Auth flow

A common local smoke check: confirm a seeded synthetic user can sign in and land in the authenticated dashboard. The agent handles the form fields itself; your job is to spell out the verification. Do not put production credentials in a goal. Use a secret-backed login setup and dedicated synthetic identity for production targets.

The spec

tests/auth.blop.ts

import { agentTest, describe } from "@blopai/cli";

describe("auth", () => {
  agentTest("seeded user can sign in", async ({ agent }) => {
    await agent.goto("/sign-in");
    await agent.goal(`
      Sign in as test@test.com with password admin123.

      After submitting:
      - Verify the URL becomes /dashboard.
      - Verify the heading "My projects" is visible.
      - Verify the user's email "test@test.com" appears in the top nav.

      Finish the test as passed only if all three checks succeed.
      Otherwise finish as failed and explain which check failed.
    `);
  });
});

Why this works

• Concrete credentials. The agent doesn’t have to guess.
• Explicit verifications. Three named checks, each addressable by a browser-tool call.
• Strict pass condition. “Only if all three” stops the agent from optimistically passing on partial state.

Run it

bunx @blopai/cli test tests/auth.blop.ts --base-url http://localhost:3000

Negative test

agentTest("invalid password is rejected", async ({ agent }) => {
  await agent.goto("/sign-in");
  await agent.goal(`
    Try to sign in as test@test.com with password "wrong".

    Verify:
    - The URL does NOT change to /dashboard.
    - An error message containing "incorrect" or "invalid" is visible.

    Finish as passed only if both are true.
  `);
});