feat:Fix the bootstrap to be deploy key application

2026-07-23 19:07:39 -07:00
parent eba9f2144c
commit 1c7395d9e1
37 changed files with 1216 additions and 1202 deletions
@@ -0,0 +1,32 @@
+import { test, expect } from '@playwright/test';
+import { TARGETS, url } from '../targets';
+
+const t = TARGETS.find((x) => x.name === 'authentik')!;
+
+// Authentik: the real signal. A healthy pod does NOT prove OIDC/redirect/session
+// work — only a completed sign-in does. Credentials come from env (injected from
+// the secret store in-cluster), never hardcoded.
+const USER = process.env.AK_ADMIN_USER ?? 'akadmin';
+const PASS = process.env.AK_ADMIN_PASSWORD;
+
+test('authentik admin can sign in', async ({ page }) => {
+  test.skip(!PASS, 'AK_ADMIN_PASSWORD not set — provide via secret to run the login flow');
+
+  await page.goto(url(t), { waitUntil: 'domcontentloaded' });
+
+  // Authentik identification stage: username, Enter/continue, then password.
+  const uid = page.locator('input[name="uidField"], input[type="text"], input[type="email"]').first();
+  await expect(uid).toBeVisible();
+  await uid.fill(USER);
+  await page.keyboard.press('Enter');
+
+  const pw = page.locator('input[type="password"]').first();
+  await expect(pw).toBeVisible();
+  await pw.fill(PASS!);
+  await page.keyboard.press('Enter');
+
+  // Landed on the user dashboard — no auth error banner.
+  await expect(page).toHaveURL(/\/if\/user|\/if\/admin|\/library/i, { timeout: 20_000 });
+  await expect(page.getByText(/invalid|incorrect|failed/i)).toHaveCount(0);
+  await page.screenshot({ path: 'test-results/authentik-dashboard.png', fullPage: true });
+});