test: E2E smoke tests + Playwright browser tests (23 tests)

smoke.sh:
- Full E2E smoke test: health, npm proxy/publish/security, Maven, PyPI, Docker, Raw, UI, mirror CLI
- Self-contained: starts NORA, runs tests, cleans up

Playwright (tests/e2e/):
- Dashboard: page load, registry sections visible, npm count > 0, Docker stats
- npm: URL rewriting, scoped packages, tarball download, publish, immutability, security
- Docker: v2 check, catalog, manifest push/pull, tags list
- Maven: proxy download, upload
- PyPI: simple index, package page
- Raw: upload and download
- Health, metrics, OpenAPI endpoints

All 23 tests pass in 4.7s against live NORA instance.

tests/e2e/tests/dashboard.spec.ts

@@ -0,0 +1,82 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('NORA Dashboard', () => {
+
+  test('dashboard page loads and shows title', async ({ page }) => {
+    await page.goto('/ui/');
+    await expect(page).toHaveTitle(/NORA|nora/i);
+  });
+
+  test('dashboard shows registry sections', async ({ page }) => {
+    await page.goto('/ui/');
+
+    // All registry types should be visible
+    await expect(page.getByText(/Docker/i).first()).toBeVisible();
+    await expect(page.getByText(/npm/i).first()).toBeVisible();
+    await expect(page.getByText(/Maven/i).first()).toBeVisible();
+    await expect(page.getByText(/PyPI/i).first()).toBeVisible();
+    await expect(page.getByText(/Cargo/i).first()).toBeVisible();
+  });
+
+  test('dashboard shows non-zero npm count after proxy fetch', async ({ page, request }) => {
+    // Trigger npm proxy cache by fetching a package
+    await request.get('/npm/chalk');
+    await request.get('/npm/chalk/-/chalk-5.4.1.tgz');
+
+    // Wait a moment for index rebuild
+    await page.waitForTimeout(1000);
+
+    await page.goto('/ui/');
+
+    // npm section should show at least 1 package
+    // Look for a number > 0 near npm section
+    const statsResponse = await request.get('/api/ui/stats');
+    const stats = await statsResponse.json();
+    expect(stats.npm).toBeGreaterThan(0);
+
+    // Verify it's actually rendered on the page
+    await page.goto('/ui/');
+    await page.waitForTimeout(500);
+
+    // The page should contain the package count somewhere
+    const content = await page.textContent('body');
+    expect(content).not.toBeNull();
+    // Should not show all zeros for npm
+    expect(content).toContain('npm');
+  });
+
+  test('dashboard shows Docker images after proxy fetch', async ({ page, request }) => {
+    // Check stats API
+    const statsResponse = await request.get('/api/ui/stats');
+    const stats = await statsResponse.json();
+
+    // Docker count should be accessible (may be 0 if no images pulled yet)
+    expect(stats).toHaveProperty('docker');
+  });
+
+  test('health endpoint returns healthy', async ({ request }) => {
+    const response = await request.get('/health');
+    expect(response.ok()).toBeTruthy();
+
+    const health = await response.json();
+    expect(health.status).toBe('healthy');
+    expect(health.registries.npm).toBe('ok');
+    expect(health.registries.docker).toBe('ok');
+    expect(health.registries.maven).toBe('ok');
+    expect(health.registries.pypi).toBe('ok');
+    expect(health.registries.cargo).toBe('ok');
+  });
+
+  test('OpenAPI docs endpoint accessible', async ({ request }) => {
+    const response = await request.get('/api-docs', { maxRedirects: 0 });
+    // api-docs redirects to swagger UI
+    expect([200, 303]).toContain(response.status());
+  });
+
+  test('metrics endpoint returns prometheus format', async ({ request }) => {
+    const response = await request.get('/metrics');
+    expect(response.ok()).toBeTruthy();
+    const text = await response.text();
+    expect(text).toContain('nora_http_request_duration_seconds');
+  });
+});

tests/e2e/tests/docker-proxy.spec.ts

@@ -0,0 +1,74 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('Docker Registry', () => {
+
+  test('v2 check returns empty JSON', async ({ request }) => {
+    const response = await request.get('/v2/');
+    expect(response.ok()).toBeTruthy();
+    const body = await response.json();
+    expect(body).toEqual({});
+  });
+
+  test('catalog endpoint returns 200', async ({ request }) => {
+    const response = await request.get('/v2/_catalog');
+    expect(response.ok()).toBeTruthy();
+  });
+
+  test('put and get manifest works', async ({ request }) => {
+    // Push a simple blob
+    const blobData = 'test-blob-content';
+    const crypto = require('crypto');
+    const blobDigest = 'sha256:' + crypto.createHash('sha256').update(blobData).digest('hex');
+
+    await request.post(`/v2/e2e-test/blobs/uploads/?digest=${blobDigest}`, {
+      data: blobData,
+      headers: { 'Content-Type': 'application/octet-stream' },
+    });
+
+    // Push config blob
+    const configData = '{}';
+    const configDigest = 'sha256:' + crypto.createHash('sha256').update(configData).digest('hex');
+
+    await request.post(`/v2/e2e-test/blobs/uploads/?digest=${configDigest}`, {
+      data: configData,
+      headers: { 'Content-Type': 'application/octet-stream' },
+    });
+
+    // Push manifest
+    const manifest = {
+      schemaVersion: 2,
+      mediaType: 'application/vnd.oci.image.manifest.v1+json',
+      config: {
+        mediaType: 'application/vnd.oci.image.config.v1+json',
+        digest: configDigest,
+        size: configData.length,
+      },
+      layers: [
+        {
+          mediaType: 'application/vnd.oci.image.layer.v1.tar+gzip',
+          digest: blobDigest,
+          size: blobData.length,
+        },
+      ],
+    };
+
+    const putResponse = await request.put('/v2/e2e-test/manifests/1.0.0', {
+      data: manifest,
+      headers: { 'Content-Type': 'application/vnd.oci.image.manifest.v1+json' },
+    });
+    expect(putResponse.status()).toBe(201);
+
+    // Pull manifest back
+    const getResponse = await request.get('/v2/e2e-test/manifests/1.0.0');
+    expect(getResponse.ok()).toBeTruthy();
+    const pulled = await getResponse.json();
+    expect(pulled.schemaVersion).toBe(2);
+    expect(pulled.layers).toHaveLength(1);
+  });
+
+  test('tags list returns pushed tags', async ({ request }) => {
+    const response = await request.get('/v2/e2e-test/tags/list');
+    // May or may not have tags depending on test order
+    expect([200, 404]).toContain(response.status());
+  });
+});

tests/e2e/tests/npm-proxy.spec.ts

@@ -0,0 +1,132 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('npm Proxy', () => {
+
+  test('metadata proxy returns rewritten tarball URLs', async ({ request }) => {
+    const response = await request.get('/npm/chalk');
+    expect(response.ok()).toBeTruthy();
+
+    const metadata = await response.json();
+    expect(metadata.name).toBe('chalk');
+    expect(metadata.versions).toBeDefined();
+
+    // Tarball URL must point to NORA, not npmjs.org
+    const version = metadata.versions['5.4.1'];
+    expect(version).toBeDefined();
+    expect(version.dist.tarball).not.toContain('registry.npmjs.org');
+    expect(version.dist.tarball).toContain('/npm/chalk/-/chalk-5.4.1.tgz');
+  });
+
+  test('scoped package @babel/parser works', async ({ request }) => {
+    const response = await request.get('/npm/@babel/parser');
+    expect(response.ok()).toBeTruthy();
+
+    const metadata = await response.json();
+    expect(metadata.name).toBe('@babel/parser');
+
+    // Check tarball URL rewriting for scoped package
+    const versions = Object.keys(metadata.versions);
+    expect(versions.length).toBeGreaterThan(0);
+
+    const firstVersion = metadata.versions[versions[0]];
+    if (firstVersion?.dist?.tarball) {
+      expect(firstVersion.dist.tarball).toContain('/npm/@babel/parser/-/');
+      expect(firstVersion.dist.tarball).not.toContain('registry.npmjs.org');
+    }
+  });
+
+  test('tarball download returns gzip data', async ({ request }) => {
+    // Ensure metadata is cached first
+    await request.get('/npm/chalk');
+
+    const response = await request.get('/npm/chalk/-/chalk-5.4.1.tgz');
+    expect(response.ok()).toBeTruthy();
+    expect(response.headers()['content-type']).toBe('application/octet-stream');
+
+    const body = await response.body();
+    expect(body.length).toBeGreaterThan(100);
+    // gzip magic bytes
+    expect(body[0]).toBe(0x1f);
+    expect(body[1]).toBe(0x8b);
+  });
+
+  test('npm publish creates package', async ({ request }) => {
+    const pkgName = `e2e-pub-${Date.now()}`;
+    const publishBody = {
+      name: pkgName,
+      versions: {
+        '1.0.0': {
+          name: pkgName,
+          version: '1.0.0',
+          dist: {},
+        },
+      },
+      'dist-tags': { latest: '1.0.0' },
+      _attachments: {
+        [`${pkgName}-1.0.0.tgz`]: {
+          data: 'dGVzdA==',
+          content_type: 'application/octet-stream',
+        },
+      },
+    };
+
+    const response = await request.put(`/npm/${pkgName}`, {
+      data: publishBody,
+      headers: { 'Content-Type': 'application/json' },
+    });
+    expect(response.status()).toBe(201);
+
+    // Verify published package is accessible
+    const getResponse = await request.get(`/npm/${pkgName}`);
+    expect(getResponse.ok()).toBeTruthy();
+    const metadata = await getResponse.json();
+    expect(metadata.name).toBe(pkgName);
+    expect(metadata.versions['1.0.0']).toBeDefined();
+  });
+
+  test('npm publish rejects duplicate version (409)', async ({ request }) => {
+    const pkgName = `e2e-dupe-${Date.now()}`;
+    const body = {
+      name: pkgName,
+      versions: { '1.0.0': { name: pkgName, version: '1.0.0', dist: {} } },
+      'dist-tags': { latest: '1.0.0' },
+      _attachments: { [`${pkgName}-1.0.0.tgz`]: { data: 'dGVzdA==' } },
+    };
+
+    await request.put(`/npm/${pkgName}`, {
+      data: body,
+      headers: { 'Content-Type': 'application/json' },
+    });
+
+    // Publish same version again
+    const response = await request.put(`/npm/${pkgName}`, {
+      data: body,
+      headers: { 'Content-Type': 'application/json' },
+    });
+    expect(response.status()).toBe(409);
+  });
+
+  test('npm publish rejects name mismatch (400)', async ({ request }) => {
+    const response = await request.put('/npm/legitimate-pkg', {
+      data: {
+        name: 'evil-pkg',
+        versions: { '1.0.0': {} },
+        _attachments: { 'a.tgz': { data: 'dGVzdA==' } },
+      },
+      headers: { 'Content-Type': 'application/json' },
+    });
+    expect(response.status()).toBe(400);
+  });
+
+  test('npm publish rejects path traversal filename (400)', async ({ request }) => {
+    const response = await request.put('/npm/safe-pkg', {
+      data: {
+        name: 'safe-pkg',
+        versions: { '1.0.0': {} },
+        _attachments: { '../../etc/passwd': { data: 'dGVzdA==' } },
+      },
+      headers: { 'Content-Type': 'application/json' },
+    });
+    expect(response.status()).toBe(400);
+  });
+});

tests/e2e/tests/other-registries.spec.ts

@@ -0,0 +1,51 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('Maven Proxy', () => {
+  test('download Maven artifact', async ({ request }) => {
+    const response = await request.get(
+      '/maven2/org/apache/commons/commons-lang3/3.17.0/commons-lang3-3.17.0.pom'
+    );
+    expect(response.ok()).toBeTruthy();
+    const text = await response.text();
+    expect(text).toContain('commons-lang3');
+  });
+
+  test('Maven upload works', async ({ request }) => {
+    const response = await request.put('/maven2/com/test/smoke/1.0/smoke-1.0.jar', {
+      data: 'test-jar-content',
+    });
+    expect(response.status()).toBe(201);
+  });
+});
+
+test.describe('PyPI Proxy', () => {
+  test('simple index returns HTML', async ({ request }) => {
+    const response = await request.get('/simple/');
+    expect(response.ok()).toBeTruthy();
+    const text = await response.text();
+    expect(text).toContain('Simple Index');
+  });
+
+  test('package page returns links', async ({ request }) => {
+    const response = await request.get('/simple/requests/');
+    expect(response.ok()).toBeTruthy();
+    const text = await response.text();
+    expect(text).toContain('requests');
+  });
+});
+
+test.describe('Raw Storage', () => {
+  test('upload and download file', async ({ request }) => {
+    const data = 'raw-e2e-test-content-' + Date.now();
+
+    const putResponse = await request.put('/raw/e2e/test.txt', {
+      data: data,
+    });
+    expect(putResponse.status()).toBe(201);
+
+    const getResponse = await request.get('/raw/e2e/test.txt');
+    expect(getResponse.ok()).toBeTruthy();
+    const body = await getResponse.text();
+    expect(body).toBe(data);
+  });
+});