test(e2e): isolate administrator roles and locale between journeys

2026-10-21 07:21:29 +02:00
parent dda1687345
commit b39a5af4de
10 changed files with 260 additions and 13 deletions
@@ -21,7 +21,9 @@ async function login(records: RequestRecord[], api: APIRequestContext, email: st
  expect((await call(records, api, 'POST', '/auth/login', undefined, { email, password })).status()).toBe(200);
  const me = await json<{ id: string; sessionContext: string }>(await call(records, api, 'GET', '/auth/me'));
  const token = (await api.storageState()).cookies.find(value => value.name === 'XSRF-TOKEN'); expect(token).toBeDefined();
-  return { id: me.id, email, headers: { 'X-CSRF-TOKEN': token!.value, 'X-Session-Context': me.sessionContext } };
+  const headers = { 'X-CSRF-TOKEN': token!.value, 'X-Session-Context': me.sessionContext };
+  if (email === 'e2e@example.test') expect((await call(records, api, 'PUT', '/auth/preferences/language', headers, { language: 'en' })).status()).toBe(204);
+  return { id: me.id, email, headers };
 }
 async function createOwner(records: RequestRecord[], admin: APIRequestContext, headers: Headers) {
  const email = `p710-admin-${Date.now()}-${Math.random().toString(36).slice(2)}@example.test`;
@@ -68,6 +70,9 @@ function response(page: Page, method: string, path: string) { return page.waitFo

 test('[P7-10 Users A01 E09] real admin creation/role persistence revoke sessions while final-admin and disabled deletion remain protected', async ({ page, playwright, session }) => {
  const administrator=await login(session.requests, page.request, 'e2e@example.test');
+  const administrators=(await json<Array<{ id: string; roles: string[] }>>(await call(session.requests, page.request, 'GET', '/users'))).filter(value => value.roles.includes('Admin'));
+  // A contaminated fixture must fail before a successful self-demotion can break later suites.
+  expect(administrators.map(value => value.id)).toEqual([administrator.id]);
  expect((await call(session.requests, page.request, 'PUT', `/users/${administrator.id}/roles`, administrator.headers, { roles: [] })).status()).toBe(409);
  await start(page, '/admin/users', 390);
  const email=`p710-created-${Date.now()}@example.test`;
@@ -90,7 +95,11 @@ test('[P7-10 Users A01 E09] real admin creation/role persistence revoke sessions
    expect((await call(session.requests, other, 'GET', '/auth/me')).status()).toBe(401);
    expect((await page.request.delete(`${apiUrl}/users/${created.id}`, { headers: { ...administrator.headers, 'X-Confirm-Account-Deletion': email } })).status()).toBe(503);
    expect((await json<Array<{ id: string }>>(await call(session.requests, page.request, 'GET', '/users'))).some(value => value.id===created.id)).toBe(true);
-  } finally { await other.dispose(); }
+  } finally {
+    try {
+      expect((await call(session.requests, session.admin, 'PUT', `/users/${created.id}/roles`, session.adminHeaders, { roles: [] })).status()).toBe(204);
+    } finally { await other.dispose(); }
+  }
 });

 test('[P7-10 Users A01 E08] unavailable user list recovers by GET without fabricating empty state', async ({ page, session }, info) => {