feat: Add E2E verification script with Playwright and VNC #132
Conversation
WalkthroughThis PR introduces a comprehensive end-to-end verification framework using Playwright and page objects, adds Django management command for test user setup, includes deployment scripts for environment setup, and documents badge standardization Phase 2 design and E2E verification approach. Changes
Sequence DiagramsequenceDiagram
participant E2E as E2E Test Script
participant VNC as VNC/Display Server
participant PW as Playwright Browser
participant App as wafer.space Web App
participant Django as Django Backend
E2E->>VNC: Spawn VNC server (PyVirtualDisplay)
VNC->>VNC: Initialize headless display
E2E->>PW: Launch browser session (non-headless)
PW->>VNC: Render in VNC display
rect rgb(200, 220, 250)
Note over E2E,Django: Step 1–3: Auth & Project Setup
E2E->>PW: Navigate to login page
PW->>App: GET /accounts/login/
App-->>PW: Login form
E2E->>PW: Fill credentials, submit
PW->>App: POST /accounts/login/
App-->>Django: Validate user
Django-->>App: Auth success
App-->>PW: Redirect to /projects/
E2E->>PW: Navigate to create project
PW->>App: GET /projects/create/
E2E->>PW: Fill name, select slot size, submit
PW->>App: POST /projects/create/
App-->>Django: Create project
Django-->>App: Project ID
App-->>PW: Redirect to /projects/{uuid}/
E2E->>PW: Extract project_id from URL
end
rect rgb(220, 250, 200)
Note over E2E,Django: Step 4–8: File Submit & Hash Mismatch
E2E->>PW: Navigate to file submit page
PW->>App: GET /projects/{uuid}/submit/
E2E->>PW: Submit file with wrong hash
PW->>App: POST /submit/ (wrong sha256)
App-->>Django: Queue download
Django-->>App: Task ID
E2E->>PW: Wait for DOWNLOADING status
E2E->>PW: Wait for DOWNLOADED status
E2E->>PW: Wait for HASH_MISMATCH status
E2E->>PW: Screenshot hash mismatch state
end
rect rgb(250, 220, 200)
Note over E2E,Django: Step 9–13: Correct Hash & Precheck Lifecycle
E2E->>PW: Submit file with correct hash
PW->>App: POST /submit/ (correct sha256)
E2E->>PW: Wait for DOWNLOADING status
E2E->>PW: Wait for HASH_VERIFIED status
E2E->>PW: Wait for PRECHECK_QUEUED status
E2E->>PW: Wait for PRECHECK_RUNNING status
E2E->>PW: Capture precheck logs
E2E->>PW: Click cancel precheck
PW->>App: POST /precheck/cancel/
App-->>Django: Cancel precheck
E2E->>PW: Submit file again
E2E->>PW: Wait for PRECHECK_COMPLETE status
E2E->>PW: Query is_manufacturable()
E2E->>PW: Screenshot final state
E2E->>VNC: Cleanup & close
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related issues
Possibly related PRs
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (3)
scripts/e2e_verify/pages/file_submit.py (1)
23-42: Clarify docstring to reflect actual parameter handling.The docstring states the
sha256_hashparameter should be "without 'sha256:' prefix", but the code defensively strips this prefix if present (lines 40-41). Update the docstring to reflect that the method accepts the hash with or without the prefix.Apply this diff:
def submit_file(self, url: str, sha256_hash: str | None = None) -> None: """Submit a file URL for download. Args: url: URL to download file from - sha256_hash: Optional SHA256 hash for verification - (without 'sha256:' prefix) + sha256_hash: Optional SHA256 hash for verification. + May include 'sha256:' prefix (will be stripped if present). """scripts/e2e_verify/pages/base.py (1)
19-22: Validate path starts with "/" to prevent malformed URLs.The
navigatemethod concatenatesbase_url(which has its trailing slash stripped on line 17) with thepathparameter. Ifpathdoesn't start with"/", this creates malformed URLs like"http://example.compath".Apply this diff to add validation:
def navigate(self, path: str = "") -> None: - """Navigate to a path relative to base_url.""" + """Navigate to a path relative to base_url. + + Args: + path: Path starting with "/" or empty string + """ + if path and not path.startswith("/"): + msg = f"Path must start with '/': {path}" + raise ValueError(msg) url = f"{self.base_url}{path}" self.page.goto(url)scripts/e2e_verify/main.py (1)
153-153: Clarify intent of waiting for empty string in logs.Waiting for logs to contain an empty string (
"") effectively checks whether the logs element exists and is visible, but the intent is not immediately clear.Consider adding a comment or using a more explicit check:
- # Wait for any log content to appear - detail_page.wait_for_logs_contain("", timeout_ms=60_000) + # Wait for logs element to be visible and populated + detail_page.wait_for_logs_contain("", timeout_ms=60_000) # Empty string checks element visibilityOr refactor
wait_for_logs_containto have a separate method likewait_for_logs_visible()for this use case.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (14)
docs/plans/2025-11-29-badge-standardization-phase2.md(1 hunks)docs/plans/2025-11-30-celery-queue-separation-design.md(1 hunks)docs/plans/2025-12-01-e2e-verification-script-design.md(1 hunks)docs/plans/2025-12-01-e2e-verification-script.md(1 hunks)pyproject.toml(1 hunks)scripts/e2e_verify/__init__.py(1 hunks)scripts/e2e_verify/__main__.py(1 hunks)scripts/e2e_verify/main.py(1 hunks)scripts/e2e_verify/pages/__init__.py(1 hunks)scripts/e2e_verify/pages/base.py(1 hunks)scripts/e2e_verify/pages/file_submit.py(1 hunks)scripts/e2e_verify/pages/login.py(1 hunks)scripts/e2e_verify/pages/project_create.py(1 hunks)scripts/e2e_verify/pages/project_detail.py(1 hunks)
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{md,markdown}
📄 CodeRabbit inference engine (CLAUDE.md)
All fenced code blocks in documentation must have a language specifier (e.g.,
python,bash,text). Wrap URLs in angle brackets:<https://example.com>to avoid MD034 lint error. Use proper markdown link syntax for clickable links:[Link text](url).
Files:
docs/plans/2025-11-30-celery-queue-separation-design.mddocs/plans/2025-12-01-e2e-verification-script-design.mddocs/plans/2025-11-29-badge-standardization-phase2.mddocs/plans/2025-12-01-e2e-verification-script.md
{**/requirements*.txt,**/pyproject.toml,**/Makefile,**/*.py,**/Dockerfile*,**/*.env*}
📄 CodeRabbit inference engine (CLAUDE.md)
Never suggest, implement, or add dependencies for Redis, RabbitMQ, or Memcached. Use PostgreSQL via
CELERY_BROKER_URL = sqla+postgresql://...for message queue,CELERY_RESULT_BACKEND = "django-db"for task results, and Django cache framework with database or LocMem backend for caching.
Files:
pyproject.tomlscripts/e2e_verify/pages/project_detail.pyscripts/e2e_verify/pages/file_submit.pyscripts/e2e_verify/pages/__init__.pyscripts/e2e_verify/pages/project_create.pyscripts/e2e_verify/__init__.pyscripts/e2e_verify/pages/login.pyscripts/e2e_verify/main.pyscripts/e2e_verify/pages/base.pyscripts/e2e_verify/__main__.py
**/*.{py,pyi}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{py,pyi}: Never add# noqa,# type: ignore, or similar lint/type suppression comments without explicit user permission. Fix the root cause of linting failures instead. Only request suppression as a last resort after attempting refactoring.
Never create circular imports. Models must never import tasks/views/services. Services can import models and tasks. Views can import models and services. Tasks can only import models. If circular imports are encountered, restructure architecture by moving logic to the services layer or deleting unused methods. Never use local imports as a workaround.
Print statements (T201) must uselogging.getLogger(__name__)instead.
Lines must not exceed 88 characters (E501). Break long lines into multiple lines.
When raising exceptions with f-strings (EM102), assign the message to a variable first instead of inline in the exception.
Never use boolean positional arguments (FBT002/3). Use keyword-only arguments instead:def fn(*, flag=True).
Never hardcode passwords directly (S105). Use constants instead:TEST_PASSWORD = "...".
All public functions must have type hints. Usefrom __future__ import annotationsfor forward references. Fix mypy errors instead of ignoring them.
When handling exceptions, catch specific exceptions and use exception chaining withraise ... from exc. Never use bareexceptor overly broadExceptioncatches.
Worker restart is not required for Celery task changes in the development environment (auto-restarts on code changes). If seeing 'unregistered task' errors, the issue is code configuration, not missing restart. EnsureCELERY_BEAT_SCHEDULEreferences the actual decorated function name (e.g.,"app.tasks.process_check_queue"), not a variable alias.
Files:
scripts/e2e_verify/pages/project_detail.pyscripts/e2e_verify/pages/file_submit.pyscripts/e2e_verify/pages/__init__.pyscripts/e2e_verify/pages/project_create.pyscripts/e2e_verify/__init__.pyscripts/e2e_verify/pages/login.pyscripts/e2e_verify/main.pyscripts/e2e_verify/pages/base.pyscripts/e2e_verify/__main__.py
🧠 Learnings (2)
📚 Learning: 2025-11-30T02:00:45.636Z
Learnt from: CR
Repo: wafer-space/platform.wafer.space PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-30T02:00:45.636Z
Learning: Applies to {**/requirements*.txt,**/pyproject.toml,**/Makefile,**/*.py,**/Dockerfile*,**/*.env*} : Never suggest, implement, or add dependencies for Redis, RabbitMQ, or Memcached. Use PostgreSQL via `CELERY_BROKER_URL = sqla+postgresql://...` for message queue, `CELERY_RESULT_BACKEND = "django-db"` for task results, and Django cache framework with database or LocMem backend for caching.
Applied to files:
docs/plans/2025-11-30-celery-queue-separation-design.md
📚 Learning: 2025-11-30T02:00:45.636Z
Learnt from: CR
Repo: wafer-space/platform.wafer.space PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-30T02:00:45.636Z
Learning: Applies to tests/browser/**/*.py : In browser tests, use `WebDriverWait` instead of `time.sleep()`. Screenshots are auto-captured on failure to `tests/browser/screenshots/`. Use Page Object pattern (see `tests/browser/pages/`).
Applied to files:
scripts/e2e_verify/pages/base.py
🧬 Code graph analysis (6)
scripts/e2e_verify/pages/project_detail.py (2)
scripts/e2e_verify/pages/base.py (1)
navigate(19-22)tests/browser/pages/base_page.py (1)
click(43-47)
scripts/e2e_verify/pages/file_submit.py (2)
scripts/e2e_verify/pages/base.py (1)
navigate(19-22)tests/browser/pages/base_page.py (1)
click(43-47)
scripts/e2e_verify/pages/__init__.py (3)
scripts/e2e_verify/pages/file_submit.py (1)
FileSubmitPage(16-48)scripts/e2e_verify/pages/project_create.py (1)
ProjectCreatePage(16-49)scripts/e2e_verify/pages/project_detail.py (1)
ProjectDetailPage(16-132)
scripts/e2e_verify/pages/project_create.py (2)
scripts/e2e_verify/pages/base.py (1)
navigate(19-22)tests/browser/pages/base_page.py (1)
click(43-47)
scripts/e2e_verify/pages/login.py (2)
scripts/e2e_verify/pages/base.py (1)
navigate(19-22)tests/browser/pages/base_page.py (1)
click(43-47)
scripts/e2e_verify/main.py (4)
scripts/e2e_verify/pages/file_submit.py (2)
FileSubmitPage(16-48)submit_file(23-48)scripts/e2e_verify/pages/project_create.py (2)
ProjectCreatePage(16-49)create_project(22-49)scripts/e2e_verify/pages/project_detail.py (11)
ProjectDetailPage(16-132)wait_for_downloaded(46-49)wait_for_hash_mismatch(60-63)wait_for_hash_verified(55-58)wait_for_precheck_running(74-77)wait_for_logs_contain(128-132)get_precheck_logs(121-126)click_cancel_precheck(109-115)wait_for_precheck_cancelled(87-90)wait_for_precheck_complete(79-85)is_manufacturable(92-103)scripts/e2e_verify/pages/base.py (1)
screenshot(24-30)
🪛 LanguageTool
docs/plans/2025-12-01-e2e-verification-script.md
[style] ~806-~806: Consider using a different verb for a more formal wording.
Context: ...pe Check Files: - Modify: Various (fix any issues) Step 1: Run linting R...
(FIX_RESOLVE)
🪛 markdownlint-cli2 (0.18.1)
docs/plans/2025-12-01-e2e-verification-script-design.md
33-33: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
139-139: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
docs/plans/2025-12-01-e2e-verification-script.md
18-18: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
31-31: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
36-36: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
41-41: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
57-57: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
98-98: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
112-112: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
155-155: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
160-160: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
174-174: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
218-218: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
223-223: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
237-237: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
291-291: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
296-296: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
310-310: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
364-364: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
369-369: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
383-383: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
520-520: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
525-525: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
539-539: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
789-789: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
794-794: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
808-808: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
813-813: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
818-818: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
832-832: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
837-837: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
842-842: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
857-857: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
🪛 Ruff (0.14.6)
scripts/e2e_verify/main.py
47-47: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
50-50: Unused noqa directive (non-enabled: PLR0915)
Remove unused noqa directive
(RUF100)
63-63: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
64-64: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
65-65: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
66-66: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
67-67: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
215-215: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
216-216: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
217-217: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
218-218: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
223-223: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
224-224: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
225-225: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
226-226: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: pytest
🔇 Additional comments (14)
docs/plans/2025-11-30-celery-queue-separation-design.md (1)
1-132: LGTM! Well-structured design document.The Celery queue separation design is comprehensive and follows all coding guidelines. All code blocks have proper language specifiers, the approach of using explicit
queue=decorators is sound, and the document correctly avoids Redis/RabbitMQ/Memcached dependencies in favor of PostgreSQL-based solutions.docs/plans/2025-11-29-badge-standardization-phase2.md (1)
1-134: LGTM! Comprehensive design document.The badge standardization Phase 2 design is well-structured with clear scope, implementation order, and verification steps. All code blocks have proper language specifiers (
python,json,javascript,bash), and the incremental vertical-slices approach is sound.scripts/e2e_verify/__init__.py (1)
1-1: LGTM!Standard package initialization with appropriate docstring.
scripts/e2e_verify/__main__.py (1)
1-6: LGTM!Standard and correct entry point pattern for making the package executable with
python -m scripts.e2e_verify.scripts/e2e_verify/pages/__init__.py (1)
1-15: LGTM!Clean package initialization with proper
__all__exports. All page objects are correctly imported and exposed.scripts/e2e_verify/pages/project_create.py (1)
16-49: LGTM!The
ProjectCreatePageimplementation is well-structured with proper type hints, error handling, and follows the Page Object Model pattern. The regex patterns are sufficient for extracting the project UUID from the redirect URL.scripts/e2e_verify/pages/login.py (1)
22-39: LGTM!The login flow correctly uses Playwright's
expectfor the redirect wait and leverages auto-wait for form interactions.scripts/e2e_verify/main.py (3)
69-70: LGTM - VNC display configuration.The VNC server configuration with appropriate display size and port is well-designed for remote monitoring.
222-227: Broad exception catch is appropriate here.While the coding guidelines prefer specific exception types, this top-level exception handler ensures the VNC display is properly stopped in the
finallyblock regardless of the failure type, which is appropriate for a CLI script.
47-47: Remove unused noqa directives.Static analysis reports that the
# noqa: T201directives are unused because the T201 rule (print statements) is not enabled in the project's linting configuration. These directives add noise without providing value.Apply this diff to remove the unused directives:
- print(f"[{timestamp}] Step {step}/{total}: {message}") # noqa: T201 + print(f"[{timestamp}] Step {step}/{total}: {message}")- print("=" * 60) # noqa: T201 - print(f" VNC server starting on port {vnc_port}") # noqa: T201 - print(f" Connect to watch: vncviewer localhost:{vnc_port}") # noqa: T201 - print("=" * 60) # noqa: T201 - print() # noqa: T201 + print("=" * 60) + print(f" VNC server starting on port {vnc_port}") + print(f" Connect to watch: vncviewer localhost:{vnc_port}") + print("=" * 60) + print()- print() # noqa: T201 - print("=" * 60) # noqa: T201 - print(" E2E VERIFICATION COMPLETE") # noqa: T201 - print("=" * 60) # noqa: T201 + print() + print("=" * 60) + print(" E2E VERIFICATION COMPLETE") + print("=" * 60)- print() # noqa: T201 - print("=" * 60) # noqa: T201 - print(f" E2E VERIFICATION FAILED: {e}") # noqa: T201 - print("=" * 60) # noqa: T201 + print() + print("=" * 60) + print(f" E2E VERIFICATION FAILED: {e}") + print("=" * 60)Also applies to: 63-67, 215-218, 223-226
⛔ Skipped due to learnings
Learnt from: CR Repo: wafer-space/platform.wafer.space PR: 0 File: CLAUDE.md:0-0 Timestamp: 2025-11-30T02:00:45.636Z Learning: Applies to **/*.{py,pyi} : Print statements (T201) must use `logging.getLogger(__name__)` instead.Learnt from: CR Repo: wafer-space/platform.wafer.space PR: 0 File: CLAUDE.md:0-0 Timestamp: 2025-11-30T02:00:45.636Z Learning: Applies to **/*.{py,pyi} : Never add `# noqa`, `# type: ignore`, or similar lint/type suppression comments without explicit user permission. Fix the root cause of linting failures instead. Only request suppression as a last resort after attempting refactoring.scripts/e2e_verify/pages/project_detail.py (3)
19-23: LGTM - Timeout constants.Using class-level timeout constants provides clear defaults while allowing method-level overrides, which is well-suited for long-running operations like prechecks.
92-103: LGTM - Correct manufacturable status detection.The logic correctly checks for "Not Manufacturable" first (returning False) before checking for "Manufacturable", avoiding false positives where "Not Manufacturable" contains "Manufacturable" as a substring.
109-115: LGTM - Dialog handler.Setting up the dialog handler before clicking the cancel button correctly handles the confirmation dialog. The lambda is appropriately simple for this use case.
docs/plans/2025-12-01-e2e-verification-script.md (1)
1-877: LGTM - Implementation plan.The implementation plan is comprehensive and well-structured with clear tasks, steps, and expected outcomes for building the E2E verification suite.
| ``` | ||
| scripts/ | ||
| └── e2e_verify/ | ||
| ├── __init__.py | ||
| ├── __main__.py # Entry point for `python -m e2e_verify` | ||
| ├── main.py # CLI and main flow orchestration | ||
| └── pages/ # Page Object Models | ||
| ├── __init__.py | ||
| ├── base.py # BasePage with common methods | ||
| ├── login.py # LoginPage | ||
| ├── project_create.py | ||
| ├── project_detail.py | ||
| └── file_submit.py | ||
| ``` |
There was a problem hiding this comment.
Add language specifier to fenced code block.
The directory structure diagram is missing a language specifier.
As per coding guidelines, all fenced code blocks must have a language specifier. Apply this diff:
-```
+```text
scripts/
└── e2e_verify/🧰 Tools
🪛 markdownlint-cli2 (0.18.1)
33-33: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
In docs/plans/2025-12-01-e2e-verification-script-design.md around lines 33 to 46
the fenced code block showing the directory structure lacks a language
specifier; update the opening fence from ``` to ```text so the block begins with
```text and leave the block content unchanged to comply with the coding
guidelines requiring a language specifier for all fenced code blocks.
| ``` | ||
| ============================================================ | ||
| VNC server starting on port 5901 | ||
| Connect to watch: vncviewer localhost:5901 | ||
| ============================================================ | ||
| [14:32:01] Step 1/13: Logging in... | ||
| [14:32:05] Step 1/13: Login successful ✓ | ||
| [14:32:05] Step 2/13: Creating project with quarter slot size... | ||
| [14:32:08] Step 2/13: Project created: a1b2c3d4-... ✓ | ||
| ... | ||
| [18:45:23] Step 13/13: Precheck PASSED - Design is manufacturable ✓ | ||
| ============================================================ | ||
| E2E VERIFICATION COMPLETE | ||
| ============================================================ | ||
| ``` | ||
|
|
There was a problem hiding this comment.
Add language specifier to fenced code block.
The example output is missing a language specifier.
As per coding guidelines, all fenced code blocks must have a language specifier. Apply this diff:
-```
+```text
============================================================
VNC server starting on port 5901🧰 Tools
🪛 markdownlint-cli2 (0.18.1)
139-139: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
In docs/plans/2025-12-01-e2e-verification-script-design.md around lines 139 to
156, the fenced code block showing the sample E2E output is missing a language
specifier; update the opening fence from ``` to ```text so the block begins with
a language tag (and ensure the closing fence remains ```), preserving the block
contents and any surrounding spacing.
| "honcho>=2.0.0", | ||
| "ipdb==0.13.13", | ||
| "mypy==1.18.2", | ||
| "playwright>=1.40", |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
playwright pypi available versions security advisories 2025
💡 Result:
Summary (as of Dec 1, 2025)
-
PyPI recent/available Playwright releases (select recent): 1.56.0 (latest, released Nov 11, 2025), 1.55.0 (Aug 28, 2025), 1.54.0 (Jul 22, 2025). See full release history on PyPI. [1]
-
Major 2025 security advisory (public):
- CVE-2025-59288 / GHSA-7mvr-c777-76hp — Playwright installer scripts used curl -k/--insecure when downloading browser binaries, enabling MitM and potential remote code execution. A fix/patched release was published (patched in 1.55.1 / later; 1.56.0 includes related fixes). Upgrade to >=1.55.1 (prefer latest). [2][1]
-
Other related CVEs where Playwright is a component:
- CVE-2025-34267 — an issue in Flowise that allows RCE via insecure use of integrated modules (Puppeteer/Playwright); impact is on Flowise when configured as described, not a direct Playwright core bug. Review the NVD entry for details. [3]
Recommended action
- Upgrade to the latest Playwright release on PyPI (1.56.0 as of Nov 11, 2025) or at minimum >=1.55.1. Audit any installer/custom scripts that download browser binaries and ensure TLS certificate validation. [1][2]
Sources
- PyPI — playwright release history (1.56.0 released Nov 11, 2025). [1]
- GitHub Advisory / GHSA and aggregated advisories for CVE-2025-59288 (details, patched versions). [2]
- NVD — CVE-2025-34267 (Flowise/Puppeteer/Playwright component issue). [3]
🌐 Web query:
pyvirtualdisplay pypi available versions security advisories 2025
💡 Result:
Summary (as of Dec 1, 2025)
- PyVirtualDisplay latest release on PyPI: 3.0 (uploaded Feb 13, 2022). (pypi.org)
- Older published versions (examples): 0.2.1, 0.2.4 (historical listings on PyPI). (pypi.org)
- Distribution builds (examples) show OS package rebuilds referencing v3.0 in 2023–2025. (packages.altlinux.org)
- Security advisories / CVEs: I found no public CVE or vendor security advisory specifically for pyvirtualdisplay (no listings in NVD/CVE feeds or common vulnerability databases) up to Dec 1, 2025. (Searches of PyPI/NVD and security DBs returned no pyvirtualdisplay-specific advisories.) (pypi.org)
If you want, I can:
- monitor NVD/GitHub advisories and notify you of new CVEs, or
- check package contents (source tarball) for risky patterns (e.g., exec of untrusted data). Which would you prefer?
Citations:
- 1: https://pypi.org/pypi/PyVirtualDisplay?utm_source=openai
- 2: https://pypi.org/project/PyVirtualDisplay/0.2.1/?utm_source=openai
- 3: https://packages.altlinux.org/en/sisyphus_riscv64/srpms/python3-module-pyvirtualdisplay/?utm_source=openai
- 4: https://pypi.org/pypi/PyVirtualDisplay?utm_source=openai
Upgrade playwright to >=1.55.1 to address security vulnerability.
Playwright versions prior to 1.55.1 are affected by CVE-2025-59288, where installer scripts use insecure download methods (curl -k/--insecure) that enable man-in-the-middle attacks and potential remote code execution. Update the minimum version from >=1.40 to >=1.55.1 (or >=1.56.0 for the latest release). The pyvirtualdisplay>=3.0 constraint is acceptable with no known security advisories.
🤖 Prompt for AI Agents
In pyproject.toml at line 150, the playwright dependency minimum is set to
"playwright>=1.40" which is vulnerable (CVE-2025-59288); update the constraint
to at least "playwright>=1.55.1" (or ">=1.56.0" for the latest) to address the
security issue, then run your lockfile/installer update (poetry lock or
pip-tools/requirements regen) and verify tests/builds to ensure no breakages
from the newer Playwright version.
| print(f"[{timestamp}] Step {step}/{total}: {message}") # noqa: T201 | ||
|
|
||
|
|
||
| def run_full_flow(base_url: str, vnc_port: int = 5901) -> bool: # noqa: PLR0915 |
There was a problem hiding this comment.
Remove unused noqa directive.
The # noqa: PLR0915 directive is unused.
Apply this diff:
-def run_full_flow(base_url: str, vnc_port: int = 5901) -> bool: # noqa: PLR0915
+def run_full_flow(base_url: str, vnc_port: int = 5901) -> bool:📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| def run_full_flow(base_url: str, vnc_port: int = 5901) -> bool: # noqa: PLR0915 | |
| def run_full_flow(base_url: str, vnc_port: int = 5901) -> bool: |
🧰 Tools
🪛 Ruff (0.14.6)
50-50: Unused noqa directive (non-enabled: PLR0915)
Remove unused noqa directive
(RUF100)
🤖 Prompt for AI Agents
In scripts/e2e_verify/main.py around line 50, the function signature includes an
unnecessary noqa directive "# noqa: PLR0915"; remove the unused directive so the
line reads without the comment. Ensure no other noqa for PLR0915 is present on
the same line and run linters/tests to confirm no other suppression is required.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
deployment/scripts/README.md (1)
117-137: Clarify secrets path to align with$SECRETS_DIRused by scriptsThe instructions hard-code
/home/django/.secrets/e2e-test-password, while07-setup-e2e-test-user.shuses$SECRETS_DIR/e2e-test-password. To avoid confusion in multi-environment setups, consider phrasing the path as$SECRETS_DIR/e2e-test-passwordand noting that the default is/home/django/.secrets/e2e-test-password.wafer_space/users/management/commands/create_e2e_test_user.py (1)
45-49: CLI--passwordoption can leak secrets; prefer env/secret-based flowAllowing
--passwordis convenient, but it exposes the value in shell history and process listings. For production/staging automation, consider recommending (or enforcing) the env/secret-based path (the secrets file +E2E_TEST_PASSWORD) and treating--passwordmainly as a local/dev convenience, e.g., by adjusting the help text or related docs. As per coding guidelines, prefer secret handling approaches that minimize credential exposure.Also applies to: 56-56
deployment/scripts/07-setup-e2e-test-user.sh (1)
42-56: Minor shell robustness tweaks (password read and env checks)The script is clear and defensively checks for the secrets directory and file. A couple of non-blocking shell nits you might consider:
Avoid the useless
catwhen reading the password:E2E_TEST_PASSWORD=$(tr -d '\n' < "$E2E_SECRET_FILE")Optionally, fail fast if
APP_DIRorDJANGO_USERare empty beforecd/sudo, to catch a misconfigureddetect-environment.shearly.These are small tweaks but would make the script a bit more robust.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
deployment/scripts/07-setup-e2e-test-user.sh(1 hunks)deployment/scripts/README.md(1 hunks)wafer_space/users/management/commands/create_e2e_test_user.py(1 hunks)
🧰 Additional context used
📓 Path-based instructions (4)
{config/settings/**/*.py,deployment/scripts/**/*.sh,docs/oauth_setup.md,.env.example}
📄 CodeRabbit inference engine (CLAUDE.md)
When adding new secrets, set to
Noneinbase.py, override in each environment file (dev.py, stage.py, prod.py), add secret file to the secrets repo, updatedeployment/scripts/03a-update-env-secrets.sh, and updatedocs/oauth_setup.mdand.env.example.
Files:
deployment/scripts/07-setup-e2e-test-user.sh
**/*.{md,markdown}
📄 CodeRabbit inference engine (CLAUDE.md)
All fenced code blocks in documentation must have a language specifier (e.g.,
python,bash,text). Wrap URLs in angle brackets:<https://example.com>to avoid MD034 lint error. Use proper markdown link syntax for clickable links:[Link text](url).
Files:
deployment/scripts/README.md
{**/requirements*.txt,**/pyproject.toml,**/Makefile,**/*.py,**/Dockerfile*,**/*.env*}
📄 CodeRabbit inference engine (CLAUDE.md)
Never suggest, implement, or add dependencies for Redis, RabbitMQ, or Memcached. Use PostgreSQL via
CELERY_BROKER_URL = sqla+postgresql://...for message queue,CELERY_RESULT_BACKEND = "django-db"for task results, and Django cache framework with database or LocMem backend for caching.
Files:
wafer_space/users/management/commands/create_e2e_test_user.py
**/*.{py,pyi}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{py,pyi}: Never add# noqa,# type: ignore, or similar lint/type suppression comments without explicit user permission. Fix the root cause of linting failures instead. Only request suppression as a last resort after attempting refactoring.
Never create circular imports. Models must never import tasks/views/services. Services can import models and tasks. Views can import models and services. Tasks can only import models. If circular imports are encountered, restructure architecture by moving logic to the services layer or deleting unused methods. Never use local imports as a workaround.
Print statements (T201) must uselogging.getLogger(__name__)instead.
Lines must not exceed 88 characters (E501). Break long lines into multiple lines.
When raising exceptions with f-strings (EM102), assign the message to a variable first instead of inline in the exception.
Never use boolean positional arguments (FBT002/3). Use keyword-only arguments instead:def fn(*, flag=True).
Never hardcode passwords directly (S105). Use constants instead:TEST_PASSWORD = "...".
All public functions must have type hints. Usefrom __future__ import annotationsfor forward references. Fix mypy errors instead of ignoring them.
When handling exceptions, catch specific exceptions and use exception chaining withraise ... from exc. Never use bareexceptor overly broadExceptioncatches.
Worker restart is not required for Celery task changes in the development environment (auto-restarts on code changes). If seeing 'unregistered task' errors, the issue is code configuration, not missing restart. EnsureCELERY_BEAT_SCHEDULEreferences the actual decorated function name (e.g.,"app.tasks.process_check_queue"), not a variable alias.
Files:
wafer_space/users/management/commands/create_e2e_test_user.py
🧬 Code graph analysis (1)
wafer_space/users/management/commands/create_e2e_test_user.py (3)
wafer_space/users/models.py (1)
User(7-26)wafer_space/users/tests/factories.py (1)
password(18-31)wafer_space/conftest.py (1)
user(13-14)
🪛 Ruff (0.14.6)
wafer_space/users/management/commands/create_e2e_test_user.py
52-52: Unused method argument: args
(ARG002)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: pytest
🔇 Additional comments (1)
wafer_space/users/management/commands/create_e2e_test_user.py (1)
51-52: Address Ruff ARG002: unusedargsparameter inhandleRuff flags
argsas unused. Since the command doesn’t use positional args, you can rename the parameter to make that explicit and satisfy linting:- def handle(self, *args: Any, **options: Any) -> None: + def handle(self, *_args: Any, **options: Any) -> None:This keeps the Django management command signature compatible while avoiding the unused-argument warning.
⛔ Skipped due to learnings
Learnt from: mithro Repo: wafer-space/platform.wafer.space PR: 45 File: wafer_space/projects/tests/test_content_processors.py:50-62 Timestamp: 2025-11-26T00:22:31.850Z Learning: In the wafer-space/platform.wafer.space project, ARG002 (unused function argument) is intentionally disabled in pyproject.toml. Mock/test implementations of abstract interfaces may have unused parameters to match the signature, and this is an accepted pattern.Learnt from: CR Repo: wafer-space/platform.wafer.space PR: 0 File: CLAUDE.md:0-0 Timestamp: 2025-11-30T02:00:45.636Z Learning: Applies to **/*.{py,pyi} : Never use boolean positional arguments (FBT002/3). Use keyword-only arguments instead: `def fn(*, flag=True)`.
Documents the remaining work to complete badge standardization: - Templates to convert (7 locations) - New model methods needed (DownloadAttempt, Project, Notification) - Server-rendered badge_html approach for real-time updates - Vertical slices implementation order - Intentional exclusions with rationale 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Add playwright>=1.40 and pyvirtualdisplay>=3.0 to dev dependencies for E2E verification script. These will be used to create a standalone browser automation script with VNC server support for live monitoring. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Created basic package structure for E2E verification script: - scripts/e2e_verify/__init__.py: Package docstring - scripts/e2e_verify/__main__.py: Entry point (imports .main) - scripts/e2e_verify/pages/__init__.py: Page objects placeholder Note: __main__.py imports from .main which will be created in Task 8. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
- Add Django management command `create_e2e_test_user` that: - Creates or updates a test user for E2E verification - Sets password from environment variable or command argument - Creates verified email address (required for login) - Add deployment script `07-setup-e2e-test-user.sh` that: - Reads password from secrets repository - Calls the management command as django user - Provides clear instructions if secret is missing - Update deployment README with new script documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Match the actual filename in the secrets repository. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Creates E2E test user with hardcoded password 'test' for local development environment. Usage: make setup-test-user 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
mithro
force-pushed
the
feature/e2e-verify
branch
from
db691b6 to
b5fa79e
Compare
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Nitpick comments (2)
wafer_space/users/management/commands/create_e2e_test_user.py (1)
87-93: Apply consistent styling to all output messages.Lines 88 and 90 use
self.style.SUCCESS()but lines 92-93 use plainself.stdout.write(). For consistency, either apply styling to all messages or use plain output throughout.Apply this diff for consistent styling:
- self.stdout.write(f" Email: {email} (verified)") - self.stdout.write(" Ready for E2E verification script") + self.stdout.write( + self.style.SUCCESS(f" Email: {email} (verified)") + ) + self.stdout.write( + self.style.SUCCESS(" Ready for E2E verification script") + )Makefile (1)
86-90: Document that hardcoded password is for local development only.The hardcoded password
testis clearly documented in the help text and appropriate for local E2E testing. However, add a warning comment to prevent accidental production use.Apply this diff to add a safety warning:
.PHONY: setup-test-user -setup-test-user: ## Create E2E test user (username: e2e-test-user, password: test) +setup-test-user: ## Create E2E test user (LOCAL DEV ONLY - username: e2e-test-user, password: test) @echo "$(BLUE)Creating E2E test user...$(NC)" + @echo "$(YELLOW)⚠️ This is for local development only. Use deployment scripts for production.$(NC)" @$(MANAGE) create_e2e_test_user --password test @echo "$(GREEN)✓ Test user created (username: e2e-test-user, password: test)$(NC)"
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (17)
Makefile(1 hunks)deployment/scripts/07-setup-e2e-test-user.sh(1 hunks)deployment/scripts/README.md(1 hunks)docs/plans/2025-11-29-badge-standardization-phase2.md(1 hunks)docs/plans/2025-12-01-e2e-verification-script-design.md(1 hunks)docs/plans/2025-12-01-e2e-verification-script.md(1 hunks)pyproject.toml(1 hunks)scripts/e2e_verify/__init__.py(1 hunks)scripts/e2e_verify/__main__.py(1 hunks)scripts/e2e_verify/main.py(1 hunks)scripts/e2e_verify/pages/__init__.py(1 hunks)scripts/e2e_verify/pages/base.py(1 hunks)scripts/e2e_verify/pages/file_submit.py(1 hunks)scripts/e2e_verify/pages/login.py(1 hunks)scripts/e2e_verify/pages/project_create.py(1 hunks)scripts/e2e_verify/pages/project_detail.py(1 hunks)wafer_space/users/management/commands/create_e2e_test_user.py(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (10)
- scripts/e2e_verify/main.py
- scripts/e2e_verify/pages/init.py
- docs/plans/2025-11-29-badge-standardization-phase2.md
- pyproject.toml
- scripts/e2e_verify/pages/file_submit.py
- docs/plans/2025-12-01-e2e-verification-script-design.md
- scripts/e2e_verify/pages/login.py
- deployment/scripts/07-setup-e2e-test-user.sh
- scripts/e2e_verify/pages/base.py
- deployment/scripts/README.md
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{py,pyi}
📄 CodeRabbit inference engine (CLAUDE.md)
Lint errors must be fixed, never suppressed. Never add
# noqa,# type: ignore, or similar without explicit user permission. Always runmake lint-fix && make lint && make type-checkbefore committing.
Files:
wafer_space/users/management/commands/create_e2e_test_user.pyscripts/e2e_verify/__init__.pyscripts/e2e_verify/pages/project_create.pyscripts/e2e_verify/main.pyscripts/e2e_verify/pages/project_detail.py
**/*.py
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.py: Never create circular imports. Maintain layer separation: Models never import tasks/views/services; Services can import models and tasks; Views can import models and services; Tasks can import models only. Never use local imports as a workaround for circular dependencies.
Avoid print statements. Uselogging.getLogger(__name__)instead (Ruff rule T201).
Lines must not exceed 88 characters (Ruff rule E501). Break long lines into multiple lines.
Never use f-strings directly in exception messages (Ruff rule EM102). Assign the message to a variable first before using it in the exception.
Avoid boolean positional arguments (Ruff rule FBT002/3). Use keyword-only arguments instead:def fn(*, flag=True).
Never hardcode passwords directly in code (Ruff rule S105). Use constants likeTEST_PASSWORD = '...'instead.
All public functions must have type hints. Usefrom __future__ import annotationsfor forward references. Fix mypy errors, don't ignore them.
Use specific exception handling with exception chaining. Catch specific exception types and useraise NewException(msg) from excto chain exceptions. Never use bareexcept:or overly broadexcept Exception:.
Celery task names inCELERY_BEAT_SCHEDULEmust reference the actual decorated function name (e.g.,'app.tasks.process_check_queue'), not a variable assignment. Task registration comes from the @shared_task decorator, not Python variable assignments.
Files:
wafer_space/users/management/commands/create_e2e_test_user.pyscripts/e2e_verify/__init__.pyscripts/e2e_verify/pages/project_create.pyscripts/e2e_verify/main.pyscripts/e2e_verify/pages/project_detail.py
**/*.{md,txt,rst}
📄 CodeRabbit inference engine (CLAUDE.md)
All fenced code blocks must have a language specifier (e.g.,
python,bash,text). Wrap URLs in angle brackets:<https://example.com>. Use proper markdown link syntax for clickable links:[Link text](url).
Files:
docs/plans/2025-12-01-e2e-verification-script.md
🧬 Code graph analysis (4)
wafer_space/users/management/commands/create_e2e_test_user.py (4)
wafer_space/users/models.py (1)
User(7-26)wafer_space/users/tests/factories.py (1)
password(18-31)wafer_space/conftest.py (1)
user(13-14)wafer_space/legal/models.py (1)
save(50-57)
scripts/e2e_verify/pages/project_create.py (2)
scripts/e2e_verify/pages/base.py (1)
navigate(19-22)tests/browser/pages/base_page.py (1)
click(43-47)
scripts/e2e_verify/main.py (4)
scripts/e2e_verify/pages/file_submit.py (2)
FileSubmitPage(16-48)submit_file(23-48)scripts/e2e_verify/pages/project_create.py (2)
ProjectCreatePage(16-49)create_project(22-49)scripts/e2e_verify/pages/project_detail.py (11)
ProjectDetailPage(16-132)wait_for_downloaded(46-49)wait_for_hash_mismatch(60-63)wait_for_hash_verified(55-58)wait_for_precheck_running(74-77)wait_for_logs_contain(128-132)get_precheck_logs(121-126)click_cancel_precheck(109-115)wait_for_precheck_cancelled(87-90)wait_for_precheck_complete(79-85)is_manufacturable(92-103)scripts/e2e_verify/pages/base.py (1)
screenshot(24-30)
scripts/e2e_verify/pages/project_detail.py (2)
scripts/e2e_verify/pages/base.py (1)
navigate(19-22)tests/browser/pages/base_page.py (1)
click(43-47)
🪛 LanguageTool
docs/plans/2025-12-01-e2e-verification-script.md
[style] ~806-~806: Consider using a different verb for a more formal wording.
Context: ...pe Check Files: - Modify: Various (fix any issues) Step 1: Run linting R...
(FIX_RESOLVE)
🪛 markdownlint-cli2 (0.18.1)
docs/plans/2025-12-01-e2e-verification-script.md
18-18: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
31-31: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
36-36: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
41-41: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
57-57: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
98-98: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
112-112: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
155-155: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
160-160: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
174-174: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
218-218: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
223-223: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
237-237: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
291-291: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
296-296: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
310-310: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
364-364: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
369-369: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
383-383: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
520-520: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
525-525: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
539-539: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
789-789: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
794-794: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
808-808: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
813-813: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
818-818: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
832-832: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
837-837: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
842-842: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
857-857: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
🪛 Ruff (0.14.7)
wafer_space/users/management/commands/create_e2e_test_user.py
52-52: Unused method argument: args
(ARG002)
scripts/e2e_verify/main.py
47-47: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
50-50: Unused noqa directive (non-enabled: PLR0915)
Remove unused noqa directive
(RUF100)
63-63: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
64-64: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
65-65: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
66-66: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
67-67: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
215-215: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
216-216: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
217-217: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
218-218: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
223-223: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
224-224: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
225-225: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
226-226: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: pytest
🔇 Additional comments (9)
scripts/e2e_verify/__init__.py (1)
1-1: LGTM!Simple package initializer with appropriate docstring.
scripts/e2e_verify/pages/project_detail.py (3)
1-27: LGTM!Well-structured Page Object with proper type hints, appropriate timeout constants, and clean constructor pattern extending
BasePage.
29-90: LGTM!Status-monitoring methods follow a consistent pattern with configurable timeouts and proper use of Playwright's
expectAPI.
109-132: LGTM!Action and log methods provide clean abstractions for cancel and log retrieval operations.
scripts/e2e_verify/pages/project_create.py (1)
1-49: LGTM!Clean Page Object implementation with proper form interaction pattern. The error message handling on lines 48-49 correctly follows the coding guideline of assigning the message to a variable before raising the exception.
scripts/e2e_verify/main.py (2)
235-252: LGTM!Clean CLI entry point with proper argument parsing and exit code handling.
74-210: Well-structured 13-step verification flow.The flow is clearly documented with step comments, uses page objects appropriately, and captures screenshots at key verification points. The logic correctly handles the hash mismatch/match scenarios and precheck lifecycle.
wafer_space/users/management/commands/create_e2e_test_user.py (2)
1-23: LGTM! Well-structured imports and constants.The imports follow best practices with
from __future__ import annotations, proper TYPE_CHECKING usage, and correct User model retrieval viaget_user_model(). The default constants matchingscripts/e2e_verify/main.pyensure consistency across the E2E workflow.
25-49: LGTM! Command arguments are properly configured.The argument definitions provide sensible defaults and clear help text. The pattern of allowing password via argument or environment variable offers good flexibility for both local development and deployment scenarios.
| @@ -0,0 +1,877 @@ | |||
| # E2E Verification Script Implementation Plan | |||
|
|
|||
| > **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task. | |||
There was a problem hiding this comment.
Remove internal directive from user-facing documentation.
Line 3 contains an internal note addressed to Claude: "For Claude: REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task." This meta-instruction should be removed or moved to a separate internal tracking system, as it clutters the public design document and is not relevant to readers or implementers.
🤖 Prompt for AI Agents
In docs/plans/2025-12-01-e2e-verification-script.md around line 3, remove the
internal meta-directive "**For Claude:** REQUIRED SUB-SKILL: Use
superpowers:executing-plans to implement this plan task-by-task." from the
public document; if the note must be retained for internal tracking, move it to
an internal-only file or issue tracker (or a private comment) and ensure the
public doc contains only user-facing instructions and rationale.
| **Files:** | ||
| - Modify: `pyproject.toml` | ||
|
|
||
| **Step 1: Add playwright and pyvirtualdisplay to dev dependencies** |
There was a problem hiding this comment.
Replace emphasis with proper Markdown headings for step titles.
Step titles throughout the document use bold text (Step N: ...) instead of proper Markdown headings (### Step N: ...). This violates the Markdown standard (MD036) and makes the document structure less navigable for tools and readers.
Convert all step titles from bold emphasis to ### headings. For example:
-**Step 1: Add playwright and pyvirtualdisplay to dev dependencies**
+### Step 1: Add playwright and pyvirtualdisplay to dev dependenciesApply this pattern to all 27+ step titles in the document.
Also applies to: 31-31, 36-36, 41-41, 57-57, 98-98, 112-112, 155-155, 160-160, 174-174, 218-218, 223-223, 237-237, 291-291, 296-296, 310-310, 364-364, 369-369, 383-383, 520-520, 525-525, 539-539, 789-789, 794-794, 808-808, 813-813, 818-818, 832-832, 837-837, 842-842, 857-857
🧰 Tools
🪛 markdownlint-cli2 (0.18.1)
18-18: Emphasis used instead of a heading
(MD036, no-emphasis-as-heading)
🤖 Prompt for AI Agents
In docs/plans/2025-12-01-e2e-verification-script.md around line 18 (and also
lines 31, 36, 41, 57, 98, 112, 155, 160, 174, 218, 223, 237, 291, 296, 310, 364,
369, 383, 520, 525, 539, 789, 794, 808, 813, 818, 832, 837, 842, 857) the step
titles are using bold markup (**Step N: ...**) instead of Markdown headings;
replace each bolded step title with a level-3 heading by removing the
surrounding ** and prefixing the line with "### " so that e.g. "**Step 1: Add
playwright and pyvirtualdisplay to dev dependencies**" becomes "### Step 1: Add
playwright and pyvirtualdisplay to dev dependencies", applying this conversion
consistently to all listed step-title lines.
| # ============================================================ | ||
| USERNAME = "e2e-test-user" | ||
| PASSWORD = "changeme" # TODO: Set this or use os.environ.get("E2E_PASSWORD") |
There was a problem hiding this comment.
Remove or externalize hardcoded credentials from configuration section.
The PASSWORD configuration on line 571 is hardcoded (even with a TODO), which poses a security risk. Credentials should never be committed to version control, even in temporary/test configuration sections.
Replace the hardcoded password with environment variable lookup and document the requirement:
-PASSWORD = "changeme" # TODO: Set this or use os.environ.get("E2E_PASSWORD")
+PASSWORD = os.environ.get("E2E_PASSWORD", "")
+if not PASSWORD:
+ raise ValueError("E2E_PASSWORD environment variable must be set")Also add documentation in the usage section (around line 844–855) noting that callers must set the E2E_PASSWORD environment variable before running the script.
Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In docs/plans/2025-12-01-e2e-verification-script.md around lines 569–571, remove
the hardcoded PASSWORD value and replace it with an environment lookup (e.g.,
read E2E_PASSWORD via os.environ.get or equivalent) and fail early with a clear
error if it is not set; then update the usage documentation around lines 844–855
to instruct callers to export/set E2E_PASSWORD before running the script and
include an example command and note that credentials must not be stored in
source control.
| print(f"[{timestamp}] Step {step}/{total}: {message}") # noqa: T201 | ||
|
|
||
|
|
||
| def run_full_flow(base_url: str, vnc_port: int = 5901) -> bool: # noqa: PLR0915 | ||
| """Run the complete E2E verification flow. | ||
| Args: | ||
| base_url: Base URL of the wafer.space instance | ||
| vnc_port: Port for VNC server | ||
| Returns: | ||
| True if all verifications passed, False otherwise | ||
| """ | ||
| total_steps = 13 | ||
|
|
||
| # Start VNC server | ||
| print("=" * 60) # noqa: T201 | ||
| print(f" VNC server starting on port {vnc_port}") # noqa: T201 | ||
| print(f" Connect to watch: vncviewer localhost:{vnc_port}") # noqa: T201 | ||
| print("=" * 60) # noqa: T201 | ||
| print() # noqa: T201 |
There was a problem hiding this comment.
🛠️ Refactor suggestion | 🟠 Major
Remove unused # noqa directives.
Static analysis indicates that the T201 rule is not enabled, making all # noqa: T201 directives unnecessary. The same applies to # noqa: PLR0915 on line 50. As per coding guidelines, noqa directives should be avoided unless absolutely necessary.
Apply this diff to remove unused directives:
- print(f"[{timestamp}] Step {step}/{total}: {message}") # noqa: T201
+ print(f"[{timestamp}] Step {step}/{total}: {message}")
-def run_full_flow(base_url: str, vnc_port: int = 5901) -> bool: # noqa: PLR0915
+def run_full_flow(base_url: str, vnc_port: int = 5901) -> bool:
"""Run the complete E2E verification flow.
...
- print("=" * 60) # noqa: T201
- print(f" VNC server starting on port {vnc_port}") # noqa: T201
- print(f" Connect to watch: vncviewer localhost:{vnc_port}") # noqa: T201
- print("=" * 60) # noqa: T201
- print() # noqa: T201
+ print("=" * 60)
+ print(f" VNC server starting on port {vnc_port}")
+ print(f" Connect to watch: vncviewer localhost:{vnc_port}")
+ print("=" * 60)
+ print()The same pattern should be applied to lines 215-218 and 223-226.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| print(f"[{timestamp}] Step {step}/{total}: {message}") # noqa: T201 | |
| def run_full_flow(base_url: str, vnc_port: int = 5901) -> bool: # noqa: PLR0915 | |
| """Run the complete E2E verification flow. | |
| Args: | |
| base_url: Base URL of the wafer.space instance | |
| vnc_port: Port for VNC server | |
| Returns: | |
| True if all verifications passed, False otherwise | |
| """ | |
| total_steps = 13 | |
| # Start VNC server | |
| print("=" * 60) # noqa: T201 | |
| print(f" VNC server starting on port {vnc_port}") # noqa: T201 | |
| print(f" Connect to watch: vncviewer localhost:{vnc_port}") # noqa: T201 | |
| print("=" * 60) # noqa: T201 | |
| print() # noqa: T201 | |
| print(f"[{timestamp}] Step {step}/{total}: {message}") | |
| def run_full_flow(base_url: str, vnc_port: int = 5901) -> bool: | |
| """Run the complete E2E verification flow. | |
| Args: | |
| base_url: Base URL of the wafer.space instance | |
| vnc_port: Port for VNC server | |
| Returns: | |
| True if all verifications passed, False otherwise | |
| """ | |
| total_steps = 13 | |
| # Start VNC server | |
| print("=" * 60) | |
| print(f" VNC server starting on port {vnc_port}") | |
| print(f" Connect to watch: vncviewer localhost:{vnc_port}") | |
| print("=" * 60) | |
| print() |
🧰 Tools
🪛 Ruff (0.14.7)
47-47: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
50-50: Unused noqa directive (non-enabled: PLR0915)
Remove unused noqa directive
(RUF100)
63-63: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
64-64: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
65-65: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
66-66: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
67-67: Unused noqa directive (non-enabled: T201)
Remove unused noqa directive
(RUF100)
🤖 Prompt for AI Agents
In scripts/e2e_verify/main.py around lines 47-67 (and also remove the identical
unnecessary directives at lines 215-218 and 223-226), remove the unused "# noqa:
T201" and the "# noqa: PLR0915" on the run_full_flow signature—simply delete the
noqa annotations from the print statements and function definition so the code
remains identical otherwise; do not change any logic or add new noqa comments
unless a linter rule actually requires them.
| log(8, total_steps, "Waiting for precheck logs...") | ||
| # Wait for any log content to appear | ||
| detail_page.wait_for_logs_contain("", timeout_ms=60_000) | ||
| logs = detail_page.get_precheck_logs() | ||
| log(8, total_steps, f"Precheck logs received ({len(logs)} chars)") | ||
| detail_page.screenshot("08_precheck_logs") |
There was a problem hiding this comment.
Empty string check is ineffective for verifying log content.
wait_for_logs_contain("") will match any text (including empty), so it doesn't verify that logs have actual content. The subsequent get_precheck_logs() call could still return an empty string.
Consider waiting for a known log prefix or checking non-empty content:
# Wait for any log content to appear
- detail_page.wait_for_logs_contain("", timeout_ms=60_000)
+ # Wait for logs element to have non-trivial content
+ detail_page.page.locator("#processing-logs").wait_for(state="visible", timeout=60_000)
logs = detail_page.get_precheck_logs()
+ if not logs.strip():
+ log(8, total_steps, "Warning: Logs element visible but empty")Alternatively, if there's a known log prefix that always appears first, wait for that specific text.
Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In scripts/e2e_verify/main.py around lines 151 to 156, the current call
detail_page.wait_for_logs_contain("") is ineffective because an empty string
matches immediately and doesn't guarantee actual log content; replace it by
waiting for a specific expected log prefix (if one exists) with
detail_page.wait_for_logs_contain("<known_prefix>"), or implement a short
polling loop with a timeout that calls detail_page.get_precheck_logs() until the
returned string is non-empty (and optionally contains an expected substring),
then proceed to log length, screenshot, and continue.
| def is_manufacturable(self) -> bool: | ||
| """Check if the design passed manufacturability check. | ||
| Call after wait_for_precheck_complete(). | ||
| """ | ||
| # Check for "Manufacturable" but not "Not Manufacturable" | ||
| manufacturable = self.page.get_by_text("Manufacturable").first | ||
| not_manufacturable = self.page.get_by_text("Not Manufacturable").first | ||
|
|
||
| if not_manufacturable.is_visible(): | ||
| return False | ||
| return manufacturable.is_visible() |
There was a problem hiding this comment.
Potential false positive due to substring matching.
get_by_text("Manufacturable") will also match elements containing "Not Manufacturable" since "Manufacturable" is a substring. While checking not_manufacturable first partially mitigates this, the logic could fail if the page layout changes.
Consider using exact matching:
- manufacturable = self.page.get_by_text("Manufacturable").first
- not_manufacturable = self.page.get_by_text("Not Manufacturable").first
+ manufacturable = self.page.get_by_text("Manufacturable", exact=True).first
+ not_manufacturable = self.page.get_by_text("Not Manufacturable", exact=True).first🤖 Prompt for AI Agents
In scripts/e2e_verify/pages/project_detail.py around lines 92-103, the code uses
get_by_text("Manufacturable") which can match "Not Manufacturable" as a
substring; change both locators to use exact matching (e.g.,
get_by_text("Manufacturable", exact=True) and get_by_text("Not Manufacturable",
exact=True)) so the checks are unambiguous, keep the existing order (check
not_manufacturable first) and return based on exact visibility results.
| ) | ||
|
|
||
| @transaction.atomic | ||
| def handle(self, *args: Any, **options: Any) -> None: |
There was a problem hiding this comment.
Remove unused args parameter per lint rules.
The static analysis correctly flags the unused args parameter. While Django's BaseCommand.handle() signature traditionally included *args, modern Django management commands only use **options. Per coding guidelines, lint errors must be fixed, not suppressed.
Apply this diff:
- def handle(self, *args: Any, **options: Any) -> None:
+ def handle(self, **options: Any) -> None:📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| def handle(self, *args: Any, **options: Any) -> None: | |
| def handle(self, **options: Any) -> None: |
🧰 Tools
🪛 Ruff (0.14.7)
52-52: Unused method argument: args
(ARG002)
🤖 Prompt for AI Agents
In wafer_space/users/management/commands/create_e2e_test_user.py around line 52,
the handle method currently declares an unused *args parameter which triggers
lint errors; remove the unused *args by changing the signature to accept only
**options (e.g., def handle(self, **options: Any) -> None:), adjust the type
hints/imports if necessary, and run linters/tests to verify the warning is
resolved.
| _email_address, _email_created = EmailAddress.objects.update_or_create( | ||
| user=user, | ||
| email=email, | ||
| defaults={ | ||
| "verified": True, | ||
| "primary": True, | ||
| }, | ||
| ) |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, find the EmailAddress model to understand its structure
find . -type f -name "*.py" | xargs grep -l "class EmailAddress" | head -10Repository: wafer-space/platform.wafer.space
Length of output: 58
🏁 Script executed:
# Search for the file being reviewed to see the full context
find . -type f -path "*/users/management/commands/create_e2e_test_user.py"Repository: wafer-space/platform.wafer.space
Length of output: 139
🏁 Script executed:
# Check if django-allauth is installed and find its location
python3 -c "import allauth; print(allauth.__file__)" 2>/dev/null || echo "Checking via pip"
pip show django-allauth 2>/dev/null | grep Location || echo "Not found via pip"Repository: wafer-space/platform.wafer.space
Length of output: 162
🏁 Script executed:
# Search for EmailAddress model and its constraints in the codebase
rg -A 10 "class EmailAddress" --type=pyRepository: wafer-space/platform.wafer.space
Length of output: 58
🏁 Script executed:
# Check the specific file and lines in question
cat -n wafer_space/users/management/commands/create_e2e_test_user.py 2>/dev/null | head -100Repository: wafer-space/platform.wafer.space
Length of output: 3680
🏁 Script executed:
# Search for EmailAddress usage patterns in the codebase to see if this is handled elsewhere
rg -B 3 -A 3 "EmailAddress.*update_or_create" --type=pyRepository: wafer-space/platform.wafer.space
Length of output: 765
🏁 Script executed:
# Check if there are any model constraints on EmailAddress in the codebase
rg -B 5 -A 10 "class EmailAddress" --type=pyRepository: wafer-space/platform.wafer.space
Length of output: 58
🏁 Script executed:
# Search for any existing patterns of handling primary email changes
rg -B 3 -A 3 "primary.*False" --type=py | head -60Repository: wafer-space/platform.wafer.space
Length of output: 6592
🏁 Script executed:
# Check django-allauth installation and inspect the model
python3 << 'EOF'
try:
from allauth.account.models import EmailAddress
import inspect
# Get model fields
print("=== EmailAddress Model Fields ===")
for field in EmailAddress._meta.get_fields():
print(f"{field.name}: {field.__class__.__name__}", end="")
if hasattr(field, 'unique'):
print(f" (unique={field.unique})", end="")
if hasattr(field, 'null'):
print(f" (null={field.null})", end="")
print()
# Check for unique_together
print("\n=== Constraints ===")
if hasattr(EmailAddress._meta, 'unique_together'):
print(f"unique_together: {EmailAddress._meta.unique_together}")
if hasattr(EmailAddress._meta, 'constraints'):
print(f"constraints: {EmailAddress._meta.constraints}")
# Check the save method
print("\n=== Custom Save Method ===")
source_file = inspect.getsourcefile(EmailAddress.save)
print(f"save() defined in: {source_file}")
except Exception as e:
print(f"Error: {e}")
EOFRepository: wafer-space/platform.wafer.space
Length of output: 162
🏁 Script executed:
# Check for any model validators on EmailAddress
rg "EmailAddress" --type=py -B 2 -A 8 | grep -A 10 "def save\|def clean\|unique_together\|constraints"Repository: wafer-space/platform.wafer.space
Length of output: 58
🏁 Script executed:
# Search for any handling of EmailAddress primary flag elsewhere in the codebase
rg "EmailAddress" --type=py -B 2 -A 5 | grep -C 3 "primary"Repository: wafer-space/platform.wafer.space
Length of output: 4205
🏁 Script executed:
# Check requirements or dependencies to understand django-allauth version
find . -name "requirements*.txt" -o -name "setup.py" -o -name "pyproject.toml" | head -5Repository: wafer-space/platform.wafer.space
Length of output: 92
🏁 Script executed:
# Look at pyproject.toml for django-allauth version
cat pyproject.toml 2>/dev/null | grep -A 5 -B 5 "allauth"Repository: wafer-space/platform.wafer.space
Length of output: 408
🏁 Script executed:
# Search for any documentation or comments about EmailAddress in the repo
rg "EmailAddress" --type=py --type=md -B 1 -A 3 | head -80Repository: wafer-space/platform.wafer.space
Length of output: 6139
🏁 Script executed:
# Check if there are any tests or documentation about EmailAddress behavior
find . -name "*.md" -type f | xargs grep -l "EmailAddress\|email.*address\|primary.*email" 2>/dev/null | head -5Repository: wafer-space/platform.wafer.space
Length of output: 123
🏁 Script executed:
# Check the Django model field definitions for unique constraints
python3 << 'EOF'
try:
from allauth.account.models import EmailAddress
print("=== EmailAddress Model Inspection ===")
print(f"Model: {EmailAddress}")
# List all model meta options related to constraints
meta = EmailAddress._meta
print(f"\nFields:")
for field in meta.get_fields():
if field.name in ['user', 'email', 'primary', 'verified']:
print(f" {field.name}: type={type(field).__name__}", end="")
if hasattr(field, 'unique'):
print(f", unique={field.unique}", end="")
if hasattr(field, 'db_index'):
print(f", db_index={field.db_index}", end="")
print()
print(f"\nConstraints:")
if hasattr(meta, 'unique_together'):
print(f" unique_together: {meta.unique_together}")
if hasattr(meta, 'constraints'):
print(f" constraints: {list(meta.constraints)}")
# Check db_table
print(f"\nDB Table: {meta.db_table}")
except ImportError:
print("django-allauth not available in this environment")
except Exception as e:
print(f"Error: {type(e).__name__}: {e}")
EOFRepository: wafer-space/platform.wafer.space
Length of output: 124
🌐 Web query:
django-allauth EmailAddress primary email constraint one per user
💡 Result:
Short answer
- django-allauth stores extra addresses in allauth.account.models.EmailAddress (fields: email, verified, primary). Setting a new primary clears the old primary via EmailAddress.set_as_primary()/manager logic, but there is no DB-level single-primary constraint per user. [1][2]
Options to enforce "one primary email per user"
-
Use settings:
- ACCOUNT_MAX_EMAIL_ADDRESSES = 1 — limits addresses to one (prevents extras).
- ACCOUNT_CHANGE_EMAIL = True — makes email-change use a temporary second address that, when verified, replaces the current one.
- ACCOUNT_UNIQUE_EMAIL = True — prevents verified emails being used by multiple accounts. [1]
-
Use the email_confirmed signal to atomically set the confirmed address primary and remove old addresses (common pattern): on email_confirmed call email_address.set_as_primary() and delete other EmailAddress rows for that user. Example: [3]
from django.dispatch import receiver
from allauth.account.models import EmailAddress
from allauth.account.signals import email_confirmed@receiver(email_confirmed)
def on_email_confirmed(sender, request, email_address, **kwargs):
email_address.set_as_primary()
EmailAddress.objects.filter(user=email_address.user).exclude(primary=True).delete() -
Enforce at DB level (advanced): add a conditional UNIQUE constraint so only one EmailAddress per user can be primary (Postgres supports partial unique indexes). Example SQL (Postgres):
CREATE UNIQUE INDEX ux_emailaddress_user_primary ON account_emailaddress(user_id) WHERE primary;
Note: allauth does not create this by default; test migrations and consider race conditions. [2]
References
- django-allauth configuration / ACCOUNT_* settings. [1]
- EmailAddress model & set_as_primary implementation. [2]
- Common pattern using email_confirmed signal to swap primary and remove old addresses. [3]
🏁 Script executed:
# Look at the test to understand the intended behavior better
cat -n wafer_space/users/tests/test_multi_provider_auth.py | head -100Repository: wafer-space/platform.wafer.space
Length of output: 3870
🏁 Script executed:
# Check if there are any migrations or schema definitions that might show constraints
find . -path "*/migrations/*.py" -name "*.py" | xargs grep -l "EmailAddress" | head -3Repository: wafer-space/platform.wafer.space
Length of output: 58
🏁 Script executed:
# Look at one of the migrations to understand EmailAddress constraints
find . -path "*/migrations/*.py" -name "*.py" | xargs grep -B 5 -A 10 "EmailAddress"Repository: wafer-space/platform.wafer.space
Length of output: 60
Explicitly clear other primary emails when updating email address.
When the email changes between invocations, update_or_create() creates a new EmailAddress record with primary=True, leaving the old record untouched. Since django-allauth has no database-level constraint enforcing one primary email per user, this creates multiple records with primary=True, violating django-allauth's assumption.
Before updating/creating the new primary email, explicitly set other email records to primary=False:
# Clear other emails as non-primary before setting new one as primary
EmailAddress.objects.filter(user=user).exclude(email=email).update(
primary=False
)
_email_address, _email_created = EmailAddress.objects.update_or_create(
user=user,
email=email,
defaults={
"verified": True,
"primary": True,
},
)🤖 Prompt for AI Agents
In wafer_space/users/management/commands/create_e2e_test_user.py around lines 78
to 85, update_or_create sets the new EmailAddress as primary but can leave
previous addresses marked primary, creating multiple primary emails; before
calling update_or_create, run a query to clear other email records for that user
by setting primary=False for all EmailAddress objects for that user that do not
match the new email, then proceed with update_or_create to set the desired email
to verified and primary so only one primary email exists.
Summary
vncviewer localhost:5901)Features
Usage
Test plan
make lint)make type-check)🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation
Chores
✏️ Tip: You can customize this high-level summary in your review settings.