The e2e suite names its own origins, and refuses a live instance

`tests/utils/api.ts` took the API origin from `VITE_API_URL`, which
`tests/config.ts` loads out of `app/.env`. In a checkout configured for a
deployment that names the deployment — so the browser went to the local stack
while every setup and teardown call, `deleteAll` included, went to the live
one. `privateApi.ts` had the same reading, and it creates users.

Both origins now come from one place: `PLAYWRIGHT_BASE_URL`, with the API
derived from it (`app.<domain>` → `api.<domain>`) or named outright by
`PLAYWRIGHT_API_URL`, which is what CI and the compose service set. Nothing in
the suite reads `VITE_API_URL` any more.

Belt and braces, since a stack served under a real domain answers to the same
names its production instance does: a global setup resolves both origins and
refuses anything that is not loopback or a private range, before a test runs.
`PLAYWRIGHT_ALLOW_PUBLIC=1` says you meant it.

`make test-frontend` is now that safe run — the Playwright image on the proxy
network with both names mapped onto Traefik by address, as the host user so it
does not leave root-owned results behind.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NUb8YpL2s3gmN9WTACTt4q

This commit is contained in:

stroblme

2026-08-20 20:46:04 +02:00

co-authored by

Claude Opus 5

parent 406b6ac144

commit 41b2c28b2b

10 changed files with 142 additions and 12 deletions

									
										frontend/tests/utils/api.ts
									
		+2
		-1
	
												View File
												
				@@ -8,8 +8,9 @@ import type { Browser, Page } from "@playwright/test"

				 * database. What a spec leaves behind is in someone's flow list tomorrow.

				 */

				import { apiUrl } from "../config.ts"

				const authFile = "playwright/.auth/user.json"

				const apiUrl = process.env.VITE_API_URL || "http://api.localhost"

				/** Call the API as the logged-in user of *page*. */

				export async function api(