stuff

e2e/admin-guard.spec.ts

@@ -0,0 +1,30 @@
+import { test, expect } from '@playwright/test'
+
+test.describe('admin page access control', () => {
+  test('admin page redirects or shows forbidden without auth', async ({ page }) => {
+    const criticalErrors: string[] = []
+    page.on('pageerror', err => {
+      if (err.message.includes('ReferenceError') || err.message.includes('SyntaxError')) {
+        criticalErrors.push(err.message)
+      }
+    })
+
+    await page.goto('/admin')
+    await page.waitForTimeout(2000)
+
+    // Should not crash
+    expect(criticalErrors).toHaveLength(0)
+
+    // Should either show forbidden/unauthorized message or redirect away
+    const url = page.url()
+    const content = await page.textContent('body')
+
+    // Valid outcomes: redirected to login/home, or shows forbidden
+    const isRedirected = !url.includes('/admin')
+    const showsForbidden = content?.match(/forbidden|unauthorized|not authorized|403|login/i) !== null
+    const isEmptyAdmin = content?.trim().length === 0 || content?.includes('Loading')
+
+    // At least one of these should be true
+    expect(isRedirected || showsForbidden || isEmptyAdmin).toBe(true)
+  })
+})