fix(e2e): auth helper — bypass CORS via server-side API call + inject localStorage

e2e/helpers/auth.ts

@@ -1,4 +1,4 @@
-import { Page, expect } from '@playwright/test';
+import { Page, request as playwrightRequest } from '@playwright/test';
 
 export const DEMO = {
   tenant: 'demo-isp',
@@ -6,34 +6,38 @@ export const DEMO = {
   password: 'Admin123!',
 };
 
-export async function login(page: Page, creds = DEMO) {
-  await page.goto('/login');
-  await page.waitForLoadState('networkidle');
-  
-  // Fill form — support both old (shadcn Label-based) and new (native) login pages
-  const tenantInput = page.locator('input[placeholder*="demo-isp"], input#tenantSlug').first();
-  await tenantInput.fill(creds.tenant);
-  
-  const emailInput = page.locator('input[type="email"]').first();
-  await emailInput.fill(creds.email);
-  
-  const passwordInput = page.locator('input[type="password"]').first();
-  await passwordInput.fill(creds.password);
-  
-  // Click submit
-  await page.click('button[type="submit"]');
-  
-  // Wait for either dashboard URL or navigation away from login
-  // Increase timeout to 15s to account for API latency
-  try {
-    await page.waitForURL(/\/(dashboard|clients|settings)/, { timeout: 15000 });
-  } catch {
-    // If URL hasn't changed, check if we're still on login with an error
-    const currentUrl = page.url();
-    if (currentUrl.includes('/login')) {
-      // Try clicking submit again (sometimes zustand hydration delays)
-      await page.click('button[type="submit"]');
-      await page.waitForURL(/\/(dashboard|clients|settings)/, { timeout: 15000 });
-    }
-  }
+// Use the public API URL — Node.js requests bypass browser CORS
+const API_URL = 'https://fiberops-api.juankibin.space';
+
+export async function loginViaAPI(creds = DEMO) {
+  const ctx = await playwrightRequest.newContext({ baseURL: API_URL });
+  const resp = await ctx.post('/api/v1/auth/login', {
+    data: { tenantSlug: creds.tenant, email: creds.email, password: creds.password },
+    headers: { 'Content-Type': 'application/json', 'x-tenant-slug': creds.tenant },
+  });
+  const data = await resp.json();
+  await ctx.dispose();
+  return data; // { accessToken, refreshToken, user }
+}
+
+export async function login(page: Page, creds = DEMO) {
+  // Step 1: Get token via Node.js HTTP — bypasses browser CORS entirely
+  const { accessToken, user } = await loginViaAPI(creds);
+
+  // Step 2: Inject zustand persist state into localStorage before navigation
+  await page.goto('/login');
+  await page.evaluate(
+    ({ token, tenant, u }) => {
+      // Zustand persist format: { state: {...}, version: 0 }
+      localStorage.setItem('fiberops_auth', JSON.stringify({
+        state: { accessToken: token, tenantSlug: tenant, user: u },
+        version: 0,
+      }));
+    },
+    { token: accessToken, tenant: creds.tenant, u: user }
+  );
+
+  // Step 3: Navigate to dashboard — auth guard reads localStorage and passes
+  await page.goto('/dashboard');
+  await page.waitForURL(/\/(dashboard|clients|settings)/, { timeout: 15000 });
 }