Integration tests : how to get a JWT on a user's behalf ?

[JesusTheHun]

I'm trying to test the integration of Ory into my backend.

I have a SPA that connects to a Node.js app and authenticate the users using OAuth2.
So I'm trying to mimic the users's flow. I'm not using something like Playwright on purpose, to completely isolate the tests over the backend.

// Step 1: Initiate login flow
const frontendClient = await getOryFrontendClient();
const loginFlowResponse = await frontendClient.createBrowserLoginFlow();
const loginFlowId = loginFlowResponse.data.id;

const loginFlowCookies = loginFlowResponse.headers['set-cookie'] ?? [];
const csrfTokenCookieHeader = loginFlowCookies.find((c) => c.startsWith('csrf_token_'));
invariant(csrfTokenCookieHeader);

const csrfSetterPart = csrfTokenCookieHeader.split(';')[0] as string;
const csrfToken = csrfSetterPart.split('=').slice(1).join('=') as string;

// Step 2: Simulate user login
const loginResponse = await fetch(
  `${appConfig.ORY_PROJECT_API_ENDPOINT}/self-service/login?flow=${loginFlowId}`,
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Cookie': loginFlowCookies.join(';'),
      'X-CSRF-Token': csrfToken,
    },
    credentials: 'include',
    body: JSON.stringify({
      method: 'password',
      password_identifier: email,
      password: password,
    }),
    redirect: 'manual',
  }
);

The fetch fails because of a CSRF issue.
I have a tunnel opened with : ory tunnel --dev --project <project_slug> --port 1000 and appConfig.ORY_PROJECT_API_ENDPOINT is set to http://localhost:1000.