@owlmeans/test-ui 0.1.11 → 0.1.15

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "package": "@owlmeans/test-ui",
-  "version": "0.1.11",
-  "generatedAt": "2026-06-17T10:37:52.340Z",
+  "version": "0.1.15",
+  "generatedAt": "2026-08-07T17:06:32.892Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/build/index.d.ts

@@ -1,4 +1,5 @@
 export * from './browser.js';
 export * from './mount.js';
+export * from './supervisor.js';
 export type { Browser, BrowserContext, Locator, Page } from 'playwright';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA"}

package/build/index.js

@@ -1,3 +1,4 @@
 export * from './browser.js';
 export * from './mount.js';
+export * from './supervisor.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA"}

package/build/supervisor.d.ts

@@ -0,0 +1,91 @@
+import type { Page } from 'playwright';
+import type { AuthRole } from '@owlmeans/auth';
+export interface PregenerateAuthTokenOptions {
+    /** Target user id / email the token represents. */
+    userId: string;
+    /**
+     * Private key to sign the bearer with, e.g. `ed25519:<base64>` from
+     * `.env.dev.secrets`. MUST be the key the target backend trusts as its own
+     * signing key (it verifies bearers against `cfg.alias`/`cfg.service`).
+     */
+    pk: string;
+    scopes?: string[];
+    role?: AuthRole;
+    entityId?: string;
+    profileId?: string;
+    /** `source` recorded in the Auth payload (usually the backend service alias). */
+    source?: string;
+}
+/**
+ * Mint a ready-to-use `ED25519-BASIC-TOKEN ...` bearer offline, reusing
+ * `@owlmeans/test-auth`'s `makeBearer`. This is the "set a token directly"
+ * fast-path for e2e/integration tests: no UI, no live auth round-trip. The
+ * backend accepts it because it is signed by the project's own trusted key.
+ *
+ * For a faithful end-to-end login (real supervisor plugin + registration), drive
+ * {@link loginViaSupervisorForm} instead.
+ */
+export declare const pregenerateAuthToken: (opts: PregenerateAuthTokenOptions) => Promise<string>;
+/**
+ * Inject a pre-generated bearer into an app that uses the standard owlmeans
+ * dispatcher: navigate to `/dispatcher?token=...` so the web app authenticates
+ * and redirects home natively. Note: apps that override the DISPATCHER route
+ * (e.g. to force an external IdP) should use {@link loginViaSupervisorForm}.
+ */
+export declare const loginViaDispatcher: (page: Page, baseUrl: string, token: string, opts?: {
+    dispatcherPath?: string;
+}) => Promise<void>;
+export interface SupervisorApiAuthOptions {
+    /** Auth-manager API base URL (the backend serving /authentication/* and /authenticate). */
+    apiBaseUrl: string;
+    /** Target user id / email to authenticate (and register on first use). */
+    userId: string;
+    /** Supervisor private key, e.g. `ed25519:<base64>` from `.env.dev.secrets`. */
+    pk: string;
+    /** Paths, overridable for non-default routing. */
+    paths?: {
+        init?: string;
+        authenticate?: string;
+        dispatch?: string;
+    };
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Pregenerate a real bearer by driving the live PK-based supervisor flow over the
+ * backend API (no browser): `/authentication/init` -> sign the challenge with the
+ * supervisor key -> `/authentication/authenticate` -> `/authenticate` (dispatcher
+ * exchange). This is the faithful "set a token directly via API" path
+ * (registers the user on first use), independent of any front-end routing.
+ *
+ * Returns the final `ED25519-BASIC-TOKEN ...` bearer the backend accepts.
+ */
+export declare const authenticateViaSupervisorApi: (opts: SupervisorApiAuthOptions) => Promise<string>;
+/**
+ * Save a full-page screenshot to `<dir>/<name>.png`, creating `dir` if needed.
+ * Returns the absolute file path. Use a host-backed folder (e.g. the project's
+ * `tmp/tests/screenshots`) so the file is visible whether the test runs on the
+ * host or inside a dev container.
+ */
+export declare const saveScreenshot: (page: Page, dir: string, name: string) => Promise<string>;
+export interface SupervisorFormLoginOptions {
+    baseUrl: string;
+    /** Target user id / email. */
+    userId: string;
+    /** Supervisor private key (e.g. `ed25519:<base64>` from `.env.dev.secrets`). */
+    pk: string;
+    /** Login path; defaults to the standard supervisor route. */
+    path?: string;
+    /** Predicate/URL fragment that signals a successful landing (default: leaving the login path). */
+    expectPath?: string;
+    timeout?: number;
+    /** When set, capture the filled login form (`supervisor-login-form.png`) before submit. */
+    screenshotDir?: string;
+}
+/**
+ * Drive the PK-based supervisor login FORM end-to-end (the faithful path that
+ * exercises the real supervisor plugin + registration): navigate to the
+ * supervisor login route, fill the user id + private key, submit, and wait for
+ * the app to leave the login screen.
+ */
+export declare const loginViaSupervisorForm: (page: Page, opts: SupervisorFormLoginOptions) => Promise<void>;
+//# sourceMappingURL=supervisor.d.ts.map

package/build/supervisor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,KAAK,EAAyB,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AASrE,MAAM,WAAW,2BAA2B;IAC1C,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAU,MAAM,2BAA2B,KAAG,OAAO,CAAC,MAAM,CAe5F,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,MAAM,IAAI,EAAE,SAAS,MAAM,EAAE,OAAO,MAAM,EAAE,OAAO;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,KAC7E,OAAO,CAAC,IAAI,CAOd,CAAA;AAED,MAAM,WAAW,wBAAwB;IACvC,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAA;IAClB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAA;IACV,kDAAkD;IAClD,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACnE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAgBD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GACvC,MAAM,wBAAwB,KAC7B,OAAO,CAAC,MAAM,CAkChB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,IAAI,EAAE,KAAK,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,MAAM,CAM1F,CAAA;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAA;IACV,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2FAA2F;IAC3F,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAID;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GACjC,MAAM,IAAI,EAAE,MAAM,0BAA0B,KAC3C,OAAO,CAAC,IAAI,CAmBd,CAAA"}

package/build/supervisor.js

@@ -0,0 +1,132 @@
+import { mkdir } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { AuthroizationType, AuthRole as Role, AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth';
+import { makeKeyPairModel } from '@owlmeans/basic-keys';
+import { createIdOfLength } from '@owlmeans/basic-ids';
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
+import { makeBearer } from '@owlmeans/test-auth';
+/**
+ * Mint a ready-to-use `ED25519-BASIC-TOKEN ...` bearer offline, reusing
+ * `@owlmeans/test-auth`'s `makeBearer`. This is the "set a token directly"
+ * fast-path for e2e/integration tests: no UI, no live auth round-trip. The
+ * backend accepts it because it is signed by the project's own trusted key.
+ *
+ * For a faithful end-to-end login (real supervisor plugin + registration), drive
+ * {@link loginViaSupervisorForm} instead.
+ */
+export const pregenerateAuthToken = async (opts) => {
+    const auth = {
+        token: createIdOfLength(32),
+        userId: opts.userId,
+        profileId: opts.profileId ?? opts.userId,
+        entityId: opts.entityId,
+        scopes: opts.scopes ?? ['*'],
+        role: opts.role ?? Role.User,
+        type: AuthroizationType.Ed25519BasicToken,
+        source: opts.source ?? '',
+        isUser: true,
+        createdAt: new Date()
+    };
+    return makeBearer(auth, makeKeyPairModel(opts.pk));
+};
+/**
+ * Inject a pre-generated bearer into an app that uses the standard owlmeans
+ * dispatcher: navigate to `/dispatcher?token=...` so the web app authenticates
+ * and redirects home natively. Note: apps that override the DISPATCHER route
+ * (e.g. to force an external IdP) should use {@link loginViaSupervisorForm}.
+ */
+export const loginViaDispatcher = async (page, baseUrl, token, opts) => {
+    const path = opts?.dispatcherPath ?? '/dispatcher';
+    const url = new URL(path, baseUrl);
+    url.searchParams.set('token', token);
+    await page.goto(url.toString());
+    // Wait until the dispatcher has navigated away (token consumed).
+    await page.waitForURL(u => !u.pathname.startsWith(path), { timeout: 30_000 });
+};
+const postJson = async (fetchImpl, url, body) => {
+    const res = await fetchImpl(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body)
+    });
+    if (!res.ok) {
+        throw new Error(`supervisor api ${url} -> ${res.status} ${await res.text().catch(() => '')}`);
+    }
+    return res.json();
+};
+/**
+ * Pregenerate a real bearer by driving the live PK-based supervisor flow over the
+ * backend API (no browser): `/authentication/init` -> sign the challenge with the
+ * supervisor key -> `/authentication/authenticate` -> `/authenticate` (dispatcher
+ * exchange). This is the faithful "set a token directly via API" path
+ * (registers the user on first use), independent of any front-end routing.
+ *
+ * Returns the final `ED25519-BASIC-TOKEN ...` bearer the backend accepts.
+ */
+export const authenticateViaSupervisorApi = async (opts) => {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const base = opts.apiBaseUrl.replace(/\/$/, '');
+    const initPath = opts.paths?.init ?? '/authentication/init';
+    const authPath = opts.paths?.authenticate ?? '/authentication/authenticate';
+    const dispatchPath = opts.paths?.dispatch ?? '/authenticate';
+    // 1. Ask the auth manager for a fresh, signed challenge envelope.
+    const { challenge } = await postJson(fetchImpl, base + initPath, {
+        type: AuthenticationType.Supervisor
+    });
+    // 2. Sign the unwrapped challenge + userId + salt with the supervisor key.
+    const challengeMsg = makeEnvelopeModel(challenge, EnvelopeKind.Wrap).message();
+    const salt = createIdOfLength(16);
+    const signature = await makeKeyPairModel(opts.pk)
+        .sign(buildSupervisorPayload(challengeMsg, opts.userId, salt));
+    const credentials = {
+        type: AuthenticationType.Supervisor,
+        challenge,
+        credential: JSON.stringify({ salt, signature }),
+        userId: opts.userId,
+        role: Role.User,
+        scopes: ['*']
+    };
+    // 3. Exchange for the intermediate auth-manager token.
+    const intermediate = await postJson(fetchImpl, base + authPath, credentials);
+    // 4. Exchange the intermediate token for the final project bearer.
+    const final = await postJson(fetchImpl, base + dispatchPath, { token: intermediate.token });
+    return final.token;
+};
+/**
+ * Save a full-page screenshot to `<dir>/<name>.png`, creating `dir` if needed.
+ * Returns the absolute file path. Use a host-backed folder (e.g. the project's
+ * `tmp/tests/screenshots`) so the file is visible whether the test runs on the
+ * host or inside a dev container.
+ */
+export const saveScreenshot = async (page, dir, name) => {
+    const target = resolve(dir);
+    await mkdir(target, { recursive: true });
+    const file = join(target, `${name}.png`);
+    await page.screenshot({ path: file, fullPage: true });
+    return file;
+};
+const DEFAULT_SUPERVISOR_PATH = '/authentication/login/pk-supervisor';
+/**
+ * Drive the PK-based supervisor login FORM end-to-end (the faithful path that
+ * exercises the real supervisor plugin + registration): navigate to the
+ * supervisor login route, fill the user id + private key, submit, and wait for
+ * the app to leave the login screen.
+ */
+export const loginViaSupervisorForm = async (page, opts) => {
+    const path = opts.path ?? DEFAULT_SUPERVISOR_PATH;
+    const timeout = opts.timeout ?? 60_000;
+    await page.goto(new URL(path, opts.baseUrl).toString());
+    await page.getByTestId('supervisor-user-id').fill(opts.userId);
+    await page.getByTestId('supervisor-pk').fill(opts.pk);
+    if (opts.screenshotDir != null) {
+        await saveScreenshot(page, opts.screenshotDir, 'supervisor-login-form');
+    }
+    await page.getByTestId('supervisor-submit').click();
+    if (opts.expectPath != null) {
+        await page.waitForURL(url => url.toString().includes(opts.expectPath), { timeout });
+    }
+    else {
+        await page.waitForURL(url => !url.pathname.startsWith(path), { timeout });
+    }
+};
+//# sourceMappingURL=supervisor.js.map

package/build/supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGzC,OAAO,EACL,iBAAiB,EAAE,QAAQ,IAAI,IAAI,EAAE,kBAAkB,EAAE,sBAAsB,EAChF,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAmBhD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,IAAiC,EAAmB,EAAE;IAC/F,MAAM,IAAI,GAAS;QACjB,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM;QACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;QAC5B,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;QACzC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAA;IAED,OAAO,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;AACpD,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,IAAU,EAAE,OAAe,EAAE,KAAa,EAAE,IAAkC,EAC/D,EAAE;IACjB,MAAM,IAAI,GAAG,IAAI,EAAE,cAAc,IAAI,aAAa,CAAA;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACpC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC/B,iEAAiE;IACjE,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;AAC/E,CAAC,CAAA;AAcD,MAAM,QAAQ,GAAG,KAAK,EACpB,SAAuB,EAAE,GAAW,EAAE,IAAa,EACrC,EAAE;IAChB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,OAAO,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAC/C,IAA8B,EACb,EAAE;IACnB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,sBAAsB,CAAA;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,IAAI,8BAA8B,CAAA;IAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,eAAe,CAAA;IAE5D,kEAAkE;IAClE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,QAAQ,EAAE;QAC/D,IAAI,EAAE,kBAAkB,CAAC,UAAU;KACpC,CAA0B,CAAA;IAE3B,2EAA2E;IAC3E,MAAM,YAAY,GAAG,iBAAiB,CAAS,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;IACtF,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;IACjC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9C,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IAEhE,MAAM,WAAW,GAAoB;QACnC,IAAI,EAAE,kBAAkB,CAAC,UAAU;QACnC,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,CAAC,GAAG,CAAC;KACd,CAAA;IAED,uDAAuD;IACvD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,QAAQ,EAAE,WAAW,CAAsB,CAAA;IAEjG,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAsB,CAAA;IAEhH,OAAO,KAAK,CAAC,KAAK,CAAA;AACpB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,IAAU,EAAE,GAAW,EAAE,IAAY,EAAmB,EAAE;IAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAA;IACxC,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAiBD,MAAM,uBAAuB,GAAG,qCAAqC,CAAA;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,IAAU,EAAE,IAAgC,EAC7B,EAAE;IACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAA;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAA;IACtC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IAEvD,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAErD,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,CAAA;IAEnD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAW,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACtF,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/test-ui",
-  "version": "0.1.11",
+  "version": "0.1.15",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,7 +22,12 @@
     "./harness": "./harness/index.html"
   },
   "dependencies": {
-    "@owlmeans/test": "^0.1.11",
+    "@owlmeans/auth": "^0.1.15",
+    "@owlmeans/basic-envelope": "^0.1.15",
+    "@owlmeans/basic-ids": "^0.1.15",
+    "@owlmeans/basic-keys": "^0.1.15",
+    "@owlmeans/test": "^0.1.15",
+    "@owlmeans/test-auth": "^0.1.15",
     "playwright": "^1.49.0"
   },
   "peerDependencies": {
@@ -38,11 +43,11 @@
     }
   },
   "devDependencies": {
-    "@owlmeans/dep-config": "^0.1.11",
-    "@types/bun": "^1.3.0",
-    "@types/react": "^19.2.7",
-    "nodemon": "^3.1.11",
-    "typescript": "^6.0.2"
+    "@owlmeans/dep-config": "^0.1.15",
+    "@types/bun": "^1.3.14",
+    "@types/react": "^19.2.17",
+    "nodemon": "^3.1.14",
+    "typescript": "^6.0.3"
   },
   "publishConfig": {
     "access": "public"

package/src/index.ts

@@ -1,3 +1,4 @@
 export * from './browser.js'
 export * from './mount.js'
+export * from './supervisor.js'
 export type { Browser, BrowserContext, Locator, Page } from 'playwright'

package/src/supervisor.ts

@@ -0,0 +1,204 @@
+import { mkdir } from 'node:fs/promises'
+import { join, resolve } from 'node:path'
+import type { Page } from 'playwright'
+import type { Auth, AuthCredentials, AuthRole } from '@owlmeans/auth'
+import {
+  AuthroizationType, AuthRole as Role, AuthenticationType, buildSupervisorPayload
+} from '@owlmeans/auth'
+import { makeKeyPairModel } from '@owlmeans/basic-keys'
+import { createIdOfLength } from '@owlmeans/basic-ids'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import { makeBearer } from '@owlmeans/test-auth'
+
+export interface PregenerateAuthTokenOptions {
+  /** Target user id / email the token represents. */
+  userId: string
+  /**
+   * Private key to sign the bearer with, e.g. `ed25519:<base64>` from
+   * `.env.dev.secrets`. MUST be the key the target backend trusts as its own
+   * signing key (it verifies bearers against `cfg.alias`/`cfg.service`).
+   */
+  pk: string
+  scopes?: string[]
+  role?: AuthRole
+  entityId?: string
+  profileId?: string
+  /** `source` recorded in the Auth payload (usually the backend service alias). */
+  source?: string
+}
+
+/**
+ * Mint a ready-to-use `ED25519-BASIC-TOKEN ...` bearer offline, reusing
+ * `@owlmeans/test-auth`'s `makeBearer`. This is the "set a token directly"
+ * fast-path for e2e/integration tests: no UI, no live auth round-trip. The
+ * backend accepts it because it is signed by the project's own trusted key.
+ *
+ * For a faithful end-to-end login (real supervisor plugin + registration), drive
+ * {@link loginViaSupervisorForm} instead.
+ */
+export const pregenerateAuthToken = async (opts: PregenerateAuthTokenOptions): Promise<string> => {
+  const auth: Auth = {
+    token: createIdOfLength(32),
+    userId: opts.userId,
+    profileId: opts.profileId ?? opts.userId,
+    entityId: opts.entityId,
+    scopes: opts.scopes ?? ['*'],
+    role: opts.role ?? Role.User,
+    type: AuthroizationType.Ed25519BasicToken,
+    source: opts.source ?? '',
+    isUser: true,
+    createdAt: new Date()
+  }
+
+  return makeBearer(auth, makeKeyPairModel(opts.pk))
+}
+
+/**
+ * Inject a pre-generated bearer into an app that uses the standard owlmeans
+ * dispatcher: navigate to `/dispatcher?token=...` so the web app authenticates
+ * and redirects home natively. Note: apps that override the DISPATCHER route
+ * (e.g. to force an external IdP) should use {@link loginViaSupervisorForm}.
+ */
+export const loginViaDispatcher = async (
+  page: Page, baseUrl: string, token: string, opts?: { dispatcherPath?: string }
+): Promise<void> => {
+  const path = opts?.dispatcherPath ?? '/dispatcher'
+  const url = new URL(path, baseUrl)
+  url.searchParams.set('token', token)
+  await page.goto(url.toString())
+  // Wait until the dispatcher has navigated away (token consumed).
+  await page.waitForURL(u => !u.pathname.startsWith(path), { timeout: 30_000 })
+}
+
+export interface SupervisorApiAuthOptions {
+  /** Auth-manager API base URL (the backend serving /authentication/* and /authenticate). */
+  apiBaseUrl: string
+  /** Target user id / email to authenticate (and register on first use). */
+  userId: string
+  /** Supervisor private key, e.g. `ed25519:<base64>` from `.env.dev.secrets`. */
+  pk: string
+  /** Paths, overridable for non-default routing. */
+  paths?: { init?: string, authenticate?: string, dispatch?: string }
+  fetchImpl?: typeof fetch
+}
+
+const postJson = async (
+  fetchImpl: typeof fetch, url: string, body: unknown
+): Promise<any> => {
+  const res = await fetchImpl(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body)
+  })
+  if (!res.ok) {
+    throw new Error(`supervisor api ${url} -> ${res.status} ${await res.text().catch(() => '')}`)
+  }
+  return res.json()
+}
+
+/**
+ * Pregenerate a real bearer by driving the live PK-based supervisor flow over the
+ * backend API (no browser): `/authentication/init` -> sign the challenge with the
+ * supervisor key -> `/authentication/authenticate` -> `/authenticate` (dispatcher
+ * exchange). This is the faithful "set a token directly via API" path
+ * (registers the user on first use), independent of any front-end routing.
+ *
+ * Returns the final `ED25519-BASIC-TOKEN ...` bearer the backend accepts.
+ */
+export const authenticateViaSupervisorApi = async (
+  opts: SupervisorApiAuthOptions
+): Promise<string> => {
+  const fetchImpl = opts.fetchImpl ?? fetch
+  const base = opts.apiBaseUrl.replace(/\/$/, '')
+  const initPath = opts.paths?.init ?? '/authentication/init'
+  const authPath = opts.paths?.authenticate ?? '/authentication/authenticate'
+  const dispatchPath = opts.paths?.dispatch ?? '/authenticate'
+
+  // 1. Ask the auth manager for a fresh, signed challenge envelope.
+  const { challenge } = await postJson(fetchImpl, base + initPath, {
+    type: AuthenticationType.Supervisor
+  }) as { challenge: string }
+
+  // 2. Sign the unwrapped challenge + userId + salt with the supervisor key.
+  const challengeMsg = makeEnvelopeModel<string>(challenge, EnvelopeKind.Wrap).message()
+  const salt = createIdOfLength(16)
+  const signature = await makeKeyPairModel(opts.pk)
+    .sign(buildSupervisorPayload(challengeMsg, opts.userId, salt))
+
+  const credentials: AuthCredentials = {
+    type: AuthenticationType.Supervisor,
+    challenge,
+    credential: JSON.stringify({ salt, signature }),
+    userId: opts.userId,
+    role: Role.User,
+    scopes: ['*']
+  }
+
+  // 3. Exchange for the intermediate auth-manager token.
+  const intermediate = await postJson(fetchImpl, base + authPath, credentials) as { token: string }
+
+  // 4. Exchange the intermediate token for the final project bearer.
+  const final = await postJson(fetchImpl, base + dispatchPath, { token: intermediate.token }) as { token: string }
+
+  return final.token
+}
+
+/**
+ * Save a full-page screenshot to `<dir>/<name>.png`, creating `dir` if needed.
+ * Returns the absolute file path. Use a host-backed folder (e.g. the project's
+ * `tmp/tests/screenshots`) so the file is visible whether the test runs on the
+ * host or inside a dev container.
+ */
+export const saveScreenshot = async (page: Page, dir: string, name: string): Promise<string> => {
+  const target = resolve(dir)
+  await mkdir(target, { recursive: true })
+  const file = join(target, `${name}.png`)
+  await page.screenshot({ path: file, fullPage: true })
+  return file
+}
+
+export interface SupervisorFormLoginOptions {
+  baseUrl: string
+  /** Target user id / email. */
+  userId: string
+  /** Supervisor private key (e.g. `ed25519:<base64>` from `.env.dev.secrets`). */
+  pk: string
+  /** Login path; defaults to the standard supervisor route. */
+  path?: string
+  /** Predicate/URL fragment that signals a successful landing (default: leaving the login path). */
+  expectPath?: string
+  timeout?: number
+  /** When set, capture the filled login form (`supervisor-login-form.png`) before submit. */
+  screenshotDir?: string
+}
+
+const DEFAULT_SUPERVISOR_PATH = '/authentication/login/pk-supervisor'
+
+/**
+ * Drive the PK-based supervisor login FORM end-to-end (the faithful path that
+ * exercises the real supervisor plugin + registration): navigate to the
+ * supervisor login route, fill the user id + private key, submit, and wait for
+ * the app to leave the login screen.
+ */
+export const loginViaSupervisorForm = async (
+  page: Page, opts: SupervisorFormLoginOptions
+): Promise<void> => {
+  const path = opts.path ?? DEFAULT_SUPERVISOR_PATH
+  const timeout = opts.timeout ?? 60_000
+  await page.goto(new URL(path, opts.baseUrl).toString())
+
+  await page.getByTestId('supervisor-user-id').fill(opts.userId)
+  await page.getByTestId('supervisor-pk').fill(opts.pk)
+
+  if (opts.screenshotDir != null) {
+    await saveScreenshot(page, opts.screenshotDir, 'supervisor-login-form')
+  }
+
+  await page.getByTestId('supervisor-submit').click()
+
+  if (opts.expectPath != null) {
+    await page.waitForURL(url => url.toString().includes(opts.expectPath!), { timeout })
+  } else {
+    await page.waitForURL(url => !url.pathname.startsWith(path), { timeout })
+  }
+}