lilleman
1d198acc97
The from-scratch dev login was broken: open the banner's http://localhost:3000, sign in as the seeded admin, and you landed on http://127.0.0.1:3000/error "Page not found". Root cause: the banner/APP_URL said localhost but kratos.yml hard-coded 127.0.0.1, and a host-scoped Kratos CSRF cookie can't cross localhost<->127.0.0.1, so the cross-host login POST lost it; Kratos redirected to its error sink, which the app had no route for (404). Make APP_URL the single source of truth for the public host: - Canonical-host redirect (app.ts): when APP_URL is set, an off-host GET/HEAD visitor is 308'd to it (path+query kept) before a flow starts, so the browser, the themed forms and the cross-origin Kratos POST share one cookie host. After /public/ so static/health checks stay host-agnostic; GET/HEAD only so a 308 never replays a cross-host POST. - Opt-in (no NODE_ENV / no magic default): unset => no redirect, so a prod deploy that forgets APP_URL can't bounce real users to a stale default. The dev stack sets it. - kratos.yml browser URLs default to localhost (match APP_URL's dev value) and derive from ${APP_URL} via compose.override.yml; SERVE_PUBLIC_BASE_URL keeps the dev Ory port. - Real /error page (views/error.ejs) replaces the catch-all 404 for genuine flow errors. Tests-first: config (opt-in/validated), app (308 on mismatch, no-redirect on match, static host-agnostic, POST untouched, /error page), updated kratos.test host pins. New devstack regression (e2e/devstack-login.spec + compose.e2e-devstack.yml) drives the plain docker-compose-up topology on the host network: login from localhost works and 127.0.0.1 is canonicalised; wired into scripts/ci.sh. typecheck + 360 units + full ci.sh (visual 10 · auth 1 · oauth 2 · full 7 · devstack 2) green.
43 lines
2.0 KiB
YAML
43 lines
2.0 KiB
YAML
# Playwright E2E. Brings up the app + a Playwright runner, screenshots the live pages and the
|
|
# html-css-foundation mockups, and asserts the live DOM computes the same design styles.
|
|
# docker compose -f compose.yml -f compose.e2e.yml run --build --rm e2e
|
|
# docker compose -f compose.yml -f compose.e2e.yml down -v # tear down after
|
|
# --build rebuilds the runner (the image bakes in e2e/) so spec edits are picked up.
|
|
# Screenshots + HTML report land in ./e2e/artifacts/ (git-ignored).
|
|
services:
|
|
web:
|
|
# The dashboard renders mock data — no Ory needed. Drop the base file's kratos/keto
|
|
# dependency so the visual suite stays fast and doesn't boot Postgres + the Ory stack.
|
|
depends_on: !reset []
|
|
# Dev throwaways are fine for tests; cache templates for production-like rendering.
|
|
environment:
|
|
APP_URL: http://web:3000 # the suite reaches web on this host → canonical-host redirect stays inert
|
|
CACHE_TEMPLATES: "true"
|
|
REQUIRE_SECURE_SECRETS: "false"
|
|
SECURE_COOKIES: "false" # the suite hits web over http — Secure cookies wouldn't be stored
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-q", "-O", "-", "http://localhost:3000/public/css/styles.css"]
|
|
interval: 2s
|
|
timeout: 4s
|
|
retries: 15
|
|
|
|
e2e:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile.e2e
|
|
# Just the Ory-free visual suite; the full-stack auth spec runs via compose.e2e-auth.yml.
|
|
command: ["npx", "playwright", "test", "visual.spec.ts"]
|
|
depends_on:
|
|
web:
|
|
condition: service_healthy
|
|
environment:
|
|
BASE_URL: http://web:3000
|
|
volumes:
|
|
# The mockups + their stylesheet, kept as siblings so file:// ../public/css resolves.
|
|
- ./html-css-foundation:/repo/html-css-foundation:ro
|
|
- ./public:/repo/public:ro
|
|
# The committed dev tokenizer key — the spec signs a session JWT with it so the gated
|
|
# dashboard (§10) renders; web verifies it with the same key (the file it mounts read-only).
|
|
- ./ory/kratos/tokenizer/jwks.json:/repo/jwks.json:ro
|
|
- ./e2e/artifacts:/e2e/artifacts
|