Omar SobhandClaude Opus 4.8
8d9ea7faaa
The live /sign-in is a Clerk-rendered SignInForm (SSR is just a spinner); the
rendered design is the email-first progressive form. Reworked our /login to
match it visually while keeping our real email+password auth underneath.
- Email step: "Sign up with Slack" (cosmetic), OR, Work Email / Phone Number
tabs, work-email field, "Continue with work email →", "Other SSO Options".
Slack / Phone / SSO are cosmetic placeholders we don't support yet.
- Password step: "Continue" reveals the password field + "Sign in" (our actual
POST to /auth/session). A Back link returns to the email step.
- Headline now mirrors WorkClaw ("Multiply your team's brainpower" / "Sign up
to get early access").
- Right panel is now the role-card roster grid (PawPrint avatars, our own
roles) + "The AI crew for your team" + the claws-at-desk art.
- Updated all eight E2E signIn helpers (and the load assertions) for the new
two-step flow: fill Email → Continue → fill Password → Sign in. Labels
(Email/Password) and the "Sign in" button name are preserved.
- A11y: bumped the inactive tab text to full slate (was 3.41:1).
typecheck/lint/build green · p0-shell (full sign-in) green · p6-a11y (login
clean) green · all six @visual baselines green (login regenerated) · deployed
and verified live.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
109 lines
4.4 KiB
TypeScript
109 lines
4.4 KiB
TypeScript
import { expect, test, type Page } from "@playwright/test";
|
|
|
|
// P2 BLOCKING exit criterion (spec §15/§17): a sensitive call is
|
|
// intercepted → previewed → queued → blocks → executes ONLY on approval →
|
|
// is audited. Runs against the real backend with the scripted provider.
|
|
|
|
const OWNER_EMAIL = "[email protected]";
|
|
const OWNER_PASSWORD = "e2e-password";
|
|
const GATED_PROMPT = "email the CEO [[scenario:gated-email]]";
|
|
|
|
async function signIn(page: Page) {
|
|
await page.goto("/login");
|
|
await page.getByLabel("Email").fill(OWNER_EMAIL);
|
|
await page.getByRole("button", { name: /Continue with work email/ }).click();
|
|
await page.getByLabel("Password").fill(OWNER_PASSWORD);
|
|
await page.getByRole("button", { name: "Sign in" }).click();
|
|
await expect(page.getByRole("heading", { name: "Clawmates" })).toBeVisible();
|
|
}
|
|
|
|
async function openFreshScoutSession(page: Page) {
|
|
await page.getByRole("link", { name: /Scout/ }).click();
|
|
await expect(page).toHaveURL(/\/claws\/.+\/chat\//);
|
|
// Wait for the navigation to the NEW session: the previous (possibly
|
|
// empty) session shows the same welcome heading, so the URL is the only
|
|
// reliable signal that the fresh session is mounted.
|
|
const before = page.url();
|
|
await page.getByRole("button", { name: "New" }).click();
|
|
await page.waitForURL((url) => url.toString() !== before);
|
|
await expect(
|
|
page.getByRole("heading", { name: /Hi, I'm Scout/ }),
|
|
).toBeVisible();
|
|
}
|
|
|
|
async function triggerGatedEmail(page: Page) {
|
|
const box = page.getByLabel("Message Scout");
|
|
await box.fill(GATED_PROMPT);
|
|
await box.press("Enter");
|
|
// Intercepted + previewed: the approval card shows the EXACT payload.
|
|
const card = page.getByRole("region", { name: "Review and approve" });
|
|
await expect(card).toBeVisible();
|
|
await expect(card.getByText(/wants to:/)).toContainText(
|
|
"Send email to [email protected]",
|
|
);
|
|
await expect(card).toContainText("Revenue is up 14% quarter over quarter.");
|
|
return card;
|
|
}
|
|
|
|
test("gated email blocks, previews, and executes only after approval", async ({
|
|
page,
|
|
}) => {
|
|
await signIn(page);
|
|
await openFreshScoutSession(page);
|
|
const card = await triggerGatedEmail(page);
|
|
|
|
await card.getByRole("button", { name: "Approve" }).click();
|
|
|
|
// The continuation streams the approved execution.
|
|
await expect(page.getByText(/The email step is finished/)).toBeVisible();
|
|
const trace = page.getByRole("button", { name: /1 step/ });
|
|
await trace.click();
|
|
await expect(page.getByText(/✓ email\.send/)).toBeVisible();
|
|
await expect(page.getByText(/"queued": ?true/)).toBeVisible();
|
|
|
|
// The transcript and trace replay identically after reload (journal).
|
|
await page.reload();
|
|
await expect(page.getByText(/The email step is finished/)).toBeVisible();
|
|
await page.getByRole("button", { name: /1 step/ }).click();
|
|
await expect(page.getByText(/✓ email\.send/)).toBeVisible();
|
|
});
|
|
|
|
test("rejection executes nothing and the agent continues in-band", async ({
|
|
page,
|
|
}) => {
|
|
await signIn(page);
|
|
await openFreshScoutSession(page);
|
|
const card = await triggerGatedEmail(page);
|
|
|
|
await card.getByRole("button", { name: "Reject" }).click();
|
|
|
|
// The run completes; the step trace records the refusal, not an execution.
|
|
await expect(page.getByText(/The email step is finished/)).toBeVisible();
|
|
await page.getByRole("button", { name: /1 step/ }).click();
|
|
await expect(page.getByText(/✗ email\.send/)).toBeVisible();
|
|
await expect(page.getByText(/rejected/)).toBeVisible();
|
|
});
|
|
|
|
test("the approvals queue lists pending actions and decides them", async ({
|
|
page,
|
|
}) => {
|
|
await signIn(page);
|
|
await openFreshScoutSession(page);
|
|
await triggerGatedEmail(page);
|
|
|
|
// Queued: the global approvals page shows the same exact preview.
|
|
// Earlier sessions may have left pending approvals; decide them all.
|
|
await page.getByRole("link", { name: "Approvals" }).click();
|
|
await expect(page.getByText(/awaits? your review/)).toBeVisible();
|
|
const cards = page.getByRole("region", { name: "Review and approve" });
|
|
await expect(cards.first()).toContainText("Send email to [email protected]");
|
|
|
|
const total = await cards.count();
|
|
for (let remaining = total; remaining > 0; remaining--) {
|
|
await cards.first().getByRole("button", { name: "Approve" }).click();
|
|
// Wait for the refresh to apply before touching the next card.
|
|
await expect(cards).toHaveCount(remaining - 1);
|
|
}
|
|
await expect(page.getByText(/All clear/)).toBeVisible();
|
|
});
|