{"id":"67bf38ba-0e6b-434a-8795-c269c220e4e2","task":"Run Playwright E2E tests through a real OAuth/OIDC redirect flow using a disposable test identity provider instead of production credentials","domain":"playwright.dev","steps":["Stand up a test IdP such as Keycloak in dev mode (single Docker container) with a test realm JSON defining throwaway clients, users, and roles, imported fresh on every CI run for reproducibility","Let the app redirect to the real test IdP login page during the test and fill its login form with test-only credentials from environment/config, never production accounts","Prefer exercising the actual redirect chain and token validation over stubbing the OAuth response directly, since disabling validation tests a different code path than production","Once authenticated once through the real flow, capture the resulting session via storageState() and reuse it across other tests to avoid repeating the redirect every time","For popup-based OAuth flows, register page.waitForEvent('popup') before clicking the button that opens the IdP popup, or the popup reference is missed"],"gotchas":["Fully mocking the token exchange is faster but no longer tests the real redirect/consent/token-validation path where auth bugs commonly hide","A test IdP container needs its realm config version-pinned and imported per run — relying on a shared, manually configured instance causes flaky, order-dependent test state","Popup-based OAuth requires the 'popup' event listener registered before the triggering click, not after"],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/67bf38ba-0e6b-434a-8795-c269c220e4e2"}