[PUI] Session authentication (#6970)

* Adjust backend cookie settings

* Allow CORS requests to /accounts/

* Refactor frontend code

- Remove API token functions
- Simplify cookie approach
- Add isLoggedIn method

* Adjust REST_AUTH settings

* Cleanup auth functions in auth.tsx

* Adjust CSRF_COOKIE_SAMESITE value

* Fix login request

* Prevent session auth on login view

- Existing (invalid) session token causes 403

* Refactor ApiImage

- Point to the right host
- Simplify code
- Now we use session cookies, so it *Just Works*

* Fix download for attachment table

- Now works with remote host

* Cleanup settings.py

* Refactor login / logout notifications

* Update API version

* Update src/frontend/src/components/items/AttachmentLink.tsx

Co-authored-by: Lukas <76838159+wolflu05@users.noreply.github.com>

* fix assert url

* Remove comment

* Add explicit page to logout user

* Change tests to first logout

* Prune dead code

* Adjust tests

* Cleanup

* Direct to login view

* Trying something

* Update CUI test

* Fix basic tests

* Refactoring

* Fix basic checks

* Fix for PUI command tests

* More test updates

* Add speciifc test for quick login

* More cleanup of playwright tests

* Add some missing icons

* Fix typo

* Ignore coverage report for playwright test

* Remove coveralls upload task

---------

Co-authored-by: Lukas <76838159+wolflu05@users.noreply.github.com>
Co-authored-by: Matthias Mair <code@mjmair.com>

src/frontend/tests/cui.spec.ts

@@ -4,11 +4,10 @@ import { classicUrl, user } from './defaults';
 
 test('CUI - Index', async ({ page }) => {
   await page.goto(`${classicUrl}/api/`);
-  await page.goto(`${classicUrl}/index/`);
-  await expect(page).toHaveTitle('InvenTree Demo Server | Sign In');
-  await expect(
-    page.getByRole('heading', { name: 'InvenTree Demo Server' })
-  ).toBeVisible();
+  await page.goto(`${classicUrl}/index/`, { timeout: 10000 });
+  console.log('Page title:', await page.title());
+  await expect(page).toHaveTitle(RegExp('^InvenTree.*Sign In$'));
+  await expect(page.getByRole('heading', { name: 'Sign In' })).toBeVisible();
 
   await page.getByLabel('username').fill(user.username);
   await page.getByLabel('password').fill(user.password);

src/frontend/tests/defaults.ts

@@ -1,6 +1,12 @@
 export const classicUrl = 'http://127.0.0.1:8000';
 
+export const baseUrl = `${classicUrl}/platform`;
+export const loginUrl = `${baseUrl}/login`;
+export const logoutUrl = `${baseUrl}/logout`;
+export const homeUrl = `${baseUrl}/home`;
+
 export const user = {
+  name: 'Ally Access',
   username: 'allaccess',
   password: 'nolimits'
 };

src/frontend/tests/login.ts

@@ -0,0 +1,37 @@
+import { expect } from './baseFixtures.js';
+import { baseUrl, loginUrl, logoutUrl, user } from './defaults';
+
+/*
+ * Perform form based login operation from the "login" URL
+ */
+export const doLogin = async (page, username?: string, password?: string) => {
+  username = username ?? user.username;
+  password = password ?? user.password;
+
+  await page.goto(logoutUrl);
+  await page.goto(loginUrl);
+  await expect(page).toHaveTitle(RegExp('^InvenTree.*$'));
+  await page.waitForURL('**/platform/login');
+  await page.getByLabel('username').fill(username);
+  await page.getByLabel('password').fill(password);
+  await page.getByRole('button', { name: 'Log in' }).click();
+  await page.waitForURL('**/platform/home');
+  await page.waitForTimeout(250);
+};
+
+/*
+ * Perform a quick login based on passing URL parameters
+ */
+export const doQuickLogin = async (
+  page,
+  username?: string,
+  password?: string
+) => {
+  username = username ?? user.username;
+  password = password ?? user.password;
+
+  // await page.goto(logoutUrl);
+  await page.goto(`${baseUrl}/login/?login=${username}&password=${password}`);
+  await page.waitForURL('**/platform/home');
+  await page.waitForTimeout(250);
+};

src/frontend/tests/pui_basic.spec.ts

@@ -1,28 +1,37 @@
 import { expect, test } from './baseFixtures.js';
-import { classicUrl, user } from './defaults.js';
+import { baseUrl, loginUrl, logoutUrl, user } from './defaults.js';
+import { doLogin, doQuickLogin } from './login.js';
 
-test('PUI - Basic test via django', async ({ page }) => {
-  await page.goto(`${classicUrl}/platform/`);
-  await expect(page).toHaveTitle('InvenTree Demo Server');
-  await page.waitForURL('**/platform/');
-  await page.getByLabel('username').fill(user.username);
-  await page.getByLabel('password').fill(user.password);
-  await page.getByRole('button', { name: 'Log in' }).click();
-  await page.waitForURL('**/platform/*');
-  await page.goto(`${classicUrl}/platform/`);
+test('PUI - Basic Login Test', async ({ page }) => {
+  await doLogin(page);
 
-  await expect(page).toHaveTitle('InvenTree Demo Server');
-});
+  // Check that the username is provided
+  await page.getByText(user.username);
 
-test('PUI - Basic test', async ({ page }) => {
-  await page.goto('./platform/');
-  await expect(page).toHaveTitle('InvenTree');
-  await page.waitForURL('**/platform/');
-  await page.getByLabel('username').fill(user.username);
-  await page.getByLabel('password').fill(user.password);
-  await page.getByRole('button', { name: 'Log in' }).click();
+  await expect(page).toHaveTitle(RegExp('^InvenTree'));
+
+  // Go to the dashboard
+  await page.goto(baseUrl);
   await page.waitForURL('**/platform');
-  await page.goto('./platform/');
 
-  await expect(page).toHaveTitle('InvenTree');
+  await page
+    .getByRole('heading', { name: `Welcome to your Dashboard, ${user.name}` })
+    .click();
+});
+
+test('PUI - Quick Login Test', async ({ page }) => {
+  await doQuickLogin(page);
+
+  // Check that the username is provided
+  await page.getByText(user.username);
+
+  await expect(page).toHaveTitle(RegExp('^InvenTree'));
+
+  // Go to the dashboard
+  await page.goto(baseUrl);
+  await page.waitForURL('**/platform');
+
+  await page
+    .getByRole('heading', { name: `Welcome to your Dashboard, ${user.name}` })
+    .click();
 });

src/frontend/tests/pui_command.spec.ts

@@ -1,26 +1,14 @@
-import { expect, systemKey, test } from './baseFixtures.js';
-import { user } from './defaults.js';
+import { systemKey, test } from './baseFixtures.js';
+import { baseUrl } from './defaults.js';
+import { doQuickLogin } from './login.js';
 
 test('PUI - Quick Command', async ({ page }) => {
-  await page.goto(
-    `./platform/login/?login=${user.username}&password=${user.password}`
-  );
-  await page.waitForURL('**/platform/*');
-  await page.goto('./platform/');
-
-  await expect(page).toHaveTitle('InvenTree');
-  await page.waitForURL('**/platform/');
-  await page
-    .getByRole('heading', { name: 'Welcome to your Dashboard,' })
-    .click();
-  await page.waitForTimeout(500);
+  await doQuickLogin(page);
 
   // Open Spotlight with Keyboard Shortcut
   await page.locator('body').press(`${systemKey}+k`);
   await page.waitForTimeout(200);
-  await page
-    .getByRole('button', { name: 'Dashboard Go to the InvenTree dashboard' })
-    .click();
+  await page.getByRole('tab', { name: 'Dashboard' }).click();
   await page
     .locator('div')
     .filter({ hasText: /^Dashboard$/ })
@@ -44,15 +32,8 @@ test('PUI - Quick Command', async ({ page }) => {
   await page.waitForURL('**/platform/dashboard');
 });
 
-test('PUI - Quick Command - no keys', async ({ page }) => {
-  await page.goto(
-    `./platform/login/?login=${user.username}&password=${user.password}`
-  );
-  await page.waitForURL('**/platform/*');
-  await page.goto('./platform/');
-
-  // wait for the page to load
-  await page.waitForTimeout(200);
+test('PUI - Quick Command - No Keys', async ({ page }) => {
+  await doQuickLogin(page);
 
   // Open Spotlight with Button
   await page.getByRole('button', { name: 'Open spotlight' }).click();
@@ -118,7 +99,7 @@ test('PUI - Quick Command - no keys', async ({ page }) => {
   await page.waitForURL('https://docs.inventree.org/**');
 
   // Test addition of new actions
-  await page.goto('./platform/playground');
+  await page.goto(`${baseUrl}/playground`);
   await page
     .locator('div')
     .filter({ hasText: /^Playground$/ })

src/frontend/tests/pui_general.spec.ts

@@ -1,17 +1,15 @@
-import { test } from './baseFixtures.js';
-import { adminuser, user } from './defaults.js';
+import { expect, test } from './baseFixtures.js';
+import { baseUrl } from './defaults.js';
+import { doQuickLogin } from './login.js';
 
 test('PUI - Parts', async ({ page }) => {
-  await page.goto(
-    `./platform/login/?login=${user.username}&password=${user.password}`
-  );
-  await page.waitForURL('**/platform/*');
-  await page.goto('./platform/home');
+  await doQuickLogin(page);
 
+  await page.goto(`${baseUrl}/home`);
   await page.getByRole('tab', { name: 'Parts' }).click();
-  await page.goto('./platform/part/');
+
   await page.waitForURL('**/platform/part/category/index/details');
-  await page.goto('./platform/part/category/index/parts');
+  await page.goto(`${baseUrl}/part/category/index/parts`);
   await page.getByText('1551ABK').click();
   await page.getByRole('tab', { name: 'Allocations' }).click();
   await page.getByRole('tab', { name: 'Used In' }).click();
@@ -36,12 +34,10 @@ test('PUI - Parts', async ({ page }) => {
 });
 
 test('PUI - Parts - Manufacturer Parts', async ({ page }) => {
-  await page.goto(
-    `./platform/login/?login=${user.username}&password=${user.password}`
-  );
-  await page.waitForURL('**/platform/*');
+  await doQuickLogin(page);
+
+  await page.goto(`${baseUrl}/part/84/manufacturers`);
 
-  await page.goto('./platform/part/84/manufacturers');
   await page.getByRole('tab', { name: 'Manufacturers' }).click();
   await page.getByText('Hammond Manufacturing').click();
   await page.getByRole('tab', { name: 'Parameters' }).click();
@@ -51,12 +47,10 @@ test('PUI - Parts - Manufacturer Parts', async ({ page }) => {
 });
 
 test('PUI - Parts - Supplier Parts', async ({ page }) => {
-  await page.goto(
-    `./platform/login/?login=${user.username}&password=${user.password}`
-  );
-  await page.waitForURL('**/platform/*');
+  await doQuickLogin(page);
+
+  await page.goto(`${baseUrl}/part/15/suppliers`);
 
-  await page.goto('./platform/part/15/suppliers');
   await page.getByRole('tab', { name: 'Suppliers' }).click();
   await page.getByRole('cell', { name: 'DIG-84670-SJI' }).click();
   await page.getByRole('tab', { name: 'Received Stock' }).click(); //
@@ -66,12 +60,10 @@ test('PUI - Parts - Supplier Parts', async ({ page }) => {
 });
 
 test('PUI - Sales', async ({ page }) => {
-  await page.goto(
-    `./platform/login/?login=${user.username}&password=${user.password}`
-  );
-  await page.waitForURL('**/platform/*');
+  await doQuickLogin(page);
+
+  await page.goto(`${baseUrl}/sales/`);
 
-  await page.goto('./platform/sales/');
   await page.waitForURL('**/platform/sales/**');
   await page.waitForURL('**/platform/sales/index/salesorders');
   await page.getByRole('tab', { name: 'Return Orders' }).click();
@@ -119,11 +111,7 @@ test('PUI - Sales', async ({ page }) => {
 });
 
 test('PUI - Scanning', async ({ page }) => {
-  await page.goto(
-    `./platform/login/?login=${user.username}&password=${user.password}`
-  );
-  await page.waitForURL('**/platform/*');
-  await page.goto('./platform/');
+  await doQuickLogin(page);
 
   await page.getByLabel('Homenav').click();
   await page.getByRole('button', { name: 'System Information' }).click();
@@ -144,11 +132,8 @@ test('PUI - Scanning', async ({ page }) => {
 });
 
 test('PUI - Admin', async ({ page }) => {
-  await page.goto(
-    `./platform/login/?login=${adminuser.username}&password=${adminuser.password}`
-  );
-  await page.waitForURL('**/platform/*');
-  await page.goto('./platform/');
+  // Note here we login with admin access
+  await doQuickLogin(page, 'admin', 'inventree');
 
   // User settings
   await page.getByRole('button', { name: 'admin' }).click();
@@ -197,11 +182,7 @@ test('PUI - Admin', async ({ page }) => {
 });
 
 test('PUI - Language / Color', async ({ page }) => {
-  await page.goto(
-    `./platform/login/?login=${user.username}&password=${user.password}`
-  );
-  await page.waitForURL('**/platform/*');
-  await page.goto('./platform/');
+  await doQuickLogin(page);
 
   await page.getByRole('button', { name: 'Ally Access' }).click();
   await page.getByRole('menuitem', { name: 'Logout' }).click();
@@ -235,12 +216,9 @@ test('PUI - Language / Color', async ({ page }) => {
 });
 
 test('PUI - Company', async ({ page }) => {
-  await page.goto(
-    `./platform/login/?login=${user.username}&password=${user.password}`
-  );
-  await page.waitForURL('**/platform/*');
+  await doQuickLogin(page);
 
-  await page.goto('./platform/company/1/details');
+  await page.goto(`${baseUrl}/company/1/details`);
   await page
     .locator('div')
     .filter({ hasText: /^DigiKey Electronics$/ })

src/frontend/tests/pui_stock.spec.ts

@@ -1,13 +1,11 @@
-import { test } from './baseFixtures.js';
-import { user } from './defaults.js';
+import { expect, test } from './baseFixtures.js';
+import { baseUrl, user } from './defaults.js';
+import { doQuickLogin } from './login.js';
 
 test('PUI - Stock', async ({ page }) => {
-  await page.goto(
-    `./platform/login/?login=${user.username}&password=${user.password}`
-  );
-  await page.waitForURL('**/platform/*');
+  await doQuickLogin(page);
 
-  await page.goto('./platform/stock');
+  await page.goto(`${baseUrl}/stock`);
   await page.waitForURL('**/platform/stock/location/index/details');
   await page.getByRole('tab', { name: 'Stock Items' }).click();
   await page.getByRole('cell', { name: '1551ABK' }).click();
@@ -21,11 +19,7 @@ test('PUI - Stock', async ({ page }) => {
 });
 
 test('PUI - Build', async ({ page }) => {
-  await page.goto(
-    `./platform/login/?login=${user.username}&password=${user.password}`
-  );
-  await page.waitForURL('**/platform/*');
-  await page.goto('./platform/');
+  await doQuickLogin(page);
 
   await page.getByRole('tab', { name: 'Build' }).click();
   await page.getByText('Widget Assembly Variant').click();
@@ -39,11 +33,7 @@ test('PUI - Build', async ({ page }) => {
 });
 
 test('PUI - Purchasing', async ({ page }) => {
-  await page.goto(
-    `./platform/login/?login=${user.username}&password=${user.password}`
-  );
-  await page.waitForURL('**/platform/*');
-  await page.goto('./platform/');
+  await doQuickLogin(page);
 
   await page.getByRole('tab', { name: 'Purchasing' }).click();
   await page.getByRole('cell', { name: 'PO0012' }).click();