Cognito-backed UI login bypass for Playwright integration tests.
The standard SPA login flow takes ~5–10s per test (form fill + Cognito round-trip + token exchange + JS app reinit). For a 10-test suite that's over a minute of pure overhead.
This namespace replaces it with:
AdminInitiateAuth from the JVM (1 HTTPS round-trip).localStorage.auth on the Playwright page with the resulting
token bundle, in the exact shape the SPA writes after a successful
login (see edd-core-web login widget core.cljs:181-187).localStorage.auth and dispatches ::login-succeeded if a non-empty
:id-token is found, so the SPA is fully authenticated by the time
the first page renders — no login form ever appears.This is a pure bypass: tokens are real Cognito tokens, every backend call uses normal JWT auth. Only the UI form is skipped.
Requires:
ADMIN_NO_SRP_AUTH enabled on the user-pool client (samurai's is).Cognito-backed UI login bypass for Playwright integration tests.
The standard SPA login flow takes ~5–10s per test (form fill + Cognito
round-trip + token exchange + JS app reinit). For a 10-test suite that's
over a minute of pure overhead.
This namespace replaces it with:
1. Call Cognito `AdminInitiateAuth` from the JVM (1 HTTPS round-trip).
2. Seed `localStorage.auth` on the Playwright page with the resulting
token bundle, in the exact shape the SPA writes after a successful
login (see edd-core-web login widget core.cljs:181-187).
3. Navigate to the SPA. The login widget's startup code reads
`localStorage.auth` and dispatches `::login-succeeded` if a non-empty
`:id-token` is found, so the SPA is fully authenticated by the time
the first page renders — no login form ever appears.
This is a pure bypass: tokens are real Cognito tokens, every backend
call uses normal JWT auth. Only the UI form is skipped.
Requires:
- The SPA must be using a version of edd-core-web's login widget that
restores from localStorage on init (web/widgets/login/core.cljs/init
calling restore-stored-auth!).
- AWS credentials available to the JVM (env vars / SSO / instance profile).
- The IAM principal must have cognito-idp:AdminInitiateAuth on the pool.
- `ADMIN_NO_SRP_AUTH` enabled on the user-pool client (samurai's is).(cognito-tokens {:keys [region user-pool-id user-pool-client-id]
:as _cognito-config}
username
password)Authenticate username/password against the given Cognito user-pool
via ADMIN_NO_SRP_AUTH and return a map shaped exactly like the SPA's
localStorage.auth blob:
{:id-token "..." :access-token "..." :refresh-token "..."}
Throws if authentication fails or if Cognito returns a challenge (e.g. NEW_PASSWORD_REQUIRED) — challenges are not handled here because the admin user used by tests must be in a fully-confirmed state.
Required keys in cognito-config:
:region AWS region of the user-pool, e.g. "eu-central-1"
:user-pool-id e.g. "eu-central-1_aBcDeFgHi"
:user-pool-client-id Cognito app client id
Pure JVM call — no Playwright involvement.
Authenticate `username`/`password` against the given Cognito user-pool
via ADMIN_NO_SRP_AUTH and return a map shaped exactly like the SPA's
`localStorage.auth` blob:
{:id-token "..." :access-token "..." :refresh-token "..."}
Throws if authentication fails or if Cognito returns a challenge (e.g.
NEW_PASSWORD_REQUIRED) — challenges are not handled here because the
admin user used by tests must be in a fully-confirmed state.
Required keys in `cognito-config`:
:region AWS region of the user-pool, e.g. "eu-central-1"
:user-pool-id e.g. "eu-central-1_aBcDeFgHi"
:user-pool-client-id Cognito app client id
Pure JVM call — no Playwright involvement.(login! base-url cognito-config username password)End-to-end UI login bypass: authenticate against Cognito, seed
localStorage.auth on the active page, and navigate to base-url.
On return, the SPA is fully logged in and the first page has loaded.
Reads the page from testing.pw/*current-page*, so call this from
inside with-ui exactly like every other helper.
cognito-config shape — see cognito-tokens.
Wrapped in a step so the trace shows a single collapsible
'Cognito login' entry instead of an opaque pause.
End-to-end UI login bypass: authenticate against Cognito, seed `localStorage.auth` on the active page, and navigate to `base-url`. On return, the SPA is fully logged in and the first page has loaded. Reads the page from `testing.pw/*current-page*`, so call this from inside `with-ui` exactly like every other helper. `cognito-config` shape — see `cognito-tokens`. Wrapped in a `step` so the trace shows a single collapsible 'Cognito login' entry instead of an opaque pause.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |