### E2E Tests: Authentication System

**Suite ID:** `AUTH-E2E`
**Feature:** Authentication middleware, session management, and token refresh.

---

## Test Case: `AUTH-MW-E2E-001` - Allow access to public routes without session

**Priority:** `normal`

**Tags:**
- type: @e2e
- feature: @auth, @middleware

**Description/Objective:** Verify public routes are accessible without authentication.

**Preconditions:**
- Application is running.
- No active session (cookies cleared).

### Flow Steps:
1. Clear all cookies.
2. Navigate to /sign-in.
3. Verify page loads.
4. Navigate to /sign-up.
5. Verify page loads.

### Expected Result:
- Public routes are accessible without authentication.

---

## Test Case: `AUTH-MW-E2E-002` - Maintain protection after session error

**Priority:** `normal`

**Tags:**
- type: @e2e
- feature: @auth, @middleware

**Description/Objective:** Verify protected routes remain protected after session invalidation.

**Preconditions:**
- Application is running.

### Flow Steps:
1. Log in with valid credentials.
2. Navigate to a protected route.
3. Invalidate session (replace cookie with invalid token).
4. Navigate to another protected route.
5. Verify redirect to sign-in.

### Expected Result:
- Invalid session results in redirect to sign-in.

---

## Test Case: `AUTH-SESSION-E2E-001` - Show RefreshAccessTokenError message

**Priority:** `normal`

**Tags:**
- type: @e2e
- feature: @auth, @session

**Description/Objective:** Verify that RefreshAccessTokenError displays appropriate toast message.

**Preconditions:**
- Application is running.

### Flow Steps:
1. Navigate to /sign-in with error=RefreshAccessTokenError query parameter.
2. Check for toast notification.
3. Verify form elements are still visible.

### Expected Result:
- Toast shows "Session Expired" message with "Please sign in again".
- Sign-in form is displayed and functional.

---

## Test Case: `AUTH-SESSION-E2E-002` - Show MissingRefreshToken error message

**Priority:** `normal`

**Tags:**
- type: @e2e
- feature: @auth, @session

**Description/Objective:** Verify that MissingRefreshToken error displays appropriate toast message.

**Preconditions:**
- Application is running.

### Flow Steps:
1. Navigate to /sign-in with error=MissingRefreshToken query parameter.
2. Check for toast notification.
3. Verify email input is visible.

### Expected Result:
- Toast shows "Session Error" message.
- Sign-in form is displayed.

---

## Test Case: `AUTH-SESSION-E2E-003` - Show generic error for unknown error types

**Priority:** `normal`

**Tags:**
- type: @e2e
- feature: @auth, @session

**Description/Objective:** Verify that unknown error types display a generic authentication error message.

**Preconditions:**
- Application is running.

### Flow Steps:
1. Navigate to /sign-in with error=UnknownError query parameter.
2. Check for toast notification.

### Expected Result:
- Toast shows "Authentication Error" message with "Please sign in again".

---

## Test Case: `AUTH-SESSION-E2E-004` - Include callbackUrl in redirect

**Priority:** `normal`

**Tags:**
- type: @e2e
- feature: @auth, @session

**Description/Objective:** Verify that callbackUrl is preserved when redirecting to sign-in after session expiry.

**Preconditions:**
- Application is running.
- Valid test user credentials.

### Flow Steps:
1. Log in with valid credentials.
2. Navigate to a protected route (/scans).
3. Navigate to a safe public page (/sign-in).
4. Clear cookies to simulate session expiry.
5. Navigate to another protected route (/providers) using fresh navigation.
6. Verify redirect to sign-in includes callbackUrl parameter.

### Expected Result:
- URL contains callbackUrl=/providers parameter.
- User can sign in and be redirected back to the original destination.

---

## Test Case: `AUTH-TOKEN-E2E-001` - Refresh access token when expired

**Priority:** `normal`

**Tags:**
- type: @e2e
- feature: @auth, @token

**Description/Objective:** Verify that session is maintained after page reload (token refresh).

**Preconditions:**
- Application is running.
- Valid test user credentials.

### Flow Steps:
1. Log in with valid credentials.
2. Verify home page is loaded.
3. Capture initial session data.
4. Reload the page.
5. Verify session is still valid with same user data.

### Expected Result:
- Session persists after reload.
- User email, userId, and tenantId remain the same.

---

## Test Case: `AUTH-TOKEN-E2E-002` - Preserve user permissions after token refresh

**Priority:** `normal`

**Tags:**
- type: @e2e
- feature: @auth, @token

**Description/Objective:** Verify that user permissions are preserved after token refresh.

**Preconditions:**
- Application is running.
- Valid test user credentials.

### Flow Steps:
1. Log in with valid credentials.
2. Capture initial session with permissions.
3. Reload the page.
4. Verify permissions match initial session.

### Expected Result:
- User permissions are identical before and after refresh.
- User profile data (email, name, companyName) is preserved.

---

## Test Case: `AUTH-TOKEN-E2E-003` - Clear session when cookies are removed

**Priority:** `normal`

**Tags:**
- type: @e2e
- feature: @auth, @token

**Description/Objective:** Verify that session is cleared when cookies are removed.

**Preconditions:**
- Application is running.
- Valid test user credentials.

### Flow Steps:
1. Log in with valid credentials.
2. Verify session is valid.
3. Clear all cookies.
4. Check session status.

### Expected Result:
- Session returns null after cookies are cleared.
- User is effectively logged out.