A_CODE || 'UAT-BA',
@@ -222,7 +223,7 @@ test.describe('v2.0.4 additional security / FY / context checks', () => {
});
test('V204-STORAGE-001 storage agent endpoints require node authentication', async () => {
const api = await request.newContext({ baseURL: process.env.BASE_URL });
const api = await request.newContext({ baseURL: BASE_URL });
const endpoints = [
'/documents/storage-agent/jobs/pending',
'/documents/storage-agent/download-requests/pending',