metabuilder/e2e/auth/complete-flow.spec.ts

import { test, expect, type Page } from '@playwright/test'

/**
 * E2E tests for authentication flows
 * 
 * Tests user authentication, session management, and permission-based access
 */

// Helper to check if user is on login page
async function isOnLoginPage(page: Page): Promise<boolean> {
  const loginForm = page.locator('input[type="password"], input[name="password"]')
  return (await loginForm.count()) > 0
}

test.describe('Authentication Flows', () => {
  test.describe('Landing Page', () => {
    test('should display landing page for unauthenticated users', async ({ page }) => {
      await page.goto('/')
      await page.waitForLoadState('domcontentloaded')
      
      // Should see sign in or get started button
      const signInButton = page.getByRole('button', { name: /sign in|get started|login/i })
      await expect(signInButton).toBeVisible({ timeout: 5000 })
    })

    test('should have navigation to login', async ({ page }) => {
      await page.goto('/')
      
      // Click sign in button
      await page.getByRole('button', { name: /sign in|get started/i }).first().click()
      await page.waitForLoadState('networkidle')
      
      // Should navigate to login page or show login form
      await expect(page.getByLabel(/username|email/i)).toBeVisible({ timeout: 5000 })
    })
  })

  test.describe('Login Flow', () => {
    test('should show login form', async ({ page }) => {
      await page.goto('/ui/login')
      await page.waitForLoadState('networkidle')
      
      // Should have username/email and password fields
      await expect(page.getByLabel(/username|email/i)).toBeVisible({ timeout: 5000 })
      await expect(page.getByLabel(/password/i)).toBeVisible()
      await expect(page.getByRole('button', { name: /login|sign in/i })).toBeVisible()
    })

    test('should validate required fields', async ({ page }) => {
      await page.goto('/ui/login')
      
      // Try to submit without filling fields
      await page.getByRole('button', { name: /login|sign in/i }).click()
      
      // Should show validation errors or stay on page
      await page.waitForTimeout(1000)
      const stillOnLogin = await isOnLoginPage(page)
      expect(stillOnLogin).toBeTruthy()
    })

    test('should show error for invalid credentials', async ({ page }) => {
      await page.goto('/ui/login')
      
      // Fill with invalid credentials
      await page.getByLabel(/username|email/i).fill('invalid@example.com')
      await page.getByLabel(/password/i).fill('wrongpassword')
      await page.getByRole('button', { name: /login|sign in/i }).click()
      
      // Should show error message
      await expect(page.getByText(/invalid|incorrect|error|failed/i)).toBeVisible({ timeout: 5000 })
    })

    test('should have register/signup link', async ({ page }) => {
      await page.goto('/ui/login')
      
      // Should have link to registration
      const registerLink = page.getByText(/register|sign up|create account/i)
      await expect(registerLink).toBeVisible({ timeout: 5000 })
    })

    test('should have forgot password link', async ({ page }) => {
      await page.goto('/ui/login')
      
      // Should have forgot password link
      const forgotLink = page.getByText(/forgot password|reset password/i)
      const linkExists = await forgotLink.count() > 0
      
      if (linkExists) {
        await expect(forgotLink).toBeVisible()
      }
    })
  })

  test.describe('Session Management', () => {
    test('should persist session across page reloads', async ({ page, context }) => {
      // Skip if we can't log in
      test.skip(true, 'Requires actual user credentials')
      
      // Login
      await page.goto('/ui/login')
      // ... login logic ...
      
      // Reload page
      await page.reload()
      
      // Should still be logged in (not redirected to login)
      const onLoginPage = await isOnLoginPage(page)
      expect(onLoginPage).toBeFalsy()
    })

    test('should maintain session across navigation', async ({ page }) => {
      // Skip if we can't log in
      test.skip(true, 'Requires actual user credentials')
      
      // After login, navigate to different pages
      await page.goto('/dashboard')
      // Should be accessible
      
      await page.goto('/default/ui_home')
      // Should still be logged in
    })
  })

  test.describe('Logout Flow', () => {
    test('should have logout option when authenticated', async ({ page }) => {
      // Skip if we can't log in
      test.skip(true, 'Requires actual user credentials')
      
      // After login, should see logout button
      const logoutButton = page.getByRole('button', { name: /logout|sign out/i })
      await expect(logoutButton).toBeVisible({ timeout: 5000 })
    })

    test('should redirect to landing page after logout', async ({ page }) => {
      // Skip if we can't log in
      test.skip(true, 'Requires actual user credentials')
      
      // Click logout
      await page.getByRole('button', { name: /logout|sign out/i }).click()
      
      // Should redirect to landing page
      await page.waitForURL('/', { timeout: 5000 })
    })

    test('should clear session after logout', async ({ page }) => {
      // Skip if we can't log in
      test.skip(true, 'Requires actual user credentials')
      
      // After logout, try to access protected page
      await page.goto('/dashboard')
      
      // Should redirect to login
      await page.waitForURL(/login/, { timeout: 5000 })
    })
  })

  test.describe('Permission-Based Access', () => {
    test('should redirect to login for protected pages', async ({ page }) => {
      // Try to access a protected page without authentication
      await page.goto('/dashboard')
      
      // Should redirect to login or show access denied
      const onLoginPage = await isOnLoginPage(page)
      const accessDenied = await page.getByText(/access denied|forbidden|login required/i).count() > 0
      
      expect(onLoginPage || accessDenied).toBeTruthy()
    })

    test('should show access denied for insufficient permissions', async ({ page }) => {
      // Skip if we can't test with actual user
      test.skip(true, 'Requires user with specific permission level')
      
      // Login as user with level 1
      // Try to access admin page (level 3)
      await page.goto('/admin')
      
      // Should show access denied
      await expect(page.getByText(/access denied|forbidden|insufficient/i)).toBeVisible({ timeout: 5000 })
    })

    test('should allow access to public pages without authentication', async ({ page }) => {
      // Public pages should be accessible
      await page.goto('/')
      await page.waitForLoadState('networkidle')
      
      // Should load successfully
      const title = await page.title()
      expect(title).toBeTruthy()
    })

    test('should allow access to user pages with authentication', async ({ page }) => {
      // Skip if we can't log in
      test.skip(true, 'Requires actual user credentials')
      
      // After login, should access user-level pages
      await page.goto('/dashboard')
      await page.waitForLoadState('networkidle')
      
      // Should not be on login page
      const onLoginPage = await isOnLoginPage(page)
      expect(onLoginPage).toBeFalsy()
    })
  })

  test.describe('Access Denied UI', () => {
    test('should show user-friendly access denied message', async ({ page }) => {
      // Try to access a page above user's permission level
      await page.goto('/supergod')
      
      // Should show access denied with details
      const accessDeniedHeading = page.getByRole('heading', { name: /access denied|forbidden/i })
      const accessDeniedText = page.getByText(/access denied|permission|insufficient/i)
      
      const hasAccessDenied = (await accessDeniedHeading.count() > 0) || (await accessDeniedText.count() > 0)
      expect(hasAccessDenied).toBeTruthy()
    })

    test('should show required permission level', async ({ page }) => {
      // Skip if access denied page doesn't exist
      test.skip(true, 'Requires actual access denied scenario')
      
      // Should show what level is required
      await expect(page.getByText(/required level|minimum level|level.*required/i)).toBeVisible({ timeout: 5000 })
    })

    test('should have link back to home', async ({ page }) => {
      // Skip if access denied page doesn't exist
      test.skip(true, 'Requires actual access denied scenario')
      
      // Should have way to go back
      const backLink = page.getByRole('link', { name: /home|back|return/i })
      await expect(backLink).toBeVisible({ timeout: 5000 })
    })
  })

  test.describe('Registration Flow', () => {
    test('should show registration form', async ({ page }) => {
      await page.goto('/ui/register')
      await page.waitForLoadState('networkidle')
      
      // Should have registration fields
      const emailInput = page.getByLabel(/email/i)
      const usernameInput = page.getByLabel(/username/i)
      const passwordInput = page.getByLabel(/password/i)
      
      const hasRegistrationFields = (await emailInput.count() > 0) || (await usernameInput.count() > 0)
      expect(hasRegistrationFields).toBeTruthy()
    })

    test('should validate email format', async ({ page }) => {
      await page.goto('/ui/register')
      
      const emailInput = page.getByLabel(/email/i)
      if (await emailInput.isVisible()) {
        // Enter invalid email
        await emailInput.fill('invalid-email')
        await page.getByRole('button', { name: /register|sign up|create/i }).click()
        
        // Should show validation error
        await expect(page.getByText(/invalid|valid.*email/i)).toBeVisible({ timeout: 5000 })
      }
    })

    test('should validate password requirements', async ({ page }) => {
      await page.goto('/ui/register')
      
      const passwordInput = page.getByLabel(/^password$/i).first()
      if (await passwordInput.isVisible()) {
        // Enter weak password
        await passwordInput.fill('123')
        await page.getByRole('button', { name: /register|sign up|create/i }).click()
        
        // Should show password requirement error
        const errorMessage = page.getByText(/password.*short|password.*weak|characters/i)
        const hasError = await errorMessage.count() > 0
        expect(hasError).toBeTruthy()
      }
    })

    test('should have link back to login', async ({ page }) => {
      await page.goto('/ui/register')
      
      // Should have link to login
      const loginLink = page.getByText(/already.*account|login|sign in/i)
      const linkExists = await loginLink.count() > 0
      
      if (linkExists) {
        await expect(loginLink).toBeVisible()
      }
    })
  })

  test.describe('Password Reset Flow', () => {
    test('should show password reset form', async ({ page }) => {
      await page.goto('/ui/forgot-password')
      await page.waitForLoadState('networkidle')
      
      // Should have email input
      const emailInput = page.getByLabel(/email/i)
      const exists = await emailInput.count() > 0
      
      if (exists) {
        await expect(emailInput).toBeVisible()
      }
    })

    test('should validate email for password reset', async ({ page }) => {
      await page.goto('/ui/forgot-password')
      
      const emailInput = page.getByLabel(/email/i)
      if (await emailInput.isVisible()) {
        // Enter invalid email
        await emailInput.fill('invalid')
        await page.getByRole('button', { name: /reset|send/i }).click()
        
        // Should show validation error
        const errorText = page.getByText(/invalid|valid.*email/i)
        const hasError = await errorText.count() > 0
        expect(hasError).toBeTruthy()
      }
    })
  })

  test.describe('Session Security', () => {
    test('should use secure cookies', async ({ page, context }) => {
      await page.goto('/')
      
      // Check cookies after navigation
      const cookies = await context.cookies()
      const sessionCookie = cookies.find(c => c.name.includes('session') || c.name.includes('token'))
      
      if (sessionCookie) {
        // Should have httpOnly flag (can't check this in browser context)
        // Should have sameSite flag
        expect(sessionCookie.sameSite).toBeTruthy()
      }
    })

    test('should expire session after timeout', async ({ page }) => {
      // Skip - requires waiting for actual timeout
      test.skip(true, 'Requires long wait time for session expiry')
    })

    test('should prevent CSRF attacks', async ({ page }) => {
      // Skip - requires complex setup
      test.skip(true, 'Requires CSRF token testing')
    })
  })

  test.describe('Error Handling', () => {
    test('should handle network errors gracefully', async ({ page, context }) => {
      // Go offline
      await context.setOffline(true)
      
      await page.goto('/ui/login')
      
      // Fill form
      const usernameInput = page.getByLabel(/username|email/i)
      if (await usernameInput.isVisible()) {
        await usernameInput.fill('test@example.com')
        await page.getByLabel(/password/i).fill('password')
        await page.getByRole('button', { name: /login|sign in/i }).click()
        
        // Should show network error
        await expect(page.getByText(/network|connection|offline|error/i)).toBeVisible({ timeout: 10000 })
      }
      
      // Go back online
      await context.setOffline(false)
    })

    test('should handle server errors', async ({ page }) => {
      // Skip - requires mock server
      test.skip(true, 'Requires server error simulation')
    })
  })
})