Skip to content

feat: Playwright test framework - API & UI automation #1678

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pranavexe wants to merge 8 commits into
base: develop
Choose a base branch
from
Open

feat: Playwright test framework - API & UI automation #1678

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
1ef3f29
Initial Playwright QA setup
pranavexe Feb 24, 2026
871c2ed
Refactor auth spec and update playwright config
pranavexe Feb 26, 2026
b622e8f
Refactor Playwright QA framework structure
pranavexe Mar 3, 2026
5132e34
feat: add Playwright API testing framework
pranavexe Mar 5, 2026
99cc2b6
feat: Playwright API testing framework
pranavexe Mar 19, 2026
a1907e0
-- edit analysis and vulnerability tests, add analysisId and vulnerab…
pranavexe Mar 19, 2026
e7e9639
feat: playwright test framework - 90 tests passing
pranavexe Apr 6, 2026
893d61b
Update Playwright QA setup
pranavexe Aug 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,4 +47,15 @@
cypress.env.json
/cypress/downloads/
/cypress/snapshots/actual
/cypress/snapshots/diff
/cypress/snapshots/diff

# Playwright
node_modules/
/test-results/
/playwright-report/
/blob-report/
/playwright/.cache/
.auth/
.state/
allure-results/
allure-report/
14 changes: 14 additions & 0 deletions auth.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
{
"cookies": [],
"origins": [
{
"origin": "https://sherlockprivacy.qa.do.appknox.io",

@coderabbitai coderabbitai Bot Apr 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Avoid hardcoded origin in persisted auth state.

Line 5 hardcodes a QA host, which undermines the multi-environment (qa/prod) goal and makes state reuse fragile across environments.

🔧 Suggested direction 
-      "origin": "https://sherlockprivacy.qa.do.appknox.io",
+      "origin": "${BASE_URL_FROM_ENV}",

Generate storage state per environment during global setup instead of committing environment-specific state.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@auth.json` at line 5, The persisted auth state currently hardcodes the
"origin" value to a QA host; update the setup so the "origin" field is not
committed with an environment-specific value—instead generate or inject the
correct origin per environment during global test setup (e.g., read from an
ENV/CONFIG and populate the "origin" field when creating the storage state) and
remove the hardcoded "origin" string from auth.json so tests can run against
qa/prod without state reuse issues.

"localStorage": [
{
"name": "ember_simple_auth-session",
"value": "{\"authenticated\":{\"authenticator\":\"authenticator:irene\",\"token\":\"653b5bbdfffd105d36fce72207778e3b060f379bc87316ca18334e62988fa11f\",\"user_id\":1,\"b64token\":\"MTo2NTNiNWJiZGZmZmQxMDVkMzZmY2U3MjIwNzc3OGUzYjA2MGYzNzliYzg3MzE2Y2ExODMzNGU2Mjk4OGZhMTFm\"}}"
Comment on lines +8 to +9

@coderabbitai coderabbitai Bot Apr 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Remove committed session secrets from repository history.

Line 9 includes live auth material (token, b64token, user_id) inside Playwright storage state. This is a secret/identity leak and should not be committed.

🔧 Suggested fix 
 {
   "cookies": [],
-  "origins": [
-    {
-      "origin": "https://sherlockprivacy.qa.do.appknox.io",
-      "localStorage": [
-        {
-          "name": "ember_simple_auth-session",
-          "value": "{\"authenticated\":{\"authenticator\":\"authenticator:irene\",\"token\":\"...\",\"user_id\":1,\"b64token\":\"...\"}}"
-        }
-      ]
-    }
-  ]
+  "origins": []
 }

Also ensure auth state files are generated at runtime in global setup and ignored by git (e.g., add auth-state paths to .gitignore), then rotate/revoke the exposed token.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@auth.json` around lines 8 - 9, The committed Playwright storage state
contains live secrets under the "ember_simple_auth-session" JSON (keys "token",
"b64token", "user_id"); remove these values from the committed auth JSON,
rotate/revoke the exposed token immediately, and purge the secret from repo
history (use git filter-repo or BFG). Add the auth-state filename(s) to
.gitignore and modify your test bootstrap/globalSetup routine (e.g., the
globalSetup function that creates storage state) to generate the Playwright
storage state at runtime instead of committing it. Ensure the sanitized
committed file contains no credentials and that runtime-generated state is used
in CI/local runs.

}
]
}
]
}
1 change: 0 additions & 1 deletion cypress/support/Actions/auth/LoginActions.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,6 @@ export default class LoginActions {
).should('not.exist'); // Username/Email field

cy.findByLabelText('login-next-button').should('not.exist'); // User check buttons

// Validate presence of access token in localStorage.
cy.window()
.its('localStorage')
Expand Down
2 changes: 2 additions & 0 deletions mirage/factories/sbom-component.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,3 +58,5 @@ export default Factory.extend({

remediation: () => faker.lorem.paragraphs(),
});


Loading
Loading