Add Playwright E2E coverage + fail-closed auth to web dashboard#48
Draft
posthog[bot] wants to merge 1 commit into
Draft
Add Playwright E2E coverage + fail-closed auth to web dashboard#48posthog[bot] wants to merge 1 commit into
posthog[bot] wants to merge 1 commit into
Conversation
…shboard Adds end-to-end test coverage for the Next.js dashboard and closes a latent auth-bypass in the Supabase middleware. E2E tests (Playwright): wires @playwright/test into web/ with a config that boots the dev server, plus deterministic tests that mock /api/sessions and /api/import at the network layer (never touching real Supabase, OAuth, or vendor APIs). Covers dashboard render, the New Agent modal, the session table, opening the session drawer on row-select, and the import error toast. Auth hardening: the middleware previously failed open when the Supabase env vars were missing — silently skipping route gating. It now fails closed in production (missing vars gate all routes to /login), while keeping the dev pass-through explicit via a non-production build or SUPABASE_AUTH_BYPASS=true. Also makes the browser Supabase client resilient when unconfigured so the dev bypass genuinely runs the app, and documents env setup, the auth-bypass behavior, and how to run the E2E suite in the README. Generated-By: PostHog Code Task-Id: c1a06c7f-4e49-4d79-8839-60392d4f632d
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
web/dashboard had zero E2E coverage, and its auth middleware failed open when the Supabase env vars were missing. This PR adds both a regression safety net and closes the latent auth-bypass.@playwright/test+ atest:e2escript and a config that boots the Next.js dev server. Tests mock/api/sessionsand/api/importat the network layer, so they never touch real Supabase, OAuth, or vendor APIs. Flows covered: dashboard render, New Agent modal, session table, row-click opening the session drawer, and the import error toast.lib/supabase/middleware.tsno longer skips route gating when the Supabase vars are absent. In production it now redirects all non-auth routes to/login; the dev pass-through stays explicit (non-production build, orSUPABASE_AUTH_BYPASS=true).Why
If the Supabase env vars ever went missing in a production deploy, the middleware's fail-open behavior would expose the entire dashboard with no auth gate. That, plus the total absence of E2E tests on the dashboard's core flows, motivated this contained, pre-production hardening pass.
Test plan
npm run test:e2einweb/— all 5 dashboard specs pass.next start, no Supabase env):GET /→ 307 →/login,/login→ 200, andSUPABASE_AUTH_BYPASS=true→/passes through (200).Created with PostHog Code from this inbox report.