hledger-web-reports/apps/web/e2e/auth.setup.ts

import { request, type FullConfig } from '@playwright/test';
import { mkdir, rm, writeFile } from 'node:fs/promises';
import { dirname } from 'node:path';
import { browserCredentials } from './auth-fixture.js';

export default async function setup(config: FullConfig) {
	const { baseURL, storageState } = config.projects[0].use;
	if (!baseURL || typeof storageState !== 'string') {
		throw new Error('Browser authentication requires a base URL and owned storage-state path.');
	}
	const directory = dirname(storageState);
	await mkdir(dirname(directory), { recursive: true });
	// Fail rather than overwrite or clean up an existing/personal directory.
	await mkdir(directory, { mode: 0o700 });
	const cleanup = () => rm(directory, { recursive: true, force: true });
	try {
		const context = await request.newContext({ baseURL });
		try {
			const response = await context.post('/signin', {
				form: browserCredentials(),
				headers: { origin: new URL(baseURL).origin, accept: 'text/html' },
				maxRedirects: 0
			});
			if (response.status() !== 303 || response.headers().location !== '/') {
				throw new Error(`Browser fixture sign-in failed (HTTP ${response.status()}).`);
			}
			const state = await context.storageState();
			if (state.cookies.length === 0) throw new Error('Browser fixture sign-in set no cookies.');
			// No cookie contents in test output; exclusive, private, ignored storage.
			await writeFile(storageState, JSON.stringify(state), { flag: 'wx', mode: 0o600 });
		} finally {
			await context.dispose();
		}
	} catch (error) {
		await cleanup();
		throw error;
	}
	return cleanup;
}