test: add badge interaction test + README; ignore disabled tests in Playwright config

tests/disabled/example.test.ts

@@ -0,0 +1,20 @@
+import { test, expect } from '@playwright/test';
+
+test('homepage has title and link', async ({ page }) => {
+    await page.goto('http://scott.localhost:5173/');
+    // await page.goto('https://dev-demo.oneskyit.com/');
+
+    // Expect a title "to contain" a substring.
+    await expect(page).toHaveTitle(/SvelteKit/);
+});
+
+test('get started link', async ({ page }) => {
+    await page.goto('http://scott.localhost:5173/');
+    // await page.goto('https://dev-demo.oneskyit.com/');
+
+    // Click the get started link.
+    await page.getByRole('link', { name: 'Docs' }).click();
+
+    // Expects page to have a heading with the name of Installation.
+    await expect(page.getByRole('heading', { name: 'Welcome' })).toBeVisible();
+});

tests/disabled/private_network_cdp.test.ts

@@ -0,0 +1,62 @@
+import { test, expect } from '@playwright/test';
+
+// This test attaches to the Chrome DevTools Protocol to capture low-level
+// network events (including those from service workers). Run this with the
+// real Chrome binary (channel: 'chrome') to reproduce the exact browser
+// behavior that shows the PNA prompt.
+
+test('CDP: detect private/local network requests and PNA preflights', async ({ page }) => {
+    const privateRequests: Array<any> = [];
+
+    function isPrivateHostname(hostname: string) {
+        if (!hostname) return false;
+        if (hostname === 'localhost' || hostname.endsWith('.localhost')) return true;
+        if (/^(127)\.|^(10)\.|^(192\.168)\.|^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(hostname)) return true;
+        return false;
+    }
+
+    // Create a CDP session for the page to listen to Network events
+    const client = await page.context().newCDPSession(page);
+    await client.send('Network.enable');
+
+    client.on('Network.requestWillBeSent', (params) => {
+        try {
+            const url = params.request.url;
+            const hostname = new URL(url).hostname;
+            const headers = params.request.headers || {};
+            const pna = headers['access-control-request-private-network'] === 'true' || headers['Access-Control-Request-Private-Network'] === 'true';
+
+            if (isPrivateHostname(hostname) || pna) {
+                privateRequests.push({
+                    url,
+                    method: params.request.method,
+                    initiator: params.initiator?.type,
+                    pnaPreflight: pna,
+                    headers
+                });
+            }
+        } catch (e) {}
+    });
+
+    // Also capture console messages to surface the same errors you see in Chrome.
+    const consoleMessages: string[] = [];
+    page.on('console', (msg) => {
+        consoleMessages.push(`${msg.type()}: ${msg.text()}`);
+    });
+
+    // Navigate to the site that triggers the behavior in your environment.
+    await page.goto('http://demo.localhost:5173/');
+    await page.waitForLoadState('networkidle');
+
+    if (privateRequests.length > 0) {
+        console.error('CDP detected private/local requests or PNA preflights:');
+        for (const r of privateRequests) console.error(JSON.stringify(r, null, 2));
+    }
+
+    if (consoleMessages.length) {
+        console.log('Captured console messages:');
+        consoleMessages.forEach((m) => console.log(m));
+    }
+
+    expect(privateRequests.length, 'No private/local network requests or PNA preflights should be made').toBe(0);
+});

tests/disabled/private_network_detection.test.ts

@@ -0,0 +1,62 @@
+import { test, expect } from '@playwright/test';
+
+// Detect requests to private/local address space or PNA preflight headers.
+test('detect private/local network requests and PNA preflights', async ({ page }) => {
+    const privateRequests: Array<any> = [];
+
+    function isPrivateHostname(hostname: string) {
+        if (!hostname) return false;
+        // hostnames that resolve to local addresses or explicitly localhost
+        if (hostname === 'localhost' || hostname.endsWith('.localhost')) return true;
+        // IPv4 private ranges
+        if (/^(127)\.|^(10)\.|^(192\.168)\.|^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(hostname)) return true;
+        return false;
+    }
+
+    page.on('request', (request) => {
+        try {
+            const url = new URL(request.url());
+            const headers = request.headers();
+            const hostname = url.hostname;
+
+            const pnaHeader = (headers['access-control-request-private-network'] || headers['Access-Control-Request-Private-Network']);
+
+            if (isPrivateHostname(hostname) || pnaHeader === 'true') {
+                privateRequests.push({
+                    url: request.url(),
+                    method: request.method(),
+                    resourceType: request.resourceType(),
+                    pnaPreflight: pnaHeader === 'true',
+                    headers
+                });
+            }
+        } catch (e) {
+            // ignore parse errors
+        }
+    });
+
+    page.on('requestfailed', (r) => {
+        // capture failed requests that might be private and blocked
+        try {
+            const url = new URL(r.url());
+            if (isPrivateHostname(url.hostname)) {
+                privateRequests.push({ url: r.url(), method: r.method(), failure: r.failure() });
+            }
+        } catch (e) {}
+    });
+
+    // Navigate to the dev site used in other tests.
+    await page.goto('http://demo.localhost:5173/');
+
+    // Wait for network to settle.
+    await page.waitForLoadState('networkidle');
+
+    if (privateRequests.length > 0) {
+        console.error('Detected private/local requests or PNA preflights:');
+        for (const r of privateRequests) {
+            console.error(JSON.stringify(r, null, 2));
+        }
+    }
+
+    expect(privateRequests.length, 'No private/local network requests or PNA preflights should be made').toBe(0);
+});

tests/disabled/v3_api_security.test.ts

@@ -0,0 +1,99 @@
+import { test, expect } from '@playwright/test';
+import { ae_app_local_data_defaults } from '../_helpers/ae_defaults';
+
+test.describe('V3 API Header Integrity', () => {
+	test.setTimeout(7000);
+
+	test.beforeEach(async ({ page }) => {
+		// Log browser console errors to the terminal for easier debugging.
+		page.on('pageerror', (err) => console.error(`BROWSER ERROR: ${err.message}`));
+		page.on('console', (msg) => {
+			if (msg.type() === 'error' || msg.type() === 'warn') {
+				console.error(`BROWSER [${msg.type().toUpperCase()}]: ${msg.text()}`);
+			}
+		});
+
+		// Mock all API requests to ensure tests are fast and independent of the network.
+		await page.route('**/*oneskyit.com/**', async (route) => {
+			const url = route.request().url();
+
+			// 1. Handshake Mock: Provide a complete response to allow the app to boot.
+			if (url.includes('site_domain/search')) {
+				return route.fulfill({
+					status: 200,
+					contentType: 'application/json',
+					body: JSON.stringify({
+						data: [
+							{
+								id: 'test-site-domain-id',
+								id_random: 'test-site-domain-id',
+								account_id: 'test-account-id',
+								site_id: 'test-site-id',
+								account_name: 'Test Account',
+								enable: '1',
+								cfg_json: {}
+							}
+						]
+					})
+				});
+			}
+			// 2. Default Mock: Provide a generic empty success response for all other API calls.
+			return route.fulfill({
+				status: 200,
+				contentType: 'application/json',
+				body: JSON.stringify({ data: [] })
+			});
+		});
+	});
+
+	test('Verify lookup requests include the unauthenticated bypass header', async ({ page }) => {
+		// Prepare the browser's localStorage with the necessary state for this test.
+		await page.addInitScript((defaults) => {
+			const testData = { ...defaults, account_id: 'test-account-id', manager_access: true };
+			window.localStorage.setItem('ae_loc', JSON.stringify(testData));
+		}, ae_app_local_data_defaults);
+
+		// Start waiting for the lookup request *before* navigating.
+		const requestPromise = page.waitForRequest((request) =>
+			request.url().includes('/v3/lookup/country/list')
+		);
+
+		// Navigate to the page that triggers the lookup.
+		await page.goto('/core/lookups');
+
+		// Wait for the request to be captured.
+		const request = await requestPromise;
+		const headers = request.headers();
+
+		// Assert that the correct bypass headers were used.
+		expect(headers['x-no-account-id']).toBe('Nothing to See Here');
+		expect(headers['x-aether-api-key']).toBeDefined();
+	});
+
+	test('Verify Account ID Scavenging from localStorage on CRUD requests', async ({ page }) => {
+		const testAccountId = 'scavenged-account-id-123';
+
+		// Prepare the browser's localStorage with a specific account ID.
+		await page.addInitScript(({ defaults, id }) => {
+			const testData = { ...defaults, account_id: id, manager_access: true };
+			window.localStorage.setItem('ae_loc', JSON.stringify(testData));
+		},{ defaults: ae_app_local_data_defaults, id: testAccountId });
+
+		// Start waiting for the CRUD request.
+		const requestPromise = page.waitForRequest((request) => {
+			const url = request.url();
+			// The /core/users page triggers a 'user' search on load.
+			return url.includes('/v3/crud/user/search');
+		});
+
+		// Navigate to a page that is guaranteed to make a standard CRUD call.
+		await page.goto('/core/users');
+
+		// Wait for the request to be captured.
+		const request = await requestPromise;
+		const headers = request.headers();
+
+		// Assert that the scavenged account ID was correctly included in the header.
+		expect(headers['x-account-id']).toBe(testAccountId);
+	});
+});