---
suite: webtest-ai-demo
app: webtest-ai-demo-console
baseUrl: http://127.0.0.1:4010
tags: [demo, local, webtest-ai]
auth:
  usernameEnv: WEBTEST_AI_DEMO_USERNAME
  passwordEnv: WEBTEST_AI_DEMO_PASSWORD
  mfaCodeEnv: WEBTEST_AI_DEMO_MFA_CODE
  validationPath: /api/session
browsers: [chromium]
---

# Public dashboard handles modern UI surfaces

tags: [public, smoke, ui]
priority: high
owner: qe-foundation

## Goal

Verify the branded WebTest AI demo console exercises modern anonymous UI surfaces.

## Steps

1. Open "/"
2. Assert text "WebTest AI Demo Console"
3. Assert text "Enterprise checkout matrix"
4. Assert text "Atlas Retail"
5. Assert text "Delayed row loaded"
6. Click role "button" named "Open command drawer"
7. Assert text "Command Center"
8. Click role "button" named "Close drawer"
9. Click role "button" named "Show release dialog"
10. Assert text "Release approval"
11. Click role "button" named "Approve release"
12. Assert text "Release approved"
13. Click role "tab" named "Performance"
14. Assert text "Vitals stream"
15. Click role "tab" named "Audit"
16. Assert text "Delayed audit row"
17. Assert text "Delayed loading complete"
18. Click role "button" named "Open command palette"
19. Assert text "Command palette"
20. Click role "button" named "Run selected command"
21. Assert text "Command executed"
22. Fill field "Assignee combobox" with "Demo"
23. Click role "option" named "Demo Operator"
24. Assert text "Assignee selected: Demo Operator"

## Expected

- The public console loads.
- Delayed table and audit data render.
- Drawer, dialog, toast, tabs, combobox, overlays, and delayed content behave correctly.

---

# New tab workspace flow is followed

tags: [public, popup, browser-context]
priority: high
owner: qe-foundation

## Goal

Verify WebTest AI follows a user action that opens a new browser tab.

## Steps

1. Open "/"
2. Click role "link" named "Open workspace tab"
3. Assert text "Popout Workspace"
4. Assert text "Popout ready"
5. Click role "button" named "Complete popout review"
6. Assert text "Popout review complete"

## Expected

- The runner detects the popup page.
- Later steps execute against the active new tab.

---

# Embedded iframe checkout flow is handled

tags: [public, iframe, embedded]
priority: high
owner: qe-foundation

## Goal

Verify WebTest AI can interact with an embedded iframe flow.

## Steps

1. Open "/"
2. Assert text "Embedded checkout frame"
3. Assert frame text "Embedded checkout verification"
4. Fill frame field "Approval note" with "Approved from parent spec"
5. Click frame role "button" named "Confirm embedded action"
6. Assert frame text "Embedded action confirmed"

## Expected

- The embedded checkout frame loads.
- WebTest AI fills and clicks inside the frame.
- The frame emits its async confirmation.

---

# Same-host login works without saving storage state

tags: [auth, same-host, no-save, serial]
priority: high
owner: qe-foundation
auth:
  mode: ui
  profile: webtest-ai-no-save
  saveStorageState: false

## Goal

Verify a same-host UI login can succeed without asking WebTest AI to save reusable storage state.

## Steps

1. Open "/login"
2. Fill field "Username" with env "WEBTEST_AI_DEMO_USERNAME"
3. Fill field "Password" with env "WEBTEST_AI_DEMO_PASSWORD"
4. Click role "button" named "Login"
5. Assert url "http://127.0.0.1:4010/"
6. Assert text "Welcome, Demo Operator"
7. Assert text "Session valid"

## Expected

- The app signs in on the primary host.
- The browser session is valid for this test.
- WebTest AI does not persist this profile because `saveStorageState` is false.

---

# Same-host login saves a reusable session

tags: [auth, same-host, save-session, serial]
priority: high
owner: qe-foundation
auth:
  mode: ui
  profile: webtest-ai-same-host
  saveStorageState: true

## Goal

Verify a same-host login can explicitly create a reusable storage state profile.

## Steps

1. Open "/login"
2. Fill field "Username" with env "WEBTEST_AI_DEMO_USERNAME"
3. Fill field "Password" with env "WEBTEST_AI_DEMO_PASSWORD"
4. Click role "button" named "Login"
5. Assert url "http://127.0.0.1:4010/"
6. Assert text "Welcome, Demo Operator"

## Expected

- Login succeeds.
- WebTest AI stores the `webtest-ai-same-host` profile after the passing test.

---

# Same-host saved session is reused within the same spec

tags: [auth, reuse, same-host, serial]
priority: high
owner: qe-foundation
auth:
  mode: reuse
  profile: webtest-ai-same-host
  loginMode: same-host
  saveStorageState: true

## Goal

Verify a saved session can be revalidated and reused by a later test in the same spec.

## Steps

1. Open "/"
2. Assert text "Welcome, Demo Operator"
3. Assert text "Session valid"
4. Click role "button" named "Open command drawer"
5. Assert text "Runbooks, release actions"

## Expected

- The saved storage state is loaded before the browser context starts.
- Session validation succeeds before reuse.
- The authenticated dashboard renders without replaying login steps.

---

# Missing reusable session is recreated through same-host MFA

tags: [auth, reuse, mfa, serial]
priority: high
owner: qe-foundation
auth:
  mode: reuse
  profile: webtest-ai-same-host-mfa
  loginMode: same-host
  loginPath: /login-mfa
  saveStorageState: true

## Goal

Verify reuse mode can create a missing session by completing same-host MFA.

## Steps

1. Open "/"
2. Assert text "Welcome, Demo Operator"
3. Assert text "Session valid"

## Expected

- WebTest AI detects no reusable profile.
- It performs same-host login with MFA using configured env vars.
- The authenticated dashboard opens with a valid saved session.

---

# Cross-domain IDP login with MFA saves a reusable session

tags: [auth, idp, mfa, serial]
priority: high
owner: qe-foundation
auth:
  mode: ui
  profile: webtest-ai-idp
  saveStorageState: true

## Goal

Verify a functional cross-domain IDP login with MFA can authenticate the app and save state.

## Steps

1. Open "/login-idp"
2. Click role "link" named "Continue with WebTest AI IDP"
3. Assert text "WebTest AI Identity Provider"
4. Fill field "Username" with env "WEBTEST_AI_DEMO_USERNAME"
5. Fill field "Password" with env "WEBTEST_AI_DEMO_PASSWORD"
6. Click role "button" named "Continue"
7. Assert text "IDP MFA challenge"
8. Fill field "MFA Code" with env "WEBTEST_AI_DEMO_MFA_CODE"
9. Click role "button" named "Verify"
10. Assert url "http://127.0.0.1:4010/"
11. Assert text "Welcome, Demo Operator"

## Expected

- Authentication leaves the app host for the IDP host.
- MFA completes on the IDP.
- The app receives the callback and saves a reusable session.

---

# External IDP popup login returns to the main app

tags: [auth, idp, external-popup, popup, serial]
priority: high
owner: qe-foundation
auth:
  mode: ui
  profile: webtest-ai-external-popup
  saveStorageState: false

## Goal

Verify an external IDP flow opens directly in a small popup window, closes after login, and returns control to the main app.

## Steps

1. Open "/"
2. Click role "button" named "Open external IDP popup"
3. Assert text "External Identity Provider"
4. Fill field "Email" with env "WEBTEST_AI_DEMO_USERNAME"
5. Fill field "Password" with env "WEBTEST_AI_DEMO_PASSWORD"
6. Click role "button" named "Continue"
7. Assert text "External IDP MFA challenge"
8. Fill field "MFA Code" with env "WEBTEST_AI_DEMO_MFA_CODE"
9. Click role "button" named "Verify login"
10. Assert url "http://127.0.0.1:4010/"
11. Assert text "Welcome, Demo Operator"

## Expected

- Clicking the external IDP button opens a small provider popup directly.
- WebTest AI continues execution in the popup window.
- The provider notifies the opener, closes the popup, and returns execution to the app.

---

# Cross-domain IDP saved session is reused within the same spec

tags: [auth, idp, reuse, serial]
priority: high
owner: qe-foundation
auth:
  mode: reuse
  profile: webtest-ai-idp
  provider: idp
  loginMode: idp
  saveStorageState: true

## Goal

Verify the IDP-created session is revalidated and reused by a later test in the same spec.

## Steps

1. Open "/"
2. Assert text "Welcome, Demo Operator"
3. Assert text "Session valid"
4. Click role "tab" named "Audit"
5. Assert text "IDP login verified"

## Expected

- The IDP session profile is reused without replaying IDP login.
- Validation confirms the storage state is still accepted by the app.