Merge pull request #102 from Akash29g/feat/e2e-playwright

feat(e2e): Playwright E2E suite + CI job

Author: g9shubh

.github/workflows/ci.yml

@@ -71,6 +71,88 @@ jobs:
       - name: Test (Vitest, single run + coverage thresholds)
         run: npx ng test --watch=false
 
+
+  # ──────────────────────── E2E (Playwright) ────────────────────────
+  e2e:
+    name: e2e (Playwright)
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: docanalytics
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET 10
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Setup Node 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: docanalytics-web/package-lock.json
+
+      - name: Trust dev HTTPS cert (API serves https on :7001)
+        run: dotnet dev-certs https
+
+      - name: Restore + build API (so startup is fast)
+        run: |
+          dotnet restore DocAnalytics.slnx
+          dotnet build DocAnalytics.Api -c Release --no-restore
+
+      - name: Install web dependencies
+        working-directory: docanalytics-web
+        run: npm ci
+
+      - name: Install Playwright browsers
+        working-directory: docanalytics-web
+        run: npx playwright install --with-deps
+
+      - name: Start API and run Playwright E2E
+        working-directory: docanalytics-web
+        env:
+          ASPNETCORE_ENVIRONMENT: Development
+          ConnectionStrings__Default: "Host=localhost;Port=5432;Database=docanalytics;Username=postgres;Password=postgres"
+          Jwt__Key: ${{ secrets.E2E_JWT_KEY }}
+          CI: 'true'
+        run: |
+          set -e
+          # Start the API in the background WITHIN this step so it stays alive
+          # while Playwright runs (background procs are killed at step end).
+          ( cd .. && dotnet run --project DocAnalytics.Api -c Release --no-build > api.log 2>&1 & )
+          echo "Waiting for API on https://localhost:7001 ..."
+          up=""
+          for i in $(seq 1 90); do
+            if curl -sk https://localhost:7001/health >/dev/null 2>&1; then up=1; echo "API is up"; break; fi
+            sleep 2
+          done
+          if [ -z "$up" ]; then echo "API did not start"; cat ../api.log || true; exit 1; fi
+          npx playwright test
+
+      - name: Upload Playwright report
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: docanalytics-web/playwright-report
+          retention-days: 7
+
+
+
   # ──────────────────────── DevSecOps (scans) ────────────────────────
   devsecops:
     name: devsecops (secrets + deps + image scan)

DocAnalytics.Data/Seeding/DbSeeder.cs

@@ -208,10 +208,15 @@ public static async Task SeedAsync(AppDbContext db)
 
 
         };
+        // Exclude any error codes already inserted by the backfill above,
+        // otherwise seeding a brand-new DB hits a duplicate-key crash on error_code.
+        var existingCodes = await db.ErrorCatalog.Select(x => x.ErrorCode).ToListAsync();
         var errorCatalog = errorDefs
+            .Where(e => !existingCodes.Contains(e.Code))
             .Select(e => new ErrorCatalog { Id = Guid.NewGuid(), ErrorCode = e.Code, Description = e.Desc, RemediationMsg = e.Remediation, CreatedAt = now, UpdatedAt = now })
             .ToArray();
 
+
         string[] sources = { "S3_Bucket_Alpha", "SFTP_Beta", "API_Upload", "Legacy_Import", "Azure_Blob_Gamma" };
         string[] pipeline = { "Upload", "Validate", "Transform", "Load" };
 

docanalytics-web/.gitignore

@@ -42,3 +42,9 @@ __screenshots__/
 # System files
 .DS_Store
 Thumbs.db
+
+# Playwright
+/e2e/.auth/
+/playwright-report/
+/test-results/
+/playwright/.cache/

docanalytics-web/e2e/auth.setup.ts

@@ -0,0 +1,26 @@
+import { test as setup, expect } from '@playwright/test';
+import path from 'node:path';
+
+// Where the reusable authenticated state is saved (matches playwright.config.ts).
+const authFile = path.join(__dirname, '.auth', 'state.json');
+
+// Creds from env in CI; fall back to local dev account.
+const EMAIL = process.env.E2E_EMAIL ?? 'admin@acme.com';
+const PASSWORD = process.env.E2E_PASSWORD ?? 'Password123!';
+
+setup('authenticate via UI and save storageState', async ({ page }) => {
+  await page.goto('/login');
+  await page.fill('input[formControlName="email"]', EMAIL);
+  await page.fill('input[formControlName="password"]', PASSWORD);
+  await page.click('button[type="submit"].btn');
+
+  // Admin -> routed to first site dashboard
+  await page.waitForURL('**/site/*/dashboard', { timeout: 15_000 });
+
+  // Verify JWT persisted under the agreed key
+  const token = await page.evaluate(() => localStorage.getItem('da_token'));
+  expect(token, 'da_token should be set in localStorage after login').toBeTruthy();
+
+  // Save cookies + localStorage (captures da_token) for reuse
+  await page.context().storageState({ path: authFile });
+});

docanalytics-web/e2e/headers.spec.ts

@@ -0,0 +1,23 @@
+import { test, expect } from '@playwright/test';
+
+// A7 runs AUTHENTICATED. Verifies auth-site.interceptor adds
+// Authorization: Bearer <token> AND X-Site-Id on API calls made from a site page.
+
+test.describe('Auth-site interceptor headers', () => {
+  test('API calls carry Authorization and X-Site-Id', async ({ page }) => {
+    await page.goto('/login');
+    await page.waitForURL(/\/site\/[^/]+\/dashboard/, { timeout: 15_000 });
+
+    // Reload and capture a data API call (exclude /auth/* which fires before site is set).
+    const [req] = await Promise.all([
+      page.waitForRequest(
+        (r) => r.url().includes('/api/v1/') && !r.url().includes('/auth/'),
+      ),
+      page.reload(),
+    ]);
+
+    const headers = req.headers();
+    expect(headers['authorization']).toMatch(/^Bearer .+/);
+    expect(headers['x-site-id']).toBeTruthy();
+  });
+});

docanalytics-web/e2e/login.spec.ts

@@ -0,0 +1,46 @@
+import { test, expect } from '@playwright/test';
+
+// A4 login tests must run LOGGED OUT — override the shared storageState.
+test.use({ storageState: { cookies: [], origins: [] } });
+
+const EMAIL = process.env.E2E_EMAIL ?? 'admin@acme.com';
+const PASSWORD = process.env.E2E_PASSWORD ?? 'Password123!';
+
+const DEV_EMAIL = process.env.E2E_DEV_EMAIL ?? 'developer@platform.com';
+const DEV_PASSWORD = process.env.E2E_DEV_PASSWORD ?? 'Password123!';
+
+test.describe('Login', () => {
+  test('valid admin login routes to a site dashboard', async ({ page }) => {
+    await page.goto('/login');
+    await page.fill('input[formControlName="email"]', EMAIL);
+    await page.fill('input[formControlName="password"]', PASSWORD);
+    await page.click('button[type="submit"].btn');
+
+    await expect(page).toHaveURL(/\/site\/[^/]+\/dashboard/, { timeout: 15_000 });
+
+    const token = await page.evaluate(() => localStorage.getItem('da_token'));
+    expect(token).toBeTruthy();
+  });
+
+  test('valid Developer login routes to /provision', async ({ page }) => {
+    await page.goto('/login');
+    await page.fill('input[formControlName="email"]', DEV_EMAIL);
+    await page.fill('input[formControlName="password"]', DEV_PASSWORD);
+    await page.click('button[type="submit"].btn');
+
+    await expect(page).toHaveURL(/\/provision$/, { timeout: 15_000 });
+  });
+
+  test('invalid credentials show inline error and stay on /login', async ({ page }) => {
+    await page.goto('/login');
+    await page.fill('input[formControlName="email"]', EMAIL);
+    await page.fill('input[formControlName="password"]', 'WrongPassword!');
+    await page.click('button[type="submit"].btn');
+
+    await expect(page.locator('.alert[role="alert"]')).toHaveText('Invalid email or password.');
+    await expect(page).toHaveURL(/\/login$/);
+
+    const token = await page.evaluate(() => localStorage.getItem('da_token'));
+    expect(token).toBeFalsy();
+  });
+});

docanalytics-web/e2e/session.spec.ts

@@ -0,0 +1,29 @@
+import { test, expect } from '@playwright/test';
+
+// A5 runs AUTHENTICATED (uses the shared storageState with da_token).
+// We intentionally do NOT clear storageState here.
+
+test.describe('Session rehydration', () => {
+  test('reload with token but empty signals recovers via /auth/me', async ({ page }) => {
+    // With a live token, hitting /login auto-routes us to the dashboard.
+    await page.goto('/login');
+    await page.waitForURL(/\/site\/[^/]+\/dashboard/, { timeout: 15_000 });
+    const dashUrl = page.url();
+
+    // Sanity: token is present in localStorage.
+    const token = await page.evaluate(() => localStorage.getItem('da_token'));
+    expect(token).toBeTruthy();
+
+    // Reload wipes in-memory signals; the guard must call /auth/me to rehydrate.
+    const [meResponse] = await Promise.all([
+      page.waitForResponse(
+        (r) => r.url().includes('/auth/me') && r.request().method() === 'GET',
+      ),
+      page.reload(),
+    ]);
+    expect(meResponse.ok()).toBeTruthy();
+
+    // Session recovered -> we STAY on the dashboard, not bounced to /login.
+    await expect(page).toHaveURL(dashUrl);
+  });
+});

docanalytics-web/e2e/site-access.spec.ts

@@ -0,0 +1,26 @@
+import { test, expect } from '@playwright/test';
+
+// A6 runs AUTHENTICATED (shared storageState = admin@acme.com, Acme sites only).
+// admin@acme has NO access to Globex sites, so visiting one must redirect
+// to the first allowed (Acme) site.
+
+test.describe('Site-access guard', () => {
+  test('visiting a site without access redirects to the first allowed site', async ({ page }) => {
+    // A real Globex site the Acme admin cannot access (from the DB seed).
+    const noAccessSite = 'b1111111-1111-1111-1111-111111111111';
+
+    await page.goto(`/site/${noAccessSite}/dashboard`);
+
+    // The guard's /auth/me + redirect is async — WAIT until we've been moved
+    // OFF the no-access site to a real dashboard (not the fake one, not /login).
+    await page.waitForURL(
+      (url) =>
+        /\/site\/[^/]+\/dashboard$/.test(url.pathname) &&
+        !url.pathname.includes(noAccessSite),
+      { timeout: 15_000 },
+    );
+
+    expect(page.url()).not.toContain(noAccessSite);
+    expect(page.url()).not.toContain('/login');
+  });
+});

docanalytics-web/e2e/smoke.spec.ts

@@ -0,0 +1,54 @@
+import { test, expect, Page } from '@playwright/test';
+
+// A8 smoke tests run AUTHENTICATED (shared storageState).
+
+async function gotoDashboard(page: Page): Promise<string> {
+  await page.goto('/login');
+  await page.waitForURL(/\/site\/[^/]+\/dashboard/, { timeout: 15_000 });
+  return page.url().match(/\/site\/([^/]+)\//)![1];
+}
+
+test.describe('Smoke', () => {
+  test('dashboard renders stat cards and charts', async ({ page }) => {
+    await gotoDashboard(page);
+    await expect(page.locator('app-stat-card').first()).toBeVisible({ timeout: 10_000 });
+    await expect(page.locator('app-chart-card').first()).toBeVisible({ timeout: 10_000 });
+  });
+
+  test('batches page renders the data table', async ({ page }) => {
+    const siteId = await gotoDashboard(page);
+    await page.goto(`/site/${siteId}/batches`);
+    await expect(page.locator('app-data-table')).toBeVisible({ timeout: 10_000 });
+  });
+
+  test('batches list pagination works', async ({ page }) => {
+    const siteId = await gotoDashboard(page);
+    await page.goto(`/site/${siteId}/batches`);
+
+    const footer = page.locator('.dt-footer');
+    await expect(footer).toBeVisible({ timeout: 10_000 });
+
+    const pageInfo = page.locator('.page-info');
+    await expect(pageInfo).toContainText('Page 1');
+
+    // Only exercise navigation if there's more than one page of data.
+    const nextBtn = page.getByRole('button', { name: 'Next' });
+    if (await nextBtn.isEnabled()) {
+      await nextBtn.click();
+      await expect(pageInfo).toContainText('Page 2');
+      await page.getByRole('button', { name: 'Prev' }).click();
+      await expect(pageInfo).toContainText('Page 1');
+    }
+  });
+
+  test('errors CSV export triggers a download', async ({ page }) => {
+    const siteId = await gotoDashboard(page);
+    await page.goto(`/site/${siteId}/errors`);
+
+    const downloadPromise = page.waitForEvent('download');
+    await page.click('button.export-btn');
+    const download = await downloadPromise;
+
+    expect(download.suggestedFilename()).toContain('.csv');
+  });
+});

docanalytics-web/e2e/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "types": [ "node", "@playwright/test" ],
+    "noPropertyAccessFromIndexSignature": false,
+    "outDir": "../out-tsc/e2e"
+  },
+  "include": [ "**/*.ts", "../playwright.config.ts" ]
+}