mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtter
b00ef20667
Security: - Apply sanitizeSvg() to all file upload routes (files.ts, user-files.ts) preventing SSRF and script injection via SVG uploads to file library Functional: - Handle PaddleOCR-VL 1.5 markdown_texts output format in ocr.py - Add empty-text fallback in OCR tier chain (ocr.ts) so higher tiers that return empty text fall back to the next tier automatically - Fix SVG->PNG filename extension mismatch in tool-factory.ts so download endpoint serves correct Content-Type - Report original upload size (not decoded size) in API response Test infrastructure: - Move Playwright auth state from test-results/ to .playwright/ to prevent mid-run cleanup deleting auth files - Fix auth.setup.ts navigation race with waitForURL - Fix gui-batch.spec.ts regex matching "Presets" instead of "reset" - Fix pipeline-advanced.spec.ts crop bounds and resize assertions - Broaden pipeline cleanup to include all E2E-prefixed pipelines
40 lines
1.6 KiB
TypeScript
40 lines
1.6 KiB
TypeScript
import fs from "node:fs";
|
|
import path from "node:path";
|
|
import { expect, test as setup } from "@playwright/test";
|
|
|
|
const authFile = path.join(process.cwd(), ".playwright", ".auth", "user.json");
|
|
|
|
setup("authenticate", async ({ page }) => {
|
|
// Ensure directory exists
|
|
const dir = path.dirname(authFile);
|
|
if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
|
|
|
|
await page.goto("/login");
|
|
await page.getByLabel("Username").fill("admin");
|
|
await page.getByLabel("Password").fill("admin");
|
|
await page.getByRole("button", { name: /login/i }).click();
|
|
|
|
// Wait for login to complete and grab the token in one step
|
|
const handle = await page.waitForFunction(() => localStorage.getItem("snapotter-token"), null, {
|
|
timeout: 15_000,
|
|
});
|
|
const token = await handle.jsonValue();
|
|
|
|
// Dismiss analytics consent via API so it won't block any test
|
|
const apiBase = process.env.API_URL || "http://localhost:13490";
|
|
await page.request.put(`${apiBase}/api/v1/user/analytics`, {
|
|
headers: { Authorization: `Bearer ${token}` },
|
|
data: { enabled: false },
|
|
});
|
|
|
|
// Now navigate to "/" - consent guard is satisfied
|
|
// Use waitUntil: "domcontentloaded" to avoid racing with client-side redirects
|
|
await page.goto("/", { waitUntil: "domcontentloaded" });
|
|
// Wait for the URL to settle (app may redirect through consent/auth guards)
|
|
await page.waitForURL((url) => url.pathname === "/", { timeout: 30_000 }).catch(() => {});
|
|
await page.waitForLoadState("load");
|
|
|
|
// Save storage state (includes localStorage with the token)
|
|
await page.context().storageState({ path: authFile });
|
|
});
|