sharang
d3a2b5e2ab
The original /products gate test expected either a Products heading (signed-in) or a Sign-in button (signed-out). In practice the page renders NotAuthorized (403) for any session without the right org_role, so the second branch never matched and the test failed. The Sign-in surface is dashboard-only today. Once M10.1 wires a shared sign-in redirect for protected routes, widen this test. Refs: M5.3
29 lines
1.3 KiB
TypeScript
29 lines
1.3 KiB
TypeScript
import { expect, test } from "@playwright/test";
|
|
|
|
// Tenant subdomain tests — no OIDC click-through (Keycloak in headless mode
|
|
// is flaky); we just assert the SIGNED-OUT view of each protected route
|
|
// renders the expected gate. Once the realm grows a service-account flow
|
|
// for testing (M5.x), we'll bolt on a signed-in suite.
|
|
|
|
test.describe("tenant subdomain @needs-stack", () => {
|
|
test("acme dashboard renders the Sign-in button when signed out", async ({ page }) => {
|
|
await page.goto("/dashboard");
|
|
await expect(page.getByRole("heading", { name: /Sign in to acme/i })).toBeVisible();
|
|
await expect(page.getByRole("button", { name: /Sign in with Keycloak/i })).toBeVisible();
|
|
});
|
|
|
|
test("acme /products is gated when signed out", async ({ page }) => {
|
|
await page.goto("/products");
|
|
// Signed-out session means canSee(null, "products") is false, so the
|
|
// page renders the 'NotAuthorized' component. The dashboard route is
|
|
// the only place that surfaces the Sign-in button today — we'll add
|
|
// a redirect-to-sign-in in M10.1 once the surface set firms up.
|
|
await expect(page.getByRole("heading", { name: /403/i })).toBeVisible();
|
|
});
|
|
|
|
test("unknown tenant slug 404s", async ({ page }) => {
|
|
const resp = await page.goto("http://nope-nope.localhost:3000/dashboard");
|
|
expect(resp?.status()).toBe(404);
|
|
});
|
|
});
|