|
| 1 | +/* funnel-recovery.spec.ts — mocked-contract Playwright gate for the |
| 2 | + * auth/claim funnel-recovery surfaces shipped 2026-06-10: |
| 3 | + * |
| 4 | + * F4 — the magic-link "we sent a link" state is no longer a silent |
| 5 | + * dead-end: it offers a Resend affordance + a GitHub-OAuth fallback |
| 6 | + * (email delivery is 100%-failing while the Brevo sender is |
| 7 | + * unvalidated, so this is the only path off the screen). |
| 8 | + * F6 — the /claim dead-ends (tokenless "Missing claim link" + invalid/ |
| 9 | + * expired token) surface GitHub OAuth as a primary recovery CTA. |
| 10 | + * D2 — the CLI device-flow: /login?cli_session=<id> forwards the id |
| 11 | + * through the OAuth/magic-link return_to so LoginCallbackPage can |
| 12 | + * POST /auth/cli/{id}/complete after sign-in. |
| 13 | + * |
| 14 | + * Runs under the DEFAULT mocked config (playwright.config.ts → VITE_NO_PROXY=1, |
| 15 | + * same-origin), so every page.route() glob below intercepts the SPA's fetch and |
| 16 | + * no upstream api is contacted. This is the browser-rendered, real-src/api layer |
| 17 | + * that complements the vitest component tests (which stub the api module). |
| 18 | + */ |
| 19 | + |
| 20 | +import { expect, test, type Page, type Route } from '@playwright/test' |
| 21 | + |
| 22 | +// ─── Constants ─────────────────────────────────────────────────────────────── |
| 23 | +const EMAIL_START_PATH = '**/auth/email/start' |
| 24 | +const AUTH_ME_PATH = '**/auth/me' |
| 25 | +const CLI_COMPLETE_PATH = /\/auth\/cli\/[^/]+\/complete$/ |
| 26 | +const TEST_EMAIL = 'founder@acme.dev' |
| 27 | +const CLI_SESSION_ID = 'cli_sess_abc123' |
| 28 | +const SESSION_TOKEN = 'sess_jwt_callback' |
| 29 | + |
| 30 | +/** Mock POST /auth/email/start → 202 (the api returns 202 regardless of |
| 31 | + * whether the email exists). Captures the request body so the test can assert |
| 32 | + * the return_to carries the cli_session when present. */ |
| 33 | +async function mockEmailStart(page: Page, captured: { body?: any; count: number }) { |
| 34 | + await page.route(EMAIL_START_PATH, (route: Route) => { |
| 35 | + if (route.request().method() !== 'POST') return route.continue() |
| 36 | + captured.count += 1 |
| 37 | + captured.body = JSON.parse(route.request().postData() ?? '{}') |
| 38 | + return route.fulfill({ status: 202, contentType: 'application/json', body: '{}' }) |
| 39 | + }) |
| 40 | +} |
| 41 | + |
| 42 | +/** Mock GET /auth/me → 200 so the callback page's post-token verification |
| 43 | + * succeeds and it proceeds to navigation. The tier is EXPLICIT because the |
| 44 | + * COMMERCE-FIRST REDIRECT (2026-06-10) routes the post-auth landing by it: |
| 45 | + * free → /pricing, paid+eligible → /app/billing, team → /app. */ |
| 46 | +async function mockAuthMe(page: Page, tier: string) { |
| 47 | + await page.route(AUTH_ME_PATH, (route: Route) => |
| 48 | + route.fulfill({ |
| 49 | + status: 200, |
| 50 | + contentType: 'application/json', |
| 51 | + body: JSON.stringify({ ok: true, user_id: 'u1', team_id: 't1', email: TEST_EMAIL, tier }), |
| 52 | + }), |
| 53 | + ) |
| 54 | +} |
| 55 | + |
| 56 | +// ─── F4: magic-link sent state is not a dead-end ───────────────────────────── |
| 57 | + |
| 58 | +test.describe('F4 — magic-link recovery affordances', () => { |
| 59 | + async function reachSentState(page: Page) { |
| 60 | + await page.getByTestId('email-input').fill(TEST_EMAIL) |
| 61 | + await page.getByTestId('email-submit').click() |
| 62 | + await expect(page.getByTestId('magic-link-sent')).toBeVisible() |
| 63 | + } |
| 64 | + |
| 65 | + test('the sent state renders Resend + GitHub-fallback controls', async ({ page }) => { |
| 66 | + const cap = { count: 0 } as { body?: any; count: number } |
| 67 | + await mockEmailStart(page, cap) |
| 68 | + await page.goto('/login') |
| 69 | + await reachSentState(page) |
| 70 | + await expect(page.getByTestId('magic-link-resend')).toBeVisible() |
| 71 | + await expect(page.getByTestId('magic-link-github-fallback')).toBeVisible() |
| 72 | + }) |
| 73 | + |
| 74 | + test('Resend re-fires POST /auth/email/start', async ({ page }) => { |
| 75 | + const cap = { count: 0 } as { body?: any; count: number } |
| 76 | + await mockEmailStart(page, cap) |
| 77 | + await page.goto('/login') |
| 78 | + await reachSentState(page) |
| 79 | + expect(cap.count).toBe(1) |
| 80 | + await page.getByTestId('magic-link-resend').click() |
| 81 | + await expect.poll(() => cap.count).toBe(2) |
| 82 | + }) |
| 83 | + |
| 84 | + test('the GitHub fallback navigates to the OAuth start handler', async ({ page }) => { |
| 85 | + const cap = { count: 0 } as { body?: any; count: number } |
| 86 | + await mockEmailStart(page, cap) |
| 87 | + // The github/start redirect leaves the SPA — intercept it so the test |
| 88 | + // doesn't navigate to the real api. Asserting the URL we were sent to. |
| 89 | + await page.route('**/auth/github/start*', (route: Route) => |
| 90 | + route.fulfill({ status: 200, contentType: 'text/html', body: '<html>oauth start</html>' }), |
| 91 | + ) |
| 92 | + await page.goto('/login') |
| 93 | + await reachSentState(page) |
| 94 | + await Promise.all([ |
| 95 | + page.waitForURL(/\/auth\/github\/start\?return_to=/), |
| 96 | + page.getByTestId('magic-link-github-fallback').click(), |
| 97 | + ]) |
| 98 | + }) |
| 99 | +}) |
| 100 | + |
| 101 | +// ─── F6: claim dead-ends surface GitHub OAuth ──────────────────────────────── |
| 102 | + |
| 103 | +test.describe('F6 — claim funnel recovery via GitHub OAuth', () => { |
| 104 | + test('the tokenless "Missing claim link" state surfaces a GitHub CTA', async ({ page }) => { |
| 105 | + await page.goto('/claim') |
| 106 | + await expect(page.getByText(/missing claim link/i)).toBeVisible() |
| 107 | + await expect(page.getByTestId('claim-github-oauth')).toBeVisible() |
| 108 | + }) |
| 109 | + |
| 110 | + test('the invalid/expired-link state surfaces a GitHub CTA', async ({ page }) => { |
| 111 | + await page.goto('/claim?t=not-a-valid-jwt-blob') |
| 112 | + await expect(page.getByTestId('claim-invalid')).toBeVisible() |
| 113 | + await expect(page.getByTestId('claim-github-oauth')).toBeVisible() |
| 114 | + }) |
| 115 | + |
| 116 | + test('the GitHub CTA navigates to the OAuth start handler', async ({ page }) => { |
| 117 | + await page.route('**/auth/github/start*', (route: Route) => |
| 118 | + route.fulfill({ status: 200, contentType: 'text/html', body: '<html>oauth start</html>' }), |
| 119 | + ) |
| 120 | + await page.goto('/claim') |
| 121 | + await Promise.all([ |
| 122 | + page.waitForURL(/\/auth\/github\/start\?return_to=/), |
| 123 | + page.getByTestId('claim-github-oauth').click(), |
| 124 | + ]) |
| 125 | + }) |
| 126 | +}) |
| 127 | + |
| 128 | +// ─── D2: CLI device-flow — cli_session preserved + completed ───────────────── |
| 129 | + |
| 130 | +test.describe('D2 — CLI device-flow completion', () => { |
| 131 | + test('LoginPage forwards cli_session into the magic-link return_to', async ({ page }) => { |
| 132 | + const cap = { count: 0 } as { body?: any; count: number } |
| 133 | + await mockEmailStart(page, cap) |
| 134 | + await page.goto(`/login?cli_session=${CLI_SESSION_ID}`) |
| 135 | + await page.getByTestId('email-input').fill(TEST_EMAIL) |
| 136 | + await page.getByTestId('email-submit').click() |
| 137 | + await expect(page.getByTestId('magic-link-sent')).toBeVisible() |
| 138 | + // The return_to the SPA sent the api must carry the cli_session so the |
| 139 | + // post-auth callback can complete the device flow. |
| 140 | + expect(cap.body?.return_to).toContain(`/login/callback?cli_session=${CLI_SESSION_ID}`) |
| 141 | + }) |
| 142 | + |
| 143 | + // The post-completion landing follows the COMMERCE-FIRST REDIRECT |
| 144 | + // (2026-06-10, memory project_commerce_first_redirect_at_interactions): |
| 145 | + // the CLI got its token via POST /auth/cli/{id}/complete, so the browser |
| 146 | + // tab is a scarce free interaction — a free-tier user is pushed to |
| 147 | + // /pricing (NOT /app). The cli_session is not a deep-link; only an |
| 148 | + // explicit ?next= / saved return_to overrides the tier rule. |
| 149 | + |
| 150 | + test('the callback POSTs /auth/cli/{id}/complete then lands a free user on /pricing', async ({ page }) => { |
| 151 | + await mockAuthMe(page, 'free') |
| 152 | + const completeCap = { id: '', count: 0 } |
| 153 | + await page.route(CLI_COMPLETE_PATH, (route: Route) => { |
| 154 | + completeCap.count += 1 |
| 155 | + // Pull the session id out of the path: /auth/cli/<id>/complete |
| 156 | + const m = new URL(route.request().url()).pathname.match(/\/auth\/cli\/([^/]+)\/complete$/) |
| 157 | + completeCap.id = m ? decodeURIComponent(m[1]) : '' |
| 158 | + return route.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify({ ok: true }) }) |
| 159 | + }) |
| 160 | + |
| 161 | + // The callback uses the legacy ?session_token path (no cookie exchange |
| 162 | + // needed for the mock) + ?cli_session to trigger completion. |
| 163 | + await page.goto(`/login/callback?session_token=${SESSION_TOKEN}&cli_session=${CLI_SESSION_ID}`) |
| 164 | + // free tier → commerce-first push to /pricing after the device flow |
| 165 | + // completes; the CLI itself is already unblocked by the POST below. |
| 166 | + await expect(page).toHaveURL(/\/pricing$/) |
| 167 | + expect(completeCap.count).toBe(1) |
| 168 | + expect(completeCap.id).toBe(CLI_SESSION_ID) |
| 169 | + }) |
| 170 | + |
| 171 | + test('a cli-completion failure does NOT block the user sign-in (still lands post-auth)', async ({ page }) => { |
| 172 | + await mockAuthMe(page, 'free') |
| 173 | + await page.route(CLI_COMPLETE_PATH, (route: Route) => |
| 174 | + route.fulfill({ status: 404, contentType: 'application/json', body: JSON.stringify({ error: 'session_not_found' }) }), |
| 175 | + ) |
| 176 | + await page.goto(`/login/callback?session_token=${SESSION_TOKEN}&cli_session=${CLI_SESSION_ID}`) |
| 177 | + // completeCliSession swallows the error; the browser user must still |
| 178 | + // reach the signed-in landing (free tier → /pricing, commerce-first). |
| 179 | + await expect(page).toHaveURL(/\/pricing$/) |
| 180 | + }) |
| 181 | + |
| 182 | + test('no cli_session → the callback never calls /auth/cli/.../complete', async ({ page }) => { |
| 183 | + await mockAuthMe(page, 'free') |
| 184 | + let completeCalled = false |
| 185 | + await page.route(CLI_COMPLETE_PATH, (route: Route) => { |
| 186 | + completeCalled = true |
| 187 | + return route.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify({ ok: true }) }) |
| 188 | + }) |
| 189 | + await page.goto(`/login/callback?session_token=${SESSION_TOKEN}`) |
| 190 | + // free tier → /pricing (commerce-first post-auth landing). |
| 191 | + await expect(page).toHaveURL(/\/pricing$/) |
| 192 | + expect(completeCalled).toBe(false) |
| 193 | + }) |
| 194 | +}) |
0 commit comments