36fe59caa5
Follows the perf + security + user-flow work with a role/persona audit (guest, host, admin, projector) and fixes across three review rounds. Highlights: HIGH - Ban now replays on reconnect. A ban isn't a soft-delete, and the `user-hidden` SSE has no replay, so a client that missed it (esp. the unattended diashow) kept cycling a banned user's slides. New `uploads_hidden_at` (migration 013) + `hidden_user_ids` in /feed/delta; feed + diashow evict those users. Applied even on a truncated delta. MEDIUM - Locked-upload data loss: a photo staged offline during a lock/release was purged as a terminal 4xx and lost when the host reopened. New reversible `uploads_locked` error code; the queue keeps the blob and auto-resumes on the `event-opened` SSE. - Reopen after release now warns (ConfirmSheet) that it revokes the published keepsake. - Host "forgotten-PIN" badge updates live (`pin-reset-requested` was broadcast but never in KNOWN_EVENTS / subscribed); host page also refetches on `pin-reset` so a two-host race can't hand out a conflicting PIN. - Ban modal copy fixed (read-only ban, not "session ended"); Degradieren/Sperren/Entsperren hidden on peer-host rows for non-admins (they always 403'd). - Host dashboard shows live keepsake generation progress / ready state + link to /export. - Admin JWT moved to sessionStorage (§11.1) to bound exposure on shared devices. Export generation guard (H1 from the prior round, hardened): per-(event,type) `release_seq` (migration 012) with seq-guarded claim/finalize/mark_failed/update_progress, per-generation temp/final paths, download follows `file_path`, prune only strictly-older generations. LOW: diashow coalesces upload-processed (avoids self-rate-limit); event-closed reconciles galleryReleased; /recover gains a forgot-PIN request + drops a stale cached PIN on 401; delta `>=` tie-break + 429 retry; misc copy/labels. Adds e2e: ban-replay, upload-lock-code, and rewrites export-reopen-rerelease with a data-completeness test. Reconciles USER_JOURNEYS §9/§11. Verified: cargo build clean, 40 unit tests, svelte-check 0 errors, 33 frontend unit tests, 155 e2e passing on chromium-desktop. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
53 lines
2.0 KiB
TypeScript
53 lines
2.0 KiB
TypeScript
/**
|
|
* USER_JOURNEYS.md §11 — admin login. Tests the /admin/login route and
|
|
* the redirect-while-already-logged-in shortcut.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
import { AdminLoginPage } from '../../page-objects';
|
|
import { ADMIN_PASSWORD } from '../../fixtures/api-client';
|
|
|
|
test.describe('Auth — admin login', () => {
|
|
test('correct password → /admin dashboard', async ({ page }) => {
|
|
const login = new AdminLoginPage(page);
|
|
await login.goto();
|
|
await login.login(ADMIN_PASSWORD);
|
|
await page.waitForURL('**/admin', { timeout: 10_000 });
|
|
|
|
// The admin JWT lands in sessionStorage (USER_JOURNEYS §11.1) — NOT localStorage — so the
|
|
// elevated credential doesn't survive a tab/browser close on a shared "event laptop".
|
|
const stores = await page.evaluate(() => {
|
|
const decodeRole = (t: string | null) => {
|
|
if (!t) return null;
|
|
try {
|
|
return JSON.parse(atob(t.split('.')[1])).role;
|
|
} catch {
|
|
return null;
|
|
}
|
|
};
|
|
return {
|
|
sessionRole: decodeRole(sessionStorage.getItem('eventsnap_jwt')),
|
|
localToken: localStorage.getItem('eventsnap_jwt')
|
|
};
|
|
});
|
|
expect(stores.sessionRole).toBe('admin');
|
|
expect(stores.localToken, 'admin token must not persist in localStorage').toBeNull();
|
|
});
|
|
|
|
test('wrong password → error, no token written', async ({ page }) => {
|
|
const login = new AdminLoginPage(page);
|
|
await login.goto();
|
|
await login.login('definitely-not-the-password');
|
|
await expect(login.errorMessage).toContainText(/falsch|forbidden|password/i);
|
|
const token = await page.evaluate(() => localStorage.getItem('eventsnap_jwt'));
|
|
expect(token).toBeNull();
|
|
});
|
|
|
|
test('already logged in as admin → auto-redirect to /admin', async ({ page, api }) => {
|
|
const adminJwt = await api.adminLogin();
|
|
await page.goto('/');
|
|
await page.evaluate((jwt) => localStorage.setItem('eventsnap_jwt', jwt), adminJwt);
|
|
await page.goto('/admin/login');
|
|
await page.waitForURL('**/admin', { timeout: 5_000 });
|
|
});
|
|
});
|