Resolve all 46 low-severity architecture review findings

2026-09-09 22:56:36 -04:00
parent fef3e7675f
commit 9ee402bbcd
139 changed files with 2621 additions and 1082 deletions
@@ -112,12 +112,17 @@ public class PlaywrightFixture : IAsyncLifetime
        // This sets the auth cookie in the browser context automatically.
        var finalUrl = await page.EvaluateAsync<string>(@"
            async ([u, p]) => {
+                const token = document.querySelector('input[name=__RequestVerificationToken]');
+                if (!token?.value) throw new Error('Login form did not render an antiforgery token.');
+                const body = new URLSearchParams({ username: u, password: p });
+                body.set(token.name, token.value);
                const resp = await fetch('/auth/login', {
                    method: 'POST',
                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                    body: 'username=' + encodeURIComponent(u) + '&password=' + encodeURIComponent(p),
+                    body: body.toString(),
                    redirect: 'follow'
                });
+                if (!resp.ok) throw new Error('Login returned HTTP ' + resp.status);
                return resp.url;
            }
        ", new object[] { username, password });