psa-systems/mokosh-server
Watch
9
0
Fork
You've already forked mokosh-server
 1
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

fix(e2e): intercept SPA bearer for setup, click User-menu -> Logout #102

Merged
nrupard merged 2 commits from fix/e2e-spa-bearer-intercept-and-logout into main 2026-06-05 18:00:42 +02:00
Conversation 0 Commits 2 Files changed 6 +83 -52
nrupard commented 2026-06-05 17:54:43 +02:00
Owner
Copy link

Summary

Two failures on the latest post-merge E2E run; both addressed here.

Failure 1 - setup project 401. POST /api/v1/auth/login returned UNAUTHORIZED. The OP (crates/mokosh-auth-oidc/src/discovery.rs:47) advertises only authorization_code + refresh_token grants - no client_credentials, no password grant - so a service-to-service token mint was never available. SPA accounts created via the bunyip hub do not exist in mokosh's local users table, so legacy /api/v1/auth/login 401s for hub-signed-up accounts.

Replace loginViaApi with a real-browser flow in setup: drive the SPA login, listen for any outbound /api/v1 request, capture the Authorization: Bearer header off the first match. Same auth path the SPA uses; no new OIDC client; no parallel signup pipeline. Token is written to e2e/.auth/token.txt the same way as before for the api project's custom request fixture.

Failure 2 - logout button not found. Logout lives inside the user-menu dropdown, not on the page surface (mokosh-clients/src/components/layout.rs:386). Click the avatar button (aria-label="User menu"), then click Logout inside the role="menu" popup. The handler then redirects through the bunyip hub's /logout (cross-origin POST + Set-Cookie + redirect to hub /login), so the post-logout URL wait grows from 15s to 30s.

Drop the now-unused loginViaApi helper. Setup project's use: block becomes browser-shaped (Desktop Chrome, SPA baseURL) since it now needs a Page.

Test plan

  • Post-merge run: setup project passes (bearer captured), auth-ui logout test passes (User-menu opens, Logout clicked, URL reaches /login within 30s).
  • api project tests run (no longer skipped on setup failure).
## Summary Two failures on the latest post-merge E2E run; both addressed here. **Failure 1 - setup project 401.** `POST /api/v1/auth/login` returned `UNAUTHORIZED`. The OP (`crates/mokosh-auth-oidc/src/discovery.rs:47`) advertises only `authorization_code` + `refresh_token` grants - no `client_credentials`, no password grant - so a service-to-service token mint was never available. SPA accounts created via the bunyip hub do not exist in mokosh's local `users` table, so legacy `/api/v1/auth/login` 401s for hub-signed-up accounts. Replace `loginViaApi` with a real-browser flow in setup: drive the SPA login, listen for any outbound `/api/v1` request, capture the `Authorization: Bearer` header off the first match. Same auth path the SPA uses; no new OIDC client; no parallel signup pipeline. Token is written to `e2e/.auth/token.txt` the same way as before for the `api` project's custom `request` fixture. **Failure 2 - logout button not found.** Logout lives inside the user-menu dropdown, not on the page surface (`mokosh-clients/src/components/layout.rs:386`). Click the avatar button (`aria-label="User menu"`), then click `Logout` inside the `role="menu"` popup. The handler then redirects through the bunyip hub's `/logout` (cross-origin POST + Set-Cookie + redirect to hub `/login`), so the post-logout URL wait grows from 15s to 30s. Drop the now-unused `loginViaApi` helper. Setup project's `use:` block becomes browser-shaped (Desktop Chrome, SPA `baseURL`) since it now needs a `Page`. ## Test plan - [ ] Post-merge run: setup project passes (bearer captured), auth-ui logout test passes (User-menu opens, Logout clicked, URL reaches `/login` within 30s). - [ ] api project tests run (no longer skipped on setup failure).
fix(e2e): intercept SPA bearer for setup, click User-menu -> Logout
All checks were successful
Check / fmt + clippy + compile + tests (pull_request) Successful in 1m33s
Details
328ffbca65 
Two failures on the post-merge E2E run:

1. setup project's `POST /api/v1/auth/login` returned 401 because the OP (crates/mokosh-auth-oidc/src/discovery.rs:47) advertises only authorization_code + refresh_token grants, and SPA accounts created via the bunyip hub do not exist in mokosh's local `users` table. Legacy login could never have worked for a hub-signed-up account.

   Replace `loginViaApi` with a real-browser flow that drives the SPA login and intercepts the `Authorization: Bearer` header off the first /api/v1 request the post-login SPA fires. Reuses the same auth path the SPA itself uses; no new OIDC client, no parallel signup pipeline. The token is written to e2e/.auth/token.txt the same way as before for the api project's custom `request` fixture.

2. auth-ui logout test could not find any element matching `/log ?out|sign ?out/i` because Logout sits inside the user-menu dropdown, not on the page surface. Open the avatar button (`aria-label="User menu"`, pinned in mokosh-clients/src/components/layout.rs:386), then click Logout inside the `role="menu"` popup. The handler redirects through the bunyip hub's /logout (cross-origin POST + Set-Cookie + redirect to hub's /login), so bump the post-logout URL wait from 15s to 30s.

Drop the now-unused `loginViaApi` helper. The setup project's `use` block becomes browser-shaped (Desktop Chrome, SPA baseURL) since it now needs a Page.

#PMS-140
test(e2e): refresh auth-state comment, drop dead routes.authLogin
All checks were successful
Create release / Create release from merged PR (pull_request) Has been skipped
Details
Check / fmt + clippy + compile + tests (pull_request) Successful in 1m25s
Details
30d66a955d 
Review follow-up on PR #102:

- auth-state.ts header still described the old direct-`POST /api/v1/auth/login` flow this PR replaces. Rewrite it to explain the actual approach (browser-driven SPA login + bearer interception) and the two constraints that ruled out direct login (OP grants + accounts living in the bunyip hub, not mokosh's `users`).
- routes.authLogin in lib/api.ts was the only thing pointing at the legacy login endpoint and its sole caller (loginViaApi) was removed in this PR. Drop the dead constant.

#PMS-140
nrupard deleted branch fix/e2e-spa-bearer-intercept-and-logout 2026-06-05 18:00:42 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-server!102
No description provided.