fix: Fix playwright gateway action tests (#3995)

* fix: Fix playwright gateway action tests

Signed-off-by: Gabriel Costa <gabrielcg@proton.me>

* fix: add missing _open_action_dropdown call in delete_gateway_by_url

The delete_gateway_by_url method was missing the _open_action_dropdown
call added by the previous commit. Since PR #3802 moved all action
buttons (including Delete) inside an Alpine.js dropdown menu, the
delete button is not directly clickable without first opening the menu.

Closes #3982

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: open action dropdown in remaining test files that bypass page object

Three test files directly click gateway action buttons without going
through the GatewaysPage page object, so they were also broken by
PR #3802's move to the Alpine.js overflow menu:

- test_rbac_permissions.py: test_admin_delete_gateway bypassed page
  object to inspect HTTP response status directly
- test_admin_url_context.py: _get_delete_gateway_btn helper used by
  multiple URL-context tests and iframe delete tests
- test_iframe_embedding_security.py: delete and toggle tests operated
  directly on iframe FrameLocator

Each now opens the actions dropdown before clicking the menu item.

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

---------

Signed-off-by: Gabriel Costa <gabrielcg@proton.me>
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
Co-authored-by: Mihai Criveti <crivetimihai@gmail.com>

Author: gcgoncalves

tests/playwright/pages/gateways_page.py

@@ -11,7 +11,8 @@
 import logging
 
 # Third-Party
-from playwright.sync_api import Error as PlaywrightError, expect, Locator
+from playwright.sync_api import Error as PlaywrightError
+from playwright.sync_api import expect, Locator
 from playwright.sync_api import TimeoutError as PlaywrightTimeoutError
 
 # Local
@@ -465,9 +466,7 @@ def search_gateways(self, query: str) -> None:
         if self.get_gateway_count() == 0:
             # Clear URL search params before reloading so the x-init HTMX load
             # does not re-apply the search term and leave the table empty again.
-            self.page.evaluate(
-                "window.history.replaceState({}, '', window.location.pathname + window.location.hash)"
-            )
+            self.page.evaluate("window.history.replaceState({}, '', window.location.pathname + window.location.hash)")
             self.page.reload(wait_until="domcontentloaded")
             self.navigate_to_gateways_tab()
             self.wait_for_gateways_table_loaded()
@@ -593,14 +592,31 @@ def get_gateway_count(self) -> int:
 
     # ==================== Gateway Row Actions ====================
 
+    def _open_action_dropdown(self, gateway_row: Locator) -> None:
+        """Open the three-dot actions dropdown for a gateway row.
+
+        PR #3802 moved all action buttons inside an Alpine.js-controlled
+        dropdown (menuOpen: false by default). This helper clicks the trigger
+        and waits for the menu to become visible before callers attempt to
+        click individual menu items.
+
+        Args:
+            gateway_row: Playwright Locator for the <tr> row element
+        """
+        gateway_row.scroll_into_view_if_needed()
+        trigger = gateway_row.locator("button[aria-expanded]")
+        trigger.click()
+        gateway_row.locator('[role="menu"]').wait_for(state="visible", timeout=5000)
+
     def click_test_button(self, gateway_index: int = 0) -> None:
         """Click the Test button for a gateway.
 
         Args:
             gateway_index: Index of the gateway row (default: 0 for first gateway)
         """
         gateway_row = self.gateway_rows.nth(gateway_index)
-        test_btn = gateway_row.locator('button:has-text("Test")')
+        self._open_action_dropdown(gateway_row)
+        test_btn = gateway_row.locator('button[role="menuitem"]:has-text("Test")')
         self.click_locator(test_btn)
 
     def click_view_button(self, gateway_index: int = 0) -> None:
@@ -610,7 +626,8 @@ def click_view_button(self, gateway_index: int = 0) -> None:
             gateway_index: Index of the gateway row (default: 0 for first gateway)
         """
         gateway_row = self.gateway_rows.nth(gateway_index)
-        view_btn = gateway_row.locator('button:has-text("View")')
+        self._open_action_dropdown(gateway_row)
+        view_btn = gateway_row.locator('button[role="menuitem"]:has-text("View")')
         self.click_locator(view_btn)
 
     def click_edit_button(self, gateway_index: int = 0) -> None:
@@ -620,7 +637,8 @@ def click_edit_button(self, gateway_index: int = 0) -> None:
             gateway_index: Index of the gateway row (default: 0 for first gateway)
         """
         gateway_row = self.gateway_rows.nth(gateway_index)
-        edit_btn = gateway_row.locator('button:has-text("Edit")')
+        self._open_action_dropdown(gateway_row)
+        edit_btn = gateway_row.locator('button[role="menuitem"]:has-text("Edit")')
         self.click_locator(edit_btn)
 
     def click_deactivate_button(self, gateway_index: int = 0) -> None:
@@ -630,7 +648,8 @@ def click_deactivate_button(self, gateway_index: int = 0) -> None:
             gateway_index: Index of the gateway row (default: 0 for first gateway)
         """
         gateway_row = self.gateway_rows.nth(gateway_index)
-        deactivate_btn = gateway_row.locator('button:has-text("Deactivate")')
+        self._open_action_dropdown(gateway_row)
+        deactivate_btn = gateway_row.locator('button[role="menuitem"]:has-text("Deactivate")')
         self.click_locator(deactivate_btn)
 
     def click_activate_button(self, gateway_index: int = 0) -> None:
@@ -640,7 +659,8 @@ def click_activate_button(self, gateway_index: int = 0) -> None:
             gateway_index: Index of the gateway row (default: 0 for first gateway)
         """
         gateway_row = self.gateway_rows.nth(gateway_index)
-        activate_btn = gateway_row.locator('button:text-is("Activate")')
+        self._open_action_dropdown(gateway_row)
+        activate_btn = gateway_row.locator('button[role="menuitem"]:text-is("Activate")')
         self.click_locator(activate_btn)
 
     def _click_delete_and_wait(self, delete_btn, confirm: bool = True) -> None:
@@ -690,11 +710,7 @@ def delete_gateway(self, gateway_index: int = 0, confirm: bool = True) -> None:
             confirm: Whether to confirm the deletion dialog (default: True)
         """
         gateway_row = self.gateway_rows.nth(gateway_index)
-
-        # Scroll the row into view first
-        gateway_row.scroll_into_view_if_needed()
-
-        # Find the delete button within the row's action column
+        self._open_action_dropdown(gateway_row)
         delete_btn = gateway_row.locator('form[action*="/delete"] button[type="submit"]:has-text("Delete")')
         self._click_delete_and_wait(delete_btn, confirm)
 
@@ -721,7 +737,7 @@ def delete_gateway_by_name(self, gateway_name: str, confirm: bool = True) -> boo
             try:
                 gateway_row = self.get_gateway_row_by_name(gateway_name)
                 gateway_row.first.wait_for(state="attached", timeout=5000)
-                gateway_row.first.scroll_into_view_if_needed()
+                self._open_action_dropdown(gateway_row.first)
                 delete_btn = gateway_row.first.locator('form[action*="/delete"] button[type="submit"]:has-text("Delete")')
                 self._click_delete_and_wait(delete_btn, confirm)
                 return True
@@ -773,6 +789,7 @@ def delete_gateway_by_url(self, gateway_url: str, confirm: bool = True) -> bool:
 
             # Get the delete button and use shared delete+navigation helper
             try:
+                self._open_action_dropdown(gateway_row.first)
                 delete_btn = gateway_row.first.locator('form[action*="/delete"] button[type="submit"]:has-text("Delete")')
                 self._click_delete_and_wait(delete_btn, confirm)
 
@@ -882,8 +899,7 @@ def set_transport_http_bypass(self) -> None:
         This allows tests that care about auth configuration (not reachability) to
         complete without a live gateway.
         """
-        self.page.evaluate(
-            """() => {
+        self.page.evaluate("""() => {
                 const form = document.getElementById('add-gateway-form');
                 if (!form) return;
                 const select = form.querySelector('select[name="transport"]');
@@ -895,8 +911,7 @@ def set_transport_http_bypass(self) -> None:
                     select.appendChild(opt);
                 }
                 select.value = 'HTTP';
-            }"""
-        )
+            }""")
 
     def toggle_one_time_auth(self, enable: bool = True) -> None:
         """Toggle one-time authentication checkbox.

tests/playwright/security/test_iframe_embedding_security.py

@@ -57,10 +57,7 @@ def _find_cookie(page: Page, name: str) -> Optional[Dict[str, Any]]:
 
 # Iframe tests require X_FRAME_OPTIONS=ALLOW-ALL to function properly
 # Skip marker for when this requirement is not met
-_requires_allow_all = pytest.mark.skipif(
-    settings.x_frame_options != "ALLOW-ALL",
-    reason="Iframe embedding tests require X_FRAME_OPTIONS=ALLOW-ALL environment variable"
-)
+_requires_allow_all = pytest.mark.skipif(settings.x_frame_options != "ALLOW-ALL", reason="Iframe embedding tests require X_FRAME_OPTIONS=ALLOW-ALL environment variable")
 
 
 @pytest.fixture
@@ -203,13 +200,11 @@ def test_x_frame_options_deny_blocks_iframe(self, page: Page, base_url: str):
 
         _ensure_admin_logged_in(page, base_url)
         admin_url = f"{base_url}/admin/"
-        page.set_content(
-            f"""<!DOCTYPE html>
+        page.set_content(f"""<!DOCTYPE html>
 <html><head><title>deny test</title></head>
 <body>
 <iframe id="admin-frame" src="{admin_url}" style="width:100%;height:100vh;border:none"></iframe>
-</body></html>"""
-        )
+</body></html>""")
 
         frame = page.frame_locator("#admin-frame")
         try:
@@ -376,15 +371,13 @@ def _strip_headers(route: Route) -> None:
         page.route(admin_pattern, _strip_headers)
 
         admin_url = f"{base_url}/admin/?ui_hide=metrics"
-        page.set_content(
-            f"""<!DOCTYPE html>
+        page.set_content(f"""<!DOCTYPE html>
 <html><head><title>ui_hide iframe test</title></head>
 <body>
 <iframe id="admin-frame" src="{admin_url}" style="width:100%;height:100vh;border:none"
         sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-modals">
 </iframe>
-</body></html>"""
-        )
+</body></html>""")
 
         frame = page.frame_locator("#admin-frame")
         try:
@@ -440,16 +433,14 @@ class TestCORSInIframeContext:
     def test_same_origin_fetch_from_iframe(self, page: Page, iframe_host):
         """fetch('/health') from inside the iframe succeeds (same-origin)."""
         frame = iframe_host
-        result = frame.locator("body").evaluate(
-            """async () => {
+        result = frame.locator("body").evaluate("""async () => {
                 try {
                     const resp = await fetch('/health');
                     return { status: resp.status, ok: resp.ok };
                 } catch (e) {
                     return { error: e.message };
                 }
-            }"""
-        )
+            }""")
         assert "error" not in result, f"Same-origin fetch from iframe failed: {result.get('error')}"
         assert result["status"] == 200, f"Expected 200 from /health, got {result['status']}"
 
@@ -595,10 +586,7 @@ def _reload_iframe(self, page: Page, iframe_host: FrameLocator) -> None:
         iframe_host.locator('[data-testid="servers-tab"]').wait_for(state="visible", timeout=30000)
 
         # Wait for JS initialization (Admin object + HTMX) - also critical
-        iframe_frame.wait_for_function(
-            "typeof window.Admin !== 'undefined' && typeof window.Admin.showTab === 'function' && typeof window.htmx !== 'undefined'",
-            timeout=15000
-        )
+        iframe_frame.wait_for_function("typeof window.Admin !== 'undefined' && typeof window.Admin.showTab === 'function' && typeof window.htmx !== 'undefined'", timeout=15000)
 
         # Give HTMX a moment to settle after page load
         page.wait_for_timeout(500)
@@ -619,8 +607,7 @@ def _search_gateway_in_iframe(self, page: Page, frame: FrameLocator, gw_name: st
             search_input.fill(gw_name)
             # Wait for the HTMX indicator to disappear (search response settled)
             page.wait_for_function(
-                "() => !document.querySelector('#admin-frame')?.contentDocument"
-                "?.querySelector('#gateways-loading.htmx-request')",
+                "() => !document.querySelector('#admin-frame')?.contentDocument" "?.querySelector('#gateways-loading.htmx-request')",
                 timeout=10000,
             )
         except (PlaywrightTimeoutError, Exception):
@@ -649,9 +636,7 @@ def _navigate_to_gateways_tab(self, page: Page, frame: FrameLocator) -> None:
             panel.wait_for(state="visible", timeout=5000)
         except PlaywrightTimeoutError:
             try:
-                iframe_frame.evaluate(
-                    "() => { if (typeof window.Admin !== 'undefined' && typeof window.Admin.showTab === 'function') window.Admin.showTab('gateways'); }"
-                )
+                iframe_frame.evaluate("() => { if (typeof window.Admin !== 'undefined' && typeof window.Admin.showTab === 'function') window.Admin.showTab('gateways'); }")
             except Exception:
                 pass
             panel.wait_for(state="visible", timeout=15000)
@@ -665,7 +650,7 @@ def _navigate_to_gateways_tab(self, page: Page, frame: FrameLocator) -> None:
                     // Either has data rows or shows empty state
                     return tbody.children.length > 0 || tbody.textContent.includes('No');
                 }""",
-                timeout=15000
+                timeout=15000,
             )
         except PlaywrightTimeoutError:
             pass  # Table may still be loading; proceed with what is available
@@ -716,8 +701,7 @@ def test_add_gateway_via_iframe_form(self, page: Page, iframe_host: FrameLocator
             # Override transport to HTTP so _initialize_gateway skips the external
             # connection check (only SSE/StreamableHTTP try to connect).
             iframe_frame = page.frames[-1]
-            iframe_frame.evaluate(
-                """() => {
+            iframe_frame.evaluate("""() => {
                     const form = document.getElementById('add-gateway-form');
                     if (!form) return;
                     const select = form.querySelector('select[name="transport"]');
@@ -729,8 +713,7 @@ def test_add_gateway_via_iframe_form(self, page: Page, iframe_host: FrameLocator
                         select.appendChild(opt);
                     }
                     select.value = 'HTTP';
-                }"""
-            )
+                }""")
 
             # Submit and wait for the POST response from the admin form handler.
             # The admin form uses JS fetch() so the page does NOT navigate.
@@ -846,7 +829,7 @@ def test_edit_gateway_via_iframe_modal(self, page: Page, iframe_host: FrameLocat
 
             # Click the edit button for this specific gateway
             # tojson_attr encodes the ID with double quotes → onclick='Admin.editGateway("id")'
-            edit_btn = frame.locator(f'button[onclick*=\'editGateway("{gw_id}")\']').first
+            edit_btn = frame.locator(f"button[onclick*='editGateway(\"{gw_id}\")']").first
             try:
                 edit_btn.wait_for(state="visible", timeout=15000)
             except PlaywrightTimeoutError:
@@ -896,9 +879,13 @@ def test_delete_gateway_via_iframe(self, page: Page, iframe_host: FrameLocator,
             # Auto-accept confirmation dialogs on the HOST page
             page.on("dialog", lambda d: d.accept())
 
-            # Click delete button (use .first for responsive layouts)
+            # Open the actions dropdown (PR #3802 moved buttons into Alpine.js menu)
+            gw_row = frame.locator(f'tr[id="gateway-row-{gw_id}"]').first
+            gw_row.wait_for(state="attached", timeout=10000)
+            gw_row.scroll_into_view_if_needed()
+            gw_row.locator("button[aria-expanded]").click()
+            gw_row.locator('[role="menu"]').wait_for(state="visible", timeout=5000)
             delete_btn = frame.locator(f'form[action*="/gateways/{gw_id}/delete"] button[type="submit"]').first
-            delete_btn.wait_for(state="visible", timeout=5000)
 
             with page.expect_response(lambda r: f"/gateways/{gw_id}/delete" in r.url, timeout=15000):
                 delete_btn.click()
@@ -926,9 +913,13 @@ def test_toggle_gateway_state_via_iframe(self, page: Page, iframe_host: FrameLoc
             # Search by name so the gateway is visible regardless of pagination
             self._search_gateway_in_iframe(page, frame, gw_name)
 
-            # Click the deactivate/toggle button for this gateway
+            # Open the actions dropdown (PR #3802 moved buttons into Alpine.js menu)
+            gw_row = frame.locator(f'tr[id="gateway-row-{gw_id}"]').first
+            gw_row.wait_for(state="attached", timeout=10000)
+            gw_row.scroll_into_view_if_needed()
+            gw_row.locator("button[aria-expanded]").click()
+            gw_row.locator('[role="menu"]').wait_for(state="visible", timeout=5000)
             toggle_btn = frame.locator(f'form[action*="/gateways/{gw_id}/state"] button[type="submit"]')
-            toggle_btn.first.wait_for(state="visible", timeout=5000)
 
             with page.expect_response(lambda r: f"/gateways/{gw_id}/state" in r.url, timeout=15000):
                 toggle_btn.first.click()