test(davinci-client): add polling e2e tests #634
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,178 @@ | ||||||
| /* | ||||||
| * Copyright (c) 2026 Ping Identity Corporation. All rights reserved. | ||||||
| * | ||||||
| * This software may be modified and distributed under the terms | ||||||
| * of the MIT license. See the LICENSE file for details. | ||||||
| */ | ||||||
| import { expect, test } from '@playwright/test'; | ||||||
| import { asyncEvents } from './utils/async-events.js'; | ||||||
|
|
||||||
| test.describe('Challenge Polling', () => { | ||||||
| test('should succeed when opening magic link', async ({ page, browser }) => { | ||||||
| const clientId = '31a587ce-9aa4-4f36-a09f-78cd8a0a74a0'; | ||||||
| const davinciPolicy = 'f40b544a4dfb575daa0cf5e9487c206a'; | ||||||
| const { navigate } = asyncEvents(page); | ||||||
| await navigate(`/?clientId=${clientId}&acr_values=${davinciPolicy}`); | ||||||
|
|
||||||
| await expect(page.url()).toBe( | ||||||
| `http://localhost:5829/?clientId=${clientId}&acr_values=${davinciPolicy}`, | ||||||
| ); | ||||||
|
|
||||||
| await page.getByRole('button', { name: 'Sign On' }).click(); | ||||||
| await expect(page.getByRole('heading', { name: 'Polling' })).toBeVisible(); | ||||||
|
|
||||||
| // Get magic link | ||||||
| const linkLocator = page.getByText('Number Challenge https://auth.pingone'); | ||||||
| await expect(linkLocator).toBeVisible(); | ||||||
|
|
||||||
| const linkLocatorText = await linkLocator.innerText(); | ||||||
| const magicLink = linkLocatorText.split('Number Challenge ')[1]; | ||||||
| expect(magicLink.startsWith('https://auth.pingone')); | ||||||
|
|
||||||
| // Start polling | ||||||
| await page.getByRole('button', { name: 'Start polling' }).click(); | ||||||
| await expect(page.getByText('Polling...')).toBeVisible(); | ||||||
|
|
||||||
| // Go to magic link in another browser to complete challenge | ||||||
| const newContext = await browser.newContext(); | ||||||
| const newPage = await newContext.newPage(); | ||||||
| await newPage.goto(magicLink); | ||||||
| await expect(newPage.getByText('Close me')).toBeVisible(); | ||||||
| await newContext.close(); | ||||||
|
|
||||||
| // Check for success | ||||||
| await expect(page.getByText('Message: approved')).toBeVisible(); | ||||||
| }); | ||||||
|
|
||||||
| test('should timeout when retries are exhausted', async ({ page }) => { | ||||||
| const clientId = '31a587ce-9aa4-4f36-a09f-78cd8a0a74a0'; | ||||||
| const davinciPolicy = 'f40b544a4dfb575daa0cf5e9487c206a'; | ||||||
| const { navigate } = asyncEvents(page); | ||||||
| await navigate(`/?clientId=${clientId}&acr_values=${davinciPolicy}`); | ||||||
|
|
||||||
| await expect(page.url()).toBe( | ||||||
| `http://localhost:5829/?clientId=${clientId}&acr_values=${davinciPolicy}`, | ||||||
| ); | ||||||
|
|
||||||
| await page.getByRole('button', { name: 'Sign On' }).click(); | ||||||
| await expect(page.getByRole('heading', { name: 'Polling' })).toBeVisible(); | ||||||
|
|
||||||
| // Track poll retries | ||||||
| let numPollRequests = 0; | ||||||
| page.on('request', (request) => { | ||||||
| const method = request.method(); | ||||||
| const requestUrl = request.url(); | ||||||
|
|
||||||
| if (method === 'POST' && requestUrl.includes('/status')) { | ||||||
| numPollRequests++; | ||||||
| } | ||||||
| }); | ||||||
|
|
||||||
| // Start polling | ||||||
| await page.getByRole('button', { name: 'Start polling' }).click(); | ||||||
| await expect(page.getByText('Polling...')).toBeVisible(); | ||||||
|
|
||||||
| // Wait for timeout | ||||||
| const pollInterval = 2000; // milliseconds | ||||||
| const maxRetries = 5; | ||||||
| await expect(page.getByText('Error: timedOut')).toBeVisible({ | ||||||
| timeout: 2 * pollInterval * maxRetries, | ||||||
| }); | ||||||
|
|
||||||
| // Check max retry count | ||||||
| expect(numPollRequests === maxRetries); | ||||||
|
There was a problem hiding this comment. Incorrect assertion - test will always pass. The assertion 🐛 Proposed fix // Check max retry count
- expect(numPollRequests === maxRetries);
+ expect(numPollRequests).toBe(maxRetries);📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||
| }); | ||||||
|
|
||||||
| test('should return expired status after challenge expires', async ({ page }) => { | ||||||
| const clientId = '31a587ce-9aa4-4f36-a09f-78cd8a0a74a0'; | ||||||
| const davinciPolicy = 'f40b544a4dfb575daa0cf5e9487c206a'; | ||||||
| const { navigate } = asyncEvents(page); | ||||||
| await navigate(`/?clientId=${clientId}&acr_values=${davinciPolicy}`); | ||||||
|
|
||||||
| await expect(page.url()).toBe( | ||||||
| `http://localhost:5829/?clientId=${clientId}&acr_values=${davinciPolicy}`, | ||||||
| ); | ||||||
|
|
||||||
| await page.getByRole('button', { name: 'Sign On' }).click(); | ||||||
| await expect(page.getByRole('heading', { name: 'Polling' })).toBeVisible(); | ||||||
|
|
||||||
| // Track poll retries | ||||||
| let numPollRequests = 0; | ||||||
| page.on('request', (request) => { | ||||||
| const method = request.method(); | ||||||
| const requestUrl = request.url(); | ||||||
|
|
||||||
| if (method === 'POST' && requestUrl.includes('/status')) { | ||||||
| numPollRequests++; | ||||||
| } | ||||||
| }); | ||||||
|
|
||||||
| // Wait for challenge to expire | ||||||
| const challengeExpiry = 15000; // milliseconds | ||||||
| await page.waitForTimeout(challengeExpiry + 5000); | ||||||
|
|
||||||
| // Start polling | ||||||
| await page.getByRole('button', { name: 'Start polling' }).click(); | ||||||
| await expect(page.getByText('Polling...')).toBeVisible(); | ||||||
|
|
||||||
| // Check for expired status | ||||||
| await expect(page.getByText('Error: expired')).toBeVisible(); | ||||||
|
|
||||||
| // Check poll count | ||||||
| expect(numPollRequests === 0); | ||||||
|
There was a problem hiding this comment. Incorrect assertion - test will always pass. Same issue as Line 83: 🐛 Proposed fix // Check poll count
- expect(numPollRequests === 0);
+ expect(numPollRequests).toBe(0);📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||
| }); | ||||||
| }); | ||||||
|
|
||||||
| test.describe('Continue Polling', () => { | ||||||
| test('should succeed on QR code scan simulation', async ({ page }) => { | ||||||
| const clientId = '31a587ce-9aa4-4f36-a09f-78cd8a0a74a0'; | ||||||
| const davinciPolicy = '27aacf0efcc480dfcd00b04be8023cdc'; | ||||||
| const { navigate } = asyncEvents(page); | ||||||
| await navigate(`/?clientId=${clientId}&acr_values=${davinciPolicy}`); | ||||||
|
|
||||||
| await expect(page.url()).toBe( | ||||||
| `http://localhost:5829/?clientId=${clientId}&acr_values=${davinciPolicy}`, | ||||||
| ); | ||||||
|
|
||||||
| await expect(page.getByRole('heading', { name: 'Select Continue Polling Test' })).toBeVisible(); | ||||||
| await page.getByRole('button', { name: 'Success' }).click(); | ||||||
| await expect(page.getByRole('heading', { name: 'Polling' })).toBeVisible(); | ||||||
|
|
||||||
| // Start polling | ||||||
| const numberCounterSuccess = 2; | ||||||
| for (let i = 0; i < numberCounterSuccess; i++) { | ||||||
| await page.getByRole('button', { name: 'Start polling' }).click(); | ||||||
| await expect(page.getByText('Polling...')).toBeVisible(); | ||||||
| await expect(page.getByRole('button', { name: 'Start polling' })).toBeDisabled(); | ||||||
| } | ||||||
|
|
||||||
| // Check for success | ||||||
| await expect(page.getByText('Message: Done')).toBeVisible(); | ||||||
| }); | ||||||
|
|
||||||
| test('should timeout when retries are exhausted', async ({ page }) => { | ||||||
| const clientId = '31a587ce-9aa4-4f36-a09f-78cd8a0a74a0'; | ||||||
| const davinciPolicy = '27aacf0efcc480dfcd00b04be8023cdc'; | ||||||
| const { navigate } = asyncEvents(page); | ||||||
| await navigate(`/?clientId=${clientId}&acr_values=${davinciPolicy}`); | ||||||
|
|
||||||
| await expect(page.url()).toBe( | ||||||
| `http://localhost:5829/?clientId=${clientId}&acr_values=${davinciPolicy}`, | ||||||
| ); | ||||||
|
|
||||||
| await expect(page.getByRole('heading', { name: 'Select Continue Polling Test' })).toBeVisible(); | ||||||
| await page.getByRole('button', { name: 'Timeout' }).click(); | ||||||
| await expect(page.getByRole('heading', { name: 'Polling' })).toBeVisible(); | ||||||
|
|
||||||
| // Start polling | ||||||
| const maxRetries = 3; | ||||||
| for (let i = 0; i < maxRetries + 1; i++) { | ||||||
| await page.getByRole('button', { name: 'Start polling' }).click(); | ||||||
| await expect(page.getByText('Polling...')).toBeVisible(); | ||||||
| await expect(page.getByRole('button', { name: 'Start polling' })).toBeDisabled(); | ||||||
| } | ||||||
|
|
||||||
| // Check for timeout | ||||||
| await expect(page.getByText('Error: timedOut')).toBeVisible(); | ||||||
| }); | ||||||
| }); | ||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Potential XSS vulnerability and unnecessary DOM element creation.
Two concerns:
XSS Risk: The error message is inserted via
innerHTMLwithout sanitization. IfdavinciClient.getError()?.messagecan contain user-controlled input, this creates an XSS vulnerability.Empty Element: The
errorDivis always appended to the DOM (Line 194) but only populated whenstatus === 'error'(Line 195). This leaves an emptydiv#error-divin the DOM for non-error states.🔒 Proposed fix to address both concerns
This fix:
textContentinstead ofinnerHTMLto prevent XSS🧰 Tools
🪛 ast-grep (0.42.2)
[warning] 196-198: Direct modification of innerHTML or outerHTML properties detected. Modifying these properties with unsanitized user input can lead to XSS vulnerabilities. Use safe alternatives or sanitize content first.
Context: errorDiv.innerHTML =
<p><strong>Error</strong>: ${davinciClient.getError()?.message}</p>Note: [CWE-79] Improper Neutralization of Input During Web Page Generation [REFERENCES]
- https://owasp.org/www-community/xss-filter-evasion-cheatsheet
- https://cwe.mitre.org/data/definitions/79.html
(dom-content-modification)
[warning] 196-198: Direct HTML content assignment detected. Modifying innerHTML, outerHTML, or using document.write with unsanitized content can lead to XSS vulnerabilities. Use secure alternatives like textContent or sanitize HTML with libraries like DOMPurify.
Context: errorDiv.innerHTML =
<p><strong>Error</strong>: ${davinciClient.getError()?.message}</p>Note: [CWE-79] Improper Neutralization of Input During Web Page Generation [REFERENCES]
- https://www.dhairyashah.dev/posts/why-innerhtml-is-a-bad-idea-and-how-to-avoid-it/
- https://cwe.mitre.org/data/definitions/79.html
(unsafe-html-content-assignment)
🤖 Prompt for AI Agents