marcandClaude Opus 5
43a98b0972
OpenID Connect, off unless four settings are present. It is a second way to the same token the password login mints — every route and the WebSocket still know only a signed JWT — which is why it fits in one file and needs no new dependency: Node imports a JWK itself, so checking an ID token is a signature and five claims. Authorization Code with PKCE, exchanged on the server so the client secret stays there. The browser comes home with a one-time ticket rather than the token, because a token in a redirect URL sits in the history, in the proxy's log and in the referrer of the next request. Somebody the app has not seen gets an account; an account that already exists under that name is linked to the identity rather than duplicated, by subject from then on. Never an administrator. An account made this way has no password here, and the interface stops offering one — but an admin can still set one, which is the way back in if the provider is ever gone. The suite signs in at a provider of its own that signs real RS256 tokens, and holds down the four ways the journey must fail as well as the way it must work. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
50 lines
1.6 KiB
Bash
Executable File
50 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Runs the browser suites against a running InkNote.
|
|
#
|
|
# ./e2e/run.sh # all suites
|
|
# ./e2e/run.sh editor drawing # only these
|
|
#
|
|
# Needs the dev stack up (docker compose -f docker-compose.dev.yml up -d) and an
|
|
# admin account to create throwaway users with — marc/geheim123 by default,
|
|
# override with INKNOTE_ADMIN / INKNOTE_ADMIN_PASS.
|
|
set -uo pipefail
|
|
cd "$(dirname "$0")"
|
|
|
|
IMAGE="mcr.microsoft.com/playwright:v1.49.0-noble"
|
|
URL="${INKNOTE_URL:-http://localhost:3000}"
|
|
SUITES=("$@")
|
|
[ ${#SUITES[@]} -eq 0 ] && SUITES=(admin oidc editor search-attachments history drawing export conflict pdf attachments-lifecycle organise chapters tables offline sync)
|
|
|
|
mkdir -p shots
|
|
if [ ! -d node_modules ]; then
|
|
echo "→ installing playwright once"
|
|
docker run --rm -v "$PWD:/w" -w /w "$IMAGE" npm install --no-audit --no-fund >/dev/null
|
|
fi
|
|
|
|
if ! curl -sf -o /dev/null "$URL"; then
|
|
echo "✗ $URL is not answering — start the stack first:"
|
|
echo " docker compose -f docker-compose.dev.yml up -d --build"
|
|
exit 1
|
|
fi
|
|
|
|
failed=()
|
|
for s in "${SUITES[@]}"; do
|
|
echo
|
|
echo "═══ $s ═══"
|
|
docker run --rm --network host \
|
|
--add-host idp.test:127.0.0.1 \
|
|
-v "$PWD:/w" -v "$PWD/shots:/out" -w /w \
|
|
-e INKNOTE_URL="$URL" \
|
|
-e INKNOTE_ADMIN="${INKNOTE_ADMIN:-marc}" \
|
|
-e INKNOTE_ADMIN_PASS="${INKNOTE_ADMIN_PASS:-geheim123}" \
|
|
"$IMAGE" node "$s.mjs" || failed+=("$s")
|
|
done
|
|
|
|
echo
|
|
if [ ${#failed[@]} -eq 0 ]; then
|
|
echo "═══ all suites passed ═══"
|
|
else
|
|
echo "═══ FAILED: ${failed[*]} ═══"
|
|
exit 1
|
|
fi
|