From a8fa66000928f327981e1c852769063bb2e711eb Mon Sep 17 00:00:00 2001
From: allaun <allaun@users.noreply.github.com>
Date: Mon, 29 Jun 2026 16:38:39 -0500
Subject: [PATCH] test(infra): add E2E Playwright verification spec for Chat
 SSO login

- Automate multi-step SSO login and NextAuth session activation for chat.researchstack.info
- Verify Caddy reverse proxy and forward auth configuration resolves ERR_TOO_MANY_REDIRECTS

Build: 0 jobs, 0 errors (lake build)
---
 4-Infrastructure/AGENTS.md                    |  1 +
 .../k3s-flake/tests/chat-verify.spec.ts       | 51 +++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 4-Infrastructure/k3s-flake/tests/chat-verify.spec.ts

diff --git a/4-Infrastructure/AGENTS.md b/4-Infrastructure/AGENTS.md
index 8485e608..e81c1853 100644
--- a/4-Infrastructure/AGENTS.md
+++ b/4-Infrastructure/AGENTS.md
@@ -369,6 +369,7 @@ python3 4-Infrastructure/storage/storage_agent.py --loop --interval 900
 - `4-Infrastructure/shim/rrc_bosonic_db_buffer.py` — Asynchronous database ingestion buffer: queues, batches, and flushes PostgreSQL inserts for bosonic tensor network receipts and metrics in thread-safe worker pools.
 - `4-Infrastructure/shim/pist_trace_classify_offline.py` — Offline, token-free trace classifier implementing Lean's `Semantics.PIST.Classify` color-space model and executing the local `rrc-watchdog` binary in the container.
 - `4-Infrastructure/shim/lake_build_ingest.py` — Pure-I/O shim that runs `lake build <target>` and ingests the result into `ene.sessions`, `ene.packages`, `ene.receipts`, and `ene.ingest_events` on the canonical neon-64gb Postgres (`arxiv-pg` container). No admissibility logic, no Float arithmetic.
+- `4-Infrastructure/k3s-flake/tests/chat-verify.spec.ts` — E2E Playwright verification spec for Chat (Hermes) SSO login.
 
 ## Canonical database locations
 
diff --git a/4-Infrastructure/k3s-flake/tests/chat-verify.spec.ts b/4-Infrastructure/k3s-flake/tests/chat-verify.spec.ts
new file mode 100644
index 00000000..1a4d39d1
--- /dev/null
+++ b/4-Infrastructure/k3s-flake/tests/chat-verify.spec.ts
@@ -0,0 +1,51 @@
+import { test, expect } from '@playwright/test';
+
+test('Verify Chat (Hermes) accessible via SSO', async ({ page }) => {
+  page.on('console', msg => console.log(`Browser Console [${msg.type()}]:`, msg.text()));
+  page.on('requestfailed', req => console.log('Request Failed:', req.url(), req.failure()?.errorText));
+  page.on('pageerror', err => console.log('Page Error:', err.message));
+
+  console.log('Navigating to Chat via domain...');
+  await page.goto('https://chat.researchstack.info/');
+  await page.waitForTimeout(5000);
+
+  console.log('Current URL:', page.url());
+
+  // Check if we are on the Authentik login page and need credentials
+  const usernameInput = page.locator('input[name="username"], input[type="text"]').first();
+  if (await usernameInput.isVisible({ timeout: 5000 }).catch(() => false)) {
+    console.log('Authentik login detected. Entering credentials...');
+    await usernameInput.fill('allaun');
+    
+    const submitUsername = page.locator('button[type="submit"], input[type="submit"]').first();
+    await submitUsername.click();
+    await page.waitForTimeout(3000);
+
+    const passwordInput = page.locator('input[name="password"], input[type="password"]').first();
+    await passwordInput.fill('Silverkitten14');
+
+    const submitPassword = page.locator('button[type="submit"], input[type="submit"]').first();
+    await submitPassword.click();
+    await page.waitForTimeout(8000);
+  }
+
+  // Handle consent screen if it appears
+  if (page.url().includes('consent') || page.url().includes('authorize') || page.url().includes('application/o/authorize')) {
+    console.log('Consent/Authorization screen detected. Clicking continue...');
+    const continueBtn = page.locator('button:has-text("Continue"), input[type="submit"], button[type="submit"]').first();
+    if (await continueBtn.isVisible({ timeout: 5000 }).catch(() => false)) {
+      await continueBtn.click();
+      await page.waitForTimeout(8000);
+    }
+  }
+
+  console.log('Final Page Title:', await page.title());
+  console.log('Final URL:', page.url());
+  await page.screenshot({ path: '/tmp/chat-verify-final.png' });
+  console.log('Page Content HTML:', await page.content());
+
+  // Assert that we have landed on the chat interface
+  // The page title should contain "Hermes" or similar
+  const title = await page.title();
+  expect(title.toLowerCase()).toContain('hermes');
+});