Sprilur → Tests Auth

Usuari no-admin bloquejat al backoffice

Editar
/

Prompt

- goal: An authenticated NON-admin user requesting /admin receives a 403 Forbidden (not a redirect to the login page) tier: stateful entry: url: /admin auth: user:regular preconditions: - desc: A verified, authenticated user whose is_admin = false existing_data_required: true steps: - { action: navigate, target: "Filament backoffice root", selector: 'url:/admin' } - { action: assert, target: "403 Forbidden page", note: "must be an HTTP 403, not /admin/login" } accept: - expect_status: 403 - expect_not_url: /admin/login notes: > REWRITTEN: the original flow logged in as admin, TOGGLED its own is_admin off, saved, then re-logged-in. That mutates the shared admin account on a shared test env and is fragile/destructive. Per project instructions ("For permission tests, use a non-admin verified user") this now just requires an existing non-admin user and asserts the 403. The panel enforces this via the 'admin' authMiddleware + User::canAccessPanel() { return (bool) $this->is_admin; }. existing_data_required: a non-admin verified user must be seeded.

Pla de Test 4 pag · 15 passos · 5 validacions

Pàgines a visitar

/login Main app login page with email/password form
/admin/users/1/edit Filament admin: edit user 1 (admin@sprilur.test) to disable is_admin toggle
/dashboard Frontend dashboard used to access the logout control
/admin Admin panel root – must return 403 Forbidden for an authenticated non-admin user, not redirect to /admin/login

Passos del test

Validacions

After first login the dashboard heading Mis proyectos is visible, confirming login succeeded h1
After clicking Guardar cambios, a Filament success notification is shown confirming the save [x-data*="notification"], [aria-live="polite"] [role="status"], .fi-notification
After second login the dashboard heading is visible, confirming the user can still authenticate as a non-admin h1
After navigating to /admin, the page body contains '403' – the user is shown a Forbidden error, not a login form. If redirected to /admin/login the body would contain 'Entre a su cuenta' instead. body
The Filament admin login form (textbox for email on /admin/login) is NOT present on the page, confirming no redirect to /admin/login occurred main h1:not(:has-text("Entre"))

Historial de validació 1 iteracions

#? FAIL

Detalls

Estat
active
Generació
none
Tipus
Playwright
Creat
03/06/2026 14:31

Tags

Tots els tags afegits

Cap tag assignat

Instruccions IA

Projecte

- **Locale coverage:** every public page and every key flow must be exercised in **both `/es` and `/eu`**; additionally verify the `/locale/{eu}` switch redirects back and persists in session. - **Default test account:** `admin@sprilur.test` / `password` (is_admin, verified, no 2FA) — use for `/admin` and authenticated frontend flows. For permission tests, use a **non-admin verified** user. - **Data conventions:** suffix any created test data (project `title`, document name, etc.) with a unique `uid` (timestamp/run id) to avoid collisions across runs. - **Mandatory assertions:** every form submission must assert the success outcome (redirect/toast) **and** the absence of validation errors; every navigation must assert the resulting **URL including its locale prefix**. - **Scope/priority:** auth + private project flows (login, create, evaluate, export) are **regression-critical** and get happy-path + key edge cases; public/buscador flows get happy path plus the "no guide type / no results / URL hydration" edges; backoffice gets representative CRUD smoke tests. - **Known seeded data to rely on:** - Guide types: **Urbanización** (`urbanization`), **Edificación** (`building`). - Typologies (urbanization): Residencial, Industrial, Terciario, Logístico, Equipamiento público, Mixto. (building): Edificio industrial, Edificio terciario. - Scopes (ámbito): **Proyecto**, **Obra**. - Chapters: GEN General, TRA Trabajos previos, PRE, VIA, AGU Agua, EST, ENE Energía, ZON, RES Residuos, EJE, MAN; (building) EDI Diseño del edificio, ENV. - Agents: Promotor, Proyectista, Constructor, Dirección facultativa, Administración pública, Empresa de mantenimiento. - Stages (Etapa): Planeamiento, Proyecto, Ejecución, Uso y mantenimiento, Fin de vida. - **Exports:** for PDF/CSV, assert the response/download headers (and CSV `;`/`,` formatting), not the binary contents.

Features Desat!

KPIs

Taxa d'èxit
20%
1r intent OK
0%
Iteracions totals
8
Temps total
177s
→ Validació
177s
Cost total
$0.9845
Tokens totals
934,975
Crides API
19
→ Cost/pas
$0.00c

Cost IA

Total
$0.9845
Generació
$0.3058
Execucions
$0.61c
Tokens totals
934,975
Crides API
19

Últimes Execucions

Cap execució encara.