# Playwright E2E

These tests exercise the app through the Vite `/api` proxy and a running local
FastAPI server. They do not replace `/auth/me`, `/personas`, sessions, admin, or
review endpoints with Playwright route fixtures.

Required local services:

```sh
# apps/api
python -m uvicorn app.main:app --host 127.0.0.1 --port 8000

# apps/web, started automatically by Playwright unless already running
npm run dev -- --host 127.0.0.1 --port 5173
```

Useful overrides:

```sh
PLAYWRIGHT_PORT=5174 npm run e2e
PLAYWRIGHT_BASE_URL=http://localhost:5173 npm run e2e
VITE_API_BASE=http://127.0.0.1:8000 npm run e2e
```

Public Google OAuth `/turn` smoke:

```sh
# 1) Verify the public API is not accidentally serving the dev runtime.
$env:E2E_PUBLIC_AUTH="1"
npx playwright test e2e/public-auth-turn.spec.ts --project=chromium-public-auth --grep "production-safe"

# 2) Open a browser, sign in with an allowed Google account, then close codegen.
npx playwright codegen https://vignette.chanpaca.net/login --save-storage=./node_modules/.tmp/public-auth.json

# 3) Reuse that authenticated storage state for the public API turn smoke.
$env:E2E_PUBLIC_AUTH="1"
$env:E2E_PUBLIC_STORAGE_STATE="./node_modules/.tmp/public-auth.json"
npx playwright test e2e/public-auth-turn.spec.ts --project=chromium-public-auth
```

Notes:

- `E2E_PUBLIC_AUTH=1` targets the public site and does not start the local Vite web server.
- `public-auth.json` contains the HttpOnly API session cookie exported by Playwright. Treat it as sensitive and keep it under `node_modules/.tmp`.
- The API session TTL is currently 8 hours, so recapture storage state when the smoke begins returning `401`.

Install browser binaries once with:

```sh
npx playwright install chromium
```