Skip to content

Add remote Playwright projects and browser session tests - #11

Merged
aevnsvi merged 2 commits into
mainfrom
e2e-remote-session
Oct 29, 2026
Merged

aevnsvi merged 2 commits into
mainfrom
e2e-remote-session

Conversation

@aevnsvi

@aevnsvi aevnsvi commented Oct 29, 2026

Copy link
Copy Markdown

Adds Playwright projects that run the end-to-end suite against any deployment, plus the first browser tests that use them.

Remote projects

  • remote-setup signs each account in once through the login API (UTF-8 Basic header, X-Requested-With) and saves the session as a storage state file, mode 0600, under the git-ignored playwright/.auth/.
  • remote-admin and remote-viewer reuse the saved session of their account.
  • remote-teardown ends those sessions and deletes the files.

The target comes from PULP_UI_E2E_BASE_URL (UI root, ending in /ui/) and the accounts from the JSON file named by PULP_UI_E2E_ACCOUNTS ({"admin": {...}, "viewer": {...}}). Without them a remote project fails with a message naming the missing variable. The smoke project is unchanged and needs neither. The remote projects are meant to be run from a terminal; no workflow runs them, because their output holds session data.

What the tests check

  • A deep link to a list page survives a reload.
  • Form sign-in: the session cookie is HttpOnly and Secure, scripts see the CSRF cookie but not the session cookie, nothing is stored, and only the sign-in call carries an Authorization header.
  • Credentials left in browser storage by an older version are removed unread and the login page shows.
  • A refused sign-in with Polish letters in the user name shows the server's message and raises no script error.
  • A next address pointing at another site is not followed after signing in.
  • Logout answers 204 and the session is gone afterwards; logout after the session already ended shows no error.
  • A second tab left open while the first one logs out is refused with 401 on its next request, does not crash, and shows the login page after a reload.
  • The limited account opens the application signed in as itself.

Tests that sign in or out start from a context of their own with a fresh sign-in, so ending a session never affects the shared one.

The remote projects run against any deployment named by
PULP_UI_E2E_BASE_URL with the accounts listed in the JSON file named by
PULP_UI_E2E_ACCOUNTS. A setup project signs each account in once with the
UTF-8 Basic login call and saves the session as a storage state file with
owner-only access under the ignored playwright/.auth directory; a teardown
project ends those sessions and deletes the files. A first test opens a list
page on the shared session and reloads it.
Against a deployment, in a context of its own so the shared sessions stay
valid: form sign-in keeps the session cookie HttpOnly and Secure and stores no
credential, legacy stored credentials are removed unread, a refused sign-in
with Polish letters shows the server message without a script error, a next
address pointing at another site is not followed, logout answers 204 and ends
the session, and logout after the session ended shows no error. A second tab
that was open when the first one logged out is refused with 401 without
crashing and shows the login page after a reload. A small test opens the
application as the limited account.
@aevnsvi
aevnsvi merged commit f2f7639 into main Oct 29, 2026
6 of 7 checks passed
@aevnsvi
aevnsvi deleted the e2e-remote-session branch October 29, 2026 18:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant