From 3cbf7cda5f43c1ffb98e10988ccb8d2944a34c2c Mon Sep 17 00:00:00 2001
From: Johan Lundberg <lundberg@sunet.se>
Date: Tue, 10 Mar 2026 10:50:44 +0100
Subject: [PATCH] test: add e2e tests for logout buttons in admin and manage
 nav bars

---
 tests/e2e/logout.spec.js | 95 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 95 insertions(+)
 create mode 100644 tests/e2e/logout.spec.js

diff --git a/tests/e2e/logout.spec.js b/tests/e2e/logout.spec.js
new file mode 100644
index 0000000..1693c34
--- /dev/null
+++ b/tests/e2e/logout.spec.js
@@ -0,0 +1,95 @@
+// @ts-check
+const { test, expect } = require('@playwright/test');
+
+const fixtures = JSON.parse(process.env.E2E_FIXTURES || '{}');
+
+/** Log in as the admin user and land on /manage/credentials. */
+async function loginAsAdmin(page) {
+  await page.goto('/login');
+  await page.fill('#username', fixtures.admin_username);
+  await page.fill('#password', fixtures.admin_password);
+  await page.click('form[hx-post="/login/password"] button[type="submit"]');
+  await page.waitForURL('**/manage/credentials', { timeout: 5000 });
+}
+
+/** Log in as a regular (non-admin) user. */
+async function loginAsRegularUser(page) {
+  await page.goto('/login');
+  await page.fill('#username', fixtures.login_username);
+  await page.fill('#password', fixtures.login_password);
+  await page.click('form[hx-post="/login/password"] button[type="submit"]');
+  await page.waitForURL('**/manage/credentials', { timeout: 5000 });
+}
+
+test.describe('Logout', () => {
+  test.describe('Manage navigation bar', () => {
+    test('clicking logout redirects to login page', async ({ page }) => {
+      await loginAsRegularUser(page);
+      await page.goto('/manage/credentials');
+
+      // Click the logout button in the manage nav bar
+      await page.click('.manage-nav .nav-logout');
+      await page.waitForURL('**/login', { timeout: 5000 });
+      expect(page.url()).toContain('/login');
+    });
+
+    test('session is cleared after logout', async ({ page }) => {
+      await loginAsRegularUser(page);
+      await page.goto('/manage/credentials');
+
+      // Log out
+      await page.click('.manage-nav .nav-logout');
+      await page.waitForURL('**/login', { timeout: 5000 });
+
+      // Attempting to visit a protected page should redirect back to login
+      await page.goto('/manage/credentials');
+      await page.waitForURL('**/login', { timeout: 5000 });
+      expect(page.url()).toContain('/login');
+    });
+  });
+
+  test.describe('Admin navigation bar', () => {
+    test('clicking logout redirects to login page', async ({ page }) => {
+      await loginAsAdmin(page);
+      await page.goto('/admin/users');
+
+      // Click the logout button in the admin nav bar
+      await page.click('.admin-nav .nav-logout');
+      await page.waitForURL('**/login', { timeout: 5000 });
+      expect(page.url()).toContain('/login');
+    });
+
+    test('session is cleared after logout', async ({ page }) => {
+      await loginAsAdmin(page);
+      await page.goto('/admin/users');
+
+      // Log out
+      await page.click('.admin-nav .nav-logout');
+      await page.waitForURL('**/login', { timeout: 5000 });
+
+      // Attempting to visit admin pages should redirect back to login
+      await page.goto('/admin/users');
+      await page.waitForURL('**/login', { timeout: 5000 });
+      expect(page.url()).toContain('/login');
+    });
+  });
+
+  test.describe('Re-authentication after logout', () => {
+    test('can log in again after logging out', async ({ page }) => {
+      // Log in
+      await loginAsRegularUser(page);
+      expect(page.url()).toContain('/manage/credentials');
+
+      // Log out via the manage nav
+      await page.click('.manage-nav .nav-logout');
+      await page.waitForURL('**/login', { timeout: 5000 });
+
+      // Log in again with the same credentials
+      await page.fill('#username', fixtures.login_username);
+      await page.fill('#password', fixtures.login_password);
+      await page.click('form[hx-post="/login/password"] button[type="submit"]');
+      await page.waitForURL('**/manage/credentials', { timeout: 5000 });
+      expect(page.url()).toContain('/manage/credentials');
+    });
+  });
+});