Charon/tests/monitoring/real-time-logs.spec.ts

/**
 * Real-Time Logs Viewer - E2E Tests
 *
 * Tests for WebSocket-based real-time log streaming, mode switching, filtering, and controls.
 * Covers 20 test scenarios as defined in phase5-implementation.md.
 *
 * Test Categories:
 * - Page Layout (3 tests): heading, connection status, mode toggle
 * - WebSocket Connection (4 tests): initial connection, reconnection, indicator, disconnect
 * - Log Display (4 tests): receive logs, formatting, log count, auto-scroll
 * - Filtering (4 tests): level filter, search filter, clear filters, filter persistence
 * - Mode Toggle (3 tests): app vs security logs, endpoint switch, mode persistence
 * - Performance (2 tests): high volume logs, buffer limits
 */

import { test, expect, loginUser } from '../fixtures/auth-fixtures';
import { waitForToast, waitForLoadingComplete } from '../utils/wait-helpers';

/**
 * TypeScript interfaces matching the API
 */
interface LiveLogEntry {
  level: string;
  timestamp: string;
  message: string;
  source?: string;
  data?: Record<string, unknown>;
}

interface SecurityLogEntry {
  timestamp: string;
  level: string;
  logger: string;
  client_ip: string;
  method: string;
  uri: string;
  status: number;
  duration: number;
  size: number;
  user_agent: string;
  host: string;
  source: 'waf' | 'crowdsec' | 'ratelimit' | 'acl' | 'normal';
  blocked: boolean;
  block_reason?: string;
  details?: Record<string, unknown>;
}

/**
 * Mock log entries for testing
 */
const mockLogEntry: LiveLogEntry = {
  timestamp: '2024-01-15T12:00:00Z',
  level: 'INFO',
  message: 'Server request processed',
  source: 'api',
};

const mockSecurityEntry: SecurityLogEntry = {
  timestamp: '2024-01-15T12:00:01Z',
  level: 'WARN',
  logger: 'http',
  client_ip: '192.168.1.100',
  method: 'GET',
  uri: '/api/users',
  status: 200,
  duration: 0.045,
  size: 1234,
  user_agent: 'Mozilla/5.0',
  host: 'api.example.com',
  source: 'normal',
  blocked: false,
};

const mockBlockedEntry: SecurityLogEntry = {
  timestamp: '2024-01-15T12:00:02Z',
  level: 'WARN',
  logger: 'security',
  client_ip: '10.0.0.50',
  method: 'POST',
  uri: '/admin/login',
  status: 403,
  duration: 0.002,
  size: 0,
  user_agent: 'curl/7.68.0',
  host: 'admin.example.com',
  source: 'waf',
  blocked: true,
  block_reason: 'SQL injection attempt',
};

/**
 * UI Selectors for the LiveLogViewer component
 */
const SELECTORS = {
  // Connection status
  connectionStatus: '[data-testid="connection-status"]',
  connectionError: '[data-testid="connection-error"]',

  // Mode toggle
  modeToggle: '[data-testid="mode-toggle"]',
  appModeButton: '[data-testid="mode-toggle"] button:first-child',
  securityModeButton: '[data-testid="mode-toggle"] button:last-child',

  // Controls
  pauseButton: 'button[title="Pause"]',
  resumeButton: 'button[title="Resume"]',
  clearButton: 'button[title="Clear logs"]',

  // Filters
  textFilter: 'input[placeholder*="Filter"]',
  levelSelect: 'select:has(option:text("All Levels"))',
  sourceSelect: 'select:has(option:text("All Sources"))',
  blockedOnlyCheckbox: 'input[type="checkbox"]',

  // Log display
  logContainer: '.font-mono.text-xs',
  logEntry: '[data-testid="log-entry"]',
  logCount: '[data-testid="log-count"]',
  emptyState: 'text=No logs yet',
  noMatchState: 'text=No logs match',
  pausedIndicator: 'text=Paused',
};

/**
 * Helper: Navigate to logs page and switch to live logs tab
 * Returns true if LiveLogViewer is visible (Cerberus enabled), false otherwise
 */
async function navigateToLiveLogs(page: import('@playwright/test').Page): Promise<boolean> {
  await page.goto('/security');
  await waitForLoadingComplete(page);

  // The LiveLogViewer is only visible when Cerberus is enabled
  // Check if the connection-status element exists (indicates LiveLogViewer is rendered)
  const liveLogViewer = page.locator('[data-testid="connection-status"]');
  const isVisible = await liveLogViewer.isVisible({ timeout: 3000 }).catch(() => false);

  if (!isVisible) {
    // Cerberus is not enabled, LiveLogViewer is not available
    return false;
  }

  // Click the live logs tab if it exists
  const liveTab = page.locator('[data-testid="live-logs-tab"], button:has-text("Live")');
  if (await liveTab.isVisible()) {
    await liveTab.click();
  }

  return true;
}

/**
 * Helper: Wait for WebSocket connection to establish
 */
async function waitForWebSocketConnection(page: import('@playwright/test').Page) {
  await expect(page.locator(SELECTORS.connectionStatus)).toContainText('Connected', {
    timeout: 10000,
  });
}

/**
 * Helper: Create a mock WebSocket message handler
 */
function createMockWebSocketHandler(
  page: import('@playwright/test').Page,
  messages: Array<LiveLogEntry | SecurityLogEntry>
) {
  let messageIndex = 0;

  page.on('websocket', (ws) => {
    ws.on('framereceived', () => {
      // Log frame received for debugging
    });
  });

  return {
    sendNextMessage: async () => {
      if (messageIndex < messages.length) {
        // Simulate a log entry being received via evaluate
        await page.evaluate((entry) => {
          // Dispatch a custom event that the component can listen to
          window.dispatchEvent(
            new CustomEvent('mock-log-entry', { detail: entry })
          );
        }, messages[messageIndex]);
        messageIndex++;
      }
    },
    reset: () => {
      messageIndex = 0;
    },
  };
}

/**
 * Helper: Generate multiple mock log entries
 */
function generateMockLogs(count: number, options?: { blocked?: boolean }): SecurityLogEntry[] {
  return Array.from({ length: count }, (_, i) => ({
    timestamp: new Date(Date.now() - i * 1000).toISOString(),
    level: ['INFO', 'WARN', 'ERROR', 'DEBUG'][i % 4],
    logger: 'http',
    client_ip: `192.168.1.${i % 255}`,
    method: ['GET', 'POST', 'PUT', 'DELETE'][i % 4],
    uri: `/api/resource/${i}`,
    status: options?.blocked ? 403 : [200, 201, 404, 500][i % 4],
    duration: Math.random() * 0.5,
    size: Math.floor(Math.random() * 5000),
    user_agent: 'Mozilla/5.0',
    host: 'api.example.com',
    source: (['normal', 'waf', 'crowdsec', 'ratelimit', 'acl'] as const)[i % 5],
    blocked: options?.blocked ?? i % 10 === 0,
    block_reason: options?.blocked || i % 10 === 0 ? 'Rate limit exceeded' : undefined,
  }));
}

test.describe('Real-Time Logs Viewer', () => {
  // Note: These tests require Cerberus (security module) to be enabled.
  // The LiveLogViewer component is only rendered when Cerberus is active.
  // Tests will be skipped if the component is not visible on the /security page.

  // Track if LiveLogViewer is available (Cerberus enabled)
  let cerberusEnabled = false;

  test.beforeAll(async ({ browser }) => {
    // Check once at the start if Cerberus is enabled
    // Use stored auth state from playwright/.auth/user.json
    const context = await browser.newContext({
      storageState: 'playwright/.auth/user.json',
    });
    const page = await context.newPage();

    // Navigate to security page
    await page.goto('/security');
    await page.waitForLoadState('networkidle');

    // Check if LiveLogViewer is visible (only shown when Cerberus is enabled)
    const connectionStatus = page.locator('[data-testid="connection-status"]');
    cerberusEnabled = await connectionStatus.isVisible({ timeout: 3000 }).catch(() => false);

    await context.close();
  });

  // =========================================================================
  // Page Layout Tests (3 tests)
  // =========================================================================
  test.describe('Page Layout', () => {
    test('should display live logs viewer with correct heading', async ({
      page,
      authenticatedUser,
    }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);

      // Verify the viewer is displayed
      await expect(page.locator('h3, h2, h1').filter({ hasText: /log/i })).toBeVisible();

      // Connection status should be visible
      await expect(page.locator(SELECTORS.connectionStatus)).toBeVisible();
    });

    test('should show connection status indicator', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);

      // Connection status badge should exist
      const statusBadge = page.locator(SELECTORS.connectionStatus);
      await expect(statusBadge).toBeVisible();

      // Should show either Connected or Disconnected
      await expect(statusBadge).toContainText(/Connected|Disconnected/);
    });

    test('should show mode toggle between App and Security logs', async ({
      page,
      authenticatedUser,
    }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);

      // Mode toggle should be visible
      const modeToggle = page.locator(SELECTORS.modeToggle);
      await expect(modeToggle).toBeVisible();

      // Both mode buttons should exist
      await expect(page.locator(SELECTORS.appModeButton)).toBeVisible();
      await expect(page.locator(SELECTORS.securityModeButton)).toBeVisible();
    });
  });

  // =========================================================================
  // WebSocket Connection Tests (4 tests)
  // =========================================================================
  test.describe('WebSocket Connection', () => {
    test('should establish WebSocket connection on load', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);

      let wsConnected = false;

      page.on('websocket', (ws) => {
        if (
          ws.url().includes('/api/v1/cerberus/logs/ws') ||
          ws.url().includes('/api/v1/logs/live')
        ) {
          wsConnected = true;
        }
      });

      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      expect(wsConnected).toBe(true);
    });

    test('should show connected status indicator when connected', async ({
      page,
      authenticatedUser,
    }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);

      // Wait for connection
      await waitForWebSocketConnection(page);

      // Status should show connected with green styling
      const statusBadge = page.locator(SELECTORS.connectionStatus);
      await expect(statusBadge).toContainText('Connected');
      await expect(statusBadge).toHaveClass(/bg-green/);
    });

    test('should handle connection failure gracefully', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);

      // Block WebSocket endpoints to simulate failure
      await page.route('**/api/v1/cerberus/logs/ws', (route) => route.abort('connectionrefused'));
      await page.route('**/api/v1/logs/live', (route) => route.abort('connectionrefused'));

      await navigateToLiveLogs(page);

      // Should show disconnected status
      const statusBadge = page.locator(SELECTORS.connectionStatus);
      await expect(statusBadge).toContainText('Disconnected');
      await expect(statusBadge).toHaveClass(/bg-red/);

      // Error message should be visible
      await expect(page.locator(SELECTORS.connectionError)).toBeVisible();
    });

    test('should show disconnect handling and recovery UI', async ({
      page,
      authenticatedUser,
    }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);

      // Initially connected
      await waitForWebSocketConnection(page);

      // Block the WebSocket to simulate disconnect
      await page.route('**/api/v1/cerberus/logs/ws', (route) => route.abort());
      await page.route('**/api/v1/logs/live', (route) => route.abort());

      // Trigger a reconnect by switching modes
      await page.click(SELECTORS.appModeButton);

      // Should show disconnected after failed reconnect
      await expect(page.locator(SELECTORS.connectionStatus)).toContainText('Disconnected', {
        timeout: 5000,
      });
    });
  });

  // =========================================================================
  // Log Display Tests (4 tests)
  // =========================================================================
  test.describe('Log Display', () => {
    test('should display incoming log entries in real-time', async ({
      page,
      authenticatedUser,
    }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);

      // Setup mock WebSocket response
      await page.route('**/api/v1/cerberus/logs/ws', async (route) => {
        // Allow the WebSocket to connect
        await route.continue();
      });

      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      // Verify log container is visible
      const logContainer = page.locator(SELECTORS.logContainer);
      await expect(logContainer).toBeVisible();

      // Initially should show empty state or waiting message
      await expect(page.locator(SELECTORS.emptyState).or(page.locator(SELECTORS.logEntry))).toBeVisible();
    });

    test('should format log entries with timestamp and source', async ({
      page,
      authenticatedUser,
    }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      // Wait for any logs to appear or check structure is ready
      const logContainer = page.locator(SELECTORS.logContainer);
      await expect(logContainer).toBeVisible();

      // Check that log count is displayed in footer
      const logCountFooter = page.locator(SELECTORS.logCount);
      await expect(logCountFooter).toBeVisible();
      await expect(logCountFooter).toContainText(/logs/i);
    });

    test('should display log count in footer', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      // Log count footer should be visible
      const logCount = page.locator(SELECTORS.logCount);
      await expect(logCount).toBeVisible();

      // Should show format like "Showing X of Y logs"
      await expect(logCount).toContainText(/Showing \d+ of \d+ logs/);
    });

    test('should auto-scroll to latest logs', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      // Get log container
      const logContainer = page.locator(SELECTORS.logContainer);
      await expect(logContainer).toBeVisible();

      // Container should be scrollable
      const scrollHeight = await logContainer.evaluate((el) => el.scrollHeight);
      const clientHeight = await logContainer.evaluate((el) => el.clientHeight);

      // Verify container has proper scroll setup
      expect(clientHeight).toBeGreaterThan(0);
    });
  });

  // =========================================================================
  // Filtering Tests (4 tests)
  // =========================================================================
  test.describe('Filtering', () => {
    test('should filter logs by level', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      // Level filter select should be visible
      const levelSelect = page.locator(SELECTORS.levelSelect);
      await expect(levelSelect).toBeVisible();

      // Should have level options
      await expect(levelSelect.locator('option:text("All Levels")')).toBeVisible();
      await expect(levelSelect.locator('option:text("Info")')).toBeVisible();
      await expect(levelSelect.locator('option:text("Error")')).toBeVisible();
      await expect(levelSelect.locator('option:text("Warning")')).toBeVisible();

      // Select a specific level
      await levelSelect.selectOption('error');

      // Verify selection was applied
      await expect(levelSelect).toHaveValue('error');
    });

    test('should filter logs by search text', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      // Text filter input should be visible
      const textFilter = page.locator(SELECTORS.textFilter);
      await expect(textFilter).toBeVisible();

      // Type search text
      await textFilter.fill('api/users');

      // Verify input has the value
      await expect(textFilter).toHaveValue('api/users');

      // Log count should update (may show filtered results)
      await expect(page.locator(SELECTORS.logCount)).toContainText(/logs/);
    });

    test('should clear all filters', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      // Apply filters
      const textFilter = page.locator(SELECTORS.textFilter);
      const levelSelect = page.locator(SELECTORS.levelSelect);

      await textFilter.fill('test');
      await levelSelect.selectOption('error');

      // Verify filters applied
      await expect(textFilter).toHaveValue('test');
      await expect(levelSelect).toHaveValue('error');

      // Clear text filter
      await textFilter.clear();
      await expect(textFilter).toHaveValue('');

      // Reset level filter
      await levelSelect.selectOption('');
      await expect(levelSelect).toHaveValue('');
    });

    test('should filter by source in security mode', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);

      // Ensure we're in security mode
      await page.click(SELECTORS.securityModeButton);
      await waitForWebSocketConnection(page);

      // Source filter should be visible in security mode
      const sourceSelect = page.locator(SELECTORS.sourceSelect);
      await expect(sourceSelect).toBeVisible();

      // Should have source options
      await expect(sourceSelect.locator('option:text("All Sources")')).toBeVisible();
      await expect(sourceSelect.locator('option:text("WAF")')).toBeVisible();
      await expect(sourceSelect.locator('option:text("CrowdSec")')).toBeVisible();

      // Select a source
      await sourceSelect.selectOption('waf');
      await expect(sourceSelect).toHaveValue('waf');
    });
  });

  // =========================================================================
  // Mode Toggle Tests (3 tests)
  // =========================================================================
  test.describe('Mode Toggle', () => {
    test('should toggle between App and Security log modes', async ({
      page,
      authenticatedUser,
    }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);

      // Default should be security mode
      const securityButton = page.locator(SELECTORS.securityModeButton);
      await expect(securityButton).toHaveClass(/bg-blue-600/);

      // Click App mode
      await page.click(SELECTORS.appModeButton);

      // App button should now be active
      const appButton = page.locator(SELECTORS.appModeButton);
      await expect(appButton).toHaveClass(/bg-blue-600/);

      // Security button should be inactive
      await expect(securityButton).not.toHaveClass(/bg-blue-600/);
    });

    test('should switch WebSocket endpoint when mode changes', async ({
      page,
      authenticatedUser,
    }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);

      const connectedEndpoints: string[] = [];

      page.on('websocket', (ws) => {
        connectedEndpoints.push(ws.url());
      });

      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      // Should have connected to security endpoint
      expect(connectedEndpoints.some((url) => url.includes('/cerberus/logs/ws'))).toBe(true);

      // Switch to app mode
      await page.click(SELECTORS.appModeButton);

      // Wait for new connection
      await page.waitForTimeout(500);

      // Should have connected to live logs endpoint
      expect(
        connectedEndpoints.some(
          (url) => url.includes('/logs/live') || url.includes('/cerberus/logs/ws')
        )
      ).toBe(true);
    });

    test('should clear logs when switching modes', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      // Get initial log count text
      const logCount = page.locator(SELECTORS.logCount);
      await expect(logCount).toBeVisible();

      // Switch mode
      await page.click(SELECTORS.appModeButton);

      // Logs should be cleared - count should show 0 of 0
      await expect(logCount).toContainText('0 of 0');
    });
  });

  // =========================================================================
  // Playback Controls Tests (2 tests from Performance category)
  // =========================================================================
  test.describe('Playback Controls', () => {
    test('should pause and resume log streaming', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      // Click pause button
      const pauseButton = page.locator(SELECTORS.pauseButton);
      await expect(pauseButton).toBeVisible();
      await pauseButton.click();

      // Should show paused indicator
      await expect(page.locator(SELECTORS.pausedIndicator)).toBeVisible();

      // Pause button should become resume button
      await expect(page.locator(SELECTORS.resumeButton)).toBeVisible();

      // Click resume
      await page.locator(SELECTORS.resumeButton).click();

      // Paused indicator should be hidden
      await expect(page.locator(SELECTORS.pausedIndicator)).not.toBeVisible();

      // Should be back to pause button
      await expect(page.locator(SELECTORS.pauseButton)).toBeVisible();
    });

    test('should clear all logs', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      // Click clear button
      const clearButton = page.locator(SELECTORS.clearButton);
      await expect(clearButton).toBeVisible();
      await clearButton.click();

      // Logs should be cleared
      await expect(page.locator(SELECTORS.logCount)).toContainText('0 of 0');

      // Should show empty state
      await expect(page.locator(SELECTORS.emptyState)).toBeVisible();
    });
  });

  // =========================================================================
  // Performance Tests (2 tests)
  // =========================================================================
  test.describe('Performance', () => {
    test('should handle high volume of incoming logs', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      // Verify the component can render without errors
      const logContainer = page.locator(SELECTORS.logContainer);
      await expect(logContainer).toBeVisible();

      // Component should remain responsive
      const pauseButton = page.locator(SELECTORS.pauseButton);
      await expect(pauseButton).toBeEnabled();

      // Filters should still work
      const textFilter = page.locator(SELECTORS.textFilter);
      await textFilter.fill('test');
      await expect(textFilter).toHaveValue('test');
    });

    test('should respect maximum log buffer limit of 500 entries', async ({
      page,
      authenticatedUser,
    }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);
      await waitForWebSocketConnection(page);

      // The component has maxLogs prop defaulting to 500
      // Verify the log count display exists and functions
      const logCount = page.locator(SELECTORS.logCount);
      await expect(logCount).toBeVisible();

      // The count format should be "Showing X of Y logs"
      await expect(logCount).toContainText(/Showing \d+ of \d+ logs/);

      // Even with many logs, the displayed count should not exceed maxLogs
      // This is a structural test - the actual buffer limiting is tested implicitly
      const countText = await logCount.textContent();
      const match = countText?.match(/of (\d+) logs/);
      if (match) {
        const totalLogs = parseInt(match[1], 10);
        expect(totalLogs).toBeLessThanOrEqual(500);
      }
    });
  });

  // =========================================================================
  // Security Mode Specific Tests (2 additional tests)
  // =========================================================================
  test.describe('Security Mode Features', () => {
    test('should show blocked only filter in security mode', async ({
      page,
      authenticatedUser,
    }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);

      // Ensure security mode
      await page.click(SELECTORS.securityModeButton);
      await waitForWebSocketConnection(page);

      // Blocked only checkbox should be visible
      const blockedCheckbox = page.locator(SELECTORS.blockedOnlyCheckbox);
      await expect(blockedCheckbox).toBeVisible();

      // Toggle the checkbox
      await blockedCheckbox.check();
      await expect(blockedCheckbox).toBeChecked();

      // Uncheck
      await blockedCheckbox.uncheck();
      await expect(blockedCheckbox).not.toBeChecked();
    });

    test('should hide source filter in app mode', async ({ page, authenticatedUser }) => {
      test.skip(!cerberusEnabled, 'LiveLogViewer not available - Cerberus security module is disabled');
      await loginUser(page, authenticatedUser);
      await navigateToLiveLogs(page);

      // Start in security mode - source filter visible
      await page.click(SELECTORS.securityModeButton);
      await waitForWebSocketConnection(page);
      await expect(page.locator(SELECTORS.sourceSelect)).toBeVisible();

      // Switch to app mode
      await page.click(SELECTORS.appModeButton);

      // Source filter should be hidden
      await expect(page.locator(SELECTORS.sourceSelect)).not.toBeVisible();

      // Blocked only checkbox should also be hidden
      await expect(page.locator('text=Blocked only')).not.toBeVisible();
    });
  });
});