mirror of
https://github.com/hanzoai/sign.git
synced 2026-10-21 01:21:51 +00:00
zooqueen
fb4e3df0e3
The product is branded Hanzo eSign (esign.hanzo.ai, repo hanzoai/esign). Rename all workspace packages @hanzo/sign-* → @hanzo/esign-* (1052 files) and align docker/Dockerfile turbo --scope/--filter to the actual remix package name @hanzo/esign (was a pre-existing mismatch with -remix that broke the build). Protected deps (@hanzo/insights, @hanzo/logo) untouched.
101 lines
3.5 KiB
TypeScript
101 lines
3.5 KiB
TypeScript
import { expect, test } from '@playwright/test';
|
|
|
|
import { NEXT_PUBLIC_WEBAPP_URL } from '@hanzo/esign-lib/constants/app';
|
|
import {
|
|
seedBlankDocument,
|
|
seedCompletedDocument,
|
|
seedPendingDocument,
|
|
} from '@hanzo/esign-prisma/seed/documents';
|
|
import { seedUser } from '@hanzo/esign-prisma/seed/users';
|
|
|
|
import { apiSignin } from '../fixtures/authentication';
|
|
|
|
test.describe.configure({
|
|
mode: 'parallel',
|
|
});
|
|
|
|
test.describe('Unauthorized Access to Documents', () => {
|
|
test('should block unauthorized access to the draft document page', async ({ page }) => {
|
|
const { user, team } = await seedUser();
|
|
const document = await seedBlankDocument(user, team.id);
|
|
|
|
const { user: unauthorizedUser } = await seedUser();
|
|
|
|
await apiSignin({
|
|
page,
|
|
email: unauthorizedUser.email,
|
|
redirectPath: `/t/${team.url}/documents`,
|
|
});
|
|
|
|
await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${team.url}/documents/${document.id}`);
|
|
await expect(page.getByRole('heading', { name: 'Team not found' })).toBeVisible();
|
|
});
|
|
|
|
test('should block unauthorized access to the draft document edit page', async ({ page }) => {
|
|
const { user, team } = await seedUser();
|
|
const document = await seedBlankDocument(user, team.id);
|
|
|
|
const { user: unauthorizedUser } = await seedUser();
|
|
|
|
await apiSignin({
|
|
page,
|
|
email: unauthorizedUser.email,
|
|
redirectPath: `/t/${team.url}/documents/${document.id}/edit`,
|
|
});
|
|
|
|
await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${team.url}/documents/${document.id}/edit`);
|
|
await expect(page.getByRole('heading', { name: 'Team not found' })).toBeVisible();
|
|
});
|
|
|
|
test('should block unauthorized access to the pending document page', async ({ page }) => {
|
|
const { user, team } = await seedUser();
|
|
const { user: recipient } = await seedUser();
|
|
const document = await seedPendingDocument(user, team.id, [recipient]);
|
|
|
|
const { user: unauthorizedUser } = await seedUser();
|
|
|
|
await apiSignin({
|
|
page,
|
|
email: unauthorizedUser.email,
|
|
redirectPath: `/t/${team.url}/documents/${document.id}`,
|
|
});
|
|
|
|
await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${team.url}/documents/${document.id}`);
|
|
await expect(page.getByRole('heading', { name: 'Team not found' })).toBeVisible();
|
|
});
|
|
|
|
test('should block unauthorized access to pending document edit page', async ({ page }) => {
|
|
const { user, team } = await seedUser();
|
|
const { user: recipient } = await seedUser();
|
|
const document = await seedPendingDocument(user, team.id, [recipient]);
|
|
|
|
const { user: unauthorizedUser } = await seedUser();
|
|
|
|
await apiSignin({
|
|
page,
|
|
email: unauthorizedUser.email,
|
|
redirectPath: `/t/${team.url}/documents/${document.id}/edit`,
|
|
});
|
|
|
|
await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${team.url}/documents/${document.id}/edit`);
|
|
await expect(page.getByRole('heading', { name: 'Team not found' })).toBeVisible();
|
|
});
|
|
|
|
test('should block unauthorized access to completed document page', async ({ page }) => {
|
|
const { user, team } = await seedUser();
|
|
const { user: recipient } = await seedUser();
|
|
const document = await seedCompletedDocument(user, team.id, [recipient]);
|
|
|
|
const { user: unauthorizedUser } = await seedUser();
|
|
|
|
await apiSignin({
|
|
page,
|
|
email: unauthorizedUser.email,
|
|
redirectPath: `/t/${team.url}/documents/${document.id}`,
|
|
});
|
|
|
|
await page.goto(`${NEXT_PUBLIC_WEBAPP_URL()}/t/${team.url}/documents/${document.id}`);
|
|
await expect(page.getByRole('heading', { name: 'Team not found' })).toBeVisible();
|
|
});
|
|
});
|