Resolve all 46 low-severity architecture review findings

tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/Deployment/TopologyAreaTests.cs

@@ -304,7 +304,18 @@ public class TopologyAreaTests : IClassFixture<DeploymentFixture>
         await page.WaitForLoadStateAsync(LoadState.NetworkIdle);
         var live = page.Locator("#live-updates");
         if (await live.IsCheckedAsync()) await live.UncheckAsync();   // stop the 15s tree reload
-        await page.Locator("button[aria-label='Expand all areas']").ClickAsync();
-        return page;
+        // Lazy topology loads a bounded first page per branch. These small authoring
+        // fixtures need their sites/areas loaded before addressing labels or instances.
+        for (var branch = 0; branch < 300; branch++)
+        {
+            await page.Locator("button[aria-label='Expand all areas']").ClickAsync();
+            var load = page.GetByRole(AriaRole.Button, new() { Name = "Load instances", Exact = true });
+            if (await load.CountAsync() == 0) return page;
+            var pages = page.GetByText("Page 1", new() { Exact = true });
+            var count = await pages.CountAsync();
+            await load.First.ClickAsync();
+            await Assertions.Expect(pages).ToHaveCountAsync(count + 1);
+        }
+        throw new InvalidOperationException("Topology fixture exceeded 300 branches.");
     }
 }

tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/LoginTests.cs

@@ -53,7 +53,7 @@ public class LoginTests
                 const resp = await fetch('/auth/login', {
                     method: 'POST',
                     headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                    body: 'username=baduser&password=badpass',
+                    body: 'username=baduser&password=badpass&__RequestVerificationToken=' + encodeURIComponent(document.querySelector('input[name=__RequestVerificationToken]').value),
                     redirect: 'follow'
                 });
                 return resp.status;

tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/LowReviewSmokeTests.cs

@@ -0,0 +1,48 @@
+using System.Collections.Concurrent;
+using Microsoft.Playwright;
+
+namespace ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests;
+
+/// <summary>Read-only deployed smoke for CSRF login, bounded lazy topology, and debugger navigation.</summary>
+[Collection("Playwright")]
+public class LowReviewSmokeTests(PlaywrightFixture fixture)
+{
+    [Fact]
+    public async Task LowReview_CsrfLogin_LazyTopology_AndFlowDebuggerNavigation()
+    {
+        var page = await fixture.NewAuthenticatedPageAsync();
+        var errors = new ConcurrentQueue<string>();
+        page.PageError += (_, error) => errors.Enqueue(error);
+        try
+        {
+            // Fixture fetch posts the real login form's antiforgery token with its cookie.
+            Assert.DoesNotContain("/login", page.Url);
+            await page.GotoAsync($"{PlaywrightFixture.BaseUrl}/deployment/topology");
+            await Assertions.Expect(page.GetByRole(AriaRole.Heading, new() { Name = "Topology", Exact = true })).ToBeVisibleAsync();
+            var live = page.Locator("#live-updates");
+            if (await live.IsCheckedAsync()) await live.UncheckAsync();
+            await Assertions.Expect(page.Locator("i.bi-box")).ToHaveCountAsync(0);
+            await Assertions.Expect(page.GetByText("0 loaded instance(s)", new() { Exact = false })).ToBeVisibleAsync();
+
+            var site = page.Locator("li[role='treeitem'][aria-level='1']").First;
+            await Assertions.Expect(site).ToBeVisibleAsync();
+            var toggle = site.Locator(":scope > .tv-row .tv-toggle").First;
+            if (await toggle.GetAttributeAsync("aria-expanded") == "false") await toggle.ClickAsync();
+            await site.GetByRole(AriaRole.Button, new() { Name = "Load instances", Exact = true }).First.ClickAsync();
+            await Assertions.Expect(site.GetByText("Page 1", new() { Exact = true })).ToBeVisibleAsync();
+            await Assertions.Expect(site.GetByRole(AriaRole.Button, new() { Name = "Previous", Exact = true })).ToBeDisabledAsync();
+            await Assertions.Expect(site.GetByRole(AriaRole.Button, new() { Name = "Next", Exact = true })).ToBeVisibleAsync();
+            Assert.InRange(await site.Locator("i.bi-box").CountAsync(), 0, 50);
+            await Assertions.Expect(page.Locator("#blazor-error-ui")).ToBeHiddenAsync();
+            await Assertions.Expect(page.Locator(".alert-danger")).ToHaveCountAsync(0);
+
+            await PlaywrightFixture.ExpandAllNavSectionsAsync(page);
+            await page.GetByRole(AriaRole.Link, new() { Name = "Flow Debugger", Exact = true }).ClickAsync();
+            await PlaywrightFixture.WaitForPathAsync(page, "/deployment/flow-debugger");
+            await Assertions.Expect(page.GetByRole(AriaRole.Heading, new() { Name = "Flow Debugger", Exact = true })).ToBeVisibleAsync();
+            await Assertions.Expect(page.Locator("#blazor-error-ui")).ToBeHiddenAsync();
+            Assert.Empty(errors);
+        }
+        finally { await page.Context.CloseAsync(); }
+    }
+}

tests/ZB.MOM.WW.ScadaBridge.CentralUI.PlaywrightTests/PlaywrightFixture.cs

@@ -112,12 +112,17 @@ public class PlaywrightFixture : IAsyncLifetime
         // This sets the auth cookie in the browser context automatically.
         var finalUrl = await page.EvaluateAsync<string>(@"
             async ([u, p]) => {
+                const token = document.querySelector('input[name=__RequestVerificationToken]');
+                if (!token?.value) throw new Error('Login form did not render an antiforgery token.');
+                const body = new URLSearchParams({ username: u, password: p });
+                body.set(token.name, token.value);
                 const resp = await fetch('/auth/login', {
                     method: 'POST',
                     headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                    body: 'username=' + encodeURIComponent(u) + '&password=' + encodeURIComponent(p),
+                    body: body.toString(),
                     redirect: 'follow'
                 });
+                if (!resp.ok) throw new Error('Login returned HTTP ' + resp.status);
                 return resp.url;
             }
         ", new object[] { username, password });