test(cypress): consolidate component test suite - #105
Open
yahyafakhroji wants to merge 5 commits into
Open
Conversation
Contributor
🧪 Test Summary
|
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Contributor
🧪 Test Summary
|
yahyafakhroji
force-pushed
the
chore/consolidate-cypress-tests
branch
from
July 28, 2026 10:41
b2f70e7 to
8b8968c
Compare
yahyafakhroji
changed the title
Contributor
🧪 Test Summary
|
yahyafakhroji
force-pushed
the
chore/consolidate-cypress-tests
branch
from
July 31, 2026 08:16
8b8968c to
6db0704
Compare
Contributor
🧪 Test Summary
|
mattdjenkinson
previously approved these changes
Jul 31, 2026
Merge single-assertion tests into table-driven ones across routes, components, modules, and resources. Assertions are preserved; a few exact duplicates were removed after verifying each one repeats another test's call and expectation. Each row carries a label so a failure names the case that broke. Security-relevant guards remain standalone tests rather than table rows. A few specs were folded into siblings already covering the same production module, and a type-only spec was renamed out of the spec glob while staying type-checked.
Titles name the primary behaviour; per-row labels carry the specifics. Also restores one outcome table to its own test rather than a helper called from a sibling — assertions living in a plain function are only as alive as their call site.
Applies the same treatment to the specs that arrived with the usernameless passkey work. - passkey-discover: the five user-dependent failures become one table. They all assert the identical opaque 400, which IS the enumeration-parity contract — as separate tests it reads as coincidence rather than intent. Operator-facing audit reasons stay asserted per row. - discovery-loader and conditional-passkey-loader: the suppression lists become arming tables, each including the stale-entry row that must NOT suppress, so a row flipping state is the whole regression signal. - conditional-passkey-loader: the two hint-cookie cases are paired, since they suppress alike but treat the cookie oppositely — a hint naming a missing user is cleared, one naming a passkey-less user survives. - use-conditional-passkey-discovery: drops a test whose assertions the abort test already makes on an identical mount. Left standalone: the crafted-POST supersede guard and the INVALID_INPUT schema boundary in passkey-discover, and the cross-organization stale-entry regression guard in conditional-passkey-loader.
Applies the merges surviving an adversarial audit: each candidate was proposed, then independently challenged by a refutation pass and a security pass, and kept only if neither objected. Four proposals were rejected — mostly ones that would have faked shape-identity by quietly adding or dropping an assertion. Covers the passkey loaders and discovery action, the auth-action hooks, brand-logo, back-link, webauthn ceremony errors, a11y guard, accounts-row, signup default-org, setup guard, login-view, sso-callback, zitadel index and authorize logout. One deletion: conditional-passkey-loader's hintless baseline made a byte-identical call to discovery-loader's first test and asserted the same thing, which that test still asserts. Left standalone throughout: named regression guards, distinct attacks (crafted POST, enumeration, identity takeover, CSRF), the anti-forgery freshness gate, and any test asserting a different error contract than its neighbours.
Second audit pass over every remaining spec with two or more tests. Seven merges applied; each was proposed, then independently challenged on both correctness and security grounds, and kept only if neither objected. Covers env, legacy redirects, path builders, the SSO provider-error link, auth error messages and codes, and CSP frame-ancestors parsing. Left standalone: the device-code regression guard, the tamper-echo/XSS invariant on the error catalog, the catalog closure property, and the wildcard clickjacking footgun in frame-ancestors. Not applied: the sudo freshness merge, which an earlier survey marked do-not-touch as a re-auth boundary. The proposal was sound — it orders accept rows before reject rows so a fail-open regression cannot be masked — but it buys one test on a security gate, so the earlier decision stands. Also not applied: an accounts-loader-action merge proposed by the first audit. The second pass caught that those tests sit under a banner citing issue #99, making them a named regression guard.
yahyafakhroji
force-pushed
the
chore/consolidate-cypress-tests
branch
from
July 31, 2026 22:46
6db0704 to
33be581
Compare
Contributor
🧪 Test Summary
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the Cypress component test suite by merging single-assertion tests
into table-driven ones. Fewer reported tests, same coverage.
and expectation.
Security-relevant guards stay standalone so they fail in isolation: returnTo and
same-origin redirect validation, passkey management, session-ownership gates,
MFA lockout and escape-hatch routing, IdP link ownership, the OIDC silent-auth
gate, and input-validation rejections.
No production or test-harness code is touched.
Test plan