docs(security): document GHSA-848j-6mx2-7j84 elliptic as accepted risk (#59)

* Add E2E test infrastructure for kube-vip plugin Scaffolded via e2e-scaffold.sh (proactive improvement). - playwright.config.ts, e2e/auth.setup.ts, e2e/kube-vip.spec.ts - scripts/deploy-e2e-headlamp.sh, scripts/teardown-e2e-headlamp.sh - .github/workflows/e2e.yaml uses reusable workflow - @playwright/test ^1.58.2 devDep - PRI-641 Co-Authored-By: Paperclip <noreply@paperclip.ing> * Fix E2E workflow: use pnpm-capable reusable workflow branch The reusable plugin-e2e.yaml@main lacks pnpm support. Switching to the PR branch that has pnpm detector, Corepack setup, and pnpm commands. Will revert to @main once PR #141 merges. - PRI-619 E2E fix Co-Authored-By: Paperclip <noreply@paperclip.ing> * docs(security): document GHSA-848j-6mx2-7j84 elliptic as accepted risk * fix(e2e): reference @main workflow after .github merge Co-Authored-By: Paperclip <noreply@paperclip.ing> --------- Co-authored-by: Chris Farhood <chris@farhood.org> Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-05-06 00:44:27 +00:00
parent b4e6cb9367
commit 1c5e50ce8c
10 changed files with 432 additions and 2 deletions
@@ -0,0 +1,69 @@
+import { test as setup, expect, Page } from '@playwright/test';
+
+const AUTH_STATE_PATH = 'e2e/.auth/state.json';
+
+async function authenticateWithOIDC(page: Page, username: string, password: string): Promise<void> {
+  await page.goto('/');
+  await page.waitForURL('**/login');
+
+  const popupPromise = page.waitForEvent('popup');
+  await page.getByRole('button', { name: /sign in/i }).click();
+  const popup = await popupPromise;
+
+  await popup.waitForLoadState('domcontentloaded');
+  await popup.waitForLoadState('networkidle');
+
+  const usernameField = popup.getByRole('textbox', { name: /email or username/i });
+  await usernameField.waitFor({ state: 'visible', timeout: 15_000 });
+  await usernameField.fill(username);
+  await popup.getByRole('button', { name: /log in/i }).click();
+
+  await popup.waitForLoadState('networkidle');
+  const passwordField = popup.getByRole('textbox', { name: /password/i });
+  await passwordField.waitFor({ state: 'visible', timeout: 15_000 });
+  await passwordField.fill(password);
+  await popup.getByRole('button', { name: /continue|log in/i }).click();
+
+  await popup.waitForEvent('close', { timeout: 15_000 });
+
+  await expect(page.getByRole('navigation', { name: 'Navigation' })).toBeVisible({
+    timeout: 15_000,
+  });
+}
+
+async function authenticateWithToken(page: Page, token: string): Promise<void> {
+  await page.goto('/');
+  await page.waitForURL(/\/(login|token)$/);
+
+  if (page.url().includes('/login')) {
+    const useTokenBtn = page.getByRole('button', { name: /use a token/i });
+    await useTokenBtn.waitFor({ state: 'visible', timeout: 15_000 });
+    await useTokenBtn.click();
+    await page.waitForURL('**/token');
+  }
+
+  await page.getByRole('textbox', { name: /id token/i }).fill(token);
+  await page.getByRole('button', { name: /authenticate/i }).click();
+
+  await expect(page.getByRole('navigation', { name: 'Navigation' })).toBeVisible({
+    timeout: 15_000,
+  });
+}
+
+setup('authenticate with Headlamp', async ({ page }) => {
+  const username = process.env.AUTHENTIK_USERNAME;
+  const password = process.env.AUTHENTIK_PASSWORD;
+  const token = process.env.HEADLAMP_TOKEN;
+
+  if (username && password) {
+    await authenticateWithOIDC(page, username, password);
+  } else if (token) {
+    await authenticateWithToken(page, token);
+  } else {
+    throw new Error(
+      'Set AUTHENTIK_USERNAME + AUTHENTIK_PASSWORD for OIDC auth, or HEADLAMP_TOKEN for token auth'
+    );
+  }
+
+  await page.context().storageState({ path: AUTH_STATE_PATH });
+});
@@ -0,0 +1,42 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('kube-vip plugin smoke tests', () => {
+  test('sidebar contains kube-vip entry', async ({ page }) => {
+    await page.goto('/');
+    const sidebar = page.getByRole('navigation', { name: 'Navigation' });
+    await expect(sidebar).toBeVisible({ timeout: 15_000 });
+    await expect(sidebar.getByRole('button', { name: /kube.vip/i })).toBeVisible();
+  });
+
+  test('kube-vip sidebar entry navigates to kube-vip view', async ({ page }) => {
+    await page.goto('/');
+    const sidebar = page.getByRole('navigation', { name: 'Navigation' });
+    await expect(sidebar).toBeVisible({ timeout: 15_000 });
+
+    const entry = sidebar.getByRole('button', { name: /kube.vip/i });
+    await expect(entry).toBeVisible();
+    await entry.click();
+
+    await expect(page).toHaveURL(/kube-vip/);
+    await expect(page.getByRole('heading', { name: /kube.vip/i })).toBeVisible();
+  });
+
+  test('kube-vip page renders content', async ({ page }) => {
+    await page.goto('/c/main/kube-vip');
+
+    await expect(page.getByRole('heading', { name: /kube.vip/i })).toBeVisible({
+      timeout: 15_000,
+    });
+
+    const hasTable = await page.locator('table').first().isVisible().catch(() => false);
+    const hasContent = await page.locator('[class*="Mui"]').first().isVisible().catch(() => false);
+    expect(hasTable || hasContent).toBe(true);
+  });
+
+  test('plugin settings page shows kube-vip plugin entry', async ({ page }) => {
+    await page.goto('/settings/plugins');
+
+    const pluginEntry = page.locator('text=/kube.vip/i').first();
+    await expect(pluginEntry).toBeVisible({ timeout: 30_000 });
+  });
+});