chore: add security audit and playwright e2e pipeline stage

Author: Arun-kushwaha007

.github/workflows/ci.yml

@@ -132,3 +132,55 @@ jobs:
 
       - name: Build web
         run: pnpm --filter web build
+
+  security-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile=false
+
+      - name: Security audit
+        run: pnpm audit --prod
+
+  e2e:
+    runs-on: ubuntu-latest
+    needs: [build]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile=false
+
+      - name: Install Playwright Browsers
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: Run E2E tests
+        env:
+          RUN_E2E: 'false'
+        run: pnpm e2e

package.json

@@ -10,10 +10,12 @@
                     "dev:web":  "pnpm --filter web dev",
                     "lint":  "turbo run lint",
                     "test":  "turbo run test",
+                    "e2e":  "playwright test",
                     "format":  "prettier --write .",
                     "seed":  "pnpm --filter backend seed"
                 },
     "devDependencies":  {
+                            "@playwright/test":  "^1.55.1",
                             "prettier":  "^3.6.2",
                             "turbo":  "^2.5.0",
                             "typescript":  "^5.7.3"

playwright.config.ts

@@ -0,0 +1,9 @@
+import { defineConfig } from '@playwright/test';
+
+export default defineConfig({
+  testDir: './tests/e2e',
+  timeout: 120_000,
+  use: {
+    baseURL: process.env.E2E_API_BASE_URL ?? 'http://localhost:3001/api/v1',
+  },
+});

pnpm-lock.yaml

@@ -0,0 +1,71 @@
+import { expect, test } from '@playwright/test';
+
+const randomEmail = () => `fairshare_${Date.now()}_${Math.random().toString(36).slice(2)}@example.com`;
+
+test('register login create group add expense settle expense', async ({ request, baseURL }) => {
+  test.skip(process.env.RUN_E2E !== 'true', 'Set RUN_E2E=true to run backend e2e flow');
+  test.skip(!baseURL, 'Base URL is required');
+
+  const emailA = randomEmail();
+  const emailB = randomEmail();
+  const password = 'Password123';
+
+  const registerA = await request.post('/auth/register', {
+    data: { name: 'User A', email: emailA, password },
+  });
+  expect(registerA.ok()).toBeTruthy();
+  const userA = await registerA.json();
+
+  const registerB = await request.post('/auth/register', {
+    data: { name: 'User B', email: emailB, password },
+  });
+  expect(registerB.ok()).toBeTruthy();
+  const userB = await registerB.json();
+
+  const loginA = await request.post('/auth/login', {
+    data: { email: emailA, password },
+  });
+  expect(loginA.ok()).toBeTruthy();
+  const loginPayload = await loginA.json();
+  const token = loginPayload.accessToken as string;
+
+  const authHeaders = { Authorization: `Bearer ${token}` };
+
+  const createGroup = await request.post('/groups', {
+    headers: authHeaders,
+    data: { name: 'E2E Group', currency: 'USD' },
+  });
+  expect(createGroup.ok()).toBeTruthy();
+  const group = await createGroup.json();
+
+  const invite = await request.post(`/groups/${group.id}/invite`, {
+    headers: authHeaders,
+    data: { email: emailB },
+  });
+  expect(invite.ok()).toBeTruthy();
+
+  const createExpense = await request.post(`/groups/${group.id}/expenses`, {
+    headers: authHeaders,
+    data: {
+      payerId: userA.user.id,
+      description: 'E2E Dinner',
+      totalAmountCents: '1000',
+      currency: 'USD',
+      splits: [
+        { userId: userA.user.id, owedAmountCents: '500', paidAmountCents: '1000' },
+        { userId: userB.user.id, owedAmountCents: '500', paidAmountCents: '0' },
+      ],
+    },
+  });
+  expect(createExpense.ok()).toBeTruthy();
+
+  const settle = await request.post(`/groups/${group.id}/settlements`, {
+    headers: authHeaders,
+    data: {
+      payerId: userB.user.id,
+      receiverId: userA.user.id,
+      amountCents: '500',
+    },
+  });
+  expect(settle.ok()).toBeTruthy();
+});