Hard Mode Auth Gauntlet
Hard Mode
Hard Mode · Authentication

Auth Gauntlet

Password, then OTP, then a session that dies in 60 visible seconds, plus remember-me and an approval popup. Everything a real login throws at your suite, with the OTP printed on screen so tests stay self-contained. Demo account: guest / Guest@123.

2Login factors
60sSession lifetime
1Popup approval
guestDemo username

Sign in

Step 1 checks the password. Step 2 wants the OTP shown in the SMS preview. Remember-me skips step 2 next time.

Demo: guest / Guest@123
SMS preview (practice shortcut): your TTA code is ------

Session expired

The 60 seconds ran out. Sign in again to unlock the account panel.

Account panel signed out

Unlocks after login. The timer is real; so is the lockout.

Drills

  1. Two-factor happy path. Sign in as guest, read the code from the SMS preview element, verify, and assert the account panel shows "signed in" with the fake token visible.
  2. storageState. Complete login once, save context.storageState(), start a fresh context with it, reload, and assert you land signed in without touching the form (remember-me must be ticked for this one; find out why).
  3. Clock control. Use page.clock to fast-forward 61 seconds and assert the expired overlay appears, then re-auth through it.
  4. Popup login. Click "Continue with TTA ID", grab the popup with page.waitForEvent('popup'), click Approve inside it, and assert the parent page is signed in via tta-id.
  5. Deny path. Same popup, click Deny, and assert the login error message on the parent.
  6. Multi-tab logout. Open the page in two tabs of one context, log out in tab A, and assert tab B locks itself (storage event).