21 lines
759 B
TypeScript
21 lines
759 B
TypeScript
import { expect, test } from '@playwright/test';
|
|
|
|
test('loads the signed-out application shell', async ({ page }) => {
|
|
await page.goto('/');
|
|
|
|
await expect(page).toHaveTitle(/SchulOS/i);
|
|
await expect(page.getByText('SchulOS', { exact: true }).first()).toBeVisible();
|
|
await expect(page.getByLabel(/email/i).first()).toBeVisible();
|
|
await expect(page.getByLabel(/password/i).first()).toBeVisible();
|
|
});
|
|
|
|
test('rejects cross-origin API mutations', async ({ request }) => {
|
|
const response = await request.post('/api/auth', {
|
|
headers: { origin: 'https://attacker.example' },
|
|
data: { action: 'logout' },
|
|
});
|
|
|
|
expect(response.status()).toBe(403);
|
|
await expect(response.json()).resolves.toMatchObject({ error: 'Invalid request origin' });
|
|
});
|