// Playwright config skeleton for the OAuth2 WASM demo E2E (todo 31).
// The specs themselves land in todos 37/38; this file only pins the stack
// contract: browser base URL plus the self-signed-cert bypass the AS needs.
const { defineConfig } = require('@playwright/test');
const { STORAGE_STATE_PATH } = require('./helpers');

module.exports = defineConfig({
  // Specs live directly in e2e/ (todos 37/38: happy.spec.ts, negative.spec.ts).
  testDir: '.',
  // Serial: the single e2e user owns one TOTP secret and the AS rejects a
  // replayed code for 180s, so two concurrent logins burn each other's code
  // and trip the 5-failure lockout. One worker keeps logins sequential.
  workers: 1,
  // A login retry waits for the next 30s TOTP step before resubmitting, so a
  // test that hits a replayed code needs headroom past one step boundary.
  timeout: 120_000,
  use: {
    baseURL: 'http://127.0.0.1:3000',
    // The AS public listener is TLS-only with a throwaway self-signed dev
    // certificate, so the browser must bypass certificate errors.
    ignoreHTTPSErrors: true,
  },
  // One authenticated context per run: the setup project logs in a single
  // time and the negative project reuses that state, so the AS sees three
  // credential logins per run (setup, happy, logout-test) instead of one per
  // session-needing test. Contexts loaded from the file never write back,
  // so no test can invalidate the shared state for the others.
  projects: [
    { name: 'setup', testMatch: /auth\.setup\.ts/ },
    { name: 'happy', testMatch: /happy\.spec\.ts/, dependencies: ['setup'] },
    {
      name: 'negative',
      testMatch: /negative\.spec\.ts/,
      dependencies: ['setup'],
      use: { storageState: STORAGE_STATE_PATH },
    },
  ],
});