diff --git a/backend/go.mod b/backend/go.mod index a177efd4..47e54ac0 100644 --- a/backend/go.mod +++ b/backend/go.mod @@ -1,6 +1,6 @@ module github.com/Wikid82/charon/backend -go 1.26.0 +go 1.26 require ( github.com/containrrr/shoutrrr v0.8.0 diff --git a/go.work b/go.work index 1f9018ac..ca05e7d8 100644 --- a/go.work +++ b/go.work @@ -1,3 +1,3 @@ -go 1.25.0 +go 1.26.0 use ./backend diff --git a/tests/phase4-uat/01-admin-onboarding.spec.ts b/tests/core/admin-onboarding.spec.ts similarity index 100% rename from tests/phase4-uat/01-admin-onboarding.spec.ts rename to tests/core/admin-onboarding.spec.ts diff --git a/tests/phase3/security-enforcement.spec.ts b/tests/core/auth-api-enforcement.spec.ts similarity index 100% rename from tests/phase3/security-enforcement.spec.ts rename to tests/core/auth-api-enforcement.spec.ts diff --git a/tests/phase3/auth-long-session.spec.ts b/tests/core/auth-long-session.spec.ts similarity index 100% rename from tests/phase3/auth-long-session.spec.ts rename to tests/core/auth-long-session.spec.ts diff --git a/tests/phase3/cerberus-acl.spec.ts b/tests/core/authorization-rbac.spec.ts similarity index 100% rename from tests/phase3/cerberus-acl.spec.ts rename to tests/core/authorization-rbac.spec.ts diff --git a/tests/phase4-integration/05-data-consistency.spec.ts b/tests/core/data-consistency.spec.ts similarity index 100% rename from tests/phase4-integration/05-data-consistency.spec.ts rename to tests/core/data-consistency.spec.ts diff --git a/tests/phase4-uat/05-domain-dns-management.spec.ts b/tests/core/domain-dns-management.spec.ts similarity index 100% rename from tests/phase4-uat/05-domain-dns-management.spec.ts rename to tests/core/domain-dns-management.spec.ts diff --git a/tests/phase4-integration/07-multi-component-workflows.spec.ts b/tests/core/multi-component-workflows.spec.ts similarity index 100% rename from tests/phase4-integration/07-multi-component-workflows.spec.ts rename to tests/core/multi-component-workflows.spec.ts diff --git a/tests/phase3/coraza-waf.spec.ts b/tests/phase3/coraza-waf.spec.ts deleted file mode 100644 index f526c8ad..00000000 --- a/tests/phase3/coraza-waf.spec.ts +++ /dev/null @@ -1,436 +0,0 @@ -/** - * Phase 3 - Coraza WAF (Attack Prevention) Tests - * - * Validates that Coraza module correctly blocks malicious payloads: - * - SQL Injection attacks - * - Cross-Site Scripting (XSS) attacks - * - CSRF token attacks - * - Malformed requests - * - Path traversal attempts - * - Command injection - * - * Total Tests: 18 - * Expected Duration: ~10 minutes - * - * Expected Behavior: - * - Malicious payloads → 403 Forbidden (WAF block) - * - Benign requests → 200/201/400 OK (allowed through) - */ - -import { test, expect } from '@playwright/test'; -import { request as playwrightRequest } from '@playwright/test'; - -const BASE_URL = process.env.PLAYWRIGHT_BASE_URL || 'http://localhost:8080'; -const VALID_TOKEN = process.env.VALID_TEST_TOKEN || 'test-token-12345'; - -// SQL Injection Payloads -const SQL_INJECTION_PAYLOADS = [ - "' OR '1'='1", - "' OR '1'='1' --", - "admin' --", - "' UNION SELECT * FROM users --", - "'; DROP TABLE users; --", - "1' AND SLEEP(5) --", - "1; DELETE FROM users --", -]; - -// XSS Payloads -const XSS_PAYLOADS = [ - '', - '', - 'javascript:alert("xss")', - '', - '', - '', - '">', -]; - -// Path Traversal Payloads -const PATH_TRAVERSAL_PAYLOADS = [ - '../../../etc/passwd', - '..%2F..%2F..%2Fetc%2Fpasswd', - '....//....//....//etc/passwd', - '/..\\..\\..\\windows\\system32\\config\\sam', - '%252e%252e%252fconfig', -]; - -// Command Injection Payloads -const COMMAND_INJECTION_PAYLOADS = [ - '; ls -la', - '| cat /etc/passwd', - '` whoami `', - '$(whoami)', - '; rm -rf /', -]; - -// CSRF Payloads (malformed CSRF token) -const CSRF_PAYLOADS = [ - { csrfToken: 'invalid-csrf' }, - { csrfToken: '' }, - { csrfToken: null }, -]; - -test.describe('Phase 3: Coraza WAF (Attack Prevention)', () => { - let context: any; - - test.beforeAll(async () => { - context = await playwrightRequest.newContext({ - baseURL: BASE_URL, - }); - }); - - test.afterAll(async () => { - await context?.close(); - }); - - // ========================================================================= - // Test Suite: SQL Injection Prevention - // ========================================================================= - test.describe('SQL Injection Prevention', () => { - SQL_INJECTION_PAYLOADS.forEach((payload, index) => { - test(`should block SQLi payload ${index + 1}: "${payload.substring(0, 20)}..."`, async () => { - const response = await context.post('/api/v1/proxy-hosts', { - data: { - domain: payload, // Inject into domain field - forward_host: '127.0.0.1', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'Content-Type': 'application/json', - }, - }); - - // WAF should block with 403, or app may reject with 400 - expect([400, 403]).toContain(response.status()); - // Preferred: 403 (WAF block) - if (response.status() === 403) { - expect(response.status()).toBe(403); - } - }); - }); - - test('should block SQLi in query parameters', async () => { - const response = await context.get(`/api/v1/proxy-hosts?search=' OR '1'='1`, { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - - // Should be 403 (WAF) or 400 (bad request) - expect([400, 403]).toContain(response.status()); - }); - - test('should block SQLi in request headers', async () => { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'X-Custom-Header': "' UNION SELECT * FROM users --", - }, - }); - - // WAF may block headers containing SQL - expect([200, 403]).toContain(response.status()); - }); - }); - - // ========================================================================= - // Test Suite: Cross-Site Scripting (XSS) Prevention - // ========================================================================= - test.describe('Cross-Site Scripting (XSS) Prevention', () => { - XSS_PAYLOADS.forEach((payload, index) => { - test(`should block XSS payload ${index + 1}: "${payload.substring(0, 25)}..."`, async () => { - const response = await context.post('/api/v1/proxy-hosts', { - data: { - domain: `example.com${payload}`, // XSS payload in field - forward_host: '127.0.0.1', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'Content-Type': 'application/json', - }, - }); - - // WAF should block with 403, or app validation fails with 400 - expect([400, 403]).toContain(response.status()); - }); - }); - - test('should block XSS in JSON payload', async () => { - const response = await context.post('/api/v1/proxy-hosts', { - data: { - domain: 'example.com', - forward_host: '', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'Content-Type': 'application/json', - }, - }); - - expect([400, 403]).toContain(response.status()); - }); - - test('should block encoded XSS payloads', async () => { - // HTML entity encoded XSS - const response = await context.post('/api/v1/proxy-hosts', { - data: { - domain: 'example.com<script>alert("xss")</script>', - forward_host: '127.0.0.1', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'Content-Type': 'application/json', - }, - }); - - // Modern WAF should still detect encoded attacks - expect([400, 403]).toContain(response.status()); - }); - }); - - // ========================================================================= - // Test Suite: Path Traversal Prevention - // ========================================================================= - test.describe('Path Traversal Prevention', () => { - PATH_TRAVERSAL_PAYLOADS.forEach((payload, index) => { - test(`should block path traversal ${index + 1}: "${payload.substring(0, 20)}..."`, async () => { - // Path traversal in URL path - const response = await context.get(`/api/v1/proxy-hosts${payload}`, { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - - // Should be blocked or return 404 (path not found) - expect([403, 404]).toContain(response.status()); - }); - }); - - test('should block path traversal in POST data', async () => { - const response = await context.post('/api/v1/import', { - data: { - file: '../../../etc/passwd', - config: '....\\..\\..\\windows\\system32\\config\\sam', - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'Content-Type': 'application/json', - }, - }); - - // Should be 403 (WAF) or 400 (validation fail) - expect([400, 403, 404]).toContain(response.status()); - }); - }); - - // ========================================================================= - // Test Suite: Command Injection Prevention - // ========================================================================= - test.describe('Command Injection Prevention', () => { - COMMAND_INJECTION_PAYLOADS.forEach((payload, index) => { - test(`should block command injection ${index + 1}: "${payload.substring(0, 20)}..."`, async () => { - const response = await context.post('/api/v1/proxy-hosts', { - data: { - domain: `example.com${payload}`, - forward_host: '127.0.0.1', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'Content-Type': 'application/json', - }, - }); - - // WAF should detect shell metacharacters - expect([400, 403]).toContain(response.status()); - }); - }); - }); - - // ========================================================================= - // Test Suite: Malformed Request Handling - // ========================================================================= - test.describe('Malformed Request Handling', () => { - test('should reject invalid JSON payload', async () => { - const response = await context.post('/api/v1/proxy-hosts', { - data: '{invalid json}', - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'Content-Type': 'application/json', - }, - }); - - // Should return 400 (bad request) - expect(response.status()).toBe(400); - }); - - test('should reject oversized payload', async () => { - // Create a very large payload - const largeString = 'A'.repeat(1024 * 1024); // 1MB of 'A' - - const response = await context.post('/api/v1/proxy-hosts', { - data: { - domain: largeString, - forward_host: '127.0.0.1', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'Content-Type': 'application/json', - }, - }); - - // Should be rejected as too large or malformed - expect([400, 413]).toContain(response.status()); - }); - - test('should reject null characters in payload', async () => { - const response = await context.post('/api/v1/proxy-hosts', { - data: { - domain: 'example.com\x00injection', - forward_host: '127.0.0.1', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'Content-Type': 'application/json', - }, - }); - - // Should be rejected - expect([400, 403]).toContain(response.status()); - }); - - test('should reject double-encoded payloads', async () => { - // %25 = %, so %2525 = %25 after one decode - const response = await context.get('/api/v1/proxy-hosts/%2525252e%2525252e', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - - // WAF should normalize and detect - expect([403, 404]).toContain(response.status()); - }); - }); - - // ========================================================================= - // Test Suite: CSRF Protection - // ========================================================================= - test.describe('CSRF Token Validation', () => { - test('should validate CSRF token presence in state-changing requests', async () => { - // POST without CSRF token might be rejected depending on app configuration - const response = await context.post('/api/v1/proxy-hosts', { - data: { - domain: 'test.example.com', - forward_host: '127.0.0.1', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'Content-Type': 'application/json', - }, - }); - - // May be 400/403 (no CSRF) or 401 (auth fail) - expect([400, 401, 403]).toContain(response.status()); - }); - - test('should reject invalid CSRF token', async () => { - const response = await context.post('/api/v1/proxy-hosts', { - data: { - domain: 'test.example.com', - forward_host: '127.0.0.1', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'X-CSRF-Token': 'invalid-csrf-token-12345', - 'Content-Type': 'application/json', - }, - }); - - expect([400, 401, 403]).toContain(response.status()); - }); - }); - - // ========================================================================= - // Test Suite: Benign Requests Should Pass - // ========================================================================= - test.describe('Benign Request Handling', () => { - test('should allow valid domain names', async () => { - const response = await context.post('/api/v1/proxy-hosts', { - data: { - domain: 'valid-domain-example.com', - forward_host: '127.0.0.1', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'Content-Type': 'application/json', - }, - }); - - // Should pass WAF (may fail auth/validation but not WAF block) - expect(response.status()).not.toBe(403); - }); - - test('should allow valid IP addresses', async () => { - const response = await context.post('/api/v1/proxy-hosts', { - data: { - domain: 'example.com', - forward_host: '192.168.1.1', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'Content-Type': 'application/json', - }, - }); - - expect(response.status()).not.toBe(403); - }); - - test('should allow GET requests with safe parameters', async () => { - const response = await context.get('/api/v1/proxy-hosts?page=1&limit=10', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - - // Should not be blocked by WAF - expect(response.status()).not.toBe(403); - }); - }); - - // ========================================================================= - // Test Suite: WAF Response Headers - // ========================================================================= - test.describe('WAF Response Indicators', () => { - test('blocked request should not expose WAF details', async () => { - const response = await context.post('/api/v1/proxy-hosts', { - data: { - domain: "' OR '1'='1", - forward_host: '127.0.0.1', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'Content-Type': 'application/json', - }, - }); - - // Should be 403 or 400 - if (response.status() === 403 || response.status() === 400) { - const text = await response.text(); - // Should not expose internal WAF rule details - expect(text).not.toContain('Coraza'); - expect(text).not.toContain('ModSecurity'); - } - }); - }); -}); diff --git a/tests/phase3/crowdsec-integration.spec.ts b/tests/phase3/crowdsec-integration.spec.ts deleted file mode 100644 index 9f8aa819..00000000 --- a/tests/phase3/crowdsec-integration.spec.ts +++ /dev/null @@ -1,364 +0,0 @@ -/** - * Phase 3 - CrowdSec Integration Tests - * - * Validates that CrowdSec module correctly enforces DDoS/bot protection: - * - Normal requests allowed → 200 OK - * - After CrowdSec ban triggered → 403 Forbidden - * - Whitelist bypass (test IP) allows requests → 200 OK - * - Decision list populated (>0 entries) - * - Bot detection headers (User-Agent spoofing) → potential 403 - * - Cache consistency across requests - * - * Total Tests: 12 - * Expected Duration: ~10 minutes - */ - -import { test, expect } from '@playwright/test'; -import { request as playwrightRequest } from '@playwright/test'; - -const BASE_URL = process.env.PLAYWRIGHT_BASE_URL || 'http://localhost:8080'; -const VALID_TOKEN = process.env.VALID_TEST_TOKEN || 'test-token-12345'; - -// Bot-like User-Agent strings -const BOT_USER_AGENTS = [ - 'curl/7.64.1', - 'wget/1.20.3', - 'python-requests/2.25.1', - 'Scrapy/2.5.0', - 'masscan/1.0.6', - 'nikto/2.1.5', - 'sqlmap/1.4.9', -]; - -// Legitimate User-Agent strings -const LEGITIMATE_USER_AGENTS = [ - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', - 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36', - 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36', -]; - -test.describe('Phase 3: CrowdSec Integration', () => { - let context: any; - - test.beforeAll(async () => { - context = await playwrightRequest.newContext({ - baseURL: BASE_URL, - }); - }); - - test.afterAll(async () => { - await context?.close(); - }); - - // ========================================================================= - // Test Suite: Normal Request Handling - // ========================================================================= - test.describe('Normal Request Handling', () => { - test('should allow normal requests with legitimate User-Agent', async () => { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'User-Agent': LEGITIMATE_USER_AGENTS[0], - }, - }); - - // Should NOT be blocked by CrowdSec (may be 401/403 for auth) - expect(response.status()).not.toBe(403); - }); - - test('should allow requests without additional headers', async () => { - const response = await context.get('/api/v1/health'); - expect(response.status()).toBe(200); - }); - - test('should allow authenticated requests', async () => { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - - // Should be allowed (may fail auth but not CrowdSec block) - expect([200, 401, 403]).toContain(response.status()); - }); - }); - - // ========================================================================= - // Test Suite: Suspicious Request Detection - // ========================================================================= - test.describe('Suspicious Request Detection', () => { - test('requests with suspicious User-Agent should be flagged', async () => { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'User-Agent': 'curl/7.64.1', - }, - }); - - // CrowdSec may flag this as suspicious, but might not block immediately - // Status could be 200 (flagged but allowed) or 403 (blocked) - expect([200, 401, 403]).toContain(response.status()); - }); - - test('rapid successive requests should be analyzed', async () => { - const responses = []; - - // Make rapid requests (potential attack pattern) - for (let i = 0; i < 5; i++) { - const response = await context.get('/api/v1/health'); - responses.push(response.status()); - } - - // Most should succeed, but CrowdSec tracks for pattern analysis - const successCount = responses.filter(status => status !== 503 && status !== 403).length; - expect(successCount).toBeGreaterThan(0); - }); - - test('requests with suspicious headers should be tracked', async () => { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - 'X-Forwarded-For': '192.0.2.1', // Documentation IP - 'User-Agent': 'sqlmap/1.4.9', // Known pen-testing tool - }, - }); - - // Should be tracked but may still be allowed or blocked - expect([200, 401, 403]).toContain(response.status()); - }); - }); - - // ========================================================================= - // Test Suite: Whitelist Bypass - // ========================================================================= - test.describe('Whitelist Functionality', () => { - test('test container IP should be whitelisted', async () => { - // Container IP in 172.17.0.0/16 should be whitelisted - const response = await context.get('/api/v1/health'); - - // Should succeed (not blocked by CrowdSec) - expect(response.status()).toBe(200); - }); - - test('whitelisted IP should bypass CrowdSec even with suspicious patterns', async () => { - // Even with bot User-Agent, whitelisted IPs should work - const response = await context.get('/api/v1/health', { - headers: { - 'User-Agent': 'sqlmap/1.4.9', - }, - }); - - // Container is whitelisted, so should succeed - expect(response.status()).toBe(200); - }); - - test('multiple requests from whitelisted IP should not trigger limit', async () => { - const responses = []; - - // Many requests from whitelisted IP - for (let i = 0; i < 20; i++) { - const response = await context.get('/api/v1/health'); - responses.push(response.status()); - } - - // All should succeed - responses.forEach(status => { - expect(status).toBe(200); - }); - }); - }); - - // ========================================================================= - // Test Suite: Ban Decision Enforcement - // ========================================================================= - test.describe('CrowdSec Decision Enforcement', () => { - test('CrowdSec decisions should be populated', async () => { - // This would need direct access to CrowdSec API or observations - // For now, we just verify requests proceed normally - const response = await context.get('/api/v1/health'); - expect(response.status()).toBe(200); - }); - - test('if IP is banned, requests should return 403', async () => { - // This would only trigger if our IP is actually banned by CrowdSec - // For test purposes, we expect it NOT to be banned - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - - // Should not be 403 from CrowdSec ban (may be 401 from auth) - if (response.status() === 403) { - // Verify it's from CrowdSec, not app-level - const text = await response.text(); - // CrowdSec blocks typically have specific format - expect(text.length).toBeGreaterThan(0); - } else { - // Normal flow - expect([200, 401]).toContain(response.status()); - } - }); - - test('ban should be lifted after duration expires', async ({}, testInfo) => { - // This is long-running and depends on actual bans - // For now, verify normal access continues - const response = await context.get('/api/v1/health'); - expect(response.status()).toBe(200); - }); - }); - - // ========================================================================= - // Test Suite: Bot Detection Patterns - // ========================================================================= - test.describe('Bot Detection Patterns', () => { - test('requests with scanning tools User-Agent should be flagged', async () => { - const scanningTools = ['nmap', 'Nessus', 'OpenVAS', 'Qualys']; - - for (const tool of scanningTools) { - const response = await context.get('/api/v1/health', { - headers: { - 'User-Agent': tool, - }, - }); - - // Should be flagged (but may still get 200 if whitelisted) - expect([200, 403]).toContain(response.status()); - } - }); - - test('requests with spoofed User-Agent should be analyzed', async () => { - // Mismatched or impossible User-Agent string - const response = await context.get('/api/v1/health', { - headers: { - 'User-Agent': 'Mozilla/5.0 (Android 1.0) Gecko/20100101 Firefox/1.0', - }, - }); - - // Should be allowed (whitelist) but flagged by CrowdSec - expect(response.status()).toBe(200); - }); - - test('requests without User-Agent should be allowed', async () => { - // Many legitimate tools don't send User-Agent - const response = await context.get('/api/v1/health'); - expect(response.status()).toBe(200); - }); - }); - - // ========================================================================= - // Test Suite: Cache Consistency - // ========================================================================= - test.describe('Decision Cache Consistency', () => { - test('repeated requests should have consistent blocking', async () => { - const responses = []; - - // Make same request 5 times - for (let i = 0; i < 5; i++) { - const response = await context.get('/api/v1/health'); - responses.push(response.status()); - } - - // All should have same status (cache should be consistent) - const first = responses[0]; - responses.forEach(status => { - expect(status).toBe(first); - }); - }); - - test('different endpoints should share ban list', async () => { - // If IP is banned, all endpoints should return 403 - const health = await context.get('/api/v1/health'); - const hosts = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - - // Both should have consistent response (both allow or both block from CrowdSec) - const healthAllowed = health.status() !== 403; - const hostsBlocked = hosts.status() === 403 && hosts.status() !== 401; - - // If CrowdSec bans IP, both should show same ban status - // (allowing for auth layer differences) - }); - }); - - // ========================================================================= - // Test Suite: Edge Cases & Recovery - // ========================================================================= - test.describe('Edge Cases & Recovery', () => { - test('should handle high-volume heartbeat requests', async () => { - // Many health checks (activity patterns) - const responses = []; - for (let i = 0; i < 50; i++) { - const response = await context.get('/api/v1/health'); - responses.push(response.status()); - } - - // Should still allow (whitelist prevents overflow) - const allAllowed = responses.every(status => status === 200); - expect(allAllowed).toBe(true); - }); - - test('should handle mixed request patterns', async () => { - // Mix of different endpoints and methods - const responses = []; - - responses.push((await context.get('/api/v1/health')).status()); - responses.push((await context.get('/api/v1/proxy-hosts')).status()); - responses.push((await context.get('/api/v1/access-lists')).status()); - responses.push((await context.post('/api/v1/proxy-hosts', { - data: { - domain: 'test.example.com', - forward_host: '127.0.0.1', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - })).status()); - - // Should not be blocked by CrowdSec (whitelisted) - responses.forEach(status => { - expect(status).not.toBe(403); - }); - }); - - test('decision TTL should expire and remove old decisions', async ({}, testInfo) => { - // This tests expiration of old CrowdSec decisions - // For now, verify current decisions are active - const response = await context.get('/api/v1/health'); - expect(response.status()).toBe(200); - }); - }); - - // ========================================================================= - // Test Suite: Response Indicators - // ========================================================================= - test.describe('CrowdSec Response Indicators', () => { - test('should not expose CrowdSec details in error response', async () => { - // If blocked, response should not reveal CrowdSec implementation - const response = await context.get('/api/v1/health'); - - if (response.status() === 403) { - const text = await response.text(); - expect(text).not.toContain('CrowdSec'); - expect(text).not.toContain('CAPI'); - } - }); - - test('blocked response should indicate rate limit or access denied', async () => { - const response = await context.get('/api/v1/health'); - - if (response.status() === 403) { - const text = await response.text(); - // Should have some indication what happened - expect(text.length).toBeGreaterThan(0); - } else { - // Normal flow - expect([200, 401]).toContain(response.status()); - } - }); - }); -}); diff --git a/tests/phase3/rate-limiting.spec.ts b/tests/phase3/rate-limiting.spec.ts deleted file mode 100644 index 1034ff98..00000000 --- a/tests/phase3/rate-limiting.spec.ts +++ /dev/null @@ -1,393 +0,0 @@ -/** - * Phase 3 - Rate Limiting Tests - * - * Validates that rate limiting correctly enforces request throttling: - * - Requests within limit → 200 OK - * - Requests exceeding limit → 429 Too Many Requests - * - Rate limit headers present in response - * - Different endpoints have correct limits - * - Rate limit window expires and resets - * - * Total Tests: 12 - * Expected Duration: ~10 minutes - * - * IMPORTANT: Run with --workers=1 - * Rate limiting tests must be SERIAL to prevent cross-test interference - * - * Rate Limit Configuration (from Phase 3 plan): - * - 3 requests per 10-second window - * - Different endpoints may have different limits - */ - -import { test, expect } from '@playwright/test'; -import { request as playwrightRequest } from '@playwright/test'; - -const BASE_URL = process.env.PLAYWRIGHT_BASE_URL || 'http://localhost:8080'; -const VALID_TOKEN = process.env.VALID_TEST_TOKEN || 'test-token-12345'; - -// Rate limit configuration -const RATE_LIMIT_CONFIG = { - requestsPerWindow: 3, - windowSeconds: 10, - description: '3 requests per 10-second window', -}; - -test.describe('Phase 3: Rate Limiting', () => { - let context: any; - - test.beforeAll(async () => { - context = await playwrightRequest.newContext({ - baseURL: BASE_URL, - }); - }); - - test.afterAll(async () => { - await context?.close(); - }); - - // ========================================================================= - // Test Suite: Basic Rate Limit Enforcement - // ========================================================================= - test.describe('Basic Rate Limit Enforcement', () => { - test(`should allow up to ${RATE_LIMIT_CONFIG.requestsPerWindow} requests in ${RATE_LIMIT_CONFIG.windowSeconds}s window`, async () => { - const responses = []; - - // Make exactly 3 requests (should all succeed) - for (let i = 0; i < RATE_LIMIT_CONFIG.requestsPerWindow; i++) { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - responses.push(response.status()); - } - - // All 3 should succeed (200 or 401, but NOT 429) - responses.forEach(status => { - expect([200, 401, 403]).toContain(status); - expect(status).not.toBe(429); - }); - }); - - test(`should return 429 when exceeding ${RATE_LIMIT_CONFIG.requestsPerWindow} requests in ${RATE_LIMIT_CONFIG.windowSeconds}s window`, async () => { - // Make limit + 1 requests (4th should be rate limited) - const responses = []; - - for (let i = 0; i < RATE_LIMIT_CONFIG.requestsPerWindow + 1; i++) { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - responses.push(response.status()); - } - - // Last request should be 429 - const lastStatus = responses[responses.length - 1]; - expect(lastStatus).toBe(429); - }); - - test('should include rate limit headers in response', async () => { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - - // Check for rate limit headers (common standards) - const headers = response.headers(); - // May use RateLimit-* headers from IETF standard - // or X-RateLimit-* from older conventions - const hasRateLimitHeader = headers['ratelimit-limit'] || - headers['x-ratelimit-limit'] || - headers['retry-after']; - - // At minimum, 429 response should have Retry-After - if (response.status() === 429) { - expect(headers['retry-after']).toBeTruthy(); - } - }); - }); - - // ========================================================================= - // Test Suite: Rate Limit Window Expiration - // ========================================================================= - test.describe('Rate Limit Window Expiration & Reset', () => { - test('should reset rate limit after window expires', async ({}, testInfo) => { - // Make 3 requests (fill the window) - const firstBatch = []; - for (let i = 0; i < RATE_LIMIT_CONFIG.requestsPerWindow; i++) { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - firstBatch.push(response.status()); - } - - // 4th request should fail (429) - const blockedResponse = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - expect(blockedResponse.status()).toBe(429); - - // Wait for window to expire (10 seconds + small buffer) - console.log(`Waiting ${RATE_LIMIT_CONFIG.windowSeconds + 1} seconds for rate limit window to expire...`); - await new Promise(resolve => setTimeout(resolve, (RATE_LIMIT_CONFIG.windowSeconds + 1) * 1000)); - - // New request should succeed - const afterResetResponse = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - expect([200, 401, 403]).toContain(afterResetResponse.status()); - expect(afterResetResponse.status()).not.toBe(429); - }); - }); - - // ========================================================================= - // Test Suite: Different Endpoints Rate Limits - // ========================================================================= - test.describe('Per-Endpoint Rate Limits', () => { - test('GET /api/v1/proxy-hosts should have rate limit', async () => { - // Make 3 requests - const responses = []; - for (let i = 0; i < RATE_LIMIT_CONFIG.requestsPerWindow; i++) { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - responses.push(response.status()); - } - - // 4th should be 429 - const fourthResponse = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - expect(fourthResponse.status()).toBe(429); - }); - - test('GET /api/v1/access-lists should have separate rate limit', async () => { - // Different endpoint should have its own counter - const responses = []; - for (let i = 0; i < RATE_LIMIT_CONFIG.requestsPerWindow; i++) { - const response = await context.get('/api/v1/access-lists', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - responses.push(response.status()); - } - - // 4th should be 429 - const fourthResponse = await context.get('/api/v1/access-lists', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - expect(fourthResponse.status()).toBe(429); - }); - }); - - // ========================================================================= - // Test Suite: Rate Limit Without Token (Anonymous) - // ========================================================================= - test.describe('Anonymous Request Rate Limiting', () => { - test('should rate limit anonymous requests separately', async () => { - // Create a new context without token to simulate different rate limit bucket - const anonContext = await playwrightRequest.newContext({ baseURL: BASE_URL }); - - try { - const responses = []; - - // Make requests without auth token - for (let i = 0; i < RATE_LIMIT_CONFIG.requestsPerWindow + 1; i++) { - const response = await anonContext.get('/api/v1/health'); // Health might not require auth - responses.push(response.status()); - } - - // Last should be rate limited (429) if rate limiting applies to unauthenticated - // Note: Rate limit bucket is usually per IP, not per user - const lastStatus = responses[responses.length - 1]; - // Either all pass (no limit on health) or last is 429 - expect([200, 429]).toContain(lastStatus); - } finally { - await anonContext.close(); - } - }); - }); - - // ========================================================================= - // Test Suite: Retry-After Header - // ========================================================================= - test.describe('Retry-After Header', () => { - test('429 response should include Retry-After header', async () => { - // Fill the rate limit - for (let i = 0; i < RATE_LIMIT_CONFIG.requestsPerWindow + 1; i++) { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - - if (response.status() === 429) { - const headers = response.headers(); - expect(headers['retry-after']).toBeTruthy(); - // Retry-After should be a number (seconds) or HTTP date - const retryAfter = headers['retry-after']; - expect(retryAfter).toMatch(/\d+/); - } - } - }); - - test('Retry-After should indicate reasonable wait time', async () => { - // Fill the rate limit - let rateLimitedResponse = null; - for (let i = 0; i < RATE_LIMIT_CONFIG.requestsPerWindow + 1; i++) { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - - if (response.status() === 429) { - rateLimitedResponse = response; - break; - } - } - - if (rateLimitedResponse) { - const headers = rateLimitedResponse.headers(); - const retryAfter = headers['retry-after']; - if (retryAfter && !isNaN(Number(retryAfter))) { - const seconds = Number(retryAfter); - // Should be within reasonable bounds (1-60 seconds) - expect(seconds).toBeGreaterThanOrEqual(1); - expect(seconds).toBeLessThanOrEqual(60); - } - } - }); - }); - - // ========================================================================= - // Test Suite: Rate Limit Consistency - // ========================================================================= - test.describe('Rate Limit Consistency', () => { - test('same endpoint should share rate limit bucket', async () => { - // Multiple calls to same endpoint should share counter - const endpoint = '/api/v1/proxy-hosts'; - const responses = []; - - for (let i = 0; i < RATE_LIMIT_CONFIG.requestsPerWindow + 1; i++) { - const response = await context.get(endpoint, { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - responses.push(response.status()); - } - - // Last should be 429 - expect(responses[responses.length - 1]).toBe(429); - }); - - test('different HTTP methods on same endpoint should share limit', async () => { - // GET and POST to same endpoint should use same rate limit bucket - const endpoint = '/api/v1/proxy-hosts'; - - const responses = []; - - // 3 GETs - for (let i = 0; i < 2; i++) { - const response = await context.get(endpoint, { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - responses.push({ method: 'GET', status: response.status() }); - } - - // 1 POST (may fail for other reasons, but should count toward limit) - const postResponse = await context.post(endpoint, { - data: { - domain: 'test.example.com', - forward_host: '127.0.0.1', - forward_port: 8000, - }, - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - responses.push({ method: 'POST', status: postResponse.status() }); - - // 4th request should be rate limited (429) - const fourthResponse = await context.get(endpoint, { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - expect(fourthResponse.status()).toBe(429); - }); - }); - - // ========================================================================= - // Test Suite: Rate Limit Error Response - // ========================================================================= - test.describe('Rate Limit Error Response Format', () => { - test('429 response should be valid JSON', async () => { - // Fill the rate limit and get 429 - let statusCode = 200; - for (let i = 0; i < RATE_LIMIT_CONFIG.requestsPerWindow + 1; i++) { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - statusCode = response.status(); - - if (statusCode === 429) { - // Try to parse as JSON - try { - const body = await response.json(); - expect(typeof body).toBe('object'); - } catch (e) { - // Or it might be plain text, which is acceptable - const text = await response.text(); - expect(text.length).toBeGreaterThan(0); - } - break; - } - } - - expect(statusCode).toBe(429); - }); - - test('429 response should not expose rate limit implementation details', async () => { - // Fill the rate limit - let responseText = ''; - for (let i = 0; i < RATE_LIMIT_CONFIG.requestsPerWindow + 1; i++) { - const response = await context.get('/api/v1/proxy-hosts', { - headers: { - Authorization: `Bearer ${VALID_TOKEN}`, - }, - }); - - if (response.status() === 429) { - responseText = await response.text(); - break; - } - } - - // Should not expose internal details - expect(responseText).not.toContain('redis'); - expect(responseText).not.toContain('sliding window'); - expect(responseText).not.toContain('Caddy'); - }); - }); -}); diff --git a/tests/phase4-integration/README.md b/tests/phase4-integration/README.md deleted file mode 100644 index ea0f5865..00000000 --- a/tests/phase4-integration/README.md +++ /dev/null @@ -1,251 +0,0 @@ -# Phase 4 Integration Test Suite - -Integration testing for multi-component workflows and system interactions in Charon. - -## Overview - -**Test Count**: 40 tests across 7 test files -**Framework**: Playwright Test (Firefox) -**Base URL**: `http://127.0.0.1:8080` (Docker container) -**Focus**: Component interactions, middleware enforcement, data consistency, security layer validation - -## Test Files - -### 01-admin-user-e2e-workflow.spec.ts (7 tests) -- **Purpose**: Complete workflows from admin and user perspectives -- **Scenarios**: - - User creation → role assignment → login → access resources - - Admin role modification triggers immediate permission updates - - Admin user deletion → deleted user login fails - - Complete workflow appears in audit log (action, user, timestamp) - - User self-promotion blocked (role escalation prevention) - - Multi-user data isolation verified - - User logout → different user login succeeds -- **Key Assertions**: - - Visibility changes after role modification - - 401 Unauthorized when accessing restricted resources - - Audit trail entries created for each action - - Data isolation between user accounts - -### 02-waf-ratelimit-interaction.spec.ts (5 tests) -- **Purpose**: WAF and rate limiting working together and independently -- **Scenarios**: - - Malicious payload blocked by WAF (403 Forbidden) - - Excessive requests blocked by rate limiter (429 Too Many Requests) - - Both enforced independently (WAF ≠ rate limit) - - Malicious request within rate limit still blocked (WAF priority → 403) - - Clean request exceeding limit blocked (rate limit → 429) -- **Payloads Tested**: - - SQL Injection: `'; DROP TABLE users--` - - Path Traversal: `../../../etc/passwd` - - Command Injection: `` `cat /etc/passwd` `` -- **Assertions**: - - response.status() === 403 for WAF blocks - - response.status() === 429 for rate limit blocks - - Headers present in denied responses - -### 03-acl-waf-layering.spec.ts (4 tests) -- **Purpose**: Defense-in-depth validation (ACL and WAF as separate mandatory layers) -- **Scenarios**: - - Non-admin insufficient to bypass WAF (403 even with permission) - - WAF enforced regardless of user role (admin ≠ immune) - - Admin user also subject to WAF enforcement (mandatory layer) - - ACL provides additional filtering beyond WAF (two-layer security) -- **Key Tests**: - - Create guest user, attempt malicious request, verify 403 - - Login as admin, send malicious request, verify 403 - - Verify ACL blocks before WAF (deny-by-default) -- **Assertions**: - - 403 Forbidden regardless of user role - - WAF module enforces on all requests - - ACL filtering applied independently - -### 04-auth-middleware-cascade.spec.ts (6 tests) -- **Purpose**: Authentication flows through middleware stack correctly -- **Middleware Chain**: - 1. Auth (token validation) - 2. ACL (role/permission check) - 3. WAF (malicious payload detection) - 4. Rate Limiting (request throttling) -- **Scenarios**: - - Missing auth token → 401 Unauthorized (auth first) - - Invalid/malformed token → 401 (auth first) - - Valid token passes through ACL (200 OK) - - Valid token passes through WAF (200 OK) - - Valid token passes through rate limiting (200 OK) - - Valid token flows through complete stack (end-to-end) -- **Assertions**: - - 401 for missing/invalid tokens (rejected early) - - 200 for valid token through each layer - -### 05-data-consistency.spec.ts (8 tests) -- **Purpose**: UI operations sync correctly with API representation -- **Scenarios**: - - Create entity via UI → API returns identical data - - Modify entity via API → UI refreshes and shows updated data - - Delete entity via UI → API no longer returns item - - Concurrent modifications handled correctly (no data loss) - - Transaction rollback prevents partial updates - - Database constraints enforced (unique, foreign key) - - UI form validation matches backend validation - - Large dataset pagination consistent between loads -- **Test Entities**: - - Users (email, role, permissions) - - Proxy hosts (domain, target, SSL) - - Domains (nameserver, DNS records) -- **Assertions**: - - API response data matches UI displayed data - - Constraint violations return expected errors - - Pagination offsets consistent across requests - -### 06-long-running-operations.spec.ts (5 tests) -- **Purpose**: Background tasks don't block system responsiveness -- **Scenarios**: - - Backup creation doesn't block other operations - - System responsive during backup (UI updates work) - - Proxy creation succeeds while backup running - - User login succeeds during long operation - - Task completion verified after operation finishes -- **Long-Running Operations Tested**: - - Database backup (2-5 second duration) - - File encryption during backup - - APK signature generation -- **Assertions**: - - Proxy creation returns 200 during backup - - Login token generated and valid during backup - - Backup completion verified with file hash - -### 07-multi-component-workflows.spec.ts (5 tests) -- **Purpose**: Complex real-world workflows involving multiple system features -- **Workflows**: - 1. Create proxy → Enable WAF → Send request → WAF enforces - 2. Create user → Assign role → User creates proxy → ACL enforces - 3. Create backup → Delete user → Restore → Data restored - 4. Enable security module → Create user → User subject to rate limits - 5. Admin: Create user → Enable security → User cannot bypass limits -- **Key Assertions**: - - Malicious request blocked (403) from WAF assigned to proxy - - New user inherits security configuration immediately - - Deleted user data restored from backup - - Rate limiting applied to new users after security enablement - - User-created resources respect admin-level security settings - -## Execution - -### Run all integration tests: -```bash -cd /projects/Charon -npx playwright test tests/phase4-integration/ --project=firefox -``` - -### Run specific integration test: -```bash -npx playwright test tests/phase4-integration/04-auth-middleware-cascade.spec.ts --project=firefox -``` - -### Run with timing output: -```bash -npx playwright test tests/phase4-integration/ --project=firefox --reporter=line -``` - -## Prerequisites - -1. **Docker environment running**: - ```bash - .github/skills/scripts/skill-runner.sh docker-rebuild-e2e - ``` - -2. **Playwright installed**: - ```bash - npm install && npx playwright install firefox - ``` - -3. **Admin user creation** (handled by global-setup.ts) - -## Test Characteristics - -### Performance Expectations -- Small operations (create/modify/delete): <5 seconds -- Long-running operations (backup): 2-5 seconds (non-blocking) -- Concurrent operations: All complete within 30 seconds total - -### Error Handling -- Tests use try/catch for error scenarios -- Soft assertions for optional features (`.catch(() => false)`) -- Multiple selector strategies for component resilience - -### Data Management -- `beforeEach`: Preps test data in known state -- `afterEach`: Cleans up test data via UI operations -- No cross-test data persistence - -## Success Criteria - -✅ All 7 files compile without syntax errors -✅ All 40 tests execute and pass -✅ WAF blocks malicious payloads (403) -✅ Rate limiting enforces thresholds (429) -✅ ACL prevents unauthorized access (401/403) -✅ UI↔API data consistency verified -✅ Concurrent operations complete successfully -✅ Long-running operations don't block system -✅ Multi-component workflows function end-to-end -✅ Middleware stack enforces in correct order - -## Troubleshooting - -### Test timeouts on operations -- Check if Docker container is healthy: `docker ps | grep charon-e2e` -- Long-running tests might need: `--timeout=120000` -- Verify network latency to container - -### Rate limit tests failing -- Verify rate limiting enabled in admin UI -- Check configured threshold (default: 100 req/60s) -- Clear any previous rate limit state: `docker exec charon-e2e redis-cli FLUSHALL` - -### WAF tests not blocking payloads -- Verify Coraza WAF enabled in admin UI -- Check WAF sensitivity level (default: medium) -- Verify malicious payload pattern matches WAF rules - -### Data consistency issues -- Run in `--debug` mode to inspect API responses -- Check browser console for validation errors -- Verify test data cleanup (afterEach should delete created items) - -## Integration with CI/CD - -These tests run as Phase 4 validation after UAT passes: - -```yaml -# .github/workflows/phase4-integration.yml -- runs: npx playwright test tests/phase4-integration/ --project=firefox - timeout: 45 minutes - screenshots: retain-on-failure -``` - -## Key Differences from UAT - -| Aspect | UAT | Integration | -|--------|-----|-------------| -| **Scope** | Single component | Multiple components | -| **Focus** | Feature completeness | Interaction correctness | -| **Assertions** | Visual/UI state | API response + UI state | -| **Workflows** | Single operation | Multi-step processes | -| **Security** | Individual module | Middleware stack | - -## Notes - -- **Concurrency testing**: Tests verify true concurrent execution, not sequential -- **Soft assertions**: Optional features handled gracefully if missing -- **Error injection**: Some tests intentionally send invalid data -- **Performance baseline**: No hard limits, but used as regression detection -- **Isolation**: Each test creates and cleans up its own data - -## Additional Resources - -- [Playwright Documentation](https://playwright.dev/) -- [Charon Architecture](../../ARCHITECTURE.md) -- [Phase 4 Plan](../../design.md) -- [Integration Test Patterns](../phase4-uat/README.md) diff --git a/tests/phase4-uat/02-user-management.spec.ts b/tests/phase4-uat/02-user-management.spec.ts deleted file mode 100644 index 1caf6b24..00000000 --- a/tests/phase4-uat/02-user-management.spec.ts +++ /dev/null @@ -1,521 +0,0 @@ -import { test, expect } from '@playwright/test'; - -/** - * Phase 4 UAT: User Management - * - * Purpose: Validate CRUD operations for users and role assignments - * Scenarios: Create, read, update, delete users; assign roles; verify access control - * Success: Users can be managed with proper role-based access - */ - -test.describe('UAT-002: User Management', () => { - const testUsers = [ - { email: 'testuser1@test.local', name: 'Test User 1', password: 'TestPass123!' }, - { email: 'testuser2@test.local', name: 'Test User 2', password: 'TestPass123!' }, - ]; - - test.beforeEach(async ({ page }) => { - // Ensure admin is logged in before user management tests - await page.goto('/'); - await page.waitForSelector('[data-testid="dashboard-container"], [role="main"]', { timeout: 5000 }); - }); - - test.afterEach(async ({ page }) => { - // Clean up test users created during this test - // Navigate to users page and delete test users - const usersLink = page.getByRole('link', { name: /user|people|account/i }); - if (await usersLink.isVisible()) { - await usersLink.click(); - await page.waitForLoadState('networkidle'); - - for (const user of testUsers) { - const userRow = page.locator('text=' + user.email).first(); - if (await userRow.isVisible()) { - // Find delete button for this user - const deleteButton = userRow.locator('..').getByRole('button', { name: /delete|remove/i }).first(); - if (await deleteButton.isVisible()) { - await deleteButton.click(); - // Confirm deletion if modal appears - const confirmButton = page.getByRole('button', { name: /confirm|delete|yes/i }); - if (await confirmButton.isVisible()) { - await confirmButton.click(); - await page.waitForLoadState('networkidle'); - } - } - } - } - } - }); - - // UAT-101: Create new user with all fields - test('Create new user with all fields', async ({ page }) => { - const newUser = testUsers[0]; - - await test.step('Navigate to users page', async () => { - const usersLink = page.getByRole('link', { name: /user|people|account/i }); - await usersLink.click(); - await page.waitForSelector('[data-testid="users-list"], [data-testid="user-table"]', { timeout: 5000 }); - }); - - await test.step('Click add user button', async () => { - const addButton = page.getByRole('button', { name: /add|create|new/i }).first(); - await addButton.click(); - await page.waitForSelector('[role="dialog"], [class*="modal"], form', { timeout: 3000 }); - }); - - await test.step('Fill user creation form', async () => { - await page.getByLabel(/email/i).fill(newUser.email); - await page.getByLabel(/name|full.?name/i).fill(newUser.name); - await page.getByLabel(/password/i).first().fill(newUser.password); - - // Confirm password (if exists) - const confirmPassword = page.getByLabel(/confirm.?password|password.?again/i); - if (await confirmPassword.isVisible()) { - await confirmPassword.fill(newUser.password); - } - - // Select role if available - const roleSelect = page.locator('select[name*="role"], [class*="role-select"]').first(); - if (await roleSelect.isVisible()) { - await roleSelect.selectOption('user'); - } - }); - - await test.step('Submit form', async () => { - const submitButton = page.getByRole('button', { name: /create|submit|save/i }).first(); - await submitButton.click(); - - // Wait for confirmation - await page.waitForLoadState('networkidle'); - }); - - await test.step('Verify user created and in list', async () => { - const userEmail = page.locator(`text=${newUser.email}`).first(); - await expect(userEmail).toBeVisible(); - - // Should show success message - const successMessage = page.getByText(/created|success/i).first(); - if (await successMessage.isVisible()) { - await expect(successMessage).toBeVisible(); - } - }); - }); - - // UAT-102: Assign roles to user - test('Assign roles to user', async ({ page }) => { - const newUser = testUsers[0]; - - await test.step('Create user first', async () => { - // Use API or UI to create user (simplified for this step) - await page.goto('/users', { waitUntil: 'networkidle' }); - - // Check if user exists, if not create - const userExists = await page.locator(`text=${newUser.email}`).first().isVisible().catch(() => false); - if (!userExists) { - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/email/i).fill(newUser.email); - await page.getByLabel(/name/i).fill(newUser.name); - await page.getByLabel(/password/i).first().fill(newUser.password); - - const submitButton = page.getByRole('button', { name: /create|submit|save/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Open user edit modal', async () => { - const userRow = page.locator(`text=${newUser.email}`).first(); - const editButton = userRow.locator('..').getByRole('button', { name: /edit|settings/i }).first(); - await editButton.click(); - await page.waitForSelector('[role="dialog"], form', { timeout: 3000 }); - }); - - await test.step('Change user role', async () => { - const roleSelect = page.locator('select[name*="role"], [class*="role"]'); - if (await roleSelect.first().isVisible()) { - await roleSelect.first().selectOption('user'); - } else { - // Try role radio buttons or dropdown - const userRoleOption = page.getByLabel(/user\s*role|user\s*access/i); - if (await userRoleOption.isVisible()) { - await userRoleOption.click(); - } - } - }); - - await test.step('Save changes', async () => { - const saveButton = page.getByRole('button', { name: /save|update/i }).first(); - await saveButton.click(); - await page.waitForLoadState('networkidle'); - }); - - await test.step('Verify role assignment shown in list', async () => { - const userRow = page.locator(`text=${newUser.email}`).first(); - const roleDisplay = userRow.locator('..').getByText(/user|admin|guest/i).first(); - await expect(roleDisplay).toBeVisible(); - }); - }); - - // UAT-103: Delete user account - test('Delete user account', async ({ page }) => { - const userToDelete = testUsers[0]; - - await test.step('Create test user', async () => { - // Ensure user exists before deleting - await page.goto('/users', { waitUntil: 'networkidle' }); - - const userExists = await page.locator(`text=${userToDelete.email}`).first().isVisible().catch(() => false); - if (!userExists) { - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/email/i).fill(userToDelete.email); - await page.getByLabel(/name/i).fill(userToDelete.name); - await page.getByLabel(/password/i).first().fill(userToDelete.password); - - const submitButton = page.getByRole('button', { name: /create|submit|save/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Click delete button', async () => { - const userRow = page.locator(`text=${userToDelete.email}`).first(); - const deleteButton = userRow.locator('..').getByRole('button', { name: /delete|remove/i }).first(); - await deleteButton.click(); - }); - - await test.step('Confirm deletion', async () => { - const confirmButton = page.getByRole('button', { name: /confirm|delete|yes|ok/i }).first(); - if (await confirmButton.isVisible()) { - await confirmButton.click(); - } - - await page.waitForLoadState('networkidle'); - }); - - await test.step('Verify user removed from list', async () => { - await page.reload(); - await page.waitForLoadState('networkidle'); - - const userEmail = page.locator(`text=${userToDelete.email}`).first(); - await expect(userEmail).not.toBeVisible(); - }); - }); - - // UAT-104: User login with restricted role - test('User login with restricted role', async ({ page }) => { - const restrictedUser = { email: 'restricted@test.local', name: 'Restricted User', password: 'RestrictPass123!' }; - - await test.step('Create restricted user via admin', async () => { - await page.goto('/users', { waitUntil: 'networkidle' }); - - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/email/i).fill(restrictedUser.email); - await page.getByLabel(/name/i).fill(restrictedUser.name); - await page.getByLabel(/password/i).first().fill(restrictedUser.password); - - // Assign "User" role (restricted) - const roleSelect = page.locator('select[name*="role"]').first(); - if (await roleSelect.isVisible()) { - await roleSelect.selectOption('user'); - } - - const submitButton = page.getByRole('button', { name: /create|submit|save/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - }); - - await test.step('Logout admin', async () => { - const profileMenu = page.locator('[data-testid="user-menu"], [class*="profile"]').first(); - if (await profileMenu.isVisible()) { - await profileMenu.click(); - } - - const logoutButton = page.getByRole('menuitem', { name: /logout|sign out/i }) - .or(page.getByRole('button', { name: /logout|sign out/i })) - .first(); - - await logoutButton.click(); - await page.waitForURL(/login|signin/, { timeout: 5000 }); - }); - - await test.step('Login as restricted user', async () => { - await page.getByLabel(/email/i).fill(restrictedUser.email); - await page.getByLabel(/password/i).fill(restrictedUser.password); - - const loginButton = page.getByRole('button', { name: /login|sign in/i }); - await loginButton.click(); - await page.waitForLoadState('networkidle'); - }); - - await test.step('Verify restricted dashboard view', async () => { - const dashboard = page.locator('[role="main"], [data-testid="dashboard"]').first(); - await expect(dashboard).toBeVisible(); - - // Some admin-only features should be hidden - const userLink = page.getByRole('link', { name: /user|people/i }); - if (await userLink.isVisible()) { - // User role should not access users (or minimal access) - expect(true); // Soft check - depends on implementation - } - }); - }); - - // UAT-105: User cannot access unauthorized resources - test('User cannot access unauthorized admin resources', async ({ page }) => { - await test.step('Attempt direct access to admin APIs', async () => { - try { - // Try accessing admin-only API endpoint - const response = await page.evaluate(async () => { - const res = await fetch('/api/v1/users', { - headers: { - 'Authorization': `Bearer ${localStorage.getItem('token') || ''}` - } - }); - return { status: res.status }; - }); - - // User role should get 403 Forbidden or 401 Unauthorized - const isRestricted = response.status === 403 || response.status === 401; - expect(isRestricted).toBe(true); - } catch (e) { - // Network error is also acceptable (endpoint not accessible) - expect(true); - } - }); - }); - - // UAT-106: Guest role has minimal access - test('Guest role has minimal access', async ({ page }) => { - const guestUser = { email: 'guest@test.local', name: 'Guest User', password: 'GuestPass123!' }; - - await test.step('Create guest user', async () => { - await page.goto('/users', { waitUntil: 'networkidle' }); - - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/email/i).fill(guestUser.email); - await page.getByLabel(/name/i).fill(guestUser.name); - await page.getByLabel(/password/i).first().fill(guestUser.password); - - // Assign "Guest" role - const roleSelect = page.locator('select[name*="role"]').first(); - if (await roleSelect.isVisible()) { - await roleSelect.selectOption('guest'); - } - - const submitButton = page.getByRole('button', { name: /create|submit|save/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - }); - - await test.step('Login as guest', async () => { - const logoutButton = page.getByRole('button', { name: /logout|sign out/i }).first(); - if (await logoutButton.isVisible()) { - await logoutButton.click(); - } - - await page.getByLabel(/email/i).fill(guestUser.email); - await page.getByLabel(/password/i).fill(guestUser.password); - - const loginButton = page.getByRole('button', { name: /login|sign in/i }); - await loginButton.click(); - await page.waitForLoadState('networkidle'); - }); - - await test.step('Verify guest has limited features', async () => { - // Guest should have read-only or very limited access - const mainContent = page.locator('[role="main"]').first(); - await expect(mainContent).toBeVisible(); - - // Edit/delete buttons should be disabled or hidden - const editButtons = page.locator('[data-testid*="edit"], button[title*="Edit"]'); - const editCount = await editButtons.count(); - // Either no edit buttons or they should be disabled - expect(editCount).toBeGreaterThanOrEqual(0); - }); - }); - - // UAT-107: Modify user email - test('Modify user email', async ({ page }) => { - const originalEmail = 'modifier@test.local'; - const newEmail = 'modified@test.local'; - const userName = 'Modifier User'; - - await test.step('Create test user', async () => { - await page.goto('/users', { waitUntil: 'networkidle' }); - - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/email/i).fill(originalEmail); - await page.getByLabel(/name/i).fill(userName); - await page.getByLabel(/password/i).first().fill('TestPass123!'); - - const submitButton = page.getByRole('button', { name: /create|submit|save/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - }); - - await test.step('Edit user email', async () => { - const userRow = page.locator(`text=${originalEmail}`).first(); - const editButton = userRow.locator('..').getByRole('button', { name: /edit|settings/i }).first(); - await editButton.click(); - await page.waitForSelector('[role="dialog"], form', { timeout: 3000 }); - - const emailInput = page.getByLabel(/email/i); - await emailInput.clear(); - await emailInput.fill(newEmail); - - const saveButton = page.getByRole('button', { name: /save|update/i }).first(); - await saveButton.click(); - await page.waitForLoadState('networkidle'); - }); - - await test.step('Verify email updated in list', async () => { - const newEmailElement = page.locator(`text=${newEmail}`).first(); - await expect(newEmailElement).toBeVisible(); - - // Original email should be gone - const oldEmailElement = page.locator(`text=${originalEmail}`).first(); - await expect(oldEmailElement).not.toBeVisible(); - }); - }); - - // UAT-108: Reset user password - test('Reset user password', async ({ page }) => { - const testUser = { email: 'resetpass@test.local', name: 'Reset Pass User', password: 'OldPass123!' }; - const newPassword = 'NewPass456!'; - - await test.step('Create test user', async () => { - await page.goto('/users', { waitUntil: 'networkidle' }); - - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/email/i).fill(testUser.email); - await page.getByLabel(/name/i).fill(testUser.name); - await page.getByLabel(/password/i).first().fill(testUser.password); - - const submitButton = page.getByRole('button', { name: /create|submit|save/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - }); - - await test.step('Reset user password', async () => { - const userRow = page.locator(`text=${testUser.email}`).first(); - const editButton = userRow.locator('..').getByRole('button', { name: /edit/i }).first(); - await editButton.click(); - await page.waitForSelector('[role="dialog"], form'); - - // Look for reset password button - const resetButton = page.getByRole('button', { name: /reset|password|set/i }); - if (await resetButton.isVisible()) { - await resetButton.click(); - - // Fill new password if prompted - const passwordInput = page.getByLabel(/password/i).first(); - if (await passwordInput.isVisible()) { - await passwordInput.fill(newPassword); - } - - const saveButton = page.getByRole('button', { name: /save|update|confirm/i }).first(); - await saveButton.click(); - } - - await page.waitForLoadState('networkidle'); - }); - - await test.step('Verify password can be used to login', async () => { - // Logout and login with new password - const logoutButton = page.getByRole('button', { name: /logout|sign out/i }).first(); - if (await logoutButton.isVisible()) { - await logoutButton.click(); - await page.waitForURL(/login/); - } - - await page.getByLabel(/email/i).fill(testUser.email); - await page.getByLabel(/password/i).fill(newPassword); - - const loginButton = page.getByRole('button', { name: /login|sign in/i }); - await loginButton.click(); - - // Should succeed with new password - await page.waitForLoadState('networkidle'); - const dashboard = page.locator('[role="main"]').first(); - await expect(dashboard).toBeVisible(); - }); - }); - - // UAT-109: Search/filter users by email - test('Search users by email', async ({ page }) => { - const searchEmail = 'search@test.local'; - - await test.step('Create searchable user', async () => { - await page.goto('/users', { waitUntil: 'networkidle' }); - - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/email/i).fill(searchEmail); - await page.getByLabel(/name/i).fill('Search Test User'); - await page.getByLabel(/password/i).first().fill('SearchPass123!'); - - const submitButton = page.getByRole('button', { name: /create|submit|save/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - }); - - await test.step('Search by email', async () => { - const searchInput = page.getByPlaceholder(/search|filter/i).first(); - if (await searchInput.isVisible()) { - await searchInput.fill(searchEmail); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Verify search results', async () => { - const userEmail = page.locator(`text=${searchEmail}`).first(); - await expect(userEmail).toBeVisible(); - }); - }); - - // UAT-110: Pagination works on users list - test('User list pagination works with many users', async ({ page }) => { - await test.step('Navigate to users page', async () => { - await page.goto('/users', { waitUntil: 'networkidle' }); - }); - - await test.step('Verify pagination controls visible if needed', async () => { - const userList = page.locator('[data-testid="user-table"], [class*="user-list"]').first(); - await expect(userList).toBeVisible(); - - // Check for pagination - const paginationControls = page.locator('[data-testid*="pagination"], [class*="pagination"]').first(); - if (await userList.evaluate((el) => el.children.length > 25)) { - // If many users, pagination should exist - if (await paginationControls.isVisible()) { - await expect(paginationControls).toBeVisible(); - } - } - }); - - await test.step('Navigate pages if pagination exists', async () => { - const nextButton = page.getByRole('button', { name: /next|>|forward/i }).first(); - if (await nextButton.isVisible()) { - await nextButton.click(); - await page.waitForLoadState('networkidle'); - - // Verify we're on next page - const userList = page.locator('[data-testid="user-table"]').first(); - await expect(userList).toBeVisible(); - } - }); - }); -}); diff --git a/tests/phase4-uat/03-proxy-host-management.spec.ts b/tests/phase4-uat/03-proxy-host-management.spec.ts deleted file mode 100644 index 56c762e1..00000000 --- a/tests/phase4-uat/03-proxy-host-management.spec.ts +++ /dev/null @@ -1,493 +0,0 @@ -import { test, expect } from '@playwright/test'; - -/** - * Phase 4 UAT: Proxy Host Management - * - * Purpose: Validate reverse proxy creation, configuration, and routing - * Scenarios: CRUD operations, SSL setup, access lists, WAF/rate limiting - * Success: Proxies created and route traffic correctly - */ - -test.describe('UAT-003: Proxy Host Management', () => { - const testProxies = [ - { domain: 'test1.proxy.local', target: 'http://127.0.0.1:3000', description: 'Test Proxy 1' }, - { domain: 'test2.proxy.local', target: 'http://127.0.0.1:3001', description: 'Test Proxy 2' }, - ]; - - test.beforeEach(async ({ page }) => { - // Ensure admin is logged in - await page.goto('/'); - await page.waitForSelector('[data-testid="dashboard-container"], [role="main"]', { timeout: 5000 }); - }); - - test.afterEach(async ({ page }) => { - // Clean up test proxies - const proxiesLink = page.getByRole('link', { name: /proxy|proxy.?host/i }); - if (await proxiesLink.isVisible()) { - await proxiesLink.click(); - await page.waitForLoadState('networkidle'); - - for (const proxy of testProxies) { - const proxyRow = page.locator(`text=${proxy.domain}`).first(); - if (await proxyRow.isVisible()) { - const deleteButton = proxyRow.locator('..').getByRole('button', { name: /delete/i }).first(); - if (await deleteButton.isVisible()) { - await deleteButton.click(); - const confirmButton = page.getByRole('button', { name: /confirm|delete/i }).first(); - if (await confirmButton.isVisible()) { - await confirmButton.click(); - await page.waitForLoadState('networkidle'); - } - } - } - } - } - }); - - // UAT-201: Create proxy host with domain - test('Create proxy host with domain', async ({ page }) => { - const proxyData = testProxies[0]; - - await test.step('Navigate to proxy hosts page', async () => { - const proxiesLink = page.getByRole('link', { name: /proxy|proxy.?host/i }); - await proxiesLink.click(); - await page.waitForSelector('[data-testid="proxies-list"], [class*="proxy"]', { timeout: 5000 }); - }); - - await test.step('Click add proxy button', async () => { - const addButton = page.getByRole('button', { name: /add|create|new/i }).first(); - await addButton.click(); - await page.waitForSelector('[role="dialog"], form[class*="proxy"]', { timeout: 3000 }); - }); - - await test.step('Fill proxy creation form', async () => { - await page.getByLabel(/domain|hostname/i).fill(proxyData.domain); - await page.getByLabel(/target|backend|upstream/i).fill(proxyData.target); - - const descriptionField = page.getByLabel(/description|notes/i); - if (await descriptionField.isVisible()) { - await descriptionField.fill(proxyData.description); - } - }); - - await test.step('Submit form', async () => { - const submitButton = page.getByRole('button', { name: /create|submit|save/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - }); - - await test.step('Verify proxy created', async () => { - const proxyElement = page.locator(`text=${proxyData.domain}`).first(); - await expect(proxyElement).toBeVisible(); - }); - }); - - // UAT-202: Edit proxy host - test('Edit proxy host settings', async ({ page }) => { - const proxyData = testProxies[0]; - const newTarget = 'http://127.0.0.1:4000'; - - await test.step('Create proxy first', async () => { - await page.goto('/proxy-hosts', { waitUntil: 'networkidle' }); - - const proxyExists = await page.locator(`text=${proxyData.domain}`).first().isVisible().catch(() => false); - if (!proxyExists) { - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/domain/i).fill(proxyData.domain); - await page.getByLabel(/target/i).fill(proxyData.target); - - const submitButton = page.getByRole('button', { name: /create|submit/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Open proxy edit modal', async () => { - const proxyRow = page.locator(`text=${proxyData.domain}`).first(); - const editButton = proxyRow.locator('..').getByRole('button', { name: /edit|config/i }).first(); - await editButton.click(); - await page.waitForSelector('[role="dialog"], form', { timeout: 3000 }); - }); - - await test.step('Modify proxy target', async () => { - const targetInput = page.getByLabel(/target|backend|upstream/i).first(); - await targetInput.clear(); - await targetInput.fill(newTarget); - }); - - await test.step('Save changes', async () => { - const saveButton = page.getByRole('button', { name: /save|update/i }).first(); - await saveButton.click(); - await page.waitForLoadState('networkidle'); - }); - - await test.step('Verify changes persisted', async () => { - const proxyRow = page.locator(`text=${proxyData.domain}`).first(); - const targetDisplay = proxyRow.locator('..').getByText(newTarget).first(); - if (await targetDisplay.isVisible()) { - await expect(targetDisplay).toBeVisible(); - } - }); - }); - - // UAT-203: Delete proxy host - test('Delete proxy host', async ({ page }) => { - const proxyToDelete = testProxies[0]; - - await test.step('Create proxy to delete', async () => { - await page.goto('/proxy-hosts', { waitUntil: 'networkidle' }); - - const proxyExists = await page.locator(`text=${proxyToDelete.domain}`).first().isVisible().catch(() => false); - if (!proxyExists) { - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/domain/i).fill(proxyToDelete.domain); - await page.getByLabel(/target/i).fill(proxyToDelete.target); - - const submitButton = page.getByRole('button', { name: /create|submit/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Delete proxy', async () => { - const proxyRow = page.locator(`text=${proxyToDelete.domain}`).first(); - const deleteButton = proxyRow.locator('..').getByRole('button', { name: /delete|remove/i }).first(); - await deleteButton.click(); - }); - - await test.step('Confirm deletion', async () => { - const confirmButton = page.getByRole('button', { name: /confirm|delete|ok/i }).first(); - if (await confirmButton.isVisible()) { - await confirmButton.click(); - } - await page.waitForLoadState('networkidle'); - }); - - await test.step('Verify proxy removed', async () => { - await page.reload(); - await page.waitForLoadState('networkidle'); - - const proxyElement = page.locator(`text=${proxyToDelete.domain}`).first(); - await expect(proxyElement).not.toBeVisible(); - }); - }); - - // UAT-204: Enable SSL/TLS on proxy - test('Configure SSL/TLS certificate on proxy', async ({ page }) => { - const proxyData = testProxies[0]; - - await test.step('Create proxy with SSL', async () => { - await page.goto('/proxy-hosts', { waitUntil: 'networkidle' }); - - const proxyExists = await page.locator(`text=${proxyData.domain}`).first().isVisible().catch(() => false); - if (!proxyExists) { - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/domain/i).fill(proxyData.domain); - await page.getByLabel(/target/i).fill(proxyData.target); - - // Check if SSL toggle available - const sslToggle = page.getByLabel(/ssl|https|tls|certificate/i).first(); - if (await sslToggle.isVisible()) { - const sslCheckbox = page.locator('input[type="checkbox"][name*="ssl"], input[type="checkbox"][name*="https"]').first(); - if (await sslCheckbox.isVisible()) { - await sslCheckbox.click(); - } - } - - const submitButton = page.getByRole('button', { name: /create|submit/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Verify SSL configuration option visible', async () => { - const sslSection = page.getByText(/ssl|certificate|https/i).first(); - if (await sslSection.isVisible()) { - await expect(sslSection).toBeVisible(); - } - }); - }); - - // UAT-205: Proxy routes traffic correctly - test('Proxy routes traffic to backend', async ({ page }) => { - const proxyDomain = 'routetest.proxy.local'; - const targetUrl = 'http://127.0.0.1:8888'; - - await test.step('Create test proxy', async () => { - await page.goto('/proxy-hosts', { waitUntil: 'networkidle' }); - - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/domain/i).fill(proxyDomain); - await page.getByLabel(/target/i).fill(targetUrl); - - const submitButton = page.getByRole('button', { name: /create|submit/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - }); - - await test.step('Verify proxy appears operational', async () => { - const proxyRow = page.locator(`text=${proxyDomain}`).first(); - await expect(proxyRow).toBeVisible(); - - // Check for status indicator (if applicable) - const statusIndicator = proxyRow.locator('[data-testid*="status"], [class*="status"]').first(); - if (await statusIndicator.isVisible()) { - await expect(statusIndicator).toBeVisible(); - } - }); - }); - - // UAT-206: Access list on proxy - test('Access list can be applied to proxy', async ({ page }) => { - const proxyData = testProxies[0]; - - await test.step('Create proxy with access list', async () => { - await page.goto('/proxy-hosts', { waitUntil: 'networkidle' }); - - const proxyExists = await page.locator(`text=${proxyData.domain}`).first().isVisible().catch(() => false); - if (!proxyExists) { - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/domain/i).fill(proxyData.domain); - await page.getByLabel(/target/i).fill(proxyData.target); - - // Look for access list checkbox - const accessListCheckbox = page.getByLabel(/access.?list|ip.?whitelist/i).first(); - if (await accessListCheckbox.isVisible()) { - await accessListCheckbox.click(); - } - - const submitButton = page.getByRole('button', { name: /create|submit/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Verify access control option visible', async () => { - const proxyRow = page.locator(`text=${proxyData.domain}`).first(); - const accessControl = proxyRow.locator('..').getByText(/access|acl|whitelist/i).first(); - if (await accessControl.isVisible()) { - await expect(accessControl).toBeVisible(); - } - }); - }); - - // UAT-207: WAF on proxy - test('WAF can be applied to proxy', async ({ page }) => { - const proxyData = testProxies[0]; - - await test.step('Create proxy with WAF enabled', async () => { - await page.goto('/proxy-hosts', { waitUntil: 'networkidle' }); - - const proxyExists = await page.locator(`text=${proxyData.domain}`).first().isVisible().catch(() => false); - if (!proxyExists) { - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/domain/i).fill(proxyData.domain); - await page.getByLabel(/target/i).fill(proxyData.target); - - const wafCheckbox = page.getByLabel(/waf|coraza|malicious|attack/i).first(); - if (await wafCheckbox.isVisible()) { - await wafCheckbox.click(); - } - - const submitButton = page.getByRole('button', { name: /create|submit/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Verify WAF setting visible on proxy', async () => { - const proxyRow = page.locator(`text=${proxyData.domain}`).first(); - const wafIndicator = proxyRow.locator('..').getByText(/waf|security|protected/i).first(); - if (await wafIndicator.isVisible()) { - await expect(wafIndicator).toBeVisible(); - } - }); - }); - - // UAT-208: Rate limit on proxy - test('Rate limit can be applied to proxy', async ({ page }) => { - const proxyData = testProxies[0]; - - await test.step('Create proxy with rate limiting', async () => { - await page.goto('/proxy-hosts', { waitUntil: 'networkidle' }); - - const proxyExists = await page.locator(`text=${proxyData.domain}`).first().isVisible().catch(() => false); - if (!proxyExists) { - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/domain/i).fill(proxyData.domain); - await page.getByLabel(/target/i).fill(proxyData.target); - - const rateLimit = page.getByLabel(/rate.?limit|throttle|requests/i).first(); - if (await rateLimit.isVisible()) { - await rateLimit.click(); - } - - const submitButton = page.getByRole('button', { name: /create|submit/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Verify rate limit configuration available', async () => { - const rateLimitSection = page.getByText(/rate.?limit|throttle|requests/i).first(); - if (await rateLimitSection.isVisible()) { - await expect(rateLimitSection).toBeVisible(); - } - }); - }); - - // UAT-209: Proxy validation - invalid regex - test('Proxy creation validation for invalid patterns', async ({ page }) => { - await test.step('Navigate to proxy hosts', async () => { - await page.goto('/proxy-hosts', { waitUntil: 'networkidle' }); - }); - - await test.step('Attempt to create proxy with invalid data', async () => { - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - // Try invalid domain - await page.getByLabel(/domain/i).fill('invalid..domain'); - const submitButton = page.getByRole('button', { name: /create|submit/i }).first(); - if (await submitButton.isVisible()) { - await submitButton.click(); - } - }); - - await test.step('Verify validation error shown', async () => { - const errorMessage = page.getByText(/invalid|error|required/i).first(); - if (await errorMessage.isVisible()) { - await expect(errorMessage).toBeVisible(); - } - }); - }); - - // UAT-210: Proxy domain validation - test('Proxy domain field is required', async ({ page }) => { - await test.step('Navigate to proxy creation', async () => { - await page.goto('/proxy-hosts', { waitUntil: 'networkidle' }); - - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - await page.waitForSelector('[role="dialog"], form'); - }); - - await test.step('Try to submit without domain', async () => { - // Fill only target, not domain - await page.getByLabel(/target/i).fill('http://127.0.0.1:3000'); - - const submitButton = page.getByRole('button', { name: /create|submit/i }).first(); - await submitButton.click(); - }); - - await test.step('Verify form validation prevents submission', async () => { - // Modal should still be open OR error message shown - const modal = page.locator('[role="dialog"]').first(); - const errorMsg = page.getByText(/required|domain|hostname/i).first(); - - if (await modal.isVisible()) { - // Still in modal = validation prevented submit - expect(true); - } else if (await errorMsg.isVisible()) { - await expect(errorMsg).toBeVisible(); - } - }); - }); - - // UAT-211: View proxy statistics - test('Proxy statistics display', async ({ page }) => { - const proxyData = testProxies[0]; - - await test.step('Create test proxy', async () => { - await page.goto('/proxy-hosts', { waitUntil: 'networkidle' }); - - const proxyExists = await page.locator(`text=${proxyData.domain}`).first().isVisible().catch(() => false); - if (!proxyExists) { - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/domain/i).fill(proxyData.domain); - await page.getByLabel(/target/i).fill(proxyData.target); - - const submitButton = page.getByRole('button', { name: /create|submit/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Open proxy details/statistics', async () => { - const proxyRow = page.locator(`text=${proxyData.domain}`).first(); - const viewButton = proxyRow.locator('..').getByRole('button', { name: /view|stats|details/i }).first(); - - if (await viewButton.isVisible()) { - await viewButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Verify stats section visible', async () => { - const statsSection = page.getByText(/request|uptime|error|traffic|statistic/i).first(); - if (await statsSection.isVisible()) { - await expect(statsSection).toBeVisible(); - } - }); - }); - - // UAT-212: Disable proxy temporarily - test('Disable proxy temporarily', async ({ page }) => { - const proxyData = testProxies[0]; - - await test.step('Create proxy', async () => { - await page.goto('/proxy-hosts', { waitUntil: 'networkidle' }); - - const proxyExists = await page.locator(`text=${proxyData.domain}`).first().isVisible().catch(() => false); - if (!proxyExists) { - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - await addButton.click(); - - await page.getByLabel(/domain/i).fill(proxyData.domain); - await page.getByLabel(/target/i).fill(proxyData.target); - - const submitButton = page.getByRole('button', { name: /create|submit/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Disable proxy', async () => { - const proxyRow = page.locator(`text=${proxyData.domain}`).first(); - const enabledToggle = proxyRow.locator('..').locator('input[type="checkbox"]').first(); - - if (await enabledToggle.isVisible()) { - const isChecked = await enabledToggle.isChecked(); - if (isChecked) { - await enabledToggle.click(); - await page.waitForLoadState('networkidle'); - } - } - }); - - await test.step('Verify proxy status changed', async () => { - const proxyRow = page.locator(`text=${proxyData.domain}`).first(); - const disabledIndicator = proxyRow.locator('..').getByText(/disabled|inactive/i).first(); - - if (await disabledIndicator.isVisible()) { - await expect(disabledIndicator).toBeVisible(); - } - }); - }); -}); diff --git a/tests/phase4-uat/04-security-configuration.spec.ts b/tests/phase4-uat/04-security-configuration.spec.ts deleted file mode 100644 index b9429df0..00000000 --- a/tests/phase4-uat/04-security-configuration.spec.ts +++ /dev/null @@ -1,367 +0,0 @@ -import { test, expect } from '@playwright/test'; - -/** - * Phase 4 UAT: Security Module Configuration - * - * Purpose: Validate enablement and configuration of security features - * Scenarios: Cerberus ACL, Coraza WAF, Rate Limiting, CrowdSec integration - * Success: Security modules can be configured and persist after restart - */ - -test.describe('UAT-004: Security Configuration', () => { - test.beforeEach(async ({ page }) => { - await page.goto('/'); - await page.waitForSelector('[data-testid="dashboard-container"], [role="main"]', { timeout: 5000 }); - }); - - // UAT-301: Enable Cerberus ACL - test('Enable Cerberus ACL module', async ({ page }) => { - await test.step('Navigate to security settings', async () => { - const settingsLink = page.getByRole('link', { name: /settings|configuration/i }).first(); - await settingsLink.click(); - - const securityTab = page.getByRole('tab', { name: /security/i }).first() - .or(page.getByText(/security|modules|enforcement/i).first()); - - if (await securityTab.isVisible()) { - await securityTab.click(); - } - await page.waitForLoadState('networkidle'); - }); - - await test.step('Enable Cerberus ACL', async () => { - const cerberusToggle = page.getByLabel(/cerberus|acl|access control/i).first(); - if (await cerberusToggle.isVisible()) { - const isChecked = await cerberusToggle.isChecked(); - if (!isChecked) { - await cerberusToggle.click(); - } - } - }); - - await test.step('Verify ACL enabled and display confirmation', async () => { - const enabledState = page.getByText(/cerberus.*enabled|acl.*enabled/i).first(); - if (await enabledState.isVisible()) { - await expect(enabledState).toBeVisible(); - } - - // Should show settings are saved - const saveButton = page.getByRole('button', { name: /save|update/i }).first(); - if (await saveButton.isVisible()) { - await saveButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - }); - - // UAT-302: Configure ACL rule - test('Configure ACL whitelist rule', async ({ page }) => { - await test.step('Navigate to ACL settings', async () => { - await page.goto('/settings/security', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings'); - }); - }); - - await test.step('Add IP whitelist rule', async () => { - const addRuleButton = page.getByRole('button', { name: /add.*rule|new.*rule|add.*acl/i }).first(); - if (await addRuleButton.isVisible()) { - await addRuleButton.click(); - await page.waitForSelector('[role="dialog"], form'); - - // Fill in IP - const ipInput = page.getByLabel(/ip.?address|ip|subnet/i).first(); - if (await ipInput.isVisible()) { - await ipInput.fill('192.168.1.0/24'); - } - - // Select action (allow/deny) - const actionSelect = page.locator('select[name*="action"]').first(); - if (await actionSelect.isVisible()) { - await actionSelect.selectOption('allow'); - } - - const saveButton = page.getByRole('button', { name: /save|add|create/i }).first(); - await saveButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Verify rule appears in list', async () => { - const ruleElement = page.getByText(/192.168.1|whitelist|rule/i).first(); - if (await ruleElement.isVisible()) { - await expect(ruleElement).toBeVisible(); - } - }); - }); - - // UAT-303: Enable WAF (Coraza) - test('Enable Coraza WAF module', async ({ page }) => { - await test.step('Navigate to security settings', async () => { - await page.goto('/settings/security', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings'); - }); - }); - - await test.step('Enable WAF toggle', async () => { - const wafToggle = page.getByLabel(/coraza|waf|web.?application.?firewall|malicious/i).first(); - if (await wafToggle.isVisible()) { - const isChecked = await wafToggle.isChecked(); - if (!isChecked) { - await wafToggle.click(); - } - } - }); - - await test.step('Verify WAF enabled', async () => { - const enabledText = page.getByText(/waf.*enabled|coraza.*enabled/i).first(); - if (await enabledText.isVisible()) { - await expect(enabledText).toBeVisible(); - } - - const saveButton = page.getByRole('button', { name: /save|update/i }).first(); - if (await saveButton.isVisible()) { - await saveButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - }); - - // UAT-304: Configure WAF sensitivity - test('Configure WAF sensitivity level', async ({ page }) => { - await test.step('Navigate to WAF settings', async () => { - await page.goto('/settings/security', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings'); - }); - }); - - await test.step('Adjust WAF threshold', async () => { - const sensitivityControl = page.locator('select[name*="sensitivity"], input[name*="threshold"], input[type="range"]').first(); - if (await sensitivityControl.isVisible()) { - if (await sensitivityControl.evaluate(el => el.tagName.toLowerCase() === 'select')) { - await sensitivityControl.selectOption('medium'); - } else if (await sensitivityControl.evaluate(el => el.type === 'range')) { - await sensitivityControl.fill('5'); - } - } - }); - - await test.step('Save WAF configuration', async () => { - const saveButton = page.getByRole('button', { name: /save|update/i }).first(); - if (await saveButton.isVisible()) { - await saveButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - }); - - // UAT-305: Enable rate limiting - test('Enable rate limiting module', async ({ page }) => { - await test.step('Navigate to security settings', async () => { - await page.goto('/settings/security', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings'); - }); - }); - - await test.step('Enable rate limiting', async () => { - const rateLimitToggle = page.getByLabel(/rate.?limit|throttle|request.?limit/i).first(); - if (await rateLimitToggle.isVisible()) { - const isChecked = await rateLimitToggle.isChecked(); - if (!isChecked) { - await rateLimitToggle.click(); - } - } - }); - - await test.step('Confirm rate limiting enabled', async () => { - const enabledText = page.getByText(/rate.?limit.*enabled/i).first(); - if (await enabledText.isVisible()) { - await expect(enabledText).toBeVisible(); - } - - const saveButton = page.getByRole('button', { name: /save/i }).first(); - if (await saveButton.isVisible()) { - await saveButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - }); - - // UAT-306: Configure rate limit threshold - test('Configure rate limit threshold', async ({ page }) => { - await test.step('Navigate to rate limiting settings', async () => { - await page.goto('/settings/security', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings'); - }); - }); - - await test.step('Set rate limit value', async () => { - const rpsInput = page.getByLabel(/requests.?per|requests.?minute|rps|req.?s/i).first(); - if (await rpsInput.isVisible()) { - await rpsInput.clear(); - await rpsInput.fill('100'); - } - - const windowInput = page.getByLabel(/window|interval|period/i).first(); - if (await windowInput.isVisible()) { - await windowInput.clear(); - await windowInput.fill('60'); - } - }); - - await test.step('Save rate limit configuration', async () => { - const saveButton = page.getByRole('button', { name: /save|update/i }).first(); - if (await saveButton.isVisible()) { - await saveButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - }); - - // UAT-307: Enable CrowdSec integration - test('Enable CrowdSec integration', async ({ page }) => { - await test.step('Navigate to CrowdSec settings', async () => { - await page.goto('/settings/security', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings'); - }); - }); - - await test.step('Enable CrowdSec', async () => { - const crowdsecToggle = page.getByLabel(/crowdsec|threat|intelligence/i).first(); - if (await crowdsecToggle.isVisible()) { - const isChecked = await crowdsecToggle.isChecked(); - if (!isChecked) { - await crowdsecToggle.click(); - } - } - }); - - await test.step('Configure CrowdSec if needed', async () => { - const apiKeyInput = page.getByLabel(/api.?key|token|bouncer/i).first(); - if (await apiKeyInput.isVisible()) { - // Don't actually fill with real key - just verify field exists - const hasValue = await apiKeyInput.evaluate((el: any) => el.value || el.placeholder); - expect(hasValue).toBeTruthy(); - } - }); - - await test.step('Save CrowdSec configuration', async () => { - const saveButton = page.getByRole('button', { name: /save|update|sync/i }).first(); - if (await saveButton.isVisible()) { - await saveButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - }); - - // UAT-308: Test malicious payload blocked by WAF - test('Malicious payload blocked by WAF', async ({ page }) => { - await test.step('Create test proxy if needed', async () => { - await page.goto('/proxy-hosts', { waitUntil: 'networkidle' }); - - const testProxyExists = await page.locator('text=waf-test').isVisible().catch(() => false); - if (!testProxyExists) { - const addButton = page.getByRole('button', { name: /add|create/i }).first(); - if (await addButton.isVisible()) { - await addButton.click(); - await page.getByLabel(/domain/i).fill('waf-test.local'); - await page.getByLabel(/target/i).fill('http://127.0.0.1:8080'); - - const wafCheckbox = page.getByLabel(/waf|coraza/i).first(); - if (await wafCheckbox.isVisible()) { - await wafCheckbox.click(); - } - - const submitButton = page.getByRole('button', { name: /create|submit/i }).first(); - await submitButton.click(); - await page.waitForLoadState('networkidle'); - } - } - }); - - await test.step('Send request through Caddy (proxy)', async () => { - // Test via API that WAF blocks malicious payload - const response = await page.evaluate(async () => { - try { - const res = await fetch('http://waf-test.local/api/test?search=\' OR \'1\'=\'1', { - method: 'GET' - }); - return { status: res.status }; - } catch (e) { - return { status: 0, error: 'blocked' }; - } - }).catch(() => ({ status: 0, error: 'network' })); - - // WAF should block (403) or reject (connection refused) - expect(response).toBeTruthy(); - }); - }); - - // UAT-309: View security dashboard - test('Security dashboard displays module status', async ({ page }) => { - await test.step('Navigate to security dashboard', async () => { - const securityTab = page.getByRole('link', { name: /security|protection/i }).first(); - if (await securityTab.isVisible()) { - await securityTab.click(); - } else { - await page.goto('/security', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings/security'); - }); - } - }); - - await test.step('Verify dashboard components visible', async () => { - // Should show status of security modules - const moduleStatus = page.locator('[data-testid*="status"], [class*="security"], [class*="module"]').first(); - if (await moduleStatus.isVisible()) { - await expect(moduleStatus).toBeVisible(); - } - - // Should show ACL, WAF, rate limit statuses - let visibleModules = 0; - for (const moduleName of ['ACL', 'WAF', 'Rate Limit', 'CrowdSec']) { - const element = page.getByText(new RegExp(moduleName, 'i')).first(); - if (await element.isVisible()) visibleModules++; - } - expect(visibleModules).toBeGreaterThan(0); - }); - }); - - // UAT-310: Security audit logs visible - test('Security audit logs recorded in system', async ({ page }) => { - await test.step('Navigate to audit logs', async () => { - const auditLink = page.getByRole('link', { name: /audit|logs|history/i }).first(); - if (await auditLink.isVisible()) { - await auditLink.click(); - } else { - await page.goto('/audit-logs', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/monitoring/logs'); - }); - } - }); - - await test.step('Verify security events in logs', async () => { - const logsTable = page.locator('[data-testid="audit-table"], [class*="log"]').first(); - if (await logsTable.isVisible()) { - await expect(logsTable).toBeVisible(); - - // Should have entries - const entries = page.locator('tbody tr, [role="row"]'); - const count = await entries.count(); - expect(count).toBeGreaterThanOrEqual(0); - } - }); - - await test.step('Search for security events', async () => { - const searchInput = page.getByPlaceholder(/search|filter/i).first(); - if (await searchInput.isVisible()) { - await searchInput.fill('security'); - await page.waitForLoadState('networkidle'); - - // Should show filtered results - const results = page.locator('[role="row"]'); - const count = await results.count(); - expect(count).toBeGreaterThanOrEqual(0); - } - }); - }); -}); diff --git a/tests/phase4-uat/06-monitoring-audit.spec.ts b/tests/phase4-uat/06-monitoring-audit.spec.ts deleted file mode 100644 index c4a8b430..00000000 --- a/tests/phase4-uat/06-monitoring-audit.spec.ts +++ /dev/null @@ -1,232 +0,0 @@ -import { test, expect } from '@playwright/test'; - -/** - * Phase 4 UAT: Monitoring & Audit - * - * Purpose: Validate logging, monitoring,and audit trail functionality - * Scenarios: View logs, filter/search, export, audit trail - * Success: All activities logged and searchable - */ - -test.describe('UAT-006: Monitoring & Audit', () => { - test.beforeEach(async ({ page }) => { - await page.goto('/'); - await page.waitForSelector('[data-testid="dashboard-container"], [role="main"]', { timeout: 5000 }); - }); - - // UAT-501: Real-time logs display - test('Real-time logs display in monitoring', async ({ page }) => { - await test.step('Navigate to logs section', async () => { - const logsLink = page.getByRole('link', { name: /log|monitor|activity/i }); - await logsLink.click(); - await page.waitForSelector('[data-testid*="log"], [class*="log"]', { timeout: 5000 }); - }); - - await test.step('Verify logs are displayed', async () => { - const logTable = page.locator('[data-testid="logs-table"], [class*="log-list"]').first(); - await expect(logTable).toBeVisible(); - - // Should have log entries - const logRows = page.locator('[role="row"], [class*="log-item"]'); - const count = await logRows.count(); - expect(count).toBeGreaterThan(0); - }); - - await test.step('Verify log columns present', async () => { - const timestamp = page.getByText(/time|date|when/i).first(); - const message = page.getByText(/message|event|action/i).first(); - - if (await timestamp.isVisible() || await message.isVisible()) { - expect(true); - } - }); - }); - - // UAT-502: Filter logs by type - test('Filter logs by level/type', async ({ page }) => { - await test.step('Navigate to logs', async () => { - await page.goto('/logs', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/monitoring/logs'); - }); - }); - - await test.step('Use level filter dropdown', async () => { - const levelFilter = page.locator('select[name*="level"], [class*="level-filter"]').first(); - if (await levelFilter.isVisible()) { - await levelFilter.selectOption('error'); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Verify filtered results', async () => { - const logRows = page.locator('[role="row"], [class*="log-item"]'); - const count = await logRows.count(); - // Should have some error logs or be empty - expect(count).toBeGreaterThanOrEqual(0); - }); - }); - - // UAT-503: Search logs - test('Search logs by keyword', async ({ page }) => { - await test.step('Navigate to logs', async () => { - await page.goto('/logs', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/monitoring/logs'); - }); - }); - - await test.step('Use search input', async () => { - const searchInput = page.getByPlaceholder(/search|filter|keyword/i); - if (await searchInput.isVisible()) { - await searchInput.fill('error'); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Verify search results', async () => { - const logRows = page.locator('[role="row"], [class*="log-item"]'); - const count = await logRows.count(); - expect(count).toBeGreaterThanOrEqual(0); - }); - }); - - // UAT-504: Export logs to file - test('Export logs to CSV file', async ({ page }) => { - await test.step('Navigate to logs', async () => { - await page.goto('/logs', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/monitoring/logs'); - }); - }); - - await test.step('Click export button', async () => { - const exportButton = page.getByRole('button', { name: /export|download|csv/i }); - if (await exportButton.isVisible()) { - const downloadPromise = page.waitForEvent('download').catch(() => null); - - await exportButton.click(); - - try { - const download = await downloadPromise; - if (download) { - expect(download.suggestedFilename()).toMatch(/log|csv/i); - } - } catch (e) { - // Download might not work in test environment - expect(true); - } - } - }); - }); - - // UAT-505: Log pagination with large datasets - test('Pagination works with large log datasets', async ({ page }) => { - await test.step('Navigate to logs', async () => { - await page.goto('/logs', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/monitoring/logs'); - }); - }); - - await test.step('Check for pagination controls', async () => { - const paginationControls = page.locator('[class*="pagination"], [data-testid*="pagination"]'); - if (await paginationControls.isVisible()) { - const nextButton = page.getByRole('button', { name: /next|>/i }).first(); - if (await nextButton.isVisible()) { - await nextButton.click(); - await page.waitForLoadState('networkidle'); - } - } - }); - - await test.step('Verify logs loaded on next page', async () => { - const logRows = page.locator('[role="row"], [class*="log-item"]'); - const count = await logRows.count(); - expect(count).toBeGreaterThan(0); - }); - }); - - // UAT-506: Audit trail shows all actions - test('Audit trail displays user actions', async ({ page }) => { - await test.step('Navigate to audit logs', async () => { - const auditLink = page.getByRole('link', { name: /audit|history|action/i }); - if (await auditLink.isVisible()) { - await auditLink.click(); - } else { - await page.goto('/audit', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/admin/audit'); - }); - } - }); - - await test.step('Verify audit entries present', async () => { - const auditTable = page.locator('[data-testid="audit-table"], [class*="audit"]').first(); - if (await auditTable.isVisible()) { - await expect(auditTable).toBeVisible(); - } - - // Should have action, user, timestamp columns - const userCol = page.getByText(/user|admin|who/i).first(); - const actionCol = page.getByText(/action|did|what/i).first(); - - if (await userCol.isVisible() || await actionCol.isVisible()) { - expect(true); - } - }); - }); - - // UAT-507: Security events are logged - test('Security events recorded in audit log', async ({ page }) => { - // Create a security-relevant event (e.g., login) - await test.step('Trigger security event (login)', async () => { - const logoutButton = page.getByRole('button', { name: /logout|sign out/i }).first(); - if (await logoutButton.isVisible()) { - // Already logged in, so we'll just check audit log for existing events - } - }); - - await test.step('Navigate to audit logs', async () => { - const auditLink = page.getByRole('link', { name: /audit|history/i }); - if (await auditLink.isVisible()) { - await auditLink.click(); - } else { - await page.goto('/audit', { waitUntil: 'networkidle' }); - } - }); - - await test.step('Verify security events visible', async () => { - const securityEventsText = page.getByText(/login|logout|auth|security|access|permission|role/i).first(); - if (await securityEventsText.isVisible()) { - await expect(securityEventsText).toBeVisible(); - } - }); - }); - - // UAT-508: Log retention policy enforced - test('Log retention respects configured policy', async ({ page }) => { - await test.step('Navigate to log settings', async () => { - await page.goto('/settings', { waitUntil: 'networkidle' }); - - const loggingTab = page.getByRole('tab', { name: /log|monitor/i }).first(); - if (await loggingTab.isVisible()) { - await loggingTab.click(); - } - }); - - await test.step('Check retention settings', async () => { - const retentionInput = page.getByLabel(/retain|days|period|duration/i).first(); - if (await retentionInput.isVisible()) { - const retentionValue = await retentionInput.evaluate((el: any) => el.value); - expect(retentionValue).toBeTruthy(); - } - }); - - await test.step('Verify old logs purged appropriately', async () => { - // Navigate to logs - await page.goto('/logs', { waitUntil: 'networkidle' }); - - const logsTable = page.locator('[data-testid="logs-table"]').first(); - if (await logsTable.isVisible()) { - // Just verify logs exist and are accessible - await expect(logsTable).toBeVisible(); - } - }); - }); -}); diff --git a/tests/phase4-uat/07-backup-recovery.spec.ts b/tests/phase4-uat/07-backup-recovery.spec.ts deleted file mode 100644 index 09209908..00000000 --- a/tests/phase4-uat/07-backup-recovery.spec.ts +++ /dev/null @@ -1,301 +0,0 @@ -import { test, expect } from '@playwright/test'; - -/** - * Phase 4 UAT: Backup & Recovery - * - * Purpose: Validate backup creation, scheduling, and restoration - * Scenarios: Manual backup, scheduled backups, restore, data integrity - * Success: System can be backed up and restored correctly - */ - -test.describe('UAT-007: Backup & Recovery', () => { - test.beforeEach(async ({ page }) => { - await page.goto('/'); - await page.waitForSelector('[data-testid="dashboard-container"], [role="main"]', { timeout: 5000 }); - }); - - // UAT-601: Create manual backup - test('Create manual backup', async ({ page }) => { - await test.step('Navigate to backup settings', async () => { - await page.goto('/settings', { waitUntil: 'networkidle' }); - - const backupTab = page.getByRole('tab', { name: /backup/i }).first() - .or(page.getByText(/backup|restore/i).first()); - - if (await backupTab.isVisible()) { - await backupTab.click(); - } - }); - - await test.step('Click create backup button', async () => { - const backupButton = page.getByRole('button', { name: /backup|create|now/i }); - if (await backupButton.isVisible()) { - await backupButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Verify backup created', async () => { - const successMessage = page.getByText(/backup.*created|success|complete/i).first(); - if (await successMessage.isVisible()) { - await expect(successMessage).toBeVisible(); - } - - // Backup should appear in list - const backupList = page.locator('[data-testid="backup-list"], [class*="backup"]').first(); - if (await backupList.isVisible()) { - await expect(backupList).toBeVisible(); - } - }); - }); - - // UAT-602: Schedule automatic backups - test('Schedule automatic backups', async ({ page }) => { - await test.step('Navigate to backup settings', async () => { - await page.goto('/settings/backup', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings'); - }); - }); - - await test.step('Enable automatic backups', async () => { - const enableToggle = page.getByLabel(/enable|automatic|scheduled/i).first(); - if (await enableToggle.isVisible()) { - const isChecked = await enableToggle.isChecked(); - if (!isChecked) { - await enableToggle.click(); - } - } - }); - - await test.step('Configure backup schedule', async () => { - const timeInput = page.getByLabel(/time|hour|minute/i).first(); - if (await timeInput.isVisible()) { - await timeInput.fill('02:00'); - } - - const frequencySelect = page.locator('select[name*="frequency"], [class*="frequency"]').first(); - if (await frequencySelect.isVisible()) { - await frequencySelect.selectOption('daily'); - } - }); - - await test.step('Save schedule', async () => { - const saveButton = page.getByRole('button', { name: /save|update/i }).first(); - if (await saveButton.isVisible()) { - await saveButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Verify schedule saved', async () => { - const scheduleText = page.getByText(/daily|02:00|scheduled|automatic/i).first(); - if (await scheduleText.isVisible()) { - await expect(scheduleText).toBeVisible(); - } - }); - }); - - // UAT-603: Download backup file - test('Download backup file', async ({ page }) => { - await test.step('Navigate to backups', async () => { - await page.goto('/settings/backup', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings'); - }); - }); - - await test.step('Find backup to download', async () => { - const backupRow = page.locator('[data-testid="backup-item"], [class*="backup-row"]').first(); - if (await backupRow.isVisible()) { - const downloadButton = backupRow.getByRole('button', { name: /download|export/i }).first(); - if (await downloadButton.isVisible()) { - const downloadPromise = page.waitForEvent('download').catch(() => null); - - await downloadButton.click(); - - try { - const download = await downloadPromise; - if (download) { - expect(download.suggestedFilename()).toMatch(/backup|zip|tar|gz/i); - } - } catch (e) { - // Download might not work in test environment - expect(true); - } - } - } - }); - }); - - // UAT-604: Restore from backup - test('Restore from backup', async ({ page }) => { - await test.step('Navigate to restore section', async () => { - await page.goto('/settings/backup', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings'); - }); - }); - - await test.step('Find restore button', async () => { - const restoreButton = page.getByRole('button', { name: /restore|import/i }).first(); - if (await restoreButton.isVisible()) { - await restoreButton.click(); - await page.waitForSelector('[role="dialog"], [class*="modal"]'); - } - }); - - await test.step('Select backup to restore', async () => { - // In test, just verify dialog/form appears - const restoreForm = page.locator('[role="dialog"], form').first(); - if (await restoreForm.isVisible()) { - await expect(restoreForm).toBeVisible(); - } - }); - }); - - // UAT-605: Verify data integrity after restore - test('Data integrity verified after restore', async ({ page }) => { - await test.step('Trigger a restore operation', async () => { - // In production test, would restore actual backup - // For this test, we'll verify the mechanism exists - const restoreButton = page.locator('[data-testid="restore"], [class*="restore"]').first(); - expect(await restoreButton.isVisible().catch(() => false) || true).toBe(true); - }); - - await test.step('Verify restored data integrity check', async () => { - // After restore, system should validate data - const integrityCheck = page.getByText(/check|verify|valid|integrity|corrupt/i).first(); - if (await integrityCheck.isVisible()) { - await expect(integrityCheck).toBeVisible(); - } - }); - - await test.step('Confirm all data present', async () => { - // Check users, proxies, etc. are present - await page.goto('/users', { waitUntil: 'networkidle' }); - const usersList = page.locator('[data-testid="user-table"]').first(); - if (await usersList.isVisible()) { - await expect(usersList).toBeVisible(); - } - }); - }); - - // UAT-606: Delete backup - test('Delete backup file', async ({ page }) => { - await test.step('Navigate to backups list', async () => { - await page.goto('/settings/backup', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings'); - }); - }); - - await test.step('Find and delete backup', async () => { - const backupRow = page.locator('[data-testid="backup-item"]').first(); - if (await backupRow.isVisible()) { - const deleteButton = backupRow.getByRole('button', { name: /delete|remove/i }).first(); - if (await deleteButton.isVisible()) { - await deleteButton.click(); - - const confirmButton = page.getByRole('button', { name: /confirm|delete|ok/i }).first(); - if (await confirmButton.isVisible()) { - await confirmButton.click(); - } - - await page.waitForLoadState('networkidle'); - } - } - }); - - await test.step('Verify backup removed', async () => { - // Backup should no longer in visible list or have fewer entries - const backupsList = page.locator('[data-testid="backup-item"]'); - const count = await backupsList.count(); - expect(count).toBeGreaterThanOrEqual(0); - }); - }); - - // UAT-607: Backup encryption - test('Backup files are encrypted', async ({ page }) => { - await test.step('Navigate to backup settings', async () => { - await page.goto('/settings/backup', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings'); - }); - }); - - await test.step('Check encryption settings', async () => { - const encryptionToggle = page.getByLabel(/encrypt|secure|password/i).first(); - if (await encryptionToggle.isVisible()) { - const isEnabled = await encryptionToggle.isChecked(); - expect(typeof isEnabled).toBe('boolean'); - } - }); - - await test.step('Create backup with encryption', async () => { - const backupButton = page.getByRole('button', { name: /backup|create/i }).first(); - if (await backupButton.isVisible()) { - await backupButton.click(); - await page.waitForLoadState('networkidle'); - } - - // Verify backup created - const backupList = page.locator('[data-testid="backup-item"]'); - const count = await backupList.count(); - expect(count).toBeGreaterThan(0); - }); - }); - - // UAT-608: Restore with password protection - test('Backup restoration with password protection', async ({ page }) => { - await test.step('Navigate to restore', async () => { - await page.goto('/settings/backup', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings'); - }); - }); - - await test.step('Check for password protection option', async () => { - const restoreButton = page.getByRole('button', { name: /restore|import/i }).first(); - if (await restoreButton.isVisible()) { - await restoreButton.click(); - await page.waitForSelector('[role="dialog"], form'); - - // Look for password field - const passwordField = page.getByLabel(/password|protect/i).first(); - if (await passwordField.isVisible()) { - // Password protection is available - await expect(passwordField).toBeVisible(); - } - } - }); - }); - - // UAT-609: Backup retention policy - test('Backup retention policy enforced', async ({ page }) => { - await test.step('Navigate to backup retention settings', async () => { - await page.goto('/settings/backup', { waitUntil: 'networkidle' }).catch(() => { - return page.goto('/settings'); - }); - }); - - await test.step('Configure retention policy', async () => { - const retentionInput = page.getByLabel(/retain|keep|day|backup.*count/i).first(); - if (await retentionInput.isVisible()) { - await retentionInput.clear(); - await retentionInput.fill('7'); - } - - const saveButton = page.getByRole('button', { name: /save|update/i }).first(); - if (await saveButton.isVisible()) { - await saveButton.click(); - await page.waitForLoadState('networkidle'); - } - }); - - await test.step('Verify retention policy applied', async () => { - // Reload to see backups - await page.reload(); - await page.waitForLoadState('networkidle'); - - const backupsList = page.locator('[data-testid="backup-item"]'); - const count = await backupsList.count(); - // Should have max 7 backups - expect(count).toBeLessThanOrEqual(7); - }); - }); -}); diff --git a/tests/phase4-uat/README.md b/tests/phase4-uat/README.md deleted file mode 100644 index 2570160f..00000000 --- a/tests/phase4-uat/README.md +++ /dev/null @@ -1,225 +0,0 @@ -# Phase 4 UAT Test Suite - -Comprehensive User Acceptance Testing for Charon reverse proxy system before production beta release. - -## Overview - -**Test Count**: 70 tests across 8 feature areas -**Framework**: Playwright Test (Firefox) -**Base URL**: `http://127.0.0.1:8080` (Docker container) -**Coverage**: Admin onboarding, user management, proxy hosts, security configuration, domain/DNS, monitoring, backup/recovery, emergency operations - -## Test Files - -### 01-admin-onboarding.spec.ts (8 tests) -- **Purpose**: Validate first-time admin setup and dashboard experience -- **Tests**: - - Admin login with performance measurement (<5s) - - Dashboard widget display and functionality - - Settings page navigation and access - - Emergency token generation (modal and inline display) - - Encryption key setup and storage - - Navigation menu item visibility and navigation - - Logout and session cleanup - - Re-login validation and session restoration - -### 02-user-management.spec.ts (10 tests) -- **Purpose**: User CRUD operations and role-based access control -- **Tests**: - - Create user (all fields, minimal fields) - - Assign and modify user roles - - Delete user with confirmation - - Login as user with restricted permissions - - Unauthorized API access from guest role - - Guest role minimal permissions - - Email address modification - - Password reset workflow with login validation - - Search users by email address - - Pagination with large user count (>25 users) - -### 03-proxy-host-management.spec.ts (12 tests) -- **Purpose**: Reverse proxy lifecycle and configuration -- **Tests**: - - Create proxy with domain and target validation - - Edit proxy configuration - - Delete proxy with cleanup - - SSL/TLS certificate setup - - Traffic routing and verification - - Access list configuration and enforcement - - WAF integration with proxy - - Rate limiting application to proxy - - Domain regex pattern validation - - Proxy statistics display - - Disable/enable proxy toggle - - Form validation error handling - -### 04-security-configuration.spec.ts (10 tests) -- **Purpose**: Security module enablement and configuration -- **Tests**: - - Enable Cerberus ACL module - - Enable Coraza WAF module - - Enable rate limiting - - Enable CrowdSec integration - - Configure ACL rules (IP whitelist) - - Adjust WAF sensitivity levels - - Set rate limiting thresholds (100 req/60s example) - - CrowdSec API key field verification - - Malicious payload blocking via API call - - Security dashboard status display - -### 05-domain-dns-management.spec.ts (8 tests) -- **Purpose**: Domain and DNS provider lifecycle -- **Tests**: - - Add domain (test.example.com) - - View DNS records (A, AAAA, CNAME) - - Add DNS provider with credentials - - Verify domain ownership (DNS TXT/CNAME) - - Renew SSL certificate with confirmation - - View domain statistics (cert expiry, uptime, DNS status) - - Disable domain toggle - - Export domains as JSON file - -### 06-monitoring-audit.spec.ts (8 tests) -- **Purpose**: Logging, monitoring, and audit trail functionality -- **Tests**: - - Real-time log stream display - - Filter logs by severity level (error, info, etc.) - - Search logs by keyword - - Export logs to CSV file with download handling - - Pagination with 100+ log entries - - Audit trail showing user actions with timestamps - - Security events logged and displayed - - Log retention policy enforcement - -### 07-backup-recovery.spec.ts (9 tests) -- **Purpose**: Backup and disaster recovery -- **Tests**: - - Create manual backup through UI - - Schedule automatic backups (daily) - - Download backup file - - Restore from backup with confirmation - - Verify data integrity post-restore (users, proxies) - - Delete backup with confirmation - - Enable encryption for backups - - Restore with password protection field - - Retention policy (keep 7 backups max) - -### 08-emergency-operations.spec.ts (5 tests) -- **Purpose**: Break-glass recovery and emergency procedures -- **Tests**: - - Emergency token availability and access - - Break-glass recovery procedures (navigation) - - Disable WAF in emergency mode (no auth required) - - Reset encryption key (availability verification) - - Emergency token usage logging in audit trail - -## Execution - -### Run all UAT tests: -```bash -cd /projects/Charon -npx playwright test tests/phase4-uat/ --project=firefox -``` - -### Run specific feature tests: -```bash -npx playwright test tests/phase4-uat/02-user-management.spec.ts --project=firefox -``` - -### Run with debugging: -```bash -npx playwright test tests/phase4-uat/ --project=firefox --debug -``` - -### Run with headed browser (visible): -```bash -npx playwright test tests/phase4-uat/ --project=firefox --headed -``` - -### View test report: -```bash -npx playwright show-report -``` - -## Prerequisites - -1. **Docker environment running**: - ```bash - .github/skills/scripts/skill-runner.sh docker-rebuild-e2e - ``` - This starts the Charon application on `http://127.0.0.1:8080` - -2. **Playwright dependencies installed**: - ```bash - npm install - npx playwright install firefox - ``` - -3. **Valid admin credentials** for initial login (from environment or `.env` file) - -## Test Data Management - -- **Test users**: Created with unique emails (`test-FEATURE@test.local`) -- **Test proxies**: Domains like `feature-test.local` -- **Cleanup**: `afterEach` hooks delete all created test data via UI operations -- **No data persistence**: Each test run is isolated, no test data leaks - -## Success Criteria - -✅ All 8 test files compile without syntax errors -✅ All 70 tests execute and pass against staging environment -✅ Dashboard loads within 5 seconds -✅ User creation completes within 10 seconds -✅ Proxy creation completes within 10 seconds -✅ Emergency procedures accessible and documented -✅ Backup/restore workflow functional -✅ Security modules configurable and togglable -✅ Audit logging captures all user actions -✅ Data cleanup runs successfully (no orphaned test data) - -## Troubleshooting - -### Container not running -```bash -.github/skills/scripts/skill-runner.sh docker-rebuild-e2e -``` - -### Tests timeout -- Increase timeout: `--timeout=120000` -- Check container health: `docker ps | grep charon-e2e` - -### Locator failures (element not found) -- Run in headed mode: `--headed` -- Use `--debug` to pause and inspect -- Check selector patterns in test file (getByRole, getByLabel, getByText) - -### Port already in use -- Kill existing container: `docker kill charon-e2e` -- Rebuild fresh: `docker-rebuild-e2e` - -## Notes - -- **Firefox only**: Phase 4 tests run Firefox to save time (tests are feature-focused, not browser-specific) -- **Performance measurements**: Login, user creation, proxy creation are timed for baseline metrics -- **Soft assertions**: Optional features use `.isVisible().catch(() => false)` to handle deployment variations -- **Test organization**: Tests group by functional feature area, not by technical layer -- **Accessibility**: Uses semantic selectors (getByRole, getByLabel) for better resilience - -## Integration with CI/CD - -These tests run as part of the Phase 4 validation gate before production beta release: - -```yaml -# .github/workflows/phase4-uat.yml -- runs: npx playwright test tests/phase4-uat/ --project=firefox - timeout: 30 minutes - screenshots: retain-on-failure -``` - -## Contact & Support - -For issues or questions about the test suite: -1. Check test output for specific failure messages -2. Run individual test in debug mode -3. Verify Docker container is healthy and responsive -4. Check application logs: `docker logs charon-e2e` diff --git a/tests/phase4-integration/03-acl-waf-layering.spec.ts b/tests/security-enforcement/acl-waf-layering.spec.ts similarity index 100% rename from tests/phase4-integration/03-acl-waf-layering.spec.ts rename to tests/security-enforcement/acl-waf-layering.spec.ts diff --git a/tests/phase4-integration/04-auth-middleware-cascade.spec.ts b/tests/security-enforcement/auth-middleware-cascade.spec.ts similarity index 100% rename from tests/phase4-integration/04-auth-middleware-cascade.spec.ts rename to tests/security-enforcement/auth-middleware-cascade.spec.ts diff --git a/tests/phase4-integration/02-waf-ratelimit-interaction.spec.ts b/tests/security-enforcement/waf-rate-limit-interaction.spec.ts similarity index 100% rename from tests/phase4-integration/02-waf-ratelimit-interaction.spec.ts rename to tests/security-enforcement/waf-rate-limit-interaction.spec.ts diff --git a/tests/phase4-uat/08-emergency-operations.spec.ts b/tests/security/emergency-operations.spec.ts similarity index 100% rename from tests/phase4-uat/08-emergency-operations.spec.ts rename to tests/security/emergency-operations.spec.ts diff --git a/tests/phase4-integration/01-admin-user-e2e-workflow.spec.ts b/tests/settings/user-lifecycle.spec.ts similarity index 100% rename from tests/phase4-integration/01-admin-user-e2e-workflow.spec.ts rename to tests/settings/user-lifecycle.spec.ts diff --git a/tests/phase4-integration/06-long-running-operations.spec.ts b/tests/tasks/long-running-operations.spec.ts similarity index 100% rename from tests/phase4-integration/06-long-running-operations.spec.ts rename to tests/tasks/long-running-operations.spec.ts