Testing Authentication Systems

test("login + protected route", async ({ page }) => {
  await page.goto("/login");
  await page.fill("[name=email]", "test@example.com");
  await page.fill("[name=password]", process.env.TEST_PWD);
  await page.click("button[type=submit]");
  await expect(page).toHaveURL("/dashboard");
  await expect(page.locator("h1")).toContainText("Welcome");
});

describe("orders authorization", () => {
  it("owner can read own order", async () => {
    expect(await can(owner, "read", order)).toBe(true);
  });
  it("other user cannot read", async () => {
    expect(await can(stranger, "read", order)).toBe(false);
  });
  it("admin can read any", async () => {
    expect(await can(admin, "read", order)).toBe(true);
  });
});

const results = await Promise.all(
  Array(20).fill(0).map(() => fetch("/login", { method: "POST", body }))
);
const codes = results.map(r => r.status);
expect(codes.filter(c => c === 429).length).toBeGreaterThan(10);