twitter-lite/e2e/integrations/auth.test.ts

import { openDatabase } from '../../src/features/storage/database.server'
import { expect, test } from '../fixtures'

const origin = 'http://127.0.0.1:4173'

test('creates the owner once and enters onboarding with a real session', async ({
  page,
  context,
  a11y,
}) => {
  const db = openDatabase(process.env.TWITTER_LITE_E2E_DB_PATH ?? '')
  db.$client.exec('DELETE FROM workspace_owner; DELETE FROM auth_throttle;')
  db.$client.close()
  await context.clearCookies()
  await page.goto('/', { waitUntil: 'networkidle' })
  await expect(page).toHaveURL(/\/setup$/)
  expect((await a11y().analyze()).violations).toEqual([])
  await page.getByLabel('Your name', { exact: true }).fill('Yuta')
  await page.getByLabel('Email address').fill('[email protected]')
  await page
    .getByLabel('Password', { exact: true })
    .fill('E2E-only-passphrase-2026')
  await page
    .getByLabel('Confirm password', { exact: true })
    .fill('E2E-only-passphrase-2026')
  await page
    .getByLabel('Setup code')
    .fill('isolated-e2e-setup-token-not-for-production')
  await page
    .getByRole('button', { name: 'Create account', exact: true })
    .click()
  await expect(page).toHaveURL(/\/onboarding$/)
  await page.waitForLoadState('networkidle')
  await page.getByRole('button', { name: 'Continue', exact: true }).click()
  await page.getByRole('button', { name: 'Open workspace' }).click()
  await expect(
    page.getByRole('heading', { name: 'Good morning, Yuta' }),
  ).toBeVisible()
})

test('requires login for documents, server functions, and live updates', async ({
  page,
  context,
}) => {
  const serverRequest = page.waitForRequest((request) =>
    request.url().includes('/_serverFn/'),
  )
  await page.goto('/deck')
  const serverUrl = (await serverRequest).url()
  await context.clearCookies()
  for (const path of ['/api/research/events', serverUrl]) {
    const result = await context.request.get(path, {
      headers: { Origin: origin, 'Sec-Fetch-Site': 'same-origin' },
    })
    expect(result.status()).toBe(401)
  }
  await page.goto('/journal')
  await expect(page).toHaveURL(/\/login$/)
  await expect(
    page.getByRole('heading', { name: 'Welcome back.' }),
  ).toBeVisible()
  await expect(
    page.getByRole('link', { name: 'Journal', exact: true }),
  ).toHaveCount(0)
})

test('signs in and revokes the session on sign out', async ({
  page,
  context,
  a11y,
}) => {
  await context.clearCookies()
  await page.goto('/login', { waitUntil: 'networkidle' })
  expect((await a11y().analyze()).violations).toEqual([])
  await page.getByLabel('Email address').fill('[email protected]')
  await page
    .getByLabel('Password', { exact: true })
    .fill('Wrong-passphrase-2026')
  await page.getByRole('button', { name: 'Sign in', exact: true }).click()
  await expect(page.getByRole('alert')).toContainText(
    'Invalid email or password.',
  )
  await page
    .getByLabel('Password', { exact: true })
    .fill('E2E-only-passphrase-2026')
  await page.getByRole('button', { name: 'Sign in', exact: true }).click()
  await expect(page).toHaveURL(`${origin}/`)
  await page.waitForLoadState('networkidle')
  const token = (await context.cookies()).find(
    (cookie) => cookie.name === 'workspace_session',
  )
  expect(token?.httpOnly).toBe(true)
  expect(token?.sameSite).toBe('Lax')
  await page.getByRole('button', { name: 'Manage connected accounts' }).click()
  await page.getByRole('button', { name: 'Sign out', exact: true }).click()
  await expect(page).toHaveURL(/\/login$/)
  const replay = await context.request.get('/api/auth', {
    headers: { Cookie: `workspace_session=${token?.value}` },
  })
  expect((await replay.json()).owner).toBeNull()
  await page.goBack()
  await expect(
    page.getByRole('link', { name: 'Home', exact: true }),
  ).toHaveCount(0)
})

test('requires onboarding and remembers its completion and name', async ({
  page,
  request,
  a11y,
}) => {
  const db = openDatabase(process.env.TWITTER_LITE_E2E_DB_PATH ?? '')
  db.$client
    .prepare(
      'UPDATE workspace_owner SET onboarding_completed_at = NULL WHERE id = 1',
    )
    .run()
  try {
    expect((await request.get('/api/research/events')).status()).toBe(403)
    await page.goto('/', { waitUntil: 'networkidle' })
    await expect(page).toHaveURL(/\/onboarding$/)
    expect((await a11y().analyze()).violations).toEqual([])
    await page.getByLabel('What should we call you?').fill('Yuta Test')
    await page.getByRole('button', { name: 'Continue', exact: true }).click()
    await page.getByRole('button', { name: 'Open workspace' }).click()
    await expect(
      page.getByRole('heading', { name: 'Good morning, Yuta Test' }),
    ).toBeVisible()
    await page.reload()
    await expect(
      page.getByRole('heading', { name: 'Good morning, Yuta Test' }),
    ).toBeVisible()
    await page.goto('/onboarding')
    await expect(page).toHaveURL(`${origin}/`)
  } finally {
    db.$client
      .prepare(
        'UPDATE workspace_owner SET name = ?, onboarding_completed_at = ? WHERE id = 1',
      )
      .run('Yuta', Date.now())
    db.$client.close()
  }
})

test('rejects cross-origin login and further account registration', async ({
  request,
  page,
  context,
}) => {
  expect(
    (
      await request.post('/api/auth', {
        headers: { Origin: 'https://other.invalid' },
        data: { action: 'logout' },
      })
    ).status(),
  ).toBe(403)
  const result = await request.post('/api/auth', {
    headers: { Origin: origin },
    data: {
      action: 'setup',
      email: '[email protected]',
      name: 'Intruder',
      password: 'Long-enough-password',
      setupToken: 'arbitrary-token',
    },
  })
  expect(result.status()).toBe(409)
  await context.clearCookies()
  await page.goto('/setup')
  await expect(page).toHaveURL(/\/login$/)
})