🧪 Auth Flow Testing

Comprehensive testing for the Jinja2 migration auth loop fix

📊 Log Level Control

Change logging verbosity for login.js and api-client.js

Current levels: LOGIN = 4, API = 3

Test 1: Clean Slate - Fresh Login Flow

Tests the complete login flow from scratch with no existing tokens.

Steps:
  1. Click "Clear All Data" below
  2. Click "Navigate to /admin"
  3. Observe browser behavior and console logs
  4. You should land on login page
✅ Expected Result:
  • Single redirect: /admin → /admin/login
  • Login page loads with NO API calls to /admin/auth/me
  • No loops, no errors in console
  • Form is ready for input

Test 2: Successful Login

Tests that login works correctly and redirects to dashboard.

Steps:
  1. Ensure you're on /admin/login
  2. Enter valid admin credentials
  3. Click "Login"
  4. Observe redirect and dashboard load
✅ Expected Result:
  • Login API call succeeds (check Network tab)
  • Token stored in localStorage
  • Success message shows briefly
  • Redirect to /admin/dashboard after 500ms
  • Dashboard loads with stats and recent vendors

Test 3: Dashboard Refresh (Authenticated)

Tests that refreshing the dashboard works without redirect loops.

Steps:
  1. Complete Test 2 (login successfully)
  2. On dashboard, press F5 or click "Refresh Page"
  3. Observe page reload behavior
✅ Expected Result:
  • Dashboard reloads normally
  • No redirects to login
  • Stats and vendors load correctly
  • No console errors

Test 4: Expired Token Handling

Tests that expired tokens are handled gracefully with redirect to login.

Steps:
  1. Click "Set Expired Token"
  2. Click "Navigate to Dashboard"
  3. Observe authentication failure and redirect
✅ Expected Result:
  • Server detects expired token
  • Returns 401 Unauthorized
  • Browser redirects to /admin/login
  • Token is cleared from localStorage
  • No infinite loops

Test 5: Direct Dashboard Access (Unauthenticated)

Tests that accessing dashboard without token redirects to login.

Steps:
  1. Click "Clear All Data"
  2. Click "Navigate to Dashboard"
  3. Observe immediate redirect to login
✅ Expected Result:
  • Redirect from /admin/dashboard to /admin/login
  • No API calls attempted
  • Login page loads correctly

Test 6: Login Page with Valid Token

Tests what happens when user visits login page while already authenticated.

Steps:
  1. Login successfully (Test 2)
  2. Click "Go to Login Page" below
  3. Observe behavior
✅ Expected Result:
  • Login page loads
  • Existing token is cleared (init() clears it)
  • Form is displayed normally
  • NO redirect loops
  • NO API calls to validate token

🔍 Current Auth Status

Current URL: -
Has admin_token: -
Has admin_user: -
Token Preview: -
Username: -

⚠️ Important Notes