1.1.7 E2E tests covering email/password + Google OAuth happy paths (Playwright)

Estimate: 22m · Depends on: 1.1.5, 1.1.6

Two Playwright tests that exercise the auth lifecycle end-to-end: one for the email/password golden path (sign-up → sign-out → sign-in → request-reset → confirm-reset → sign-in-with-new-password) and one for the Google OAuth path (sign-in via Google → session created → sign-out → sign-in via Google again returns to the same account → sign-in via email/password with the same email links into the same user). If both pass, the Story is functionally complete.

Why two tests, not one: Email/password and Google OAuth exercise substantially different code paths (Server Actions vs. OAuth callback round-trip, Better-Auth credentials method vs. social method, different cookie set timings). One test per path keeps each focused and the failure messages legible. The account-linking assertion in the Google test is the load-bearing check that 1.1.3's findOrCreateOAuthUser + 1.1.4's auto-link wiring are correct end-to-end.

Why only two E2E tests: E2E tests are slow and brittle. The golden-path coverage catches "we broke auth"; unit tests at the repo/handler layer (added in 1.1.3, 1.1.4, 1.1.6) catch finer-grained issues. Don't try to cover edge cases here.

How to test Google OAuth without hitting real Google: Use Playwright's page.route() to intercept Better-Auth's OAuth redirect to Google's authorize endpoint and respond with a synthetic OAuth callback (signed with a test secret). Better-Auth supports a test-mode "trusted-OAuth" hook for exactly this; if not, intercept at the network layer. Do not use real Google credentials in CI.

What you'll do: Create /tests/e2e/auth-credentials.spec.ts (the email/password test) and /tests/e2e/auth-google.spec.ts (the OAuth test). Use the Playwright config from 1.0.4 (CI). Seed a clean database before each test; reset-link via the dev console provider from 1.1.6; Google OAuth via the test-mode interceptor. Tag both @smoke so CI runs them on every PR.

Acceptance criteria

• Two tests exist: /tests/e2e/auth-credentials.spec.ts and /tests/e2e/auth-google.spec.ts; both tagged @smoke.
• Both tests pass locally with pnpm test:e2e and in CI on every PR.
• Email/password test covers: sign-up → sign-out → sign-in → request-reset → confirm-reset → sign-in-with-new-password.
• Google OAuth test covers: Google sign-in (intercepted, synthetic callback) → session created → sign-out → Google sign-in again returns to same user → email/password sign-in with the same email succeeds (auto-link assertion: it's the same user, not a duplicate).
• Database is reset to a known clean state before each test runs.
• Reset link obtained from dev console provider output (not from a real email service).
• Google's OAuth endpoints are intercepted, NOT called for real; no real Google credentials in CI.
• Each test fails clearly with a screenshot when any step breaks.

Context refs

• playwright.config.ts — base configuration (from 1.0.4)
• /app/(auth)/* — pages produced by 1.1.5
• /app/(auth)/reset-password/actions.ts — reset endpoints (from 1.1.6)
• /lib/auth/index.ts — Better-Auth instance + Google provider (from 1.1.2 + 1.1.4) — for the test-mode OAuth hook
• /lib/email.ts — email abstraction with dev console provider (from 1.1.6)
• /tests/setup/db-reset.ts — test-database helper (if exists from 1.0.4; create it here if not)
• Better-Auth testing docs (fetched at prompt-gen time): test-mode hooks for social providers, if available