# OPNsense WebGUI integration tests

These Playwright tests use a disposable OPNsense deployment. They create and delete only entries containing the synthetic `UI_TEST_NETWORK` alias and require `OPNSENSE_UI_TEST_ALLOW_MUTATION=1`.

Run a QEMU fixture after building a package. The runner generates a disposable root WebGUI password, stores it only in `tests/ui/.runtime/credentials.env`, and removes it with the QEMU overlay when it exits. It needs a compatible OPNsense base image and transfer disk, neither of which is stored in this repository.

```sh
NORDVPN_PACKAGE_PATH=/path/to/os-nordvpn.pkg \
OPNSENSE_VM_IMAGE=/path/to/opnsense.qcow2 \
OPNSENSE_TRANSFER_IMAGE=/path/to/transfer.img \
tests/ui/run-opnsense.sh
```

The runner retains a failed VM for inspection. Stop it with:

```sh
tests/ui/stop-opnsense.sh
```

To keep the VM running for interactive inspection, use `start-opnsense.sh` instead, then load its ignored credential file before running the suite:

```sh
. tests/ui/.runtime/credentials.env
pnpm --dir tests/ui test
```

The suite mocks only the countries API response with synthetic values. It covers populated country options, failure-policy labels, native alias selectors, Add/Edit/Clone state restoration, and the selector menu/footer layout.

The browser target must be loopback by default. A remote disposable deployment requires `OPNSENSE_UI_TEST_ALLOW_REMOTE=1` and a trusted TLS certificate.