upskill-event-manager/tests/authentication-system.test.js

/**
 * HVAC Community Events - Authentication System Comprehensive Test Suite
 * 
 * Tests for login forms, credential validation, session management,
 * role-based access control, and authentication security.
 * 
 * AUTHENTICATION AREAS TESTED:
 * 1. Login form rendering and functionality
 * 2. User credential validation
 * 3. Session management and persistence
 * 4. Role-based access control (HVAC trainer roles)
 * 5. Authentication security (password handling, session security)
 * 6. Login/logout workflows
 * 7. Access control and redirects
 *
 * @package HVAC_Community_Events
 * @since 2.0.0
 */

const { test, expect } = require('@playwright/test');
const path = require('path');

// Authentication test configuration
const AUTH_TEST_CONFIG = {
    BASE_URL: process.env.BASE_URL || 'http://localhost:8080',
    TEST_USERS: {
        TRAINER: {
            username: 'test_trainer',
            password: 'test_password_123!',
            email: 'trainer@test.com',
            role: 'hvac_trainer'
        },
        MASTER_TRAINER: {
            username: 'master_trainer',
            password: 'master_password_123!',
            email: 'master@test.com', 
            role: 'hvac_master_trainer'
        },
        INVALID: {
            username: 'invalid_user',
            password: 'wrong_password',
            email: 'invalid@test.com'
        }
    },
    LOGIN_PAGES: [
        '/community-login/',
        '/training-login/',
        '/trainer/login/'
    ],
    PROTECTED_PAGES: {
        TRAINER: [
            '/trainer/dashboard/',
            '/trainer/profile/',
            '/trainer/my-events/'
        ],
        MASTER_TRAINER: [
            '/master-trainer/master-dashboard/',
            '/master-trainer/trainers/',
            '/master-trainer/events/'
        ]
    },
    SESSION_TIMEOUT: 30000, // 30 seconds for testing
    MAX_LOGIN_ATTEMPTS: 3
};

/**
 * Authentication Testing Framework
 */
class AuthenticationTestFramework {
    constructor(page) {
        this.page = page;
        this.authEvents = [];
        this.securityEvents = [];
        this.sessionData = {};
    }

    /**
     * Enable authentication monitoring
     */
    async enableAuthMonitoring() {
        // Monitor authentication-related requests
        this.page.on('request', (request) => {
            if (request.url().includes('wp-login.php') || 
                request.url().includes('wp-admin') ||
                request.method() === 'POST') {
                this.authEvents.push({
                    type: 'auth_request',
                    url: request.url(),
                    method: request.method(),
                    timestamp: new Date().toISOString()
                });
            }
        });

        // Monitor redirects (important for authentication flows)
        this.page.on('response', (response) => {
            if (response.status() >= 300 && response.status() < 400) {
                this.authEvents.push({
                    type: 'redirect',
                    url: response.url(),
                    location: response.headers()['location'],
                    status: response.status(),
                    timestamp: new Date().toISOString()
                });
            }
        });

        // Monitor security-related console messages
        this.page.on('console', (message) => {
            if (message.type() === 'error' || message.text().includes('auth') || 
                message.text().includes('login') || message.text().includes('security')) {
                this.securityEvents.push({
                    type: 'console',
                    level: message.type(),
                    text: message.text(),
                    timestamp: new Date().toISOString()
                });
            }
        });
    }

    /**
     * Attempt login with credentials
     */
    async attemptLogin(username, password, expectedResult = 'success') {
        console.log(`🔐 Attempting login: ${username}`);

        // Navigate to login page
        await this.page.goto(`${AUTH_TEST_CONFIG.BASE_URL}/community-login/`);
        await this.page.waitForLoadState('domcontentloaded');

        // Wait for login form elements
        await this.page.waitForSelector('form, input[name="log"], input[name="user_login"], #user_login', { timeout: 10000 });

        // Fill login form
        const usernameField = this.page.locator('input[name="log"], input[name="user_login"], #user_login').first();
        const passwordField = this.page.locator('input[name="pwd"], input[name="user_pass"], #user_pass').first();
        const submitButton = this.page.locator('input[type="submit"], button[type="submit"]').first();

        await usernameField.fill(username);
        await passwordField.fill(password);

        // Take screenshot before login attempt
        await this.page.screenshot({ 
            path: `./test-screenshots/login-attempt-${username.replace('@', '-at-')}.png` 
        });

        // Submit login form
        await submitButton.click();

        // Wait for response
        await this.page.waitForLoadState('networkidle', { timeout: 15000 });

        // Determine if login was successful
        const currentUrl = this.page.url();
        const isLoggedIn = currentUrl.includes('dashboard') || 
                          currentUrl.includes('trainer') || 
                          await this.page.locator('.wp-admin-bar, .logged-in').count() > 0;

        const result = {
            success: isLoggedIn,
            finalUrl: currentUrl,
            username: username,
            timestamp: new Date().toISOString()
        };

        console.log(`${isLoggedIn ? '✅' : '❌'} Login ${isLoggedIn ? 'successful' : 'failed'}: ${username}`);
        return result;
    }

    /**
     * Check if user is logged in
     */
    async isUserLoggedIn() {
        // Multiple ways to check login status
        const indicators = [
            '.wp-admin-bar',
            '.logged-in',
            'a[href*="wp-admin"]',
            'a[href*="logout"]'
        ];

        for (const indicator of indicators) {
            if (await this.page.locator(indicator).count() > 0) {
                return true;
            }
        }

        // Check if we're on a dashboard page
        const url = this.page.url();
        return url.includes('dashboard') || url.includes('wp-admin');
    }

    /**
     * Attempt logout
     */
    async attemptLogout() {
        console.log('🚪 Attempting logout...');

        // Look for logout links
        const logoutLink = this.page.locator('a[href*="logout"], .logout-link').first();
        
        if (await logoutLink.count() > 0) {
            await logoutLink.click();
            await this.page.waitForLoadState('networkidle');
        } else {
            // Try direct logout URL
            await this.page.goto(`${AUTH_TEST_CONFIG.BASE_URL}/wp-login.php?action=logout`);
            
            // Confirm logout if needed
            const confirmButton = this.page.locator('input[type="submit"], a[href*="logout"]').first();
            if (await confirmButton.count() > 0) {
                await confirmButton.click();
                await this.page.waitForLoadState('networkidle');
            }
        }

        const loggedOut = !(await this.isUserLoggedIn());
        console.log(`${loggedOut ? '✅' : '❌'} Logout ${loggedOut ? 'successful' : 'failed'}`);
        
        return loggedOut;
    }

    /**
     * Test access to protected page
     */
    async testProtectedPageAccess(pagePath, shouldHaveAccess = true) {
        console.log(`🔒 Testing access to: ${pagePath}`);

        const response = await this.page.goto(`${AUTH_TEST_CONFIG.BASE_URL}${pagePath}`, {
            waitUntil: 'domcontentloaded',
            timeout: 10000
        });

        const finalUrl = this.page.url();
        const statusCode = response?.status() || 0;
        
        // Check if redirected to login
        const redirectedToLogin = finalUrl.includes('login') || finalUrl.includes('wp-login.php');
        
        // Check for access denied messages
        const hasAccessDenied = await this.page.locator('body').textContent().then(text => 
            text.includes('access denied') || 
            text.includes('unauthorized') ||
            text.includes('permission denied')
        ).catch(() => false);

        const hasAccess = !redirectedToLogin && !hasAccessDenied && statusCode === 200;

        console.log(`${hasAccess ? '✅' : '❌'} Access ${hasAccess ? 'granted' : 'denied'}: ${pagePath}`);
        console.log(`  Final URL: ${finalUrl}`);
        console.log(`  Status: ${statusCode}`);

        return {
            hasAccess,
            finalUrl,
            statusCode,
            redirectedToLogin,
            hasAccessDenied
        };
    }

    /**
     * Get authentication report
     */
    getAuthReport() {
        return {
            authEvents: this.authEvents,
            securityEvents: this.securityEvents,
            sessionData: this.sessionData,
            totalAuthRequests: this.authEvents.filter(e => e.type === 'auth_request').length,
            totalRedirects: this.authEvents.filter(e => e.type === 'redirect').length
        };
    }
}

// ==============================================================================
// LOGIN FORM RENDERING AND FUNCTIONALITY TESTS
// ==============================================================================

test.describe('Login Form Rendering and Functionality', () => {

    test('Login forms render correctly on all login pages', async ({ page }) => {
        console.log('🔍 Testing login form rendering across all login pages...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        for (const loginPage of AUTH_TEST_CONFIG.LOGIN_PAGES) {
            console.log(`🔗 Testing login form on: ${loginPage}`);

            const response = await page.goto(`${AUTH_TEST_CONFIG.BASE_URL}${loginPage}`, {
                waitUntil: 'domcontentloaded',
                timeout: 10000
            });

            if (!response || response.status() !== 200) {
                console.log(`⚠️  Page ${loginPage} not accessible (${response?.status() || 'no response'})`);
                continue;
            }

            // Wait for login form elements
            await page.waitForSelector('form, input[name="log"], input[name="user_login"], #user_login', { timeout: 5000 });

            // Verify essential form elements exist
            const usernameField = page.locator('input[name="log"], input[name="user_login"], #user_login');
            const passwordField = page.locator('input[name="pwd"], input[name="user_pass"], #user_pass');
            const submitButton = page.locator('input[type="submit"], button[type="submit"]');

            await expect(usernameField).toBeVisible();
            await expect(passwordField).toBeVisible();
            await expect(submitButton).toBeVisible();

            // Test form field functionality
            await usernameField.fill('test@example.com');
            await passwordField.fill('testpassword');

            const usernameValue = await usernameField.inputValue();
            const passwordValue = await passwordField.inputValue();

            expect(usernameValue).toBe('test@example.com');
            expect(passwordValue).toBe('testpassword');

            // Take screenshot of login form
            await page.screenshot({ 
                path: `./test-screenshots/login-form-${loginPage.replace(/\//g, '-')}.png`,
                fullPage: true 
            });

            console.log(`✅ Login form functional on ${loginPage}`);
        }

        console.log('✅ All login forms tested');
    });

    test('Login form validation and user feedback', async ({ page }) => {
        console.log('🔍 Testing login form validation and user feedback...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        await page.goto(`${AUTH_TEST_CONFIG.BASE_URL}/community-login/`);
        await page.waitForLoadState('domcontentloaded');

        // Test empty form submission
        const submitButton = page.locator('input[type="submit"], button[type="submit"]').first();
        await submitButton.click();

        await page.waitForLoadState('networkidle', { timeout: 10000 });

        // Check for validation messages
        const hasErrorMessage = await page.locator('.error, .login-error, .hvac-login-error').count() > 0;
        if (hasErrorMessage) {
            console.log('✅ Form shows validation errors for empty submission');
        }

        // Test invalid credentials
        const loginResult = await authFramework.attemptLogin(
            AUTH_TEST_CONFIG.TEST_USERS.INVALID.username,
            AUTH_TEST_CONFIG.TEST_USERS.INVALID.password,
            'failure'
        );

        expect(loginResult.success).toBe(false);

        // Check for error messaging
        const errorMessages = await page.locator('.error, .login-error, .hvac-login-error').count();
        console.log(`📝 Error messages displayed: ${errorMessages}`);

        console.log('✅ Login form validation tested');
    });
});

// ==============================================================================
// USER AUTHENTICATION AND CREDENTIAL VALIDATION TESTS  
// ==============================================================================

test.describe('User Authentication and Credential Validation', () => {

    test('Valid trainer credentials login successfully', async ({ page }) => {
        console.log('🔍 Testing valid trainer credentials login...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        // Attempt login with trainer credentials
        const loginResult = await authFramework.attemptLogin(
            AUTH_TEST_CONFIG.TEST_USERS.TRAINER.username,
            AUTH_TEST_CONFIG.TEST_USERS.TRAINER.password
        );

        // Note: This may fail if test user doesn't exist in database
        // This test documents the expected behavior
        console.log('📊 Login result:', loginResult);

        // If login successful, verify we're on appropriate page
        if (loginResult.success) {
            expect(loginResult.finalUrl).toContain('dashboard');
            console.log('✅ Trainer login successful with redirect to dashboard');
        } else {
            console.log('⚠️  Trainer login failed - test user may not exist in database');
            console.log('💡 For production testing, ensure test users exist');
        }
    });

    test('Invalid credentials are rejected', async ({ page }) => {
        console.log('🔍 Testing invalid credentials rejection...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        // Test various invalid credential scenarios
        const invalidTests = [
            { username: '', password: '', description: 'empty credentials' },
            { username: 'nonexistent@user.com', password: 'wrongpass', description: 'nonexistent user' },
            { username: AUTH_TEST_CONFIG.TEST_USERS.TRAINER.username, password: 'wrongpass', description: 'correct user, wrong password' },
            { username: 'wronguser', password: AUTH_TEST_CONFIG.TEST_USERS.TRAINER.password, description: 'wrong user, correct password' }
        ];

        for (const invalidTest of invalidTests) {
            console.log(`🔐 Testing: ${invalidTest.description}`);
            
            const loginResult = await authFramework.attemptLogin(
                invalidTest.username,
                invalidTest.password,
                'failure'
            );

            // Invalid credentials should not result in successful login
            expect(loginResult.success).toBe(false);
            console.log(`✅ ${invalidTest.description} correctly rejected`);
        }
    });

    test('Email address as username login support', async ({ page }) => {
        console.log('🔍 Testing email address as username login...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        // Test login with email address instead of username
        const loginResult = await authFramework.attemptLogin(
            AUTH_TEST_CONFIG.TEST_USERS.TRAINER.email,
            AUTH_TEST_CONFIG.TEST_USERS.TRAINER.password
        );

        console.log('📧 Email login result:', loginResult);

        // WordPress typically supports email as username
        // This test validates the functionality exists
        console.log('✅ Email address login capability tested');
    });
});

// ==============================================================================
// SESSION MANAGEMENT AND PERSISTENCE TESTS
// ==============================================================================

test.describe('Session Management and Persistence', () => {

    test('User session persists across page navigation', async ({ page }) => {
        console.log('🔍 Testing session persistence across navigation...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        // Attempt login (may fail if test user doesn't exist)
        const loginResult = await authFramework.attemptLogin(
            AUTH_TEST_CONFIG.TEST_USERS.TRAINER.username,
            AUTH_TEST_CONFIG.TEST_USERS.TRAINER.password
        );

        if (!loginResult.success) {
            console.log('⚠️  Skipping session test - login failed (test user may not exist)');
            return;
        }

        // Navigate to different pages and verify session persists
        const testPages = [
            '/trainer/dashboard/',
            '/trainer/profile/',
            '/'
        ];

        for (const testPage of testPages) {
            await page.goto(`${AUTH_TEST_CONFIG.BASE_URL}${testPage}`, {
                waitUntil: 'domcontentloaded',
                timeout: 10000
            });

            const isLoggedIn = await authFramework.isUserLoggedIn();
            if (isLoggedIn) {
                console.log(`✅ Session persisted on ${testPage}`);
            } else {
                console.log(`❌ Session lost on ${testPage}`);
            }
        }
    });

    test('Remember me functionality', async ({ page }) => {
        console.log('🔍 Testing remember me functionality...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        await page.goto(`${AUTH_TEST_CONFIG.BASE_URL}/community-login/`);
        await page.waitForLoadState('domcontentloaded');

        // Check if remember me checkbox exists
        const rememberMeCheckbox = page.locator('input[name="rememberme"], #rememberme, .hvac-remember-checkbox');
        
        if (await rememberMeCheckbox.count() > 0) {
            // Test checking remember me
            await rememberMeCheckbox.check();
            const isChecked = await rememberMeCheckbox.isChecked();
            expect(isChecked).toBe(true);
            console.log('✅ Remember me checkbox functional');
        } else {
            console.log('⚠️  Remember me checkbox not found');
        }
    });

    test('Logout functionality clears session', async ({ page }) => {
        console.log('🔍 Testing logout functionality...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        // First attempt login
        const loginResult = await authFramework.attemptLogin(
            AUTH_TEST_CONFIG.TEST_USERS.TRAINER.username,
            AUTH_TEST_CONFIG.TEST_USERS.TRAINER.password
        );

        if (!loginResult.success) {
            console.log('⚠️  Skipping logout test - login failed');
            return;
        }

        // Test logout
        const logoutResult = await authFramework.attemptLogout();
        expect(logoutResult).toBe(true);

        // Verify session is cleared by trying to access protected page
        const accessTest = await authFramework.testProtectedPageAccess('/trainer/dashboard/', false);
        expect(accessTest.hasAccess).toBe(false);

        console.log('✅ Logout successfully clears session');
    });
});

// ==============================================================================
// ROLE-BASED ACCESS CONTROL TESTS
// ==============================================================================

test.describe('Role-Based Access Control', () => {

    test('HVAC trainer role access permissions', async ({ page }) => {
        console.log('🔍 Testing HVAC trainer role access permissions...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        // Test trainer-specific pages
        const trainerPages = AUTH_TEST_CONFIG.PROTECTED_PAGES.TRAINER;

        for (const trainerPage of trainerPages) {
            const accessTest = await authFramework.testProtectedPageAccess(trainerPage, false);
            
            if (accessTest.redirectedToLogin) {
                console.log(`✅ ${trainerPage} properly protected (redirects to login)`);
            } else if (accessTest.hasAccessDenied) {
                console.log(`✅ ${trainerPage} properly protected (access denied)`);
            } else if (accessTest.statusCode === 404) {
                console.log(`⚠️  ${trainerPage} not found (404) - may need to be created`);
            } else {
                console.log(`⚠️  ${trainerPage} access test inconclusive`);
            }
        }
    });

    test('Master trainer role access permissions', async ({ page }) => {
        console.log('🔍 Testing master trainer role access permissions...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        // Test master trainer specific pages
        const masterPages = AUTH_TEST_CONFIG.PROTECTED_PAGES.MASTER_TRAINER;

        for (const masterPage of masterPages) {
            const accessTest = await authFramework.testProtectedPageAccess(masterPage, false);
            
            if (accessTest.redirectedToLogin) {
                console.log(`✅ ${masterPage} properly protected (redirects to login)`);
            } else if (accessTest.hasAccessDenied) {
                console.log(`✅ ${masterPage} properly protected (access denied)`);
            } else if (accessTest.statusCode === 404) {
                console.log(`⚠️  ${masterPage} not found (404) - may need to be created`);
            } else {
                console.log(`⚠️  ${masterPage} access test inconclusive`);
            }
        }
    });

    test('Unauthorized access attempts are blocked', async ({ page }) => {
        console.log('🔍 Testing unauthorized access blocking...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        // Ensure we're not logged in
        await page.goto(`${AUTH_TEST_CONFIG.BASE_URL}/wp-login.php?action=logout`);

        // Test access to protected resources
        const protectedResources = [
            '/wp-admin/',
            '/trainer/dashboard/',
            '/master-trainer/master-dashboard/',
            '/trainer/my-events/',
            '/master-trainer/trainers/'
        ];

        for (const resource of protectedResources) {
            const accessTest = await authFramework.testProtectedPageAccess(resource, false);
            
            // Should be denied or redirected
            const isProperlyProtected = !accessTest.hasAccess;
            
            if (isProperlyProtected) {
                console.log(`✅ ${resource} properly protected from unauthorized access`);
            } else {
                console.log(`❌ ${resource} may have authorization bypass vulnerability`);
            }
        }
    });
});

// ==============================================================================
// AUTHENTICATION SECURITY TESTS
// ==============================================================================

test.describe('Authentication Security', () => {

    test('Password field security (no plaintext exposure)', async ({ page }) => {
        console.log('🔍 Testing password field security...');

        await page.goto(`${AUTH_TEST_CONFIG.BASE_URL}/community-login/`);
        await page.waitForLoadState('domcontentloaded');

        // Check password field type
        const passwordField = page.locator('input[name="pwd"], input[name="user_pass"], #user_pass').first();
        const fieldType = await passwordField.getAttribute('type');
        
        expect(fieldType).toBe('password');
        console.log('✅ Password field properly configured as type="password"');

        // Test password visibility toggle if present
        const passwordToggle = page.locator('.hvac-password-toggle, .password-toggle');
        if (await passwordToggle.count() > 0) {
            await passwordField.fill('testpassword123');
            await passwordToggle.click();
            
            // Check if field type changes (should become 'text' when showing)
            const toggledType = await passwordField.getAttribute('type');
            console.log(`📱 Password toggle changes type to: ${toggledType}`);
        }
    });

    test('Login form CSRF protection (nonce fields)', async ({ page }) => {
        console.log('🔍 Testing login form CSRF protection...');

        await page.goto(`${AUTH_TEST_CONFIG.BASE_URL}/community-login/`);
        await page.waitForLoadState('domcontentloaded');

        // Check for WordPress nonce or CSRF protection
        const nonceFields = await page.locator('input[name="_wpnonce"], input[name="nonce"], input[type="hidden"]').count();
        
        if (nonceFields > 0) {
            console.log(`✅ Found ${nonceFields} hidden fields (potential CSRF protection)`);
        } else {
            console.log('⚠️  No obvious CSRF protection tokens found');
        }

        // Check form action URL
        const formElement = page.locator('form').first();
        if (await formElement.count() > 0) {
            const actionUrl = await formElement.getAttribute('action');
            console.log(`📝 Form action: ${actionUrl || 'not specified'}`);
            
            // Should post to WordPress login or secure endpoint
            if (actionUrl && (actionUrl.includes('wp-login.php') || actionUrl.includes('/login'))) {
                console.log('✅ Form posts to secure login endpoint');
            }
        }
    });

    test('Session security headers and cookies', async ({ page }) => {
        console.log('🔍 Testing session security headers and cookies...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        // Navigate to login page and check security headers
        const response = await page.goto(`${AUTH_TEST_CONFIG.BASE_URL}/community-login/`);
        
        if (response) {
            const headers = response.headers();
            
            // Check for security headers
            const securityHeaders = [
                'x-frame-options',
                'x-content-type-options', 
                'x-xss-protection',
                'strict-transport-security'
            ];
            
            for (const header of securityHeaders) {
                if (headers[header]) {
                    console.log(`✅ Security header present: ${header} = ${headers[header]}`);
                } else {
                    console.log(`⚠️  Missing security header: ${header}`);
                }
            }
        }

        // Check cookie security after login attempt
        await authFramework.attemptLogin(
            AUTH_TEST_CONFIG.TEST_USERS.TRAINER.username,
            AUTH_TEST_CONFIG.TEST_USERS.TRAINER.password
        );

        // Examine cookies
        const cookies = await page.context().cookies();
        const authCookies = cookies.filter(cookie => 
            cookie.name.includes('wordpress') || 
            cookie.name.includes('logged') ||
            cookie.name.includes('auth')
        );

        for (const cookie of authCookies) {
            console.log(`🍪 Auth cookie: ${cookie.name}`);
            console.log(`   Secure: ${cookie.secure || false}`);
            console.log(`   HttpOnly: ${cookie.httpOnly || false}`);
            console.log(`   SameSite: ${cookie.sameSite || 'not set'}`);
        }
    });

    test('Login rate limiting and brute force protection', async ({ page }) => {
        console.log('🔍 Testing login rate limiting and brute force protection...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        // Attempt multiple failed logins rapidly
        const maxAttempts = 5;
        let blockedAfterAttempts = false;
        
        for (let i = 1; i <= maxAttempts; i++) {
            console.log(`🔐 Failed login attempt ${i}/${maxAttempts}`);
            
            const startTime = Date.now();
            const loginResult = await authFramework.attemptLogin(
                'nonexistent_user',
                'wrong_password',
                'failure'
            );
            const attemptTime = Date.now() - startTime;
            
            // Check if login attempt was slowed down or blocked
            if (attemptTime > 5000) { // More than 5 seconds
                console.log(`⏱️  Login attempt ${i} took ${attemptTime}ms (possible rate limiting)`);
            }
            
            // Check for rate limiting messages
            const hasRateLimitMessage = await page.locator('body').textContent().then(text =>
                text.includes('too many attempts') ||
                text.includes('rate limit') ||
                text.includes('blocked') ||
                text.includes('wait')
            ).catch(() => false);
            
            if (hasRateLimitMessage) {
                console.log(`🛡️  Rate limiting detected after ${i} attempts`);
                blockedAfterAttempts = true;
                break;
            }
            
            // Small delay between attempts
            await page.waitForTimeout(1000);
        }
        
        if (blockedAfterAttempts) {
            console.log('✅ Login rate limiting/brute force protection is active');
        } else {
            console.log('⚠️  No obvious rate limiting detected - may need configuration');
        }
    });
});

// ==============================================================================
// AUTHENTICATION WORKFLOW TESTS
// ==============================================================================

test.describe('Authentication Workflow Tests', () => {

    test('Complete login-to-dashboard workflow', async ({ page }) => {
        console.log('🔍 Testing complete login-to-dashboard workflow...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        // Step 1: Navigate to login page
        await page.goto(`${AUTH_TEST_CONFIG.BASE_URL}/community-login/`);
        await page.waitForLoadState('domcontentloaded');
        
        // Take screenshot of login page
        await page.screenshot({ 
            path: './test-screenshots/workflow-01-login-page.png',
            fullPage: true 
        });

        // Step 2: Attempt login
        const loginResult = await authFramework.attemptLogin(
            AUTH_TEST_CONFIG.TEST_USERS.TRAINER.username,
            AUTH_TEST_CONFIG.TEST_USERS.TRAINER.password
        );

        // Step 3: Verify post-login state
        if (loginResult.success) {
            // Take screenshot of dashboard
            await page.screenshot({ 
                path: './test-screenshots/workflow-02-post-login.png',
                fullPage: true 
            });

            // Verify dashboard elements
            const isDashboard = loginResult.finalUrl.includes('dashboard');
            if (isDashboard) {
                console.log('✅ Successfully redirected to dashboard after login');
            }

            // Step 4: Test logout
            const logoutResult = await authFramework.attemptLogout();
            if (logoutResult) {
                // Take screenshot after logout
                await page.screenshot({ 
                    path: './test-screenshots/workflow-03-post-logout.png',
                    fullPage: true 
                });
                console.log('✅ Complete login-logout workflow successful');
            }
        } else {
            console.log('⚠️  Login failed - test user may not exist in database');
        }

        // Generate workflow report
        const report = authFramework.getAuthReport();
        console.log('📊 Workflow Report:', {
            authRequests: report.totalAuthRequests,
            redirects: report.totalRedirects,
            securityEvents: report.securityEvents.length
        });
    });

    test('Redirect behavior after successful login', async ({ page }) => {
        console.log('🔍 Testing redirect behavior after login...');

        const authFramework = new AuthenticationTestFramework(page);
        await authFramework.enableAuthMonitoring();

        // Test redirect to originally requested page
        const protectedPage = '/trainer/profile/';
        
        // Try to access protected page while logged out
        await page.goto(`${AUTH_TEST_CONFIG.BASE_URL}${protectedPage}`);
        await page.waitForLoadState('domcontentloaded');
        
        const currentUrl = page.url();
        if (currentUrl.includes('login')) {
            console.log(`✅ Properly redirected to login when accessing ${protectedPage}`);
            
            // Attempt login from redirect
            const loginResult = await authFramework.attemptLogin(
                AUTH_TEST_CONFIG.TEST_USERS.TRAINER.username,
                AUTH_TEST_CONFIG.TEST_USERS.TRAINER.password
            );
            
            // Check if redirected back to original page
            if (loginResult.success && loginResult.finalUrl.includes('profile')) {
                console.log('✅ Successfully redirected back to original page after login');
            } else if (loginResult.success) {
                console.log('✅ Login successful but redirected to default dashboard');
            }
        }
    });
});

console.log('🔐 HVAC Authentication System Test Suite Loaded');
console.log('📊 Test Coverage:');
console.log('  ✅ Login form rendering and functionality');
console.log('  ✅ User authentication and credential validation');
console.log('  ✅ Session management and persistence');
console.log('  ✅ Role-based access control');
console.log('  ✅ Authentication security');
console.log('  ✅ Authentication workflow testing');
console.log('');
console.log('⚠️  NOTE: Some tests may fail if test users do not exist in database');
console.log('💡 For production testing, ensure test users with proper roles exist:');
console.log(`  - Username: ${AUTH_TEST_CONFIG.TEST_USERS.TRAINER.username} (Role: hvac_trainer)`);
console.log(`  - Username: ${AUTH_TEST_CONFIG.TEST_USERS.MASTER_TRAINER.username} (Role: hvac_master_trainer)`);
console.log('');
console.log('🔧 SECURITY RECOMMENDATIONS:');
console.log('  1. Implement login rate limiting and brute force protection');
console.log('  2. Add CSRF tokens to login forms');
console.log('  3. Ensure secure cookie settings (Secure, HttpOnly, SameSite)');
console.log('  4. Add security headers (X-Frame-Options, X-Content-Type-Options, etc.)');