Cleanup, improvement and cookie auth tests in password_* tests.

* Separate assertions and state preparation.
* Check for call on /user for cookie auth.
* Test for presence of cookie in login reply.

cypress/e2e/header_auth/spec.cy.ts

@@ -5,19 +5,64 @@ describe('Header auth', () => {
     runTestServer();
   });
 
-  it('should fail to auth without custom header', () => {
-    cy.get('.MuiAlert-message').should('exist');
+  beforeEach(() => {
+    cy.visit('/');
   });
 
-  it('should be able to auth with custom header', () => {
-    cy.intercept('*', (req) => {
-      req.headers['test-header'] = 'test header value';
+  describe('without an authorization header', () => {
+    it('should display an alert message', () => {
+      cy.get('.MuiAlert-message').should('exist');
     });
-    cy.visit('/');
-    cy.get('.MuiAlert-message').should('not.exist');
-    cy.get('.step').eq(0).should('contain', 'Hello admin');
+  });
+
+  describe('with authorization header set', () => {
+    beforeEach(() => {
+      cy.intercept('/auth/header', (req) => {
+        req.headers['test-header'] = 'test header value';
+        req.continue();
+      }).as('auth');
+
+      // Only intercept /user _after_ we're logged in.
+      cy.wait('@auth').then(() => {
+        cy.intercept('GET', '/user').as('user');
+      });
+    });
+
+    const shouldBeLoggedIn = () => {
+      it('should have an access_token cookie in /auth/header response', () => {
+        cy.wait('@auth').then((interception) => {
+          expect(interception.response.statusCode).to.equal(200);
+
+          // Response contains `Authorization` cookie, starting with Bearer
+          expect(interception.response.headers).to.have.property('set-cookie');
+          const cookie = interception.response.headers['set-cookie'][0];
+          expect(cookie).to.contain('access_token');
+        });
+      });
 
-    cy.reload();
-    cy.get('.step').eq(0).should('contain', 'Hello admin');
+      it('should not display an alert message', () => {
+        cy.get('.MuiAlert-message').should('not.exist');
+      });
+
+      it("should display 'Hello admin'", () => {
+        cy.get('.step').eq(0).should('contain', 'Hello admin');
+      });
+    };
+
+    shouldBeLoggedIn();
+
+    it('should request and have access to /user', () => {
+      cy.wait('@user').then((interception) => {
+        expect(interception.response.statusCode).to.equal(200);
+      });
+    });
+
+    describe('after reloading', () => {
+      before(() => {
+        cy.reload();
+      });
+
+      shouldBeLoggedIn();
+    });
   });
 });

cypress/e2e/password_auth/spec.cy.ts

@@ -5,22 +5,94 @@ describe('Password Auth', () => {
     runTestServer();
   });
 
-  it('should fail to login with wrong credentials', () => {
-    cy.get("input[name='email']").type('user');
-    cy.get("input[name='password']").type('user');
-    cy.get("button[type='submit']").click();
-    cy.get('.MuiAlert-message').should('exist');
-  });
+  describe('when unauthenticated', () => {
+    describe('visiting /', () => {
+      beforeEach(() => {
+        cy.intercept('GET', '/user').as('user');
+        cy.visit('/');
+      });
+
+      it('should attempt to and not not have permission to access /user', () => {
+        cy.wait('@user').then((interception) => {
+          expect(interception.response.statusCode).to.equal(401);
+        });
+      });
+
+      it('should redirect to login dialog', () => {
+        cy.location('pathname').should('eq', '/login');
+        cy.get("input[name='email']").should('exist');
+        cy.get("input[name='password']").should('exist');
+      });
+    });
+
+    describe('visiting /login', () => {
+      beforeEach(() => {
+        cy.visit('/login');
+      });
+
+      describe('submitting incorrect credentials', () => {
+        it('should fail to login with wrong credentials', () => {
+          cy.get("input[name='email']").type('user');
+          cy.get("input[name='password']").type('user');
+          cy.get("button[type='submit']").click();
+          cy.get('body').should('contain', 'Unauthorized');
+        });
+      });
+
+      describe('submitting correct credentials', () => {
+        beforeEach(() => {
+          cy.get("input[name='email']").type('admin');
+          cy.get("input[name='password']").type('admin');
+
+          cy.intercept('POST', '/login').as('login');
+          cy.intercept('GET', '/user').as('user');
+          cy.get("button[type='submit']").click();
+        });
+
+        const shouldBeLoggedIn = () => {
+          it('should have an access_token cookie in /login response', () => {
+            cy.wait('@login').then((interception) => {
+              expect(interception.response.statusCode).to.equal(200);
+
+              // Response contains `Authorization` cookie, starting with Bearer
+              expect(interception.response.headers).to.have.property(
+                'set-cookie'
+              );
+              const cookie = interception.response.headers['set-cookie'][0];
+              expect(cookie).to.contain('access_token');
+            });
+          });
+
+          it('should request and have access to /user', () => {
+            cy.wait('@user').then((interception) => {
+              expect(interception.response.statusCode).to.equal(200);
+            });
+          });
+
+          it('should not be on /login', () => {
+            cy.location('pathname').should('not.contain', '/login');
+          });
+
+          it('should not contain a login form', () => {
+            cy.get("input[name='email']").should('not.exist');
+            cy.get("input[name='password']").should('not.exist');
+          });
+
+          it('should show "Hello admin"', () => {
+            cy.get('.step').eq(0).should('contain', 'Hello admin');
+          });
+        };
+
+        shouldBeLoggedIn();
 
-  it('should be able to login with correct credentials', () => {
-    cy.visit('/');
-    cy.get("input[name='email']").type('admin');
-    cy.get("input[name='password']").type('admin');
-    cy.get("button[type='submit']").click();
-    cy.get('.step').eq(0).should('contain', 'Hello admin');
+        describe('after reloading', () => {
+          beforeEach(() => {
+            cy.reload();
+          });
 
-    cy.reload();
-    cy.get("input[name='email']").should('not.exist');
-    cy.get('.step').eq(0).should('contain', 'Hello admin');
+          shouldBeLoggedIn();
+        });
+      });
+    });
   });
 });