Merge pull request #16 from precise-alloy/features/basic-auth

feat: basic auth

Author: tuyen-at-work

.engine_scripts/playwright/onBefore.js

@@ -1,4 +1,31 @@
 module.exports = async (page, scenario, viewport, isReference, browserContext) => {
+  if (scenario.basicAuth) {
+    const entries = (Array.isArray(scenario.basicAuth) ? scenario.basicAuth : [scenario.basicAuth]).filter(
+      (entry) => entry && entry.origin && entry.username && entry.password
+    );
+    const targetUrl = isReference && scenario.referenceUrl ? scenario.referenceUrl : scenario.url;
+    const targetOrigin = new URL(targetUrl).origin;
+    const match = entries.find((entry) => entry.origin === targetOrigin);
+
+    if (match) {
+      // Backstop creates the browser context before this hook runs. Set
+      // Playwright HTTP credentials on that fresh per-scenario context so the
+      // browser responds only to Basic-auth challenges for the configured
+      // origin, without broadcasting Authorization headers to subresources or
+      // redirects.
+      await browserContext.setHTTPCredentials({
+        origin: match.origin,
+        username: match.username,
+        password: match.password,
+      });
+    } else if (entries.length > 0) {
+      const configuredOrigins = entries.map((entry) => entry.origin).join(', ');
+      console.warn(
+        `No basicAuth entry matches scenario origin ${targetOrigin} (configured: ${configuredOrigins}); skipping Basic auth credentials for ${scenario.label}`
+      );
+    }
+  }
+
   if (scenario.bypassCsp) {
     const browser = browserContext.browser();
     const browserName = browser ? browser.browserType().name() : undefined;

common/regressify-schema.json

@@ -98,6 +98,9 @@
         },
         "requiredLogin": {
           "type": "boolean"
+        },
+        "basicAuth": {
+          "$ref": "#/definitions/BasicAuthConfig"
         }
       },
       "title": "WorkspaceConfig"
@@ -124,6 +127,43 @@
         "test"
       ],
       "title": "UrlReplacements"
+    },
+    "BasicAuthConfig": {
+      "description": "HTTP Basic Authentication credentials. Provide a single entry to protect one origin, or an array of entries to protect several origins; the entry matching the scenario's origin is selected at runtime.",
+      "oneOf": [
+        {
+          "$ref": "#/definitions/BasicAuth"
+        },
+        {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/BasicAuth"
+          }
+        }
+      ]
+    },
+    "BasicAuth": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "HTTP Basic Authentication credentials applied before navigation. Each value may reference an environment variable with ${VAR} or $VAR so secrets stay out of committed YAML. Origin must be the protected origin (scheme://host:port).",
+      "properties": {
+        "origin": {
+          "type": "string",
+          "description": "Protected origin (scheme://host:port). May contain ${VAR}/$VAR references (including embedded, e.g. https://${HOST}); it is expanded and normalized to an origin at runtime."
+        },
+        "username": {
+          "type": "string"
+        },
+        "password": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "origin",
+        "username",
+        "password"
+      ],
+      "title": "BasicAuth"
     }
   }
 }

common/test-schema.json

@@ -96,6 +96,9 @@
         },
         "ignoreSslErrors": {
           "type": "boolean"
+        },
+        "basicAuth": {
+          "$ref": "#/definitions/BasicAuthConfig"
         }
       },
       "required": [
@@ -259,6 +262,9 @@
         },
         "bypassCsp": {
           "type": "boolean"
+        },
+        "basicAuth": {
+          "$ref": "#/definitions/BasicAuthConfig"
         }
       },
       "required": [
@@ -291,6 +297,43 @@
       ],
       "title": "URL Replacements"
     },
+    "BasicAuthConfig": {
+      "description": "HTTP Basic Authentication credentials. Provide a single entry to protect one origin, or an array of entries to protect several origins; the entry matching the scenario's origin is selected at runtime.",
+      "oneOf": [
+        {
+          "$ref": "#/definitions/BasicAuth"
+        },
+        {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/BasicAuth"
+          }
+        }
+      ]
+    },
+    "BasicAuth": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "HTTP Basic Authentication credentials applied before navigation. Each value may reference an environment variable with ${VAR} or $VAR so secrets stay out of committed YAML. Origin must be the protected origin (scheme://host:port).",
+      "properties": {
+        "origin": {
+          "type": "string",
+          "description": "Protected origin (scheme://host:port). May contain ${VAR}/$VAR references (including embedded, e.g. https://${HOST}); it is expanded and normalized to an origin at runtime."
+        },
+        "username": {
+          "type": "string"
+        },
+        "password": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "origin",
+        "username",
+        "password"
+      ],
+      "title": "BasicAuth"
+    },
     "CheckAction": {
       "type": "object",
       "description": "Documentation: https://tuyen.blog/optimizely-cms/testing/create-action/#spoiler--check",