test(keycloak): cover the sign-in/sign-up redesign against its design

[saqibmanan]

Source

CivicDataLab/DataSpaceKeycloakTheme#28 (merged into dev as 34fa299), released to production by #29 (a695d9c, deployed 2026-09-25). Design reference: the sign-in / sign-up auth-flow prototype.

What changed in the product

#28 replaced the Login and Register pages and added custom Info, Error, LoginResetPassword, IdpReviewUserProfile, LoginIdpLinkConfirm(Override) and SignedIn pages, all with design copy ("Welcome back", "Reset your password", "Create your account", …), a password show/hide toggle, a new Google button, and a new footer.

What this adds

The existing auth-page tests only checked wiring (Google link, register link, privacy links, consent checkbox). They now check the design as well.

Passing today: 9 new tests, 16 in the file. These guard the redesign against regressions.

• Sign-in heading and subtitle, field labels and placeholders, Forgot / Create-account / Google copy and icon, "Back to Home" → the app, and the show/hide toggle.
• Google button hands off to accounts.google.com. It follows the redirect only and never signs in.
• Reset-password page copy.
• Register heading, subtitle, sign-in prompt and Google button, plus consent enforced in the browser (no document reload).
• Mobile (390px): no horizontal scroll.

Strict xfail: 12 tests, each linked to its issue. They assert the design where production doesn't match it yet. When a fix ships, the test XPASSes, strict=True turns that into a failure, and the marker has to come off.

Issue	Test
#32	error page titled "Google sign-in failed" for a bad redirect_uri / unknown client (2 tests)
#33	reset request doesn't show "Check your email"
#39	empty sign-in isn't validated inline; credential error copy (2 tests)
#40	email not carried over to reset; "Please specify username." (2 tests)
#41	no password checklist
#42	consent doesn't cover Terms & Conditions
#43	footer is missing Terms/Legal; no legal links on mobile (2 tests)
#44	register fields are email/firstName/lastName, not email/password/confirm. This replaces the old EXPECTED_REGISTER_FIELDS = (email, firstName, lastName) check, which asserted the opposite of the design.

Page objects gain a shared _KeycloakPage base (heading, subtitle, field errors, legal links, viewport, document-replaced check). Three helpers that were duplicated in both classes moved into it. New KeycloakResetPage and KeycloakErrorPage. The locators file has matching entries. No raw selectors in tests.

keycloak-tests.yml: the job summary now lists xfailed. The skip gate is unchanged: pytest-json-report counts xfails as xfailed, not skipped.

Why read-only, and why it's safe on production

Everything stays smoke + readonly, because the workflow runs this file against auth.civicdatalab.in after every theme deploy and every 6h. The only submissions are a failed sign-in and a reset request for a random @example.invalid address with no account, so Keycloak writes nothing and sends nothing. The register form is only submitted with consent unticked, which the theme blocks in the browser. functional/test_con_registration.py is untouched.

Proof (local, against production auth.civicdatalab.in)

Green:

======================= 16 passed, 12 xfailed in 57.32s ========================

xfails fail on the design assertion, not on a timeout (--runxfail):

147: AssertionError: An empty form was sent to the server instead of being checked in the browser.
156: AssertionError: assert ['Invalid use...or password.'] == ['Email or pa...s incorrect.']
172: AssertionError: assert '' == 'qa-no-accoun...ample.invalid'
177: AssertionError: assert 'Email is required.' in ['Please specify username.']
182: AssertionError: assert 'Welcome back' == 'Check your email'
223: AssertionError: Register form fields differ from the design. Missing ['password', 'password-confirm'], not in design ['firstName', 'lastName']. Present: ['email', 'firstName', 'lastName', 'termsAccepted']
230: AssertionError: No password field on the register form
238: AssertionError: I acknowledge the Privacy Policy.
245: AssertionError: assert 'Google sign-in failed' != 'Google sign-in failed'
250: AssertionError: assert 'Google sign-in failed' != 'Google sign-in failed'
256: AssertionError: assert ['Privacy'] == ['Privacy', 'Terms', 'Legal']
267: AssertionError: No Privacy/Terms/Legal link visible at 390px
12 failed, 16 deselected

Red: a throwaway copy with one expected value flipped per class (not committed):

line 92:  AssertionError: Continue with Google landed on 'accounts.google.com', not Google's sign-in. …
line 117: AssertionError: assert 'Welcome back' == 'Welcome back!'
line 140: AssertionError: assert ('text', 'Hide password') == ('password', 'Hide password')
line 165: AssertionError: assert 'Send Reset Link' == 'Send Link'
line 203: AssertionError: assert 'Create your account' == 'Create an account'
line 213: AssertionError: The form was posted to the server with consent unticked.
7 failed, 21 deselected

Gaps, not covered here

• Can't be reached read-only on production: docs: add status badges, including keycloak tests #31 (Info page dead end, which needs an admin-sent action email), chore: add the pr-test-sync skill as the single spec for test-coverage automation #34/pr-test-sync skill: auto-draft test coverage for merged PRs #35/Cover the footer Privacy link from DataSpaceFrontend#447 #36/Cover login idempotency from DataSpaceBackend#136 #37 (Google account linking, which needs a real Google identity), TC_HOM_02–09 have never run: a triple-quote hides them #38 (update-password and Terms pages, which need a reset link or required action). They need a disposable realm and are left for a separate change.
• functional/test_con_registration.py still fills first/last name and no password, matching today's realm. It has to change together with fix: sitemap tests were pagination-blind on dev #44.
• ParakhAI_test: no change needed. ParakhAI uses its own parakh realm, which isn't on this server, and its login selectors are generic fallbacks the new theme still matches.

Targets CI, the branch whose workflows run.

Closes #139