@etus/bhono-app 0.1.1

package/templates/base/tests/e2e/journeys/audit-investigation.spec.ts

@@ -0,0 +1,299 @@
+import { test, expect, isAuthenticated, apiRequest, getAccountId, closeAllDialogs } from '../fixtures'
+
+/**
+ * Audit Log Investigation Journey Tests
+ *
+ * These tests verify complete audit log investigation flows,
+ * including listing logs, filtering, and examining individual entries.
+ *
+ * @tags @journey @audit @security
+ */
+
+test.describe('Audit Log Investigation Journey @journey @audit', () => {
+  test.describe('Audit Log Overview', () => {
+    test.beforeEach(async ({ page }) => {
+      const authenticated = await isAuthenticated(page)
+      test.skip(!authenticated, 'No authenticated session available')
+
+      const accountId = getAccountId()
+      test.skip(!accountId, 'No account ID available')
+    })
+
+    test.afterEach(async ({ page }) => {
+      await closeAllDialogs(page)
+    })
+
+    test('should retrieve audit logs via API with proper structure', async ({ page }) => {
+      // Step 1: Fetch audit logs from API
+      const response = await apiRequest(page, 'get', '/api/audits')
+      expect(response.ok()).toBeTruthy()
+
+      // Step 2: Verify response structure
+      const body = await response.json()
+      expect(body).toHaveProperty('data')
+      expect(body).toHaveProperty('meta')
+      expect(Array.isArray(body.data)).toBeTruthy()
+
+      // Step 3: Verify pagination metadata
+      expect(body.meta).toHaveProperty('currentPage')
+      expect(body.meta).toHaveProperty('limit')
+      expect(body.meta).toHaveProperty('totalItems')
+      expect(body.meta).toHaveProperty('totalPages')
+    })
+
+    test('should filter audit logs by LOGIN action type', async ({ page }) => {
+      // Step 1: Fetch filtered audit logs
+      const response = await apiRequest(page, 'get', '/api/audits?action=LOGIN')
+      expect(response.ok()).toBeTruthy()
+
+      const body = await response.json()
+      expect(body).toHaveProperty('data')
+
+      // Step 2: Verify all results match the filter
+      if (body.data.length > 0) {
+        for (const entry of body.data) {
+          expect(entry.action).toBe('LOGIN')
+        }
+      }
+    })
+
+    test('should filter audit logs by INSERT action type', async ({ page }) => {
+      // Step 1: Fetch filtered audit logs
+      const response = await apiRequest(page, 'get', '/api/audits?action=INSERT')
+      expect(response.ok()).toBeTruthy()
+
+      const body = await response.json()
+      expect(body).toHaveProperty('data')
+
+      // Step 2: Verify all results match the filter
+      if (body.data.length > 0) {
+        for (const entry of body.data) {
+          expect(entry.action).toBe('INSERT')
+        }
+      }
+    })
+
+    test('should filter audit logs by UPDATE action type', async ({ page }) => {
+      // Step 1: Fetch filtered audit logs
+      const response = await apiRequest(page, 'get', '/api/audits?action=UPDATE')
+      expect(response.ok()).toBeTruthy()
+
+      const body = await response.json()
+      expect(body).toHaveProperty('data')
+
+      // Step 2: Verify all results match the filter
+      if (body.data.length > 0) {
+        for (const entry of body.data) {
+          expect(entry.action).toBe('UPDATE')
+        }
+      }
+    })
+  })
+
+  test.describe('Audit Log Entry Details', () => {
+    test.beforeEach(async ({ page }) => {
+      const authenticated = await isAuthenticated(page)
+      test.skip(!authenticated, 'No authenticated session available')
+
+      const accountId = getAccountId()
+      test.skip(!accountId, 'No account ID available')
+    })
+
+    test('should have complete audit entry fields for investigation', async ({ page }) => {
+      // Step 1: Fetch a single audit log entry
+      const response = await apiRequest(page, 'get', '/api/audits?limit=1')
+      expect(response.ok()).toBeTruthy()
+
+      const body = await response.json()
+
+      // Step 2: Skip if no audit logs exist
+      if (body.data.length === 0) {
+        test.skip(true, 'No audit logs available to validate')
+        return
+      }
+
+      const entry = body.data[0]
+
+      // Step 3: Verify required investigative fields
+      expect(entry).toHaveProperty('id')
+      expect(entry).toHaveProperty('action')
+      expect(entry).toHaveProperty('timestamp')
+      expect(entry).toHaveProperty('transactionId')
+      expect(entry).toHaveProperty('entity')
+      expect(entry).toHaveProperty('entityId')
+
+      // Step 4: Verify field types
+      expect(typeof entry.id).toBe('string')
+      expect(typeof entry.action).toBe('string')
+      expect(typeof entry.timestamp).toBe('string')
+      expect(typeof entry.transactionId).toBe('string')
+    })
+
+    test('should have valid action types for audit entries', async ({ page }) => {
+      // Step 1: Fetch audit log entries
+      const response = await apiRequest(page, 'get', '/api/audits?limit=10')
+      expect(response.ok()).toBeTruthy()
+
+      const body = await response.json()
+
+      // Step 2: Skip if no audit logs exist
+      if (body.data.length === 0) {
+        test.skip(true, 'No audit logs available to validate')
+        return
+      }
+
+      // Step 3: Validate action types
+      const validActions = ['INSERT', 'UPDATE', 'DELETE', 'LOGIN', 'LOGOUT', 'SIGNUP', 'TOKEN_REFRESH', 'LOGIN_FAILED']
+
+      for (const entry of body.data) {
+        expect(validActions).toContain(entry.action)
+      }
+    })
+  })
+
+  test.describe('Audit Log Pagination', () => {
+    test.beforeEach(async ({ page }) => {
+      const authenticated = await isAuthenticated(page)
+      test.skip(!authenticated, 'No authenticated session available')
+
+      const accountId = getAccountId()
+      test.skip(!accountId, 'No account ID available')
+    })
+
+    test('should paginate audit logs correctly', async ({ page }) => {
+      // Step 1: Fetch first page with small limit
+      const page1Response = await apiRequest(page, 'get', '/api/audits?page=1&limit=5')
+      expect(page1Response.ok()).toBeTruthy()
+
+      const page1Body = await page1Response.json()
+      expect(page1Body.meta.currentPage).toBe(1)
+      expect(page1Body.meta.limit).toBe(5)
+      expect(page1Body.data.length).toBeLessThanOrEqual(5)
+
+      // Step 2: If there are more pages, fetch second page
+      if (page1Body.meta.hasNextPage) {
+        const page2Response = await apiRequest(page, 'get', '/api/audits?page=2&limit=5')
+        expect(page2Response.ok()).toBeTruthy()
+
+        const page2Body = await page2Response.json()
+        expect(page2Body.meta.currentPage).toBe(2)
+
+        // Step 3: Verify no duplicate entries between pages
+        const page1Ids = page1Body.data.map((e: { id: string }) => e.id)
+        const page2Ids = page2Body.data.map((e: { id: string }) => e.id)
+
+        for (const id of page2Ids) {
+          expect(page1Ids).not.toContain(id)
+        }
+      }
+    })
+
+    test('should respect pagination limit parameter', async ({ page }) => {
+      // Test different limit values
+      const limits = [5, 10, 20]
+
+      for (const limit of limits) {
+        const response = await apiRequest(page, 'get', `/api/audits?limit=${limit}`)
+        expect(response.ok()).toBeTruthy()
+
+        const body = await response.json()
+        expect(body.meta.limit).toBe(limit)
+        expect(body.data.length).toBeLessThanOrEqual(limit)
+      }
+    })
+  })
+
+  test.describe('Audit Investigation Flow', () => {
+    test.beforeEach(async ({ page }) => {
+      const authenticated = await isAuthenticated(page)
+      test.skip(!authenticated, 'No authenticated session available')
+
+      const accountId = getAccountId()
+      test.skip(!accountId, 'No account ID available')
+    })
+
+    test('complete audit investigation workflow', async ({ page }) => {
+      // Step 1: Start investigation - fetch recent audit logs
+      const recentResponse = await apiRequest(page, 'get', '/api/audits?limit=50')
+      expect(recentResponse.ok()).toBeTruthy()
+
+      const recentBody = await recentResponse.json()
+      expect(recentBody).toHaveProperty('data')
+
+      // Step 2: Gather statistics from available logs
+      const actionCounts: Record<string, number> = {}
+      for (const entry of recentBody.data) {
+        actionCounts[entry.action] = (actionCounts[entry.action] || 0) + 1
+      }
+
+      // Step 3: Identify most common action type
+      let mostCommonAction = ''
+      let maxCount = 0
+      for (const [action, count] of Object.entries(actionCounts)) {
+        if (count > maxCount) {
+          maxCount = count
+          mostCommonAction = action
+        }
+      }
+
+      // Step 4: If we have a common action, investigate it further
+      if (mostCommonAction) {
+        const filteredResponse = await apiRequest(page, 'get', `/api/audits?action=${mostCommonAction}`)
+        expect(filteredResponse.ok()).toBeTruthy()
+
+        const filteredBody = await filteredResponse.json()
+        expect(filteredBody.data.length).toBeGreaterThanOrEqual(maxCount)
+      }
+
+      // Step 5: Verify timeline ordering (most recent first)
+      if (recentBody.data.length >= 2) {
+        const firstTimestamp = new Date(recentBody.data[0].timestamp).getTime()
+        const secondTimestamp = new Date(recentBody.data[1].timestamp).getTime()
+        expect(firstTimestamp).toBeGreaterThanOrEqual(secondTimestamp)
+      }
+    })
+
+    test('should trace activity by transaction ID', async ({ page }) => {
+      // Step 1: Fetch audit logs
+      const response = await apiRequest(page, 'get', '/api/audits?limit=10')
+      expect(response.ok()).toBeTruthy()
+
+      const body = await response.json()
+
+      // Step 2: Skip if no logs available
+      if (body.data.length === 0) {
+        test.skip(true, 'No audit logs available')
+        return
+      }
+
+      // Step 3: Verify all entries have transaction IDs for tracing
+      for (const entry of body.data) {
+        expect(entry.transactionId).toBeDefined()
+        expect(typeof entry.transactionId).toBe('string')
+        expect(entry.transactionId.length).toBeGreaterThan(0)
+      }
+    })
+
+    test('should identify entity types in audit logs', async ({ page }) => {
+      // Step 1: Fetch audit logs
+      const response = await apiRequest(page, 'get', '/api/audits?limit=50')
+      expect(response.ok()).toBeTruthy()
+
+      const body = await response.json()
+
+      // Step 2: Gather entity types
+      const entityTypes = new Set<string>()
+      for (const entry of body.data) {
+        if (entry.entity) {
+          entityTypes.add(entry.entity)
+        }
+      }
+
+      // Step 3: If we have entities, verify they are valid table names
+      const validEntities = ['users', 'accounts', 'account_users', 'invitations', 'sessions']
+      for (const entity of entityTypes) {
+        expect(validEntities).toContain(entity)
+      }
+    })
+  })
+})

package/templates/base/tests/e2e/journeys/auth-onboarding.spec.ts

@@ -0,0 +1,232 @@
+import { test, expect, isAuthenticated, waitForNavigation, closeAllDialogs, apiRequest, getAccountId } from '../fixtures'
+
+/**
+ * Authentication & Onboarding Journey Tests
+ *
+ * These tests verify the complete authentication journey from login
+ * through onboarding to session management.
+ *
+ * @tags @critical @journey @auth
+ */
+
+test.describe('Authentication & Onboarding Journeys @critical @journey @auth', () => {
+  test.describe('OAuth Flow Structure', () => {
+    test('should display complete OAuth provider options on login page', async ({ page }) => {
+      await page.goto('/login')
+
+      // Verify login page loads with welcome message
+      await expect(page.getByText('Welcome back')).toBeVisible()
+
+      // Verify Google OAuth button is present and properly styled
+      const googleOAuthButton = page.getByRole('button', { name: /continue with google/i })
+      await expect(googleOAuthButton).toBeVisible()
+      await expect(googleOAuthButton).toBeEnabled()
+
+      // Verify the button has the expected structure (icon + text)
+      await expect(page.locator('body')).toBeVisible()
+    })
+
+    test('should show OAuth consent flow elements', async ({ page }) => {
+      await page.goto('/login')
+
+      // Verify the Google OAuth button initiates the OAuth flow
+      const googleOAuthButton = page.getByRole('button', { name: /continue with google/i })
+      await expect(googleOAuthButton).toBeVisible()
+
+      // Click the button and verify navigation to OAuth provider or auth endpoint
+      await googleOAuthButton.click()
+
+      // Wait for URL to change from login page (navigates to OAuth provider or auth callback)
+      await expect(page).not.toHaveURL('/login', { timeout: 10000 })
+    })
+  })
+
+  test.describe('Post-Login Onboarding', () => {
+    test.beforeEach(async ({ page }) => {
+      const authenticated = await isAuthenticated(page)
+      test.skip(!authenticated, 'No authenticated session available')
+    })
+
+    test('should land on dashboard after successful authentication', async ({ page }) => {
+      // Navigate to dashboard
+      await page.goto('/dashboard')
+
+      // Verify we are on the dashboard (not redirected to login)
+      await expect(page).not.toHaveURL(/login/)
+      await expect(page).toHaveURL(/dashboard/)
+
+      // Verify dashboard navigation is visible (primary indicator)
+      await expect(page.getByRole('navigation')).toBeVisible()
+    })
+
+    test('should have user context available after login', async ({ page, request, baseURL }) => {
+      // Verify /auth/me returns user data
+      const response = await request.get(`${baseURL}/auth/me`)
+
+      expect(response.ok()).toBeTruthy()
+
+      const body = await response.json()
+
+      // Should have user data with expected fields
+      expect(body).toHaveProperty('user')
+      expect(body.user).toHaveProperty('email')
+      expect(body.user).toHaveProperty('name')
+    })
+
+    test('should persist session across page reloads', async ({ page }) => {
+      // Go to dashboard
+      await page.goto('/dashboard')
+      await expect(page).not.toHaveURL(/login/)
+
+      // Reload the page
+      await page.reload()
+
+      // Should still be on dashboard (session persisted)
+      await expect(page).not.toHaveURL(/login/)
+      await expect(page).toHaveURL(/dashboard/)
+
+      // Verify we can access protected content
+      await expect(page.locator('body')).toBeVisible()
+    })
+
+    test('should persist session across navigation', async ({ page }) => {
+      // Start at dashboard
+      await page.goto('/dashboard')
+      await expect(page).not.toHaveURL(/login/)
+      await expect(page).toHaveURL(/dashboard/)
+
+      // Navigate to settings and verify session persists
+      await page.goto('/settings')
+      await expect(page).not.toHaveURL(/login/)
+      await expect(page.getByRole('heading', { name: /settings/i })).toBeVisible()
+
+      // Navigate to team and verify session persists
+      await page.goto('/team')
+      await expect(page).not.toHaveURL(/login/)
+      await expect(page.getByRole('heading', { name: /team members/i })).toBeVisible()
+
+      // Navigate to account and verify session persists
+      await page.goto('/account')
+      await expect(page).not.toHaveURL(/login/)
+      await expect(page.getByRole('heading', { name: /^account$/i })).toBeVisible()
+
+      // Return to dashboard - session should still be valid
+      await page.goto('/dashboard')
+      await expect(page).not.toHaveURL(/login/)
+      await expect(page).toHaveURL(/dashboard/)
+    })
+  })
+
+  test.describe('Account Selection Flow', () => {
+    test.beforeEach(async ({ page }) => {
+      const authenticated = await isAuthenticated(page)
+      test.skip(!authenticated, 'No authenticated session available')
+    })
+
+    test('should have account context in API requests', async ({ page }) => {
+      // Make an API request with account context
+      const response = await apiRequest(page, 'get', '/auth/me')
+
+      expect(response.ok()).toBeTruthy()
+
+      const body = await response.json()
+
+      // Verify user context is available with expected fields
+      expect(body).toHaveProperty('user')
+      expect(body.user).toHaveProperty('email')
+      expect(body.user).toHaveProperty('name')
+    })
+
+    test('should maintain account context across pages', async ({ page }) => {
+      // Navigate to account page
+      await page.goto('/account')
+      await expect(page).not.toHaveURL(/login/)
+
+      // Verify account page loads with user's account data
+      await expect(page.getByRole('heading', { name: /^account$/i })).toBeVisible()
+
+      // Verify connected accounts section shows user info
+      await expect(page.getByRole('heading', { name: /connected accounts/i })).toBeVisible()
+
+      // Navigate to settings - account context should be maintained
+      await page.goto('/settings')
+      await expect(page).not.toHaveURL(/login/)
+      await expect(page.getByRole('heading', { name: /settings/i })).toBeVisible()
+
+      // Navigate to team - account context should be maintained
+      await page.goto('/team')
+      await expect(page).not.toHaveURL(/login/)
+      await expect(page.getByRole('heading', { name: /team members/i })).toBeVisible()
+
+      // Return to account - context should still be valid
+      await page.goto('/account')
+      await expect(page).not.toHaveURL(/login/)
+      await expect(page.getByRole('heading', { name: /^account$/i })).toBeVisible()
+    })
+  })
+
+  test.describe('Session Management Journey', () => {
+    test.beforeEach(async ({ page }) => {
+      const authenticated = await isAuthenticated(page)
+      test.skip(!authenticated, 'No authenticated session available')
+    })
+
+    test.afterEach(async ({ page }) => {
+      await closeAllDialogs(page)
+    })
+
+    test('should display active sessions on account page', async ({ page }) => {
+      await page.goto('/account')
+
+      // Verify Active Sessions section is visible
+      await expect(page.getByRole('heading', { name: /active sessions/i })).toBeVisible()
+
+      // Verify at least one session is displayed with device info
+      const sessionInfo = page.getByText(/chrome on|safari on|firefox on|edge on/i)
+      await expect(sessionInfo.first()).toBeVisible()
+
+      // Current session badge should be visible
+      await expect(page.getByText('Current', { exact: true })).toBeVisible()
+    })
+
+    test('should show session device information', async ({ page }) => {
+      await page.goto('/account')
+
+      // Verify session shows device/browser information
+      const deviceInfo = page.getByText(/chrome on|safari on|firefox on/i)
+      await expect(deviceInfo.first()).toBeVisible()
+
+      // Verify the device info includes OS context (macOS, Windows, iPhone, etc.)
+      await expect(
+        page.getByText(/chrome on macos|safari on iphone|chrome on windows|firefox on/i).first()
+      ).toBeVisible()
+    })
+
+    test('should have sign out all sessions option', async ({ page }) => {
+      await page.goto('/account')
+
+      // Verify Active Sessions section exists
+      await expect(page.getByRole('heading', { name: /active sessions/i })).toBeVisible()
+
+      // Verify "Sign out all" button is present
+      const signOutAllButton = page.getByRole('button', { name: /sign out all/i })
+      await expect(signOutAllButton).toBeVisible()
+      await expect(signOutAllButton).toBeEnabled()
+    })
+
+    test('should show session location/activity', async ({ page }) => {
+      await page.goto('/account')
+
+      // Verify session shows location information
+      const locationInfo = page.getByText(/san francisco|new york|london|active now|hours ago|minutes ago/i)
+      await expect(locationInfo.first()).toBeVisible()
+
+      // Verify current session has "Current" badge
+      await expect(page.getByText('Current', { exact: true })).toBeVisible()
+
+      // Verify activity time is displayed
+      const activityInfo = page.getByText(/active now|hours ago|minutes ago|days ago/i)
+      await expect(activityInfo.first()).toBeVisible()
+    })
+  })
+})