dev:web: browser end-to-end tests for the web UI - #2697
Open
acinader wants to merge 1 commit into
Open
Conversation
acinader
commented
Aug 23, 2026
simonmichael
added
A-WISH
acinader
force-pushed
the
web-e2e-tests
branch
3 times, most recently
from
August 23, 2026 22:14
5a0c787 to
bc23d8f
Compare
acinader
marked this pull request as ready for review
August 23, 2026 22:18
acinader
marked this pull request as draft
August 24, 2026 02:00
Owner
|
I'm nervous about using npm on a trusted machine these days. But that aside, this sounds great and I'll merge when it's ready. |
Contributor
Author
|
Very interesting. Hadn't considered. Will research. |
acinader
force-pushed
the
web-e2e-tests
branch
from
August 24, 2026 19:11
0def2d0 to
11c5497
Compare
Contributor
Author
|
Thanks for feedback @simonmichael Hardened. See 11c5497. |
acinader
marked this pull request as ready for review
August 24, 2026 21:48
acinader
marked this pull request as draft
August 24, 2026 21:57
These Playwright tests drive a browser to cover the parts of the web UI implemented client side in javascript: add form, autocomplete, date picker, keyboard shortcuts, sidebar state, and hash highlighting. This suite is a complement to the yesod-test suite. The security suite also confirms journal data renders as text and not markup. The suite is available for on demand use and is not part of stack build or stack test. CSRF tokens and restricting file access to the journal's own files need no browser, so this PR adds those tests to Hledger/Web/Test.hs, which already runs in CI. Each negative test there has a positive control posting the same request with a valid token. The suite runs with pnpm (>= 10) to reduce supply-chain exposure: pnpm does not run dependency install scripts by default, pnpm-workspace.yaml adds a 24h release-age gate, and pnpm-lock.yaml is committed with integrity hashes. The one dependency is @playwright/test. AI usage: Claude Opus 5, ~90k output tokens
acinader
force-pushed
the
web-e2e-tests
branch
from
August 24, 2026 22:18
9caaa10 to
ad056b0
Compare
acinader
marked this pull request as ready for review
August 24, 2026 22:19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See #200
Why
Hledger/Web/Test.hs(yesod-test) never runs JavaScript, so nothing currently covers the parts of the web UI that only exist in a browser: the add form's posting rows, autocomplete, the date picker, keyboard shortcuts, sidebar show/hide, scroll state, and hash highlighting.What is here
webui.spec.js— the current behavior of page startup, the add form, the edit form, search, keyboard shortcuts, and the sidebar. It includes a regression test for web: keep the account sidebar's scroll position when switching accounts #2651 (sidebar scroll position) and one forregister?...#N.security.spec.js— journal data (descriptions, account names) renders as text and not markup, including the data handed to the autocomplete's javascript.fixture.journaldeliberately carries html/javascript payloads for this. Only a browser can show that nothing executes.Hledger/Web/Test.hs— CSRF tokens and restricting file access to the journal's own files. These need no browser, so they belong here, where they already run in CI. Each negative test has a positive control posting the same request with a valid token; without one they pass whether or not the protection exists.24 browser tests, ~8s. 15 server tests, ~0.05s.
Notes / questions
test/e2etouchesstack buildorstack test; node is needed only to run that suite. TheTest.hsadditions are ordinarystack testtests.AI usage: Claude Fable 5, ~70k output tokens