|
| 1 | +/** |
| 2 | + * Session Persistence — focused Playwright test |
| 3 | + * |
| 4 | + * Verifies that when a custom session duration is configured, the WordPress |
| 5 | + * auth cookie is written as a persistent cookie (explicit expiry, not expire=0) |
| 6 | + * so it survives a browser kill / swipe-up on mobile. |
| 7 | + * |
| 8 | + * Uses cs_devtools_test (admin) — no separate admin credentials needed. |
| 9 | + * |
| 10 | + * Run: npx playwright test tests/session-persistence.spec.js --headed |
| 11 | + */ |
| 12 | + |
| 13 | +const { test, expect, request } = require('@playwright/test'); |
| 14 | + |
| 15 | +const SITE = process.env.WP_SITE || 'https://andrewbaker.ninja'; |
| 16 | +const TEST_USER = process.env.WP_TEST_USER || 'cs_session_test'; |
| 17 | +const TEST_PASS = process.env.WP_TEST_PASS || 'SessionTest2026!'; |
| 18 | + |
| 19 | +const LOGIN_URL = `${SITE}/wp-login.php`; |
| 20 | +const SETTINGS_URL = `${SITE}/wp-admin/tools.php?page=cloudscale-devtools&tab=login`; |
| 21 | + |
| 22 | +/** Add the WP test cookie (browser compatibility check) */ |
| 23 | +async function addWpTestCookie( ctx ) { |
| 24 | + await ctx.addCookies( [ { |
| 25 | + name: 'wordpress_test_cookie', |
| 26 | + value: 'WP Cookie check', |
| 27 | + domain: new URL( SITE ).hostname, |
| 28 | + path: '/', |
| 29 | + secure: true, |
| 30 | + httpOnly: false, |
| 31 | + sameSite: 'Lax', |
| 32 | + } ] ); |
| 33 | +} |
| 34 | + |
| 35 | +/** Log in and return — throws if login fails */ |
| 36 | +async function wpLogin( page, user, pass ) { |
| 37 | + await addWpTestCookie( page.context() ); |
| 38 | + await page.goto( LOGIN_URL, { waitUntil: 'domcontentloaded' } ); |
| 39 | + await page.fill( '#user_login', user ); |
| 40 | + await page.fill( '#user_pass', pass ); |
| 41 | + await Promise.all( [ |
| 42 | + page.waitForNavigation( { waitUntil: 'domcontentloaded', timeout: 30_000 } ), |
| 43 | + page.click( '#wp-submit' ), |
| 44 | + ] ); |
| 45 | + if ( page.url().includes( 'wp-login.php' ) ) { |
| 46 | + const err = await page.locator( '#login_error' ).textContent().catch( () => 'unknown' ); |
| 47 | + throw new Error( `Login failed: ${err.trim()}` ); |
| 48 | + } |
| 49 | +} |
| 50 | + |
| 51 | +// ───────────────────────────────────────────────────────────────────────────── |
| 52 | +// 1. Baseline — confirm default WP sessions ARE session cookies (expire = -1) |
| 53 | +// ───────────────────────────────────────────────────────────────────────────── |
| 54 | +test( 'Baseline — default WP session is a session cookie (expires=-1)', async ( { browser } ) => { |
| 55 | + // Make sure session duration is set to "default" first. |
| 56 | + const ctx = await browser.newContext( { ignoreHTTPSErrors: true } ); |
| 57 | + const page = await ctx.newPage(); |
| 58 | + await wpLogin( page, TEST_USER, TEST_PASS ); |
| 59 | + |
| 60 | + // Navigate to settings and set duration to "default". |
| 61 | + await page.goto( SETTINGS_URL ); |
| 62 | + await page.locator( '#cs-session-duration' ).selectOption( 'default' ); |
| 63 | + await page.locator( '#cs-session-save' ).click(); |
| 64 | + await expect( page.locator( '#cs-session-saved' ) ).toBeVisible( { timeout: 5_000 } ); |
| 65 | + console.log( '✅ Session duration set to default.' ); |
| 66 | + |
| 67 | + // Log out, then log back in fresh so the new setting applies. |
| 68 | + await page.goto( `${SITE}/wp-login.php?action=logout` ); |
| 69 | + const confirmLogout = page.locator( 'a[href*="action=logout"]' ); |
| 70 | + if ( await confirmLogout.isVisible( { timeout: 3_000 } ).catch( () => false ) ) { |
| 71 | + await confirmLogout.click(); |
| 72 | + } |
| 73 | + await page.waitForTimeout( 500 ); |
| 74 | + await wpLogin( page, TEST_USER, TEST_PASS ); |
| 75 | + |
| 76 | + const cookies = await ctx.cookies(); |
| 77 | + const authCook = cookies.find( c => c.name.startsWith( 'wordpress_logged_in_' ) ); |
| 78 | + console.log( ` Auth cookie expires = ${authCook?.expires}` ); |
| 79 | + |
| 80 | + // With default WP (no remember-me), expire should be -1 (session cookie). |
| 81 | + expect( authCook ).toBeTruthy(); |
| 82 | + expect( authCook.expires ).toBe( -1 ); |
| 83 | + console.log( '✅ Confirmed: default login is a session cookie (expires=-1).' ); |
| 84 | + await ctx.close(); |
| 85 | +} ); |
| 86 | + |
| 87 | +// ───────────────────────────────────────────────────────────────────────────── |
| 88 | +// 2. With custom duration — cookie must be persistent (expires > 0) |
| 89 | +// ───────────────────────────────────────────────────────────────────────────── |
| 90 | +test( 'Custom 30-day session — auth cookie must be persistent (expires > 0)', async ( { browser } ) => { |
| 91 | + const ctx = await browser.newContext( { ignoreHTTPSErrors: true } ); |
| 92 | + const page = await ctx.newPage(); |
| 93 | + await wpLogin( page, TEST_USER, TEST_PASS ); |
| 94 | + |
| 95 | + // Set 30-day session. |
| 96 | + await page.goto( SETTINGS_URL ); |
| 97 | + await page.locator( '#cs-session-duration' ).selectOption( '30' ); |
| 98 | + await page.locator( '#cs-session-save' ).click(); |
| 99 | + await expect( page.locator( '#cs-session-saved' ) ).toBeVisible( { timeout: 5_000 } ); |
| 100 | + console.log( '✅ Session duration set to 30 days.' ); |
| 101 | + |
| 102 | + // Log out and back in so the new cookie is issued. |
| 103 | + await page.goto( `${SITE}/wp-login.php?action=logout` ); |
| 104 | + const confirmLogout = page.locator( 'a[href*="action=logout"]' ); |
| 105 | + if ( await confirmLogout.isVisible( { timeout: 3_000 } ).catch( () => false ) ) { |
| 106 | + await confirmLogout.click(); |
| 107 | + } |
| 108 | + await page.waitForTimeout( 500 ); |
| 109 | + await wpLogin( page, TEST_USER, TEST_PASS ); |
| 110 | + |
| 111 | + const cookies = await ctx.cookies(); |
| 112 | + const authCook = cookies.find( c => c.name.startsWith( 'wordpress_logged_in_' ) ); |
| 113 | + console.log( ` Auth cookie expires = ${authCook?.expires} (0 = session cookie, >0 = persistent)` ); |
| 114 | + |
| 115 | + expect( authCook ).toBeTruthy(); |
| 116 | + // -1 or 0 means session cookie — this is the bug we're fixing. |
| 117 | + expect( authCook.expires ).toBeGreaterThan( 0 ); |
| 118 | + |
| 119 | + const expiryDate = new Date( authCook.expires * 1000 ); |
| 120 | + const daysFromNow = ( authCook.expires - Date.now() / 1000 ) / 86400; |
| 121 | + console.log( ` Expires: ${expiryDate.toISOString()} (~${Math.round( daysFromNow )} days from now)` ); |
| 122 | + expect( daysFromNow ).toBeGreaterThan( 25 ); // should be ~30 days |
| 123 | + console.log( '✅ Auth cookie is persistent — survives browser kill/swipe-up.' ); |
| 124 | + await ctx.close(); |
| 125 | +} ); |
| 126 | + |
| 127 | +// ───────────────────────────────────────────────────────────────────────────── |
| 128 | +// 3. Simulate browser kill — new context with saved cookies stays logged in |
| 129 | +// ───────────────────────────────────────────────────────────────────────────── |
| 130 | +test( 'Simulated browser kill — re-opening with saved cookies stays logged in', async ( { browser } ) => { |
| 131 | + // First context: log in with 30-day session and grab cookies. |
| 132 | + const ctx1 = await browser.newContext( { ignoreHTTPSErrors: true } ); |
| 133 | + const page1 = await ctx1.newPage(); |
| 134 | + await wpLogin( page1, TEST_USER, TEST_PASS ); |
| 135 | + |
| 136 | + // Ensure 30-day duration is set. |
| 137 | + await page1.goto( SETTINGS_URL ); |
| 138 | + await page1.locator( '#cs-session-duration' ).selectOption( '30' ); |
| 139 | + await page1.locator( '#cs-session-save' ).click(); |
| 140 | + await expect( page1.locator( '#cs-session-saved' ) ).toBeVisible( { timeout: 5_000 } ); |
| 141 | + |
| 142 | + // Re-login to get the fresh persistent cookie. |
| 143 | + await page1.goto( `${SITE}/wp-login.php?action=logout` ); |
| 144 | + const confirmLogout = page1.locator( 'a[href*="action=logout"]' ); |
| 145 | + if ( await confirmLogout.isVisible( { timeout: 3_000 } ).catch( () => false ) ) { |
| 146 | + await confirmLogout.click(); |
| 147 | + } |
| 148 | + await page1.waitForTimeout( 500 ); |
| 149 | + await wpLogin( page1, TEST_USER, TEST_PASS ); |
| 150 | + |
| 151 | + const cookies = await ctx1.cookies(); |
| 152 | + const authCook = cookies.find( c => c.name.startsWith( 'wordpress_logged_in_' ) ); |
| 153 | + expect( authCook?.expires ).toBeGreaterThan( 0 ); |
| 154 | + console.log( ` Captured persistent cookie: ${authCook?.name}, expires ${new Date( authCook.expires * 1000 ).toISOString()}` ); |
| 155 | + |
| 156 | + // "Kill" the browser — close context 1. |
| 157 | + await ctx1.close(); |
| 158 | + console.log( ' Browser context closed (simulating swipe-up / app kill).' ); |
| 159 | + |
| 160 | + // "Reopen" — new context with the saved cookies (simulating restored session). |
| 161 | + const ctx2 = await browser.newContext( { ignoreHTTPSErrors: true } ); |
| 162 | + await ctx2.addCookies( cookies ); |
| 163 | + const page2 = await ctx2.newPage(); |
| 164 | + await page2.goto( `${SITE}/wp-admin/`, { waitUntil: 'domcontentloaded' } ); |
| 165 | + |
| 166 | + // Should land in wp-admin, not be redirected to login. |
| 167 | + const finalUrl = page2.url(); |
| 168 | + console.log( ` After "reopen", landed at: ${finalUrl}` ); |
| 169 | + expect( finalUrl ).not.toContain( 'wp-login.php' ); |
| 170 | + expect( finalUrl ).toContain( 'wp-admin' ); |
| 171 | + console.log( '✅ Session survived simulated browser kill — still logged in.' ); |
| 172 | + await ctx2.close(); |
| 173 | +} ); |
| 174 | + |
| 175 | +// ───────────────────────────────────────────────────────────────────────────── |
| 176 | +// Cleanup — restore default session duration |
| 177 | +// ───────────────────────────────────────────────────────────────────────────── |
| 178 | +test( 'Cleanup — restore default session duration', async ( { browser } ) => { |
| 179 | + const ctx = await browser.newContext( { ignoreHTTPSErrors: true } ); |
| 180 | + const page = await ctx.newPage(); |
| 181 | + await wpLogin( page, TEST_USER, TEST_PASS ); |
| 182 | + await page.goto( SETTINGS_URL ); |
| 183 | + await page.locator( '#cs-session-duration' ).selectOption( 'default' ); |
| 184 | + await page.locator( '#cs-session-save' ).click(); |
| 185 | + await expect( page.locator( '#cs-session-saved' ) ).toBeVisible( { timeout: 5_000 } ); |
| 186 | + console.log( '✅ Session duration restored to default.' ); |
| 187 | + await ctx.close(); |
| 188 | +} ); |
0 commit comments