Add comprehensive Playwright E2E test coverage and testing documentation

[Copilot]

The repo had E2E coverage for only 3 flows (login, users, products). This adds tests for the remaining 8 page flows and full testing documentation.

New E2E tests (56 tests across 8 files)

• dashboard.e2e.test.js — stats cards, all dashboard sections, time range selector
• orders.e2e.test.js — table, search, filters, stats cards
• inventory.e2e.test.js — table, search, status filter, low stock toggle, refresh
• returns.e2e.test.js — table, headers, search, status filter, refresh
• reviews.e2e.test.js — table, search, filters, stats cards
• settings.e2e.test.js — profile, theme toggle, notification toggles, about section
• navigation.e2e.test.js — branding, URL routing, user info, root redirect, sign out
• not-found.e2e.test.js — 404 display, dashboard link, go back

Mock fixture changes

• mock-data.js — Added realistic data for orders, reviews, inventory, returns stats, and enriched dashboard stats (previously orders/reviews were empty arrays)
• api-mocks.js — Two routing bugs fixed:
  • /api/admin/orders/paged was matched by the single-order pattern /api/admin/orders/[\w-]+$ — added explicit match before the wildcard
  • /inventory route (no /api/ prefix) was intercepting page navigation — added resourceType === 'document' guard:

await page.route('**/inventory', async (route) => {
  if (route.request().resourceType() === 'document') return route.continue();
  // ... handle API request
});

Documentation (docs/testing/)

• user-flows.md — Step-by-step flows with expected behavior for all 11 feature areas
• test-guide.md — Prerequisites, install, run locally/headless/headed/UI mode, CI config, writing new tests, troubleshooting
• reviewer-checklist.md — PR review checklist for coverage, quality, mocks, docs

Total: 73 tests passing (17 existing + 56 new), all deterministic with mocked APIs, no backend required.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• fonts.googleapis.com
  • Triggering command: /home/REDACTED/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell /home/REDACTED/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell --disable-field-trial-config --disable-REDACTED-networking --disable-REDACTED-timer-throttling --disable-REDACTEDing-occluded-windows --disable-back-forward-cache --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-REDACTED-pages --disable-component-update --no-default-browser-check --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Transl (dns block)
  • Triggering command: /home/REDACTED/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell /home/REDACTED/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell --disable-field-trial-config --disable-REDACTED-networking --disable-REDACTED-timer-throttling --disable-REDACTEDing-occluded-windows --disable-back-forward-cache --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-REDACTED-pages --disable-component-update --no-default-browser-check --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Transl p/bin/git ame (dns block)
  • Triggering command: /home/REDACTED/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell /home/REDACTED/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell --disable-field-trial-config --disable-REDACTED-networking --disable-REDACTED-timer-throttling --disable-REDACTEDing-occluded-windows --disable-back-forward-cache --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-REDACTED-pages --disable-component-update --no-default-browser-check --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Transl rgo/bin/git ame (dns block)
• placehold.co
  • Triggering command: /home/REDACTED/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell /home/REDACTED/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell --disable-field-trial-config --disable-REDACTED-networking --disable-REDACTED-timer-throttling --disable-REDACTEDing-occluded-windows --disable-back-forward-cache --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-REDACTED-pages --disable-component-update --no-default-browser-check --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Transl (dns block)
  • Triggering command: /home/REDACTED/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell /home/REDACTED/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell --disable-field-trial-config --disable-REDACTED-networking --disable-REDACTED-timer-throttling --disable-REDACTEDing-occluded-windows --disable-back-forward-cache --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-REDACTED-pages --disable-component-update --no-default-browser-check --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Transl hrome-headless-shell-linux64/chrome-headless-shell (dns block)
  • Triggering command: /home/REDACTED/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell /home/REDACTED/.cache/ms-playwright/chromium_headless_shell-1208/chrome-headless-shell-linux64/chrome-headless-shell --disable-field-trial-config --disable-REDACTED-networking --disable-REDACTED-timer-throttling --disable-REDACTEDing-occluded-windows --disable-back-forward-cache --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-REDACTED-pages --disable-component-update --no-default-browser-check --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-features=AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Transl PartyStoragePart--disable-client-side-phishing-detection (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Implement Playwright E2E Tests and User Flow Documentation</issue_title>
<issue_description>## 🎯 Objective

Create end-to-end test coverage for the web application located in the ./src folder using Playwright.

The goal is to ensure that future development does not break existing functionality.

---

📌 Scope of Work

1️⃣ Identify and Document User Flows

• Analyze the application in ./src

• Identify all primary and secondary user flows

• Document each flow in Markdown

• Include:

  • Step-by-step user journey
  • Expected behavior at each step
  • Screenshots for key stages

• Store the documentation inside this repository (suggested location: /docs/testing or similar)

---

2️⃣ Create Playwright Test Scripts

• Implement end-to-end tests covering the documented user flows

• Follow best practices:

  • Use page object model (if applicable)
  • Keep tests readable and maintainable
  • Avoid hardcoded waits

• Organize tests clearly (e.g., /tests/e2e)

• Ensure tests are deterministic and CI-friendly

---

3️⃣ Documentation: How to Run Tests

Create a Markdown guide that includes:

• Prerequisites
• Installation steps
• How to run tests locally
• How to run in headless mode
• How to generate and view Playwright reports
• How to run in CI (if applicable)

---

4️⃣ Reviewer Checklist

Create a checklist for PR reviewers that includes:

• All major user flows are documented
• Screenshots are included and up to date
• All documented flows have corresponding Playwright tests
• Tests pass locally
• Tests pass in CI
• No flaky tests
• Documentation is clear and complete

---

✅ Definition of Done

• User flows fully documented with screenshots
• Playwright test suite implemented
• Test execution guide added
• Reviewer checklist included
• All tests passing</issue_description>

Comments on the Issue (you are @copilot in this section)

Custom agent used: Playwright Tester Mode
Testing mode for Playwright tests

• Fixes Implement Playwright E2E Tests and User Flow Documentation #1

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.