snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/tests/e2e/iframe-authentication.spec.ts

@@ -0,0 +1,140 @@
+import fs from 'fs';
+import path from 'path';
+
+import { Users } from './fixtures/userStates';
+import { Authenticated, Login } from './page-objects';
+import { test, expect } from './utils/test';
+
+const IFRAME_URL = 'http://iframe.rocket.chat';
+const API_URL = 'http://auth.rocket.chat/api/login';
+
+test.describe('iframe-authentication', () => {
+	let poLogin: Login;
+	let poAuth: Authenticated;
+
+	test.beforeAll(async ({ api }) => {
+		await api.post('/settings/Accounts_iframe_enabled', { value: true });
+		await api.post('/settings/Accounts_iframe_url', { value: IFRAME_URL });
+		await api.post('/settings/Accounts_Iframe_api_url', { value: API_URL });
+		await api.post('/settings/Accounts_Iframe_api_method', { value: 'POST' });
+	});
+
+	test.afterAll(async ({ api }) => {
+		await api.post('/settings/Accounts_iframe_enabled', { value: false });
+		await api.post('/settings/Accounts_iframe_url', { value: '' });
+		await api.post('/settings/Accounts_Iframe_api_url', { value: '' });
+		await api.post('/settings/Accounts_Iframe_api_method', { value: '' });
+	});
+
+	test.beforeEach(async ({ page }) => {
+		poLogin = new Login(page);
+		poAuth = new Authenticated(page);
+
+		await page.route(API_URL, async (route) => {
+			await route.fulfill({
+				status: 200,
+			});
+		});
+
+		const htmlContent = fs
+			.readFileSync(path.resolve(__dirname, 'fixtures/files/iframe-login.html'), 'utf-8')
+			.replace('REPLACE_WITH_TOKEN', Users.user1.data.loginToken);
+
+		await page.route(IFRAME_URL, async (route) => {
+			await route.fulfill({
+				status: 200,
+				contentType: 'text/html',
+				body: htmlContent,
+			});
+		});
+	});
+
+	test('should render iframe instead of login page', async () => {
+		await poLogin.goto('/home', poLogin.loginIframeForm);
+	});
+
+	test('should render iframe login page if API returns error', async ({ page }) => {
+		await page.route(API_URL, async (route) => {
+			await route.fulfill({
+				status: 500,
+			});
+		});
+
+		await poLogin.goto('/home', poLogin.loginIframeForm);
+	});
+
+	test('should login with token when API returns valid token', async ({ page }) => {
+		await page.route(API_URL, async (route) => {
+			await route.fulfill({
+				status: 200,
+				contentType: 'application/json',
+				body: JSON.stringify({ loginToken: Users.user1.data.loginToken }),
+			});
+		});
+
+		await poAuth.goto();
+	});
+
+	test('should show login page when API returns invalid token', async ({ page }) => {
+		await page.route(API_URL, async (route) => {
+			await route.fulfill({
+				status: 200,
+				contentType: 'application/json',
+				body: JSON.stringify({ loginToken: 'invalid-token' }),
+			});
+		});
+
+		await poLogin.goto('/home', poLogin.loginIframeForm);
+	});
+
+	test('should login through iframe', async () => {
+		await poLogin.goto('/home', poLogin.loginIframeForm);
+
+		await poLogin.loginIframeSubmitButton.click();
+
+		await poAuth.waitForDisplay();
+	});
+
+	test('should return error to iframe when login fails', async ({ page }) => {
+		const htmlContent = fs.readFileSync(path.resolve(__dirname, 'fixtures/files/iframe-login.html'), 'utf-8');
+
+		await page.route(IFRAME_URL, async (route) => {
+			await route.fulfill({
+				status: 200,
+				contentType: 'text/html',
+				body: htmlContent,
+			});
+		});
+
+		await poLogin.goto('/home', poLogin.loginIframeForm);
+
+		await poLogin.loginIframeSubmitButton.click();
+
+		await expect(poLogin.loginIframeError).toBeVisible();
+	});
+
+	test.describe('incomplete settings', () => {
+		test.beforeAll(async ({ api }) => {
+			await api.post('/settings/Accounts_Iframe_api_url', { value: '' });
+		});
+
+		test.afterAll(async ({ api }) => {
+			await api.post('/settings/Accounts_Iframe_api_url', { value: API_URL });
+		});
+
+		test('should render default login page, if settings are incomplete', async ({ page }) => {
+			const htmlContent = fs.readFileSync(path.resolve(__dirname, 'fixtures/files/iframe-login.html'), 'utf-8');
+
+			await page.route(IFRAME_URL, async (route) => {
+				await route.fulfill({
+					status: 200,
+					contentType: 'text/html',
+					body: htmlContent,
+				});
+			});
+
+			await poLogin.goto();
+			await expect(poLogin.loginIframeForm).not.toBeVisible();
+		});
+	});
+});