mARTin-B78
230a4034e8
Erste Abarbeitung des Repository-Audits (siehe TODO.md). Sicherheit: - Rate-Limiting für alle vier Auth-Endpunkte. Sie waren unbegrenzt aufrufbar, also beliebig viele Mails über den eigenen SMTP-Zugang und beliebig viele Rateversuche auf Verifizierungscodes. - Passwort-Reset-Token nur noch als SHA-256-Hash in der Datenbank. Bisher Klartext: Lesezugriff auf die DB genuegte zur Kontouebernahme. - Tote Mock-Login-Route entfernt. Sie verglich gegen ein hartcodiertes Fake-Passwort und war ueber die Middleware-Ausnahme fuer /api/auth/* ohne Anmeldung erreichbar. - Passwort-Reset auf bcrypt-Kosten 12, wie beim Signup. Reparaturen: - npm test rief jest auf, obwohl es weder Jest-Config noch Jest-Tests gibt. Zeigt jetzt auf Playwright; jest/ts-jest/@types/jest entfernt. - Falscher sonar.projectKey im Workflow. Verifiziert per tsc gegen die geaenderten Bereiche: keine neuen Typfehler. v1.117.0 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
60 lines
2.3 KiB
TypeScript
60 lines
2.3 KiB
TypeScript
import { test, expect } from '@playwright/test';
|
|
|
|
test.describe('Login Page Debug - Simplified', () => {
|
|
test('should load login page successfully', async ({ page }) => {
|
|
await page.goto('http://localhost:3001/auth/login');
|
|
|
|
// Basic page load verification
|
|
await expect(page).toHaveURL(/login/);
|
|
await expect(page).toHaveTitle(/Weekly To Do List/);
|
|
|
|
// Check for key elements that should be present
|
|
await expect(page.locator('h1')).toContainText('Weekly To Do List');
|
|
await expect(page.locator('p')).toContainText('Sign in to your account');
|
|
|
|
// Check for form elements
|
|
await expect(page.locator('input[name="email"]')).toBeVisible();
|
|
await expect(page.locator('input[name="password"]')).toBeVisible();
|
|
await expect(page.locator('button[type="submit"]')).toBeVisible();
|
|
|
|
// Check for navigation links
|
|
await expect(page.getByRole('link', { name: 'Don\'t have an account?' })).toBeVisible();
|
|
await expect(page.getByRole('link', { name: 'Forgot your password?' })).toBeVisible();
|
|
});
|
|
|
|
test('should have Tailwind CSS classes in structure', async ({ page }) => {
|
|
await page.goto('http://localhost:3001/auth/login');
|
|
|
|
// Check main container classes
|
|
const container = page.locator('div.min-h-screen.bg-gray-50');
|
|
await expect(container).toBeVisible();
|
|
|
|
// Check the form container
|
|
const formContainer = page.locator('div.bg-white.rounded-xl.shadow-lg.p-8');
|
|
await expect(formContainer).toBeVisible();
|
|
|
|
// Check for basic Tailwind classes that should be present
|
|
const bodyClass = await page.evaluate(() => document.body.className);
|
|
expect(bodyClass).toContain('min-h-screen');
|
|
expect(bodyClass).toContain('bg-gray-50');
|
|
});
|
|
|
|
test('should have functional form elements', async ({ page }) => {
|
|
await page.goto('http://localhost:3001/auth/login');
|
|
|
|
// Test that the form exists
|
|
const form = page.locator('form');
|
|
await expect(form).toBeVisible();
|
|
|
|
// Test that we can interact with inputs
|
|
const emailInput = page.locator('input[name="email"]');
|
|
const passwordInput = page.locator('input[name="password"]');
|
|
|
|
await expect(emailInput).toBeVisible();
|
|
await expect(passwordInput).toBeVisible();
|
|
|
|
// Test that submit button exists
|
|
const submitButton = page.locator('button[type="submit"]');
|
|
await expect(submitButton).toBeVisible();
|
|
});
|
|
}); |