John O'Keefe
f579696633
Phase 5.5 (plan §7.5) first increment: the SSR/HTMX frontend is swept in a real browser (official Playwright image, no host browsers) for BOTH personas — testuser (admin) and rls-phone (restricted; Audiobooks hidden from them via the visibility API). Green checks: auth rejection + session establishment; admin dashboard renders sections incl. the hidden-from-others library; restricted dashboard renders real sections (Recently Added present — not a vacuous landing-page pass) with ZERO hidden-library traces; search and media payloads leak nothing for the restricted persona. Harness lessons encoded: / is a landing page (dashboard lives at /dashboard); the login endpoint rate-limits rapid attempts so sessions are established once per persona and reused via storageState — a sweep must not look like a brute-force run; getByText visibility assertions are wrong for <option> text (library switcher) — body-textContent assertions instead. COVERAGE.md tracks the full 14-area sweep per the plan; the remaining areas (reader, collections CRUD, admin matrix, upload roundtrip) are enumerated and pending their sweep runs.
5 lines
65 B
Plaintext
5 lines
65 B
Plaintext
node_modules/
|
|
package-lock.json
|
|
test-results/
|
|
playwright-report/
|