# Instructions

- Following Playwright test failed.
- Explain why, be concise, respect Playwright best practices.
- Provide a snippet of code with the fix, if possible.

# Test info

- Name: tests/ui/cms-proxy.spec.ts >> /api/cms/ proxy >> the allowed collections reach the CMS
- Location: tests/ui/cms-proxy.spec.ts:46:7

# Error details

```
Error: contributors: 404

expect(received).not.toContain(expected) // indexOf

Expected value: not 404
Received array:     [404, 405]
```

# Test source

```ts
  1  | import { test, expect } from '@playwright/test';
  2  | 
  3  | /*
  4  |  * /api/cms/ is a public, anonymous, GET-only window onto Payload (nginx.conf): only the entity collections the pages
  5  |  * read are proxied, everything else is 404 at nginx, and identity/credential headers are cleared. On 2026-10-15 a
  6  |  * forged X-authentik-email signed in as a CMS admin through this proxy (/api/cms/users/me). These checks don't need
  7  |  * the CMS to be up: blocked paths never reach it.
  8  |  */
  9  | 
  10 | const ALLOWED = ['politicians', 'committees', 'code-sources', 'contributors', 'data-sources'];
  11 | 
  12 | test.describe('/api/cms/ proxy', () => {
  13 |   for (const path of [
  14 |     '/api/cms/users/me',
  15 |     '/api/cms/users',
  16 |     '/api/cms/users/login',
  17 |     '/api/cms/payload-mcp-api-keys',
  18 |     '/api/cms/payload-preferences',
  19 |     '/api/cms/payload-locked-documents',
  20 |     '/api/cms/posts',
  21 |     '/api/cms/media',
  22 |     '/api/cms/graphql',
  23 |     '/api/cms/mcp',
  24 |     '/api/cms/slug-lookup?collection=politicians&path=x',
  25 |     '/api/cms/politicians/a/b',
  26 |     '/api/cms/politicians/%2e%2e/users/me',
  27 |     '/api/cms/politicians%2F..%2Fusers%2Fme',
  28 |     '/api/cms/',
  29 |   ]) {
  30 |     test(`${path} is 404`, async ({ request }) => {
  31 |       const res = await request.get(path, {
  32 |         headers: { 'X-authentik-email': 'steve@elect.info' },
  33 |         maxRedirects: 0,
  34 |       });
  35 |       expect(res.status()).toBe(404);
  36 |     });
  37 |   }
  38 | 
  39 |   test('writes are 405', async ({ request }) => {
  40 |     for (const collection of ALLOWED) {
  41 |       expect((await request.post(`/api/cms/${collection}`, { data: {} })).status(), collection).toBe(405);
  42 |     }
  43 |     expect((await request.post('/api/cms/users/login', { data: {} })).status()).toBe(405);
  44 |   });
  45 | 
  46 |   test('the allowed collections reach the CMS', async ({ request }) => {
  47 |     for (const collection of ALLOWED) {
  48 |       // 200 when the CMS is up; 5xx from nginx when it is down. Never the nginx 404/405.
  49 |       const status = (await request.get(`/api/cms/${collection}?limit=0`)).status();
> 50 |       expect([404, 405], `${collection}: ${status}`).not.toContain(status);
     |                                                          ^ Error: contributors: 404
  51 |     }
  52 |   });
  53 | });
  54 | 
```