# Instructions

- Following Playwright test failed.
- Explain why, be concise, respect Playwright best practices.
- Provide a snippet of code with the fix, if possible.

# Test info

- Name: tests/ui/cms-proxy.spec.ts >> /api/cms/ proxy >> /api/cms/slug-lookup?collection=politicians&path=x is 404
- Location: tests/ui/cms-proxy.spec.ts:30:9

# Error details

```
Error: apiRequestContext.get: connect ECONNREFUSED 10.1.105.22:80
Call log:
  - → GET http://10.1.105.22/api/cms/slug-lookup?collection=politicians&path=x
    - user-agent: Playwright/1.64.1 (x64; ubuntu 22.04) node/20.9 CI/1
    - accept: */*
    - accept-encoding: gzip,deflate,br
    - X-authentik-email: steve@elect.info

```

# Test source

```ts
  1  | import { test, expect } from '@playwright/test';
  2  | 
  3  | /*
  4  |  * /api/cms/ is a public, anonymous, GET-only window onto Payload (nginx.conf): only the entity collections the pages
  5  |  * read are proxied, everything else is 404 at nginx, and identity/credential headers are cleared. On 2026-10-15 a
  6  |  * forged X-authentik-email signed in as a CMS admin through this proxy (/api/cms/users/me). These checks don't need
  7  |  * the CMS to be up: blocked paths never reach it.
  8  |  */
  9  | 
  10 | const ALLOWED = ['politicians', 'committees', 'code-sources', 'contributors', 'data-sources'];
  11 | 
  12 | test.describe('/api/cms/ proxy', () => {
  13 |   for (const path of [
  14 |     '/api/cms/users/me',
  15 |     '/api/cms/users',
  16 |     '/api/cms/users/login',
  17 |     '/api/cms/payload-mcp-api-keys',
  18 |     '/api/cms/payload-preferences',
  19 |     '/api/cms/payload-locked-documents',
  20 |     '/api/cms/posts',
  21 |     '/api/cms/media',
  22 |     '/api/cms/graphql',
  23 |     '/api/cms/mcp',
  24 |     '/api/cms/slug-lookup?collection=politicians&path=x',
  25 |     '/api/cms/politicians/a/b',
  26 |     '/api/cms/politicians/%2e%2e/users/me',
  27 |     '/api/cms/politicians%2F..%2Fusers%2Fme',
  28 |     '/api/cms/',
  29 |   ]) {
  30 |     test(`${path} is 404`, async ({ request }) => {
> 31 |       const res = await request.get(path, {
     |                                 ^ Error: apiRequestContext.get: connect ECONNREFUSED 10.1.105.22:80
  32 |         headers: { 'X-authentik-email': 'steve@elect.info' },
  33 |         maxRedirects: 0,
  34 |       });
  35 |       // Traefik refuses an encoded slash (400) before nginx sees it, on the front door.
  36 |       if (path.includes('%2F')) expect([400, 404]).toContain(res.status());
  37 |       else expect(res.status()).toBe(404);
  38 |     });
  39 |   }
  40 | 
  41 |   test('writes are 405', async ({ request }) => {
  42 |     for (const collection of ALLOWED) {
  43 |       expect((await request.post(`/api/cms/${collection}`, { data: {} })).status(), collection).toBe(405);
  44 |     }
  45 |     expect((await request.post('/api/cms/users/login', { data: {} })).status()).toBe(405);
  46 |   });
  47 | 
  48 |   test('the allowed collections reach the CMS', async ({ request }) => {
  49 |     for (const collection of ALLOWED) {
  50 |       // 200 when the CMS is up; 5xx from nginx when it is down. Never the nginx 404/405.
  51 |       const status = (await request.get(`/api/cms/${collection}?limit=0`)).status();
  52 |       expect([404, 405], `${collection}: ${status}`).not.toContain(status);
  53 |     }
  54 |   });
  55 | });
  56 | 
```