global-setup.ts TRUNCATEs four tables against whatever DB_* points at, with no
production guard — an operator with prod DB_* still exported could wipe lists/
list_items/list_shares/calendar_events. The README promised a DEV_AUTH_BYPASS
guardrail the code never enforced. Adds a fail-closed guard mirroring
apps/api/src/auth/devBypass.ts: hard NODE_ENV==='production' check first, then
require DEV_AUTH_BYPASS==='true' before opening any DB connection. README updated
with the test-process env requirement (run command + CI runner env).
Verified: guard throws without DEV_AUTH_BYPASS; full 58-test suite passes with it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Playwright transpiles specs without typechecking (esbuild), so layout.spec.ts ran
green while `tsc -p tsconfig.e2e.json` failed: page.evaluate(() => document...)
callbacks need the DOM lib, and styleHandle.evaluate((el) => el.remove()) typed el as
Node (no .remove()). Phase 8 CI runs the typecheck gate, so this would have broken CI.
Adds DOM/DOM.Iterable to the e2e tsconfig (also covers 07-04 specs) and casts el to Element.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Replace ISO 8601 'T' separator with space in dtstart_utc value
- MariaDB TIMESTAMP requires 'YYYY-MM-DD HH:MM:SS', not 'YYYY-MM-DDTHH:MM:SSZ'
- Was causing 'Incorrect datetime value' error blocking all e2e harness runs
- Documents pnpm test:e2e run commands and single-profile / headed variants
- Documents DEV_AUTH_BYPASS=true must be set before API starts (Pitfall 5)
- States production compose MUST NOT set DEV_AUTH_BYPASS (Elevation of Privilege)
- Lists PLAYWRIGHT_BASE_URL and DB_* env vars (all credentials env-only, never hardcoded)
- States no storageState file is used (D-01 — no expiring session cookie)
- Describes globalSetup readiness gate + seed anchors (Milk/Eggs/Seeded Test Event)
- Notes Phase 8 CI scope and --with-deps WebKit requirement
- Two projects: iphone/WebKit (iPhone 14) + pixel/Chromium (Pixel 7)
- serviceWorkers: 'block' on both profiles per D-02/Pitfall 15
- env-driven baseURL via PLAYWRIGHT_BASE_URL (D-08/Rule 8)
- globalSetup ref to e2e/global-setup.ts (Plan 02 implements)
- webServer manages vite only with reuseExistingServer (D-10)
- no storageState, no toHaveScreenshot per D-01/UI-SPEC Rule 6
- add e2e/global-setup.ts placeholder (stub) so config path resolves
