Vibe passkey

Chrono/Tests/AuthenticatedPageTest.cs

@@ -0,0 +1,20 @@
+using Microsoft.Playwright.NUnit;
+
+namespace Tests;
+
+/// <summary>
+/// Base class for Playwright tests that require an authenticated session.
+/// Signs in via the dev-only bypass endpoint before each test.
+/// </summary>
+public abstract class AuthenticatedPageTest : PageTest
+{
+    protected const string BaseUrl = "http://localhost:5256";
+
+    [SetUp]
+    public async Task SignIn()
+    {
+        var response = await Page.APIRequestContext.PostAsync($"{BaseUrl}/api/auth/dev-login");
+        if (!response.Ok)
+            throw new Exception($"Dev login failed with status {response.Status}. Ensure the server is running in Development mode.");
+    }
+}

Chrono/Tests/DeckBuilderTests.cs

@@ -1,16 +1,14 @@
 using System.Text.RegularExpressions;
 using Microsoft.Playwright;
-using Microsoft.Playwright.NUnit;
 using Tests.PageObjects;
 
 namespace Tests;
 
 [Parallelizable(ParallelScope.Self)]
 [TestFixture]
-public class DeckBuilderTests : PageTest
+public class DeckBuilderTests : AuthenticatedPageTest
 {
     private DeckBuilderPage _builderPage = null!;
-    private const string BaseUrl = "http://localhost:5256";
     private Guid _savedDeckId = Guid.Empty;
 
     [SetUp]

Chrono/Tests/FeatureTests.cs

@@ -1,11 +1,10 @@
-using Microsoft.Playwright.NUnit;
-using Tests.PageObjects;
+using Tests.PageObjects;
 
 namespace Tests;
 
 [Parallelizable(ParallelScope.Self)]
 [TestFixture]
-public class FeatureTests : PageTest
+public class FeatureTests : AuthenticatedPageTest
 {
     [SetUp]
     public void Setup()

Chrono/Tests/PageObjects/LoginPage.cs

@@ -0,0 +1,21 @@
+using Microsoft.Playwright;
+
+namespace Tests.PageObjects;
+
+public class LoginPage : BasePage
+{
+    public LoginPage(IPage page) : base(page) { }
+
+    public ILocator EnrollButton => Page.GetByRole(AriaRole.Button, new() { Name = "Enroll Passkey" });
+    public ILocator SignInButton => Page.GetByRole(AriaRole.Button, new() { Name = "Sign in with Passkey" });
+    public ILocator ErrorMessage => Page.Locator(".alert-danger");
+
+    public async Task GotoAsync() => await NavigateToAsync("/login");
+
+    public async Task WaitForInteractiveAsync()
+    {
+        await Page.WaitForLoadStateAsync(LoadState.NetworkIdle);
+        // Wait for Blazor circuit: either button must be visible
+        await Page.WaitForSelectorAsync("button", new PageWaitForSelectorOptions { Timeout = 10_000 });
+    }
+}

Chrono/Tests/PasskeyTests.cs

@@ -0,0 +1,142 @@
+using System.Text.RegularExpressions;
+using Microsoft.Playwright;
+using Microsoft.Playwright.NUnit;
+using Tests.PageObjects;
+
+namespace Tests;
+
+[Parallelizable(ParallelScope.Self)]
+[TestFixture]
+public class PasskeyTests : PageTest
+{
+    private const string BaseUrl = "http://localhost:5256";
+    private LoginPage _loginPage = null!;
+
+    [SetUp]
+    public async Task SetUp()
+    {
+        _loginPage = new LoginPage(Page);
+        // Clear any auth cookies and wipe all stored credentials for a clean slate
+        await Page.Context.ClearCookiesAsync();
+        using var http = new HttpClient();
+        await http.DeleteAsync($"{BaseUrl}/api/auth/credentials");
+    }
+
+    [TearDown]
+    public async Task TearDown()
+    {
+        using var http = new HttpClient();
+        await http.DeleteAsync($"{BaseUrl}/api/auth/credentials");
+        await Page.Context.ClearCookiesAsync();
+    }
+
+    [Test]
+    public async Task LoginPage_WhenNoCredentials_ShowsEnrollButton()
+    {
+        await _loginPage.GotoAsync();
+        await _loginPage.WaitForInteractiveAsync();
+
+        await Expect(_loginPage.EnrollButton).ToBeVisibleAsync(new() { Timeout = 10_000 });
+        await Expect(_loginPage.SignInButton).Not.ToBeVisibleAsync();
+    }
+
+    [Test]
+    public async Task EnrollPasskey_CompletesSuccessfully_AndRedirectsHome()
+    {
+        var authenticatorId = await Page.Context.AddVirtualAuthenticatorAsync(new VirtualAuthenticatorOptions
+        {
+            Protocol = "ctap2",
+            Transport = "internal",
+            HasResidentKey = true,
+            HasUserVerification = true,
+            IsUserVerified = true,
+        });
+
+        try
+        {
+            await _loginPage.GotoAsync();
+            await _loginPage.WaitForInteractiveAsync();
+
+            await Expect(_loginPage.EnrollButton).ToBeVisibleAsync(new() { Timeout = 10_000 });
+            await _loginPage.EnrollButton.ClickAsync();
+
+            // After enrollment + auto sign-in, redirects away from /login
+            await Page.WaitForURLAsync(new Regex(@"^http://localhost:5256(?!/login)"), new() { Timeout = 20_000 });
+        }
+        finally
+        {
+            await Page.Context.RemoveVirtualAuthenticatorAsync(authenticatorId);
+        }
+    }
+
+    [Test]
+    public async Task LoginPage_AfterEnrollment_ShowsSignInButton()
+    {
+        var authenticatorId = await Page.Context.AddVirtualAuthenticatorAsync(new VirtualAuthenticatorOptions
+        {
+            Protocol = "ctap2",
+            Transport = "internal",
+            HasResidentKey = true,
+            HasUserVerification = true,
+            IsUserVerified = true,
+        });
+
+        try
+        {
+            // Enroll first
+            await _loginPage.GotoAsync();
+            await _loginPage.WaitForInteractiveAsync();
+            await _loginPage.EnrollButton.ClickAsync();
+            await Page.WaitForURLAsync(new Regex(@"^http://localhost:5256(?!/login)"), new() { Timeout = 20_000 });
+
+            // Clear the auth cookie and navigate back to /login
+            await Page.Context.ClearCookiesAsync();
+            await _loginPage.GotoAsync();
+            await _loginPage.WaitForInteractiveAsync();
+
+            // Should show Sign In button (credential is enrolled)
+            await Expect(_loginPage.SignInButton).ToBeVisibleAsync(new() { Timeout = 10_000 });
+        }
+        finally
+        {
+            await Page.Context.RemoveVirtualAuthenticatorAsync(authenticatorId);
+        }
+    }
+
+    [Test]
+    public async Task SignInWithPasskey_AfterEnrollment_AuthenticatesSuccessfully()
+    {
+        var authenticatorId = await Page.Context.AddVirtualAuthenticatorAsync(new VirtualAuthenticatorOptions
+        {
+            Protocol = "ctap2",
+            Transport = "internal",
+            HasResidentKey = true,
+            HasUserVerification = true,
+            IsUserVerified = true,
+        });
+
+        try
+        {
+            // Enroll
+            await _loginPage.GotoAsync();
+            await _loginPage.WaitForInteractiveAsync();
+            await _loginPage.EnrollButton.ClickAsync();
+            await Page.WaitForURLAsync(new Regex(@"^http://localhost:5256(?!/login)"), new() { Timeout = 20_000 });
+
+            // Sign out (clear cookie) and return to login
+            await Page.Context.ClearCookiesAsync();
+            await _loginPage.GotoAsync();
+            await _loginPage.WaitForInteractiveAsync();
+
+            await Expect(_loginPage.SignInButton).ToBeVisibleAsync(new() { Timeout = 10_000 });
+            await _loginPage.SignInButton.ClickAsync();
+
+            // After sign-in, redirects away from /login
+            await Page.WaitForURLAsync(new Regex(@"^http://localhost:5256(?!/login)"), new() { Timeout = 20_000 });
+        }
+        finally
+        {
+            await Page.Context.RemoveVirtualAuthenticatorAsync(authenticatorId);
+        }
+    }
+}

Chrono/Tests/PlaywrightTests.cs

@@ -1,14 +1,12 @@
 using System.Text.RegularExpressions;
 using Microsoft.Playwright;
-using Microsoft.Playwright.NUnit;
 
 namespace Tests;
 
 [Parallelizable(ParallelScope.Self)]
 [TestFixture]
-public class PlaywrightTests : PageTest
+public class PlaywrightTests : AuthenticatedPageTest
 {
-    private const string BaseUrl = "http://localhost:5256";
 
     [Test]
     public async Task HomePage_ShouldLoad()