Files
clawmates/frontend/tests/e2e/p6-a11y.spec.ts
T
Omar SobhandClaude Fable 5 ccf96053e6 P6: security soak, axe a11y sign-off, signed air-gapped bundle tooling
- Concurrency soak (exit criterion): 12 concurrent gated runs, every
  decision attempted twice concurrently, explicit resumes racing the
  durable sweeper — exactly one execution per approval, grants consumed
  at most once, every decision audited, zero stuck runs, zero unaudited
  executions. (Testkit pool raised to 20 connections; the 5-connection
  pool starved the storm.)
- axe a11y sweep (exit criterion): serious+critical violations fail CI on
  login, shell, chat, computer home, settings app, all global pages, and
  the wizard. Two real violations found and fixed: aria-label on a plain
  div (wizard progress -> role=group) and a button directly inside a <dl>
  (settings -> plain bordered list).
- tools/bundler (exit criterion): keygen / assemble / verify CLI — copies
  artifacts, writes manifest.json + sha256 checksums.txt + a detached
  ed25519 signature; verification is fully offline (keyless signing is
  internet-dependent and disqualified). Tests: round trip, tampered
  artifact caught by hash, tampered checksum list caught by signature,
  wrong key refused, missing artifact reported.

147 Rust + 63 frontend tests + 27 Playwright journeys (incl. 4 a11y).

Co-Authored-By: Claude Fable 5 <[email protected]>
2026-06-10 07:36:15 -05:00

73 lines
2.5 KiB
TypeScript

import AxeBuilder from "@axe-core/playwright";
import { expect, test, type Page } from "@playwright/test";
// P6 exit (spec §17): a11y sign-off. Serious and critical axe violations
// fail the build on every primary surface.
const OWNER_EMAIL = "[email protected]";
const OWNER_PASSWORD = "e2e-password";
async function signIn(page: Page) {
await page.goto("/login");
await page.getByLabel("Email").fill(OWNER_EMAIL);
await page.getByLabel("Password").fill(OWNER_PASSWORD);
await page.getByRole("button", { name: "Sign in" }).click();
await expect(page.getByRole("heading", { name: "TeamClaw" })).toBeVisible();
}
async function expectClean(page: Page, context: string) {
const results = await new AxeBuilder({ page }).analyze();
const blocking = results.violations.filter(
(v) => v.impact === "serious" || v.impact === "critical",
);
expect(
blocking.map((v) => `${v.id}: ${v.help} (${v.nodes.length} nodes)`),
`axe violations on ${context}`,
).toEqual([]);
}
test("login page is clean", async ({ page }) => {
await page.goto("/login");
await expect(page.getByRole("button", { name: "Sign in" })).toBeVisible();
await expectClean(page, "login");
});
test("shell, chat, and computer panel are clean", async ({ page }) => {
await signIn(page);
await expectClean(page, "workspace home");
await page.getByRole("link", { name: /Scout/ }).click();
await expect(page).toHaveURL(/\/claws\/.+\/chat\//);
await expectClean(page, "chat");
await page.getByRole("button", { name: "Computer" }).click();
const panel = page.getByRole("complementary", { name: "Computer" });
await expect(panel.getByText(/Scout's Computer/)).toBeVisible();
await expectClean(page, "computer home");
await panel.getByRole("button", { name: "Settings" }).click();
await expect(panel.getByText("Managed by")).toBeVisible();
await expectClean(page, "settings app");
});
test("global pages are clean", async ({ page }) => {
await signIn(page);
for (const [link, marker] of [
["Skills", /Skill Library/],
["Approvals", /review/i],
["Team", /workspace/],
["Credits", /Available credits/],
] as const) {
await page.getByRole("link", { name: link, exact: true }).click();
await expect(page.getByText(marker).first()).toBeVisible();
await expectClean(page, link);
}
});
test("the wizard is clean", async ({ page }) => {
await signIn(page);
await page.getByRole("link", { name: "New claw" }).click();
await expect(page.getByText("Create your Claw")).toBeVisible();
await expectClean(page, "wizard");
});