0 Fork 0

Files

T

John O'Keefe f579696633 test(ui): Playwright RLS sweep — real-browser proof, both personas

Phase 5.5 (plan §7.5) first increment: the SSR/HTMX frontend is swept
in a real browser (official Playwright image, no host browsers) for
BOTH personas — testuser (admin) and rls-phone (restricted; Audiobooks
hidden from them via the visibility API).

Green checks: auth rejection + session establishment; admin dashboard
renders sections incl. the hidden-from-others library; restricted
dashboard renders real sections (Recently Added present — not a
vacuous landing-page pass) with ZERO hidden-library traces; search and
media payloads leak nothing for the restricted persona.

Harness lessons encoded: / is a landing page (dashboard lives at
/dashboard); the login endpoint rate-limits rapid attempts so sessions
are established once per persona and reused via storageState — a sweep
must not look like a brute-force run; getByText visibility assertions
are wrong for <option> text (library switcher) — body-textContent
assertions instead.

COVERAGE.md tracks the full 14-area sweep per the plan; the remaining
areas (reader, collections CRUD, admin matrix, upload roundtrip) are
enumerated and pending their sweep runs.

2026-10-29 10:25:08 -04:00

618 B

Raw Blame History

tests/ui — Playwright sweep (plan §7.5)

Real-browser sweep of the SSR/HTMX frontend. Dev server must be up on localhost:8765. Run inside the official image (no host browsers needed):

cd tests/ui
docker run --rm --network host \
  -v "$PWD":/work -w /work \
  mcr.microsoft.com/playwright:v1.49.0 \
  bash -c "npm install --no-audit --no-fund && npx playwright test"

Personas (see rls_sweep.spec.ts): testuser (admin) and rls-phone (restricted — Audiobooks hidden from them).

Coverage: COVERAGE.md enumerates every swept page/control per the plan; new pages/controls get a line when added.

618 B Raw Blame History

tests/ui — Playwright sweep (plan §7.5)

618 B

Raw Blame History