fix(integration): keep LXD login out of IdP input detection

Author: terion-labs

tests/integration/assertions/browser.test.ts

@@ -6,6 +6,7 @@ import {
   bodyContainsHttpErrorText,
   browserScreenshotPath,
   formatDeniedTargetRouteFailure,
+  isIdentityLoginInputPage,
   isRetryableBlankNavigationError,
   isLoginOrOauthCallbackPlumbingPath,
   isTargetApplicationPage,
@@ -41,6 +42,11 @@ describe("browser assertion helpers", () => {
     expect(isTargetLoginOrOauthPlumbingPage("https://app.example.test/oidc/login", "app.example.test")).toBe(true);
     expect(isTargetLoginOrOauthPlumbingPage("https://app.example.test/protected", "app.example.test")).toBe(false);
     expect(isTargetLoginOrOauthPlumbingPage("https://auth.example.test/ui/v2/login/password", "app.example.test")).toBe(false);
+
+    expect(isIdentityLoginInputPage("https://app.example.test/ui/login", "app.example.test")).toBe(false);
+    expect(isIdentityLoginInputPage("https://app.example.test/oidc/login", "app.example.test")).toBe(false);
+    expect(isIdentityLoginInputPage("https://auth.example.test/ui/v2/login/loginname?requestId=oidc_123", "app.example.test")).toBe(true);
+    expect(isIdentityLoginInputPage("https://app.example.test/protected", "app.example.test")).toBe(true);
   });
 
   test("makes browser artifact names distinct by URL, expectation, user, and outcome", () => {

tests/integration/assertions/browser.ts

@@ -164,7 +164,7 @@ async function clickOidcStartIfNeeded(page: Page, targetHost: string): Promise<v
   let lastStartClick = 0;
 
   while (Date.now() < deadline) {
-    if (await inputVisible(page, USERNAME_INPUT_SELECTORS)) {
+    if ((await inputVisible(page, USERNAME_INPUT_SELECTORS)) && isIdentityLoginInputPage(page.url(), targetHost)) {
       return;
     }
     const parsed = parseBrowserUrl(page.url());
@@ -232,7 +232,7 @@ async function clickOidcStartIfNeeded(page: Page, targetHost: string): Promise<v
 async function waitForOidcStartHandoff(page: Page, targetHost: string): Promise<void> {
   const deadline = Date.now() + BROWSER_OIDC_HANDOFF_TIMEOUT_MS;
   while (Date.now() < deadline) {
-    if (await inputVisible(page, USERNAME_INPUT_SELECTORS)) {
+    if ((await inputVisible(page, USERNAME_INPUT_SELECTORS)) && isIdentityLoginInputPage(page.url(), targetHost)) {
       return;
     }
 
@@ -258,7 +258,7 @@ async function waitForIdentityLoginDocument(page: Page, targetHost: string): Pro
     }
 
     await maybeWithTimeout(page.waitForLoadState("domcontentloaded", { timeout: 3000 }).catch(() => undefined), 4000);
-    if (await inputVisible(page, USERNAME_INPUT_SELECTORS)) {
+    if ((await inputVisible(page, USERNAME_INPUT_SELECTORS)) && isIdentityLoginInputPage(currentUrl, targetHost)) {
       return;
     }
 
@@ -1175,6 +1175,11 @@ export function isTargetLoginOrOauthPlumbingPage(currentUrl: string, targetHost:
   return Boolean(parsed && parsed.host === targetHost && isLoginOrOauthCallbackPlumbingPath(parsed.pathname));
 }
 
+export function isIdentityLoginInputPage(currentUrl: string, targetHost: string): boolean {
+  const parsed = parseBrowserUrl(currentUrl);
+  return Boolean(parsed && !(parsed.host === targetHost && isLoginOrOauthCallbackPlumbingPath(parsed.pathname)));
+}
+
 export function formatDeniedTargetRouteFailure(finalUrl: string, body: string): string {
   return [
     "expected denied protected route to show a denial page, but the browser reached the target host without denial text",