test(platform): live checks follow the one-header settings body and the server-read SSO list

Author: waleedlatif1

apps/sim/platform/checks/live/links.spec.ts

@@ -71,7 +71,8 @@ test('Links: header, Chrome install, columns, and a list that reads on as it scr
       if (request.url().includes('/sim-links') && request.url().includes('cursor='))
         pages.push(request.url())
     })
-    const list = page.getByRole('region', { name: 'Links' })
+    // The page is a region named by its heading, and the scrolling list a region inside it.
+    const list = page.getByRole('region', { name: 'Links' }).getByRole('region', { name: 'Links' })
     await expect(async () => {
       await list.evaluate((node) => {
         const scroller =

apps/sim/platform/checks/live/routes.spec.ts

@@ -25,7 +25,10 @@ const pageHeading =
   (main) =>
     main.getByRole('heading', { level: 1, name, exact: typeof name === 'string' || undefined })
 
-/** A Settings section's `main` opens on the title its navigation gives it (`settings-navigation.ts`). */
+/**
+ * A Settings section's `main` opens on the title its navigation gives it (`settings-navigation.ts`),
+ * or on its sub-view's own title when the route opens one, since a page renders one header.
+ */
 const settingsHeading = pageHeading
 
 const composer: Landmark = (main) => main.getByRole('textbox').first()
@@ -49,7 +52,7 @@ const ADMIN_ROUTES: readonly (readonly [string, string, Landmark])[] = [
     liveRoute('/settings/keyboard-shortcuts'),
     settingsHeading('Keyboard shortcuts'),
   ],
-  ['settings-privacy', liveRoute('/settings/privacy'), settingsHeading('Preferences')],
+  ['settings-privacy', liveRoute('/settings/privacy'), settingsHeading('Privacy')],
   ['settings-account', liveRoute('/settings/account'), settingsHeading('Preferences')],
   [
     'settings-recently-deleted',
@@ -60,7 +63,7 @@ const ADMIN_ROUTES: readonly (readonly [string, string, Landmark])[] = [
   ['settings-requests', liveRoute('/settings/requests'), settingsHeading('Requests')],
   ['settings-billing', liveRoute('/settings/billing'), settingsHeading('Subscription')],
   ['settings-usage', liveRoute('/settings/usage'), settingsHeading('Insights')],
-  ['settings-usage-events', liveRoute('/settings/usage/events'), settingsHeading('Insights')],
+  ['settings-usage-events', liveRoute('/settings/usage/events'), settingsHeading('Usage events')],
   ['settings-links', liveRoute('/settings/links'), settingsHeading('Links')],
   [
     'settings-whitelabeling',

apps/sim/platform/checks/live/settings-a.spec.ts

@@ -126,7 +126,10 @@ test('a plan read on the server stands when the browser’s own read fails', asy
   await expect
     .poll(() => failedReads.length, 'the browser never gave up on its read')
     .toBeGreaterThanOrEqual(2)
-  await expect(page.getByRole('region', { name: 'Subscription' })).toBeVisible()
+  // The page is a region named Subscription, and its plan's section another inside it.
+  await expect(
+    page.getByRole('region', { name: 'Subscription' }).getByRole('region', { name: 'Subscription' })
+  ).toBeVisible()
   await expect(page.getByText('Enterprise plan')).toBeVisible()
   await expect(page.getByRole('button', { name: 'Retry', exact: true })).toHaveCount(0)
 })

apps/sim/platform/checks/live/settings-b.spec.ts

@@ -96,23 +96,45 @@ test.describe('governance settings', () => {
           (select id from "user" where email = ${adminEmail()}), ${providerId}, ${organizationId()})`
     })
     try {
-      // Signed in elsewhere first, so the body read here cannot belong to a page that navigated away.
+      // The section's first read runs on the server and reaches the browser inside the document,
+      // so the document, every response after it and the API itself are all checked for the secret.
       await openSection(page, 'general')
-      const providers = page.waitForResponse(
-        (response) =>
-          response.request().method() === 'GET' &&
-          response.url().includes('/api/auth/sso/providers')
+      const leaks: string[] = []
+      page.on('response', async (response) => {
+        const body = await response.text().catch(() => '')
+        if (body.includes(clientSecret)) leaks.push(response.url())
+      })
+      const document = await page.goto(liveRoute(`/settings/sso?provider=${providerId}`))
+      const html = (await document?.text()) ?? ''
+      expect(html, 'the document did not carry the seeded provider').toContain(providerId)
+      expect(html).not.toContain(clientSecret)
+
+      const api = await page.request.get(
+        `/api/auth/sso/providers?organizationId=${organizationId()}`
       )
-      await page.goto(liveRoute('/settings/sso'))
-      await expect(page.getByRole('tab', { name: 'Domains' })).toBeAttached()
-      const body = await (await providers).text()
+      const body = await api.text()
       expect(body).not.toContain(clientSecret)
       const listed = (
         JSON.parse(body) as { providers: { providerId: string; oidcConfig: string | null }[] }
       ).providers.find((provider) => provider.providerId === providerId)
       expect(listed?.oidcConfig, 'the seeded provider was not listed').toBeTruthy()
       expect(JSON.parse(listed?.oidcConfig ?? '{}').clientSecret).toBe('[REDACTED]')
+
+      // The provider's detail shows the saved secret as a masked fact, never as a value.
+      await expect(page.getByRole('heading', { level: 1, name: providerId })).toBeVisible()
+      await expect(page.getByRole('textbox', { name: 'Client secret (saved)' })).toBeVisible()
       await expect(page.getByRole('button', { name: /Copy Client secret/ })).toHaveCount(0)
+      for (const input of await page.locator('input').all())
+        expect(await input.inputValue()).not.toContain(clientSecret)
+
+      // Saving without retyping the secret asks the server to keep it, never to store a blank.
+      const registration = page.waitForRequest('**/api/auth/sso/register')
+      await page.route('**/api/auth/sso/register', (route) => route.abort())
+      await page.getByRole('textbox', { name: 'Client ID' }).fill('platform-live-client-edited')
+      await page.getByRole('button', { name: 'Save', exact: true }).click()
+      const sent = (await registration).postDataJSON() as { clientSecret?: string }
+      expect(sent.clientSecret).toBe('[REDACTED]')
+      expect(leaks).toEqual([])
     } finally {
       await withLiveDatabase(
         (sql) => sql`delete from sso_provider where provider_id = ${providerId}`