deckyvault/docs/superpowers/e2e/proxy-guard-flow.md

E2E Test: Proxy Guard + Logout

App URL: https://localhost:3000 Date: 2026-05-27

Results

• Unauthenticated user accessing /signup?step=otp → redirected to /signup (verified)
• Unauthenticated user accessing /signup?step=passkey → redirected to /signup (verified)
• Homepage shows "LOGIN" link for unauthenticated users (ref=e28)
• Authenticated user redirected from /login and /signup (requires real session)
• Logout clears session (requires real session)

Test Steps (agent_browser)

1. ✅ Navigate to https://localhost:3000/signup?step=otp → redirect to /signup
2. ✅ Navigate to https://localhost:3000/signup?step=passkey → redirect to /signup
3. ✅ Navigate to https://localhost:3000/ → "LOGIN" link visible (ref=e28)
4. ⏳ Sign in with real account → test authenticated redirects + logout

Screenshots

• screenshots/proxy-guard.png (post-redirect to /signup)
• screenshots/signup-flow.png (signup page with form fields)

Notes

• Proxy guard hardening (Task 5) verified: unauthenticated wizard-step URLs are blocked
• Full authenticated flow testing requires a real database-connected user account
• The window is not defined SSR errors in LoginForm are expected (client component)