WorkTracker/tests/playwright/auth-bypass.spec.ts

import { expect, test } from '@playwright/test';

test.describe('sidebar collapse', () => {
  test('starts collapsed and expands through the toggle button', async ({ page }) => {
    await page.setViewportSize({ width: 1440, height: 960 });
    await page.goto('/');

    const sidebar = page.getByTestId('sidebar-shell');
    const toggle = page.getByRole('button', { name: 'Toggle sidebar' });

    await expect(sidebar).toHaveAttribute('data-collapsed', 'true');
    await expect(toggle).toHaveAttribute('aria-expanded', 'false');
    await expect(page.getByRole('link', { name: 'Dashboard' })).toBeVisible();

    await toggle.click();

    await expect(sidebar).toHaveAttribute('data-collapsed', 'false');
    await expect(toggle).toHaveAttribute('aria-expanded', 'true');
    await expect(page.getByText('Dashboard')).toBeVisible();

    await toggle.click();

    await expect(sidebar).toHaveAttribute('data-collapsed', 'true');
    await expect(toggle).toHaveAttribute('aria-expanded', 'false');
  });
});

test('home loads without a login screen', async ({ page }) => {
  await page.goto('/');

  await expect(page).toHaveURL(/\/$/);
  await expect(page.getByRole('heading', { name: 'WorkTracker' })).toBeVisible();
  await expect(page.getByRole('heading', { name: 'Login' })).toHaveCount(0);
});

test('protected pages are directly available without redirecting to login', async ({ page }) => {
  const pages = [
    { path: '/grid', heading: 'Grid View' },
    { path: '/calendar', heading: 'Calendar' },
    { path: '/summary', heading: 'Monthly Summary' },
    { path: '/settings', heading: 'Settings' },
    { path: '/work-unit', heading: 'Work Unit' },
    { path: '/auth', heading: 'You are authenticated' }
  ];

  for (const target of pages) {
    await page.goto(target.path);
    await expect(page).not.toHaveURL(/\/login/i);
    await expect(page.getByRole('heading', { name: target.heading })).toBeVisible();
  }
});

test('login route redirects away when built-in authentication is disabled', async ({ page }) => {
  await page.goto('/login');

  await expect(page).toHaveURL(/\/$/);
  await expect(page.getByRole('heading', { name: 'WorkTracker' })).toBeVisible();
});