From 4901bc878ba8109eff6148ed122cf4c326f82ac7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hartmut=20N=C3=B6renberg?= <hn@hartmut-noerenberg.com>
Date: Wed, 1 Apr 2026 20:57:14 +0200
Subject: [PATCH] fix(e2e): complete E2E_TEST_MODE isolation for session
 registry + rate limits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three related fixes to prevent E2E test runs from disrupting real user sessions:

1. auth.ts: skip active_sessions registration in E2E mode
   E2E logins now return early after setting token.sid without writing
   to active_sessions. Prevents test sessions from kicking real user
   sessions via the concurrent-session limit.

2. trpc/route.ts: skip active_sessions validation in E2E mode
   Pairs with (1): if registration is skipped, validation must be too,
   otherwise every storageState-based test gets a 401 "Session revoked".

3. docker-compose.yml: hardcode Docker-internal DATABASE_URL + E2E_TEST_MODE
   Previously ${DATABASE_URL:-postgres:5432} picked up the host's
   localhost:5433 override and passed it into the container, where
   localhost refers to the container itself — breaking db:migrate:deploy
   on container recreate. Now hardcoded to postgres:5432.
   Also adds E2E_TEST_MODE=true to the dev container environment.

Result: 21/21 dev-system E2E tests pass, test runs leave zero footprint
in active_sessions and rate limiter counters for real user accounts.
The timeline disruption caused by test sessions kicking the admin's
real browser session is also resolved.

Co-Authored-By: claude-flow <ruv@ruv.net>
---
 apps/web/src/app/api/trpc/[trpc]/route.ts | 4 +++-
 apps/web/src/server/auth.ts               | 6 ++++++
 docker-compose.yml                        | 8 +++++++-
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/apps/web/src/app/api/trpc/[trpc]/route.ts b/apps/web/src/app/api/trpc/[trpc]/route.ts
index b0b1779..1c9c1b0 100644
--- a/apps/web/src/app/api/trpc/[trpc]/route.ts
+++ b/apps/web/src/app/api/trpc/[trpc]/route.ts
@@ -26,7 +26,9 @@ const handler = async (req: NextRequest) => {
   // Validate active session registry on every authenticated request.
   // Sessions kicked by concurrent-session limits or manual logout are rejected immediately.
   // Fail-open: if the table doesn't exist yet (pending migration) the check is skipped.
-  if (session?.user) {
+  // In E2E test mode the jwt callback skips registration, so skip validation too.
+  const isE2eTestMode = process.env["E2E_TEST_MODE"] === "true";
+  if (session?.user && !isE2eTestMode) {
     const jti = (session.user as typeof session.user & { jti?: string }).jti;
     if (jti) {
       try {
diff --git a/apps/web/src/server/auth.ts b/apps/web/src/server/auth.ts
index 53c33b0..68b95e7 100644
--- a/apps/web/src/server/auth.ts
+++ b/apps/web/src/server/auth.ts
@@ -170,6 +170,12 @@ const authConfig = {
         const jti = crypto.randomUUID();
         token.sid = jti;
 
+        // Skip active-session registration in E2E test mode.
+        // Test logins must not pollute the active_sessions table — doing so
+        // kicks real user sessions when the concurrent-session limit is reached.
+        const isE2eTestMode = process.env["E2E_TEST_MODE"] === "true";
+        if (isE2eTestMode) return token;
+
         // Enforce concurrent session limit (kick-oldest strategy)
         try {
           const settings = await prisma.systemSettings.findUnique({
diff --git a/docker-compose.yml b/docker-compose.yml
index 69b4481..09a2152 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -52,10 +52,16 @@ services:
     ports:
       - "3100:3100"
     environment:
-      DATABASE_URL: ${DATABASE_URL:-postgresql://capakraken:capakraken_dev@postgres:5432/capakraken}
+      # Always use the Docker-internal service name. The host-level DATABASE_URL
+      # (localhost:5433) must not bleed into the container where "localhost" is
+      # the container itself, not the host.
+      DATABASE_URL: postgresql://capakraken:capakraken_dev@postgres:5432/capakraken
       REDIS_URL: ${REDIS_URL:-redis://redis:6379}
       NEXTAUTH_URL: ${NEXTAUTH_URL:-http://localhost:3100}
       NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:?set NEXTAUTH_SECRET}
+      # Bypass auth + API rate limiters so E2E test runs don't exhaust
+      # per-user quotas and don't pollute active_sessions for real users.
+      E2E_TEST_MODE: "true"
     depends_on:
       postgres:
         condition: service_healthy