# Instructions

- Following Playwright test failed.
- Explain why, be concise, respect Playwright best practices.
- Provide a snippet of code with the fix, if possible.

# Test info

- Name: tests/ui/auth.spec.ts >> sign-in and premium sections >> a forged identity header grants nothing where Authentik is off
- Location: tests/ui/auth.spec.ts:65:7

# Error details

```
Error: apiRequestContext.get: connect ECONNREFUSED 10.1.105.22:80
Call log:
  - → GET http://10.1.105.22/auth/whoami
    - user-agent: Playwright/1.64.1 (x64; ubuntu 22.04) node/20.9 CI/1
    - accept: */*
    - accept-encoding: gzip,deflate,br
    - X-authentik-email: someone@elect.info

```

# Test source

```ts
  1   | import { test, expect } from '@playwright/test';
  2   | import { premiumGated } from './helpers';
  3   | 
  4   | // Sign-in and premium sections (electinfo/sites#270). /auth/whoami reports
  5   | // whether Authentik is on for the host under test:
  6   | //   - CI test pods: enabled "false" (no Traefik in front), so nothing is gated
  7   | //     and the homepage keeps its premium cards greyed out;
  8   | //   - preview.elect.info front door: enabled "true", signed in as the
  9   | //     preview-e2e service account (preview-e2e@e2e.elect.news, ops#703): a plain
  10  | //     registered visitor, not elevated, so the premium sections are closed to it;
  11  | //   - us.elect.info front door, anonymous (the prod e2e run): /auth/ itself is
  12  | //     forward-auth gated, so whoami answers the outpost's redirect to sign-in,
  13  | //     which identity-bar.js reads as Authentik on and signed out.
  14  | const PREMIUM = [
  15  |   { path: '/voters/', label: 'Voters' },
  16  |   { path: '/individuals/', label: 'Individual Donors' },
  17  |   { path: '/blocks/', label: 'Census Blocks' },
  18  | ];
  19  | 
  20  | interface WhoAmI {
  21  |   enabled: string;
  22  |   email: string;
  23  |   elevated: boolean;
  24  |   entitlements: { voters: boolean; individuals: boolean; blocks: boolean; curator: boolean; preview: boolean };
  25  |   /** Set here, not by nginx: whoami itself answered the outpost's redirect to sign-in. */
  26  |   redirected?: boolean;
  27  | }
  28  | 
  29  | const SIGNED_OUT: WhoAmI = {
  30  |   enabled: 'true',
  31  |   email: '',
  32  |   elevated: false,
  33  |   entitlements: { voters: false, individuals: false, blocks: false, curator: false, preview: false },
  34  |   redirected: true,
  35  | };
  36  | 
  37  | async function whoami(request: import('@playwright/test').APIRequestContext, headers: Record<string, string> = {}): Promise<WhoAmI> {
> 38  |   const res = await request.get('/auth/whoami', { headers, maxRedirects: 0 });
      |                             ^ Error: apiRequestContext.get: connect ECONNREFUSED 10.1.105.22:80
  39  |   if (res.status() === 302) {
  40  |     expect(res.headers()['location'], 'a redirected /auth/whoami goes to sign-in').toMatch(/\/application\/o\/authorize\/|outpost\.goauthentik\.io/);
  41  |     return SIGNED_OUT;
  42  |   }
  43  |   expect(res.status(), '/auth/whoami answers 200').toBe(200);
  44  |   expect(res.headers()['cache-control']).toContain('no-store');
  45  |   return (await res.json()) as WhoAmI;
  46  | }
  47  | 
  48  | test.describe('sign-in and premium sections', () => {
  49  |   test('/auth/whoami returns well-formed JSON', async ({ request }) => {
  50  |     const me = await whoami(request);
  51  |     expect(['true', 'false']).toContain(me.enabled);
  52  |     expect(typeof me.email).toBe('string');
  53  |     expect(typeof me.elevated).toBe('boolean');
  54  |     // Per-section entitlements (sites#305), always all four booleans.
  55  |     expect(Object.keys(me.entitlements).sort()).toEqual(['blocks', 'curator', 'individuals', 'preview', 'voters']);
  56  |     for (const v of Object.values(me.entitlements)) expect(typeof v).toBe('boolean');
  57  |     expect(me.elevated).toBe(me.entitlements.voters || me.entitlements.individuals || me.entitlements.blocks);
  58  |     if (me.enabled === 'false') {
  59  |       expect(me.email).toBe('');
  60  |       expect(me.elevated).toBe(false);
  61  |       expect(Object.values(me.entitlements).some(Boolean)).toBe(false);
  62  |     }
  63  |   });
  64  | 
  65  |   test('a forged identity header grants nothing where Authentik is off', async ({ request }) => {
  66  |     const me = await whoami(request, { 'X-authentik-email': 'someone@elect.info' });
  67  |     test.skip(me.enabled === 'true', 'host has Authentik: Traefik sets the header');
  68  |     expect(me.email).toBe('');
  69  |     expect(me.elevated).toBe(false);
  70  |   });
  71  | 
  72  |   for (const group of ['elect-info-premium', 'ei-voter-viewers', 'ei-donor-viewers', 'ei-block-viewers', 'elect-news-curators', 'ei-preview-viewers']) {
  73  |     test(`a forged ${group} group header grants nothing where Authentik is off`, async ({ request }) => {
  74  |       const me = await whoami(request, { 'X-authentik-email': 'someone@example.com', 'X-authentik-groups': group });
  75  |       test.skip(me.enabled === 'true', 'host has Authentik: Traefik sets the headers');
  76  |       expect(me.email).toBe('');
  77  |       expect(me.elevated).toBe(false);
  78  |       expect(Object.values(me.entitlements).some(Boolean)).toBe(false);
  79  |     });
  80  |   }
  81  | 
  82  |   for (const { path } of PREMIUM) {
  83  |     test(`${path} answers 200 for the test identity, or asks a signed-out one to sign in`, async ({ page, request }) => {
  84  |       const me = await whoami(request);
  85  |       // Where /auth/ asks an anonymous visitor to sign in, so must the premium sections.
  86  |       if (me.redirected) {
  87  |         expect(await premiumGated(request, path), `${path} sends a signed-out visitor to sign-in`).toBe(true);
  88  |         return;
  89  |       }
  90  |       test.skip(me.enabled === 'true' && !me.elevated, 'signed in without elevated access');
  91  |       const response = await page.goto(path);
  92  |       expect(response?.status()).toBe(200);
  93  |     });
  94  |   }
  95  | 
  96  |   // The placeholder became the voter search page (sites#277, tests/voters.spec.ts).
  97  |   test('/voters/ is the voter search page', async ({ page, request }) => {
  98  |     const me = await whoami(request);
  99  |     // A signed-in visitor without the voters entitlement (the front door as preview-e2e, ops#703) gets the premium notice.
  100 |     test.skip(me.enabled === 'true' && !me.entitlements.voters, 'no voters access (signed out, or signed in without it)');
  101 |     await page.goto('/voters/');
  102 |     await expect(page.locator('h1')).toHaveText('Voters');
  103 |     await expect(page.locator('script[src="/js/voter-index.js"]')).toHaveCount(1);
  104 |     await expect(page.locator('.coming-soon')).toHaveCount(0);
  105 |   });
  106 | 
  107 |   test('the premium notice page is not directly reachable', async ({ page }) => {
  108 |     const response = await page.goto('/premium-required.html');
  109 |     expect(response?.status()).toBe(404);
  110 |   });
  111 | 
  112 |   test('homepage premium cards follow the account', async ({ page, request }) => {
  113 |     const me = await whoami(request);
  114 |     await page.goto('/');
  115 |     for (const { path, label } of PREMIUM) {
  116 |       const card = page.locator(`[data-premium-href="${path}"]`);
  117 |       await expect(card).toHaveCount(1);
  118 |       await expect(card).toContainText(label);
  119 |       const area = path.replace(/\//g, '') as 'voters' | 'individuals' | 'blocks';
  120 |       if (me.enabled === 'true' && me.entitlements[area]) {
  121 |         await expect(page.locator(`a[data-premium-href="${path}"]`)).toHaveAttribute('href', path);
  122 |         await expect(card).not.toHaveClass(/entity-card--disabled/);
  123 |       } else {
  124 |         await expect(card).toHaveClass(/entity-card--disabled/);
  125 |         await expect(page.locator(`a[data-premium-href="${path}"]`)).toHaveCount(0);
  126 |       }
  127 |     }
  128 |   });
  129 | 
  130 |   test('account slot shows the signed-in email where Authentik is on', async ({ page, request }) => {
  131 |     const me = await whoami(request);
  132 |     await page.goto('/');
  133 |     const slot = page.locator('#auth-slot');
  134 |     if (me.enabled !== 'true') {
  135 |       await expect(slot).toBeEmpty();
  136 |       return;
  137 |     }
  138 |     if (me.email) {
```