@nextsparkjs/theme-default 0.1.0-beta.1 → 0.1.0-beta.100

package/tests/cypress/e2e/uat/_core/auth/custom-roles/editor-login.cy.ts

@@ -0,0 +1,188 @@
+/// <reference types="cypress" />
+
+/**
+ * Editor Custom Role Login Tests
+ *
+ * Tests the Editor custom role (theme-defined) login and specific permissions:
+ * - Editor is a custom role defined in the Default theme
+ * - Can view/list customers but cannot create/update/delete
+ * - Limited navigation and entity access
+ * - Cannot access Superadmin or Dev Zone
+ *
+ * Note: Editor role is team-based (not a global app role)
+ * This file tests Editor-specific permissions as defined in the theme.
+ *
+ * Tags: @uat, @feat-auth, @custom-role, @editor
+ */
+
+import * as allure from 'allure-cypress'
+
+import { loginAsDefaultEditor, DEFAULT_THEME_USERS } from '../../../../src/session-helpers'
+import { DashboardPOM } from '../../../../src/features/DashboardPOM'
+import { SettingsPOM } from '../../../../src/features/SettingsPOM'
+import { SuperadminPOM } from '../../../../src/features/SuperadminPOM'
+import { DevAreaPOM } from '../../../../src/features/DevAreaPOM'
+import { AuthPOM } from '../../../../src/core/AuthPOM'
+
+describe('Authentication - Editor Custom Role Permissions', {
+  tags: ['@uat', '@feat-auth', '@custom-role', '@editor']
+}, () => {
+  const dashboard = DashboardPOM.create()
+  const settings = SettingsPOM.create()
+  const sector7 = SuperadminPOM.create()
+  const devArea = DevAreaPOM.create()
+  const auth = new AuthPOM()
+
+  beforeEach(() => {
+    allure.epic('Authentication')
+    allure.feature('Custom Roles')
+    allure.story('Editor Permissions')
+    loginAsDefaultEditor()
+  })
+
+  describe('EDITOR-PERM-001: Editor Dashboard Access', { tags: '@smoke' }, () => {
+    it('should access dashboard with limited navigation', { tags: '@smoke' }, () => {
+      allure.severity('critical')
+
+      // 1. Visit dashboard and wait for load
+      dashboard.visitDashboard()
+      dashboard.waitForDashboard()
+
+      // 2. Validate dashboard is accessible
+      dashboard.assertDashboardVisible()
+
+      cy.log(`✅ Editor dashboard access verified (${DEFAULT_THEME_USERS.EDITOR})`)
+    })
+  })
+
+  describe('EDITOR-PERM-002: Editor View-Only Customer Access', { tags: '@smoke' }, () => {
+    it('should have view-only access to customers list', { tags: '@smoke' }, () => {
+      allure.severity('critical')
+
+      // 1. Navigate to customers
+      dashboard.visitEntity('customers')
+      dashboard.waitForEntityPage('customers')
+
+      // 2. Validate table is visible (Editor can read)
+      dashboard.assertEntityPageVisible('customers')
+
+      // 3. Create button should NOT be visible for Editor
+      dashboard.assertEntityAddButtonNotVisible('customers')
+
+      cy.log('✅ Editor has view-only access to customers')
+    })
+  })
+
+  describe('EDITOR-PERM-003: Editor Cannot Edit Customers', () => {
+    it('should not see edit buttons on customer items', () => {
+      allure.severity('high')
+
+      // 1. Navigate to customers
+      dashboard.visitEntity('customers')
+      dashboard.waitForEntityPage('customers')
+
+      // 2. Validate table is visible
+      dashboard.assertEntityPageVisible('customers')
+
+      // 3. If there are items, check they don't have edit buttons
+      cy.get('body').then(($body) => {
+        if ($body.find('[data-cy^="customers-row-"]').length > 0) {
+          // Check first row doesn't have edit action
+          cy.get('[data-cy^="customers-row-"]').first().within(() => {
+            cy.get('[data-cy*="edit"]').should('not.exist')
+            cy.get('[data-cy*="delete"]').should('not.exist')
+          })
+          cy.log('✅ Editor cannot see edit/delete actions')
+        } else {
+          cy.log('✅ No items to verify, but create button is hidden')
+        }
+      })
+    })
+  })
+
+  describe('EDITOR-PERM-004: Editor Tasks Access', { tags: '@in-develop' }, () => {
+    it('should NOT have access to tasks (permission denied)', { tags: '@in-develop' }, () => {
+      allure.severity('high')
+
+      // 1. Navigate to tasks - Editor does NOT have tasks.list permission
+      cy.visit('/dashboard/tasks', { failOnStatusCode: false })
+
+      // 2. Should be redirected to permission denied page
+      cy.url().should('include', 'permission-denied')
+      cy.contains('Acceso denegado').should('be.visible')
+
+      cy.log('✅ Editor correctly blocked from tasks')
+    })
+  })
+
+  describe('EDITOR-PERM-005: Editor Settings Access', () => {
+    it('should have profile-only settings access', () => {
+      allure.severity('normal')
+
+      // 1. Navigate to settings
+      settings.visitSettings()
+
+      // 2. Check access
+      cy.url().then((url) => {
+        if (url.includes('/settings')) {
+          settings.assertSettingsVisible()
+          // Should only see profile, not team settings
+          settings.assertNavItemVisible('profile')
+          cy.log('✅ Editor has profile settings access')
+        } else {
+          cy.log('✅ Editor redirected from settings')
+        }
+      })
+    })
+  })
+
+  describe('EDITOR-PERM-006: Editor Cannot Access Superadmin', () => {
+    it('should be redirected when trying to access /superadmin', () => {
+      allure.severity('high')
+
+      // 1. Attempt to visit Superadmin
+      cy.visit('/superadmin', { timeout: 60000, failOnStatusCode: false })
+
+      // 2. Should be redirected
+      sector7.assertAccessDenied()
+
+      cy.log('✅ Editor correctly blocked from Superadmin')
+    })
+  })
+
+  describe('EDITOR-PERM-007: Editor Cannot Access Dev Zone', () => {
+    it('should be redirected when trying to access /dev', () => {
+      allure.severity('high')
+
+      // 1. Attempt to visit Dev Zone
+      devArea.attemptToVisitDev()
+
+      // 2. Should be redirected
+      devArea.assertRedirectedToDashboard()
+
+      cy.log('✅ Editor correctly blocked from Dev Zone')
+    })
+  })
+
+  describe('EDITOR-PERM-008: Editor Logout Flow', () => {
+    it('should logout successfully', () => {
+      allure.severity('normal')
+
+      // 1. Visit dashboard
+      dashboard.visitDashboard()
+      dashboard.waitForDashboard()
+
+      // 2. Logout using AuthPOM
+      auth.logout()
+
+      // 3. Validate redirected to login
+      auth.assertOnLoginPage()
+
+      cy.log('✅ Editor logout successful')
+    })
+  })
+
+  after(() => {
+    cy.log('✅ Editor custom role tests completed')
+  })
+})

package/tests/cypress/e2e/uat/_core/auth/login-logout.bdd.md

@@ -0,0 +1,160 @@
+---
+feature: Authentication via DevKeyring
+priority: critical
+tags: [auth, login, logout, devkeyring]
+grepTags: [uat, feat-auth, smoke, critical]
+coverage: 4
+---
+
+# Authentication via DevKeyring
+
+> Test suite for user authentication using DevKeyring development tool. Covers login flows for Owner, Member, and Admin roles, plus logout functionality.
+
+## @test LOGIN-001: Owner Login via DevKeyring
+
+### Metadata
+- **Priority:** Critical
+- **Type:** Smoke
+- **Tags:** login, owner, devkeyring
+- **Grep:** `@smoke` `@critical`
+
+```gherkin:en
+Scenario: Owner can login and access dashboard
+
+Given I am on the login page
+And the DevKeyring component is visible
+When I select the Owner user (owner@nextspark.dev)
+And I click to login
+Then I should be redirected to the dashboard
+And the dashboard container should be visible
+```
+
+```gherkin:es
+Scenario: Owner puede loguearse y acceder al dashboard
+
+Given estoy en la pagina de login
+And el componente DevKeyring esta visible
+When selecciono el usuario Owner (owner@nextspark.dev)
+And hago clic para iniciar sesion
+Then deberia ser redirigido al dashboard
+And el contenedor del dashboard deberia estar visible
+```
+
+### Expected Results
+- DevKeyring component displays user selector
+- Owner user (owner@nextspark.dev) is selectable
+- Login redirects to /dashboard
+- Dashboard container is visible after login
+
+---
+
+## @test LOGIN-002: Member Login via DevKeyring
+
+### Metadata
+- **Priority:** Critical
+- **Type:** Smoke
+- **Tags:** login, member, devkeyring
+- **Grep:** `@smoke` `@critical`
+
+```gherkin:en
+Scenario: Member can login and access dashboard
+
+Given I am on the login page
+And the DevKeyring component is visible
+When I select the Member user (member@nextspark.dev)
+And I click to login
+Then I should be redirected to the dashboard
+And the dashboard container should be visible
+```
+
+```gherkin:es
+Scenario: Member puede loguearse y acceder al dashboard
+
+Given estoy en la pagina de login
+And el componente DevKeyring esta visible
+When selecciono el usuario Member (member@nextspark.dev)
+And hago clic para iniciar sesion
+Then deberia ser redirigido al dashboard
+And el contenedor del dashboard deberia estar visible
+```
+
+### Expected Results
+- Member user (member@nextspark.dev) is selectable
+- Login redirects to /dashboard
+- Dashboard container is visible after login
+- Member has read-only access to most entities
+
+---
+
+## @test LOGIN-003: Admin Login via DevKeyring
+
+### Metadata
+- **Priority:** High
+- **Type:** Regression
+- **Tags:** login, admin, devkeyring
+
+```gherkin:en
+Scenario: Admin can login and access dashboard
+
+Given I am on the login page
+And the DevKeyring component is visible
+When I select the Admin user (admin@nextspark.dev)
+And I click to login
+Then I should be redirected to the dashboard
+And the dashboard container should be visible
+```
+
+```gherkin:es
+Scenario: Admin puede loguearse y acceder al dashboard
+
+Given estoy en la pagina de login
+And el componente DevKeyring esta visible
+When selecciono el usuario Admin (admin@nextspark.dev)
+And hago clic para iniciar sesion
+Then deberia ser redirigido al dashboard
+And el contenedor del dashboard deberia estar visible
+```
+
+### Expected Results
+- Admin user (admin@nextspark.dev) is selectable
+- Login redirects to /dashboard
+- Dashboard container is visible after login
+- Admin has delegated full CRUD access
+
+---
+
+## @test LOGOUT-001: User Logout Flow
+
+### Metadata
+- **Priority:** High
+- **Type:** Regression
+- **Tags:** logout, signout, navigation
+
+```gherkin:en
+Scenario: User can logout successfully
+
+Given I am logged in as Owner
+And I am on the dashboard
+When I click on the user menu in the top navigation
+And I click "Sign Out"
+Then I should be redirected to the login page
+And the DevKeyring component should be visible again
+```
+
+```gherkin:es
+Scenario: Usuario puede cerrar sesion exitosamente
+
+Given estoy logueado como Owner
+And estoy en el dashboard
+When hago clic en el menu de usuario en la navegacion superior
+And hago clic en "Cerrar Sesion"
+Then deberia ser redirigido a la pagina de login
+And el componente DevKeyring deberia estar visible nuevamente
+```
+
+### Expected Results
+- User menu is accessible in top navigation
+- Sign Out option is visible in menu
+- Clicking Sign Out clears session
+- User is redirected to login page
+- DevKeyring component is visible for re-login

package/tests/cypress/e2e/uat/_core/auth/login-logout.cy.ts

@@ -0,0 +1,116 @@
+/// <reference types="cypress" />
+
+import * as allure from 'allure-cypress'
+
+import { DevKeyringPOM } from '../../../../src/components/DevKeyringPOM'
+import { DEFAULT_THEME_USERS } from '../../../../src/session-helpers'
+
+describe('Authentication - DevKeyring Flow', {
+  tags: ['@uat', '@feat-auth', '@smoke', '@regression']
+}, () => {
+  const devKeyring = DevKeyringPOM.create()
+  const users = DEFAULT_THEME_USERS
+
+  beforeEach(() => {
+    allure.epic('UAT')
+    allure.feature('Authentication')
+    allure.story('DevKeyring Login')
+    // Clear cookies and localStorage to ensure fresh state
+    cy.clearCookies()
+    cy.clearLocalStorage()
+  })
+
+  describe('LOGIN_001: Owner Login via DevKeyring', { tags: '@smoke' }, () => {
+    it('should login as Owner and access dashboard', { tags: '@smoke' }, () => {
+      allure.severity('critical')
+
+      // 1. Visit login page
+      cy.visit('/login')
+
+      // 2. Validate DevKeyring is visible
+      devKeyring.validateVisible()
+
+      // 3. Login as Owner using email
+      devKeyring.quickLoginByEmail(users.OWNER)
+
+      // 4. Validate dashboard access
+      cy.url().should('include', '/dashboard')
+      cy.get('[data-cy="dashboard-container"]').should('be.visible')
+
+      cy.log(`✅ Owner login successful (${users.OWNER})`)
+    })
+  })
+
+  describe('LOGIN_002: Member Login via DevKeyring', { tags: '@smoke' }, () => {
+    it('should login as Member and access dashboard', { tags: '@smoke' }, () => {
+      allure.severity('critical')
+
+      // 1. Visit login page
+      cy.visit('/login')
+
+      // 2. Validate DevKeyring is visible
+      devKeyring.validateVisible()
+
+      // 3. Login as Member using email
+      devKeyring.quickLoginByEmail(users.MEMBER)
+
+      // 4. Validate dashboard access
+      cy.url().should('include', '/dashboard')
+      cy.get('[data-cy="dashboard-container"]').should('be.visible')
+
+      cy.log(`✅ Member login successful (${users.MEMBER})`)
+    })
+  })
+
+  describe('LOGIN_003: Admin Login via DevKeyring', () => {
+    it('should login as Admin and access dashboard', () => {
+      // 1. Visit login page
+      cy.visit('/login')
+
+      // 2. Validate DevKeyring is visible
+      devKeyring.validateVisible()
+
+      // 3. Login as Admin using email
+      devKeyring.quickLoginByEmail(users.ADMIN)
+
+      // 4. Validate dashboard access
+      cy.url().should('include', '/dashboard')
+      cy.get('[data-cy="dashboard-container"]').should('be.visible')
+
+      cy.log(`✅ Admin login successful (${users.ADMIN})`)
+    })
+  })
+
+  describe('LOGOUT_001: User Logout Flow', () => {
+    it('should logout successfully and redirect to login', () => {
+      // Set desktop viewport to show TopNavbar (requires lg: 1024px+)
+      cy.viewport(1280, 800)
+
+      // 1. Login first as Owner
+      cy.visit('/login')
+      devKeyring.quickLoginByEmail(users.OWNER)
+
+      // Wait for dashboard to fully load
+      cy.url().should('include', '/dashboard')
+      cy.get('[data-cy="dashboard-container"]').should('be.visible')
+
+      // Wait for user menu to be available (session loaded)
+      // TopNavbar uses useAuth() which has loading state
+      cy.get('[data-cy="topnav-user-menu-trigger"]', { timeout: 15000 }).should('be.visible')
+
+      // 2. Logout via user menu
+      cy.get('[data-cy="topnav-user-menu-trigger"]').click()
+      cy.get('[data-cy="topnav-menu-signOut"]').should('be.visible').click()
+
+      // 3. Validate redirected to login and DevKeyring is visible again
+      cy.url().should('include', '/login')
+      devKeyring.validateVisible()
+
+      cy.log('✅ Logout successful')
+    })
+  })
+
+  after(() => {
+    cy.log('✅ Authentication tests completed')
+  })
+})