fix(security): reject soft-deleted users in cortex verifyUserSiteAccess #143
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: playwright e2e | |
| on: | |
| pull_request: | |
| paths: | |
| - 'web/**' | |
| - 'firestore.rules' | |
| - 'firebase.json' | |
| - '.github/workflows/e2e.yml' | |
| push: | |
| branches: [main, dev] | |
| paths: | |
| - 'web/**' | |
| - 'firestore.rules' | |
| - 'firebase.json' | |
| - '.github/workflows/e2e.yml' | |
| concurrency: | |
| group: e2e-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| playwright: | |
| name: run suite against firebase emulators | |
| runs-on: ubuntu-latest | |
| # Local steady-state is ~45s after the first build. CI has cold caches | |
| # on first run plus a pre-build step (next start requires a built .next | |
| # dir) — 15 minutes gives a comfortable ceiling for the target | |
| # <6 min wall-clock once caches warm. | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: '20' | |
| cache: npm | |
| cache-dependency-path: web/package-lock.json | |
| # Temurin JDK 21 for Firebase emulators (Firestore emulator is a Java | |
| # binary). The `java` on the stock Ubuntu runner is fine, but pinning | |
| # to JDK 21 matches the local-dev setup documented in context.md. | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: '21' | |
| # Cache the Playwright browser binaries keyed on the @playwright/test | |
| # version pinned in web/package-lock.json. Cache miss on a Playwright | |
| # upgrade is the right behavior — forces a fresh `playwright install`. | |
| # Read from package.json (no node_modules required) so this step can | |
| # safely run before npm ci. | |
| - name: resolve playwright version | |
| id: pw | |
| working-directory: web | |
| run: | | |
| version=$(node -p "require('./package.json').devDependencies['@playwright/test']" | tr -d '^~') | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| - name: cache playwright browsers | |
| id: pw-cache | |
| uses: actions/cache@v5 | |
| with: | |
| path: ~/.cache/ms-playwright | |
| key: playwright-${{ runner.os }}-${{ steps.pw.outputs.version }} | |
| - name: install web deps | |
| working-directory: web | |
| run: npm ci --legacy-peer-deps | |
| - name: install playwright chromium | |
| if: steps.pw-cache.outputs.cache-hit != 'true' | |
| working-directory: web | |
| run: npx playwright install --with-deps chromium | |
| # `npm run e2e` does the production build then spins up emulators | |
| # (firebase emulators:exec) wrapping `npx playwright test`. The exec | |
| # wrapper guarantees teardown even on a crashed test run — critical | |
| # for CI where lingering emulator processes would block reruns. | |
| - name: install firebase-tools | |
| run: npm i -g firebase-tools@13 | |
| - name: run e2e suite | |
| working-directory: web | |
| env: | |
| CI: 'true' | |
| # sessionManager.server.ts requires SESSION_SECRET ≥32 chars at | |
| # module-load. The e2e suite runs against the Firestore/Auth | |
| # emulators — no real sessions, so a fixed deterministic value | |
| # is fine here. NOT a secret: the emulator doesn't validate it | |
| # against anything external. | |
| SESSION_SECRET: 'ci-e2e-emulator-session-secret-do-not-reuse-in-prod' | |
| run: npm run e2e | |
| # Upload the Playwright HTML report + traces / screenshots / videos on | |
| # failure. `outputDir` in playwright.config.ts places everything under | |
| # e2e/.output/; that whole tree is the post-mortem surface. | |
| - name: upload playwright report | |
| if: failure() || cancelled() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: playwright-report | |
| path: web/e2e/.output/ | |
| retention-days: 14 |