feat(e2e): un-fixme auth-ui login + logout round-trip (PMS-142 v2) #130

Merged

nrupard merged 1 commit from feat/pms-142-auth-ui-unfixme-v2 into main

2026-06-08 00:21:25 +02:00

nrupard commented

2026-06-08 00:00:56 +02:00

Owner

Summary

Second attempt at closing PMS-142. Drops test.fixme on the auth-ui Playwright project so the SPA login + logout round-trip runs unconditionally against staging.

Why now

The original un-fixme attempt (PR #112, commit 826e5b4) was rolled back by b6d9619 after CI found that bunyip's /logout did not actually terminate the OP session: the SPA navigated through /logout, then /oauth2/authorize immediately issued a fresh code and the user landed back on /dashboard. That gap was tracked in BUNYIP-53 and fixed in bunyip via two PRs:

467ab5a bunyip PR #67 (BUNYIP-53): fix(oidc): gate authorize on a server-validated OP session.
98ca4dc bunyip PR #70: fix(auth): GET /v1/auth/logout 302s directly to url; /logout page lands on /.

Verified the staging bunyip-api is serving 98ca4dc (GET https://api.a8n.systems/v1/version, build_date 2026-06-06T01:18:23Z), which is 467ab5a's descendant. The harness-side defenses from PR #112 (diagnostic capture in e2e/lib/page-diagnostics.ts, click-retry-if-menu-not-open in auth.spec.ts's logout()) are still in tree, so the failure-mode-1 (WASM hydration race) and failure-mode-2 (post-logout assertion) diagnostics from the AC are already met.

Changes

e2e/tests/auth.spec.ts: drop test.fixme and trim the now-historical BUNYIP-53 narrative comment down to the two notes still load-bearing for the test (rate-limit reason for the single-test shape; WASM hydration race defenses to preserve).
e2e/README.md: drop the matching quarantine notes from the What it covers row and the auth-ui project paragraph.

Test plan

CI Check green (no Rust touched, but pre-commit safety).
CI e2e green: auth-ui runs to completion, login + logout asserts pass.
Post-merge: two consecutive push:main runs of auth-ui pass on the first attempt (per PMS-142 AC).
If the run fails, the new diagnostic dump (URL trail + last-30-requests) appears in the thrown error, so the next iteration is precise rather than speculative.

Rollback plan

If staging re-regresses the OP session termination, re-add .fixme on auth.spec.ts line 22 and restore the README quarantine notes. The harness defenses do not need to move.

## Summary Second attempt at closing PMS-142. Drops `test.fixme` on the `auth-ui` Playwright project so the SPA login + logout round-trip runs unconditionally against staging. ## Why now The original un-fixme attempt (PR #112, commit `826e5b4`) was rolled back by `b6d9619` after CI found that bunyip's `/logout` did not actually terminate the OP session: the SPA navigated through `/logout`, then `/oauth2/authorize` immediately issued a fresh `code` and the user landed back on `/dashboard`. That gap was tracked in BUNYIP-53 and fixed in bunyip via two PRs: - `467ab5a` bunyip PR #67 (BUNYIP-53): `fix(oidc): gate authorize on a server-validated OP session`. - `98ca4dc` bunyip PR #70: `fix(auth): GET /v1/auth/logout 302s directly to url; /logout page lands on /`. Verified the staging bunyip-api is serving `98ca4dc` (`GET https://api.a8n.systems/v1/version`, `build_date 2026-06-06T01:18:23Z`), which is `467ab5a`'s descendant. The harness-side defenses from PR #112 (diagnostic capture in `e2e/lib/page-diagnostics.ts`, click-retry-if-menu-not-open in `auth.spec.ts`'s `logout()`) are still in tree, so the failure-mode-1 (WASM hydration race) and failure-mode-2 (post-logout assertion) diagnostics from the AC are already met. ## Changes - `e2e/tests/auth.spec.ts`: drop `test.fixme` and trim the now-historical BUNYIP-53 narrative comment down to the two notes still load-bearing for the test (rate-limit reason for the single-test shape; WASM hydration race defenses to preserve). - `e2e/README.md`: drop the matching quarantine notes from the `What it covers` row and the `auth-ui project` paragraph. ## Test plan - [ ] CI `Check` green (no Rust touched, but pre-commit safety). - [ ] CI `e2e` green: `auth-ui` runs to completion, login + logout asserts pass. - [ ] Post-merge: two consecutive `push:main` runs of `auth-ui` pass on the first attempt (per PMS-142 AC). - [ ] If the run fails, the new diagnostic dump (URL trail + last-30-requests) appears in the thrown error, so the next iteration is precise rather than speculative. ## Rollback plan If staging re-regresses the OP session termination, re-add `.fixme` on `auth.spec.ts` line 22 and restore the README quarantine notes. The harness defenses do not need to move.

nrupard added 1 commit

2026-06-08 00:00:56 +02:00

feat(e2e): un-fixme auth-ui login + logout round-trip (PMS-142 v2)

Check / fmt + clippy + compile + tests (pull_request) Successful in 1m1s

Details

E2E (staging) / Playwright against staging (pull_request) Failing after 1m59s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

9b3cfe15fa

Bunyip shipped two upstream fixes after the first un-fixme attempt was rolled back: PR #67 (commit `467ab5a`, BUNYIP-53 - gate `/oauth2/authorize` on a server-validated OP session) and PR #70 (commit `98ca4dc`, `/v1/auth/logout` 302s directly to the final url). Staging is now serving bunyip-api `98ca4dc` (built 2026-06-06), which contains both. Drop the `test.fixme` and let the auth-ui project run unconditionally.

Trimmed the outdated diagnostic novella in `auth.spec.ts` down to the still-load-bearing notes: the rate-limit reason for folding login + logout into a single test, and the WASM-hydration-race defense (diagnostic capture + click-retry loop in `logout()`). The full BUNYIP-53 narrative is preserved in the issue and in commit `b6d9619` for anyone who wants the history.

README quarantine notes dropped to match (`What it covers` row + `auth-ui project` paragraph).

#PMS-142