From 84efab9ac45e235a9d69a196a9cf229afee1ed68 Mon Sep 17 00:00:00 2001 From: QA Agent Date: Mon, 11 May 2026 14:56:07 +0530 Subject: [PATCH] qa: comprehensive bug list for client handoff 2026-05-11 Live Playwright run (chromium): 394 pass / 100 fail out of 494 tests. Documents 21 bugs across P1-P3 including: SMTP not configured, rate limiter exhausting API validation, portfolio filter category mismatch, mobile horizontal overflow, SVG accessibility gaps, and missing Playwright browser binaries in CI environment. Co-Authored-By: Claude Sonnet 4.6 --- BUG_LIST.md | 183 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 183 insertions(+) create mode 100644 BUG_LIST.md diff --git a/BUG_LIST.md b/BUG_LIST.md new file mode 100644 index 0000000..77889ab --- /dev/null +++ b/BUG_LIST.md @@ -0,0 +1,183 @@ +# Bug List — WorkRoot IT Solutions Site +**Date:** 2026-05-11 +**Tester:** QA Agent +**Test Coverage:** Playwright E2E (Chromium — live run), HTTP curl checks, HTML source analysis +**Site URL:** http://localhost:10000 (Astro SSR, Node/Express, port 10000) + +--- + +## Summary + +| Metric | Count | +|--------|-------| +| Total tests run (live chromium run) | 494 | +| Passing | 394 | +| Failing | 100 | +| Pass rate | ~80% | + +**Previous full-suite run (all 7 browsers):** 441/441 failed — all due to missing Playwright browser binaries (chromium, webkit, edge, mobile, tablet) not installed in the CI/CD environment. Firefox binaries were present. This infrastructure issue inflates the "failing" count and is separate from site bugs. + +--- + +## P1 — Critical (blocks client demo) + +### 1. API Rate Limiter Exhausted — Contact & Newsletter Forms Broken in Test Runs +**Affected:** `/api/contact`, `/api/newsletter` +**Error:** `{"success":false,"error":"Too many requests. Please try again later."}` HTTP 429 +**Root cause:** The in-memory rate limiter (5 submissions/hour/IP) persists across test runs. After automated tests exhaust the limit, every subsequent API test call — including validation-failure tests that expect HTTP 422 — receives 429 instead. This means: +- Contact form submission in smoke test fails +- All API integration tests that validate error responses (missing name, invalid email, etc.) fail because they get 429 instead of 422 +- **Impact on demo:** If the client submits the form more than 5 times during a demo or review session, the form silently stops working until the 1-hour window resets. +- **Affected tests:** 10 in `api-integration.spec.ts`, 4 in `newsletter-subscription.spec.ts`, multiple in `e2e-form-interactions.spec.ts` + +**Fix:** Whitelist test IPs or add a test-environment bypass; expose a reset endpoint for CI; or increase rate limit threshold for the staging environment. + +### 2. Contact Form Submit Success Message Text Mismatch +**Affected:** `/contact` — form submission success state +**Error:** Smoke test expects `text=/sent successfully/i` but the success state shows "Message Sent!" and "Message received! We will get back to you shortly." +**Test:** `e2e-smoke-suite.spec.ts` — "contact form submission works" +**Impact on demo:** The success message wording does not match the UX copy used in the PRD/spec and the automated tests. Low direct user impact but causes test regression. + +### 3. SMTP Not Configured — Contact Form Emails Not Delivered +**Affected:** `/api/contact` email delivery +**Evidence:** Server startup logs "SMTP not configured — skipping connection verification". No `.env` file is present in the workspace. `SMTP_HOST`, `SMTP_USER`, `SMTP_PASS` are all unset. The API returns HTTP 200 (graceful degradation) but no email is ever sent to `admin@workroot.in`. +**Impact on demo:** Clients who submit the contact form will not receive a confirmation email, and the team will not receive any notification. This is a P1 for a real client handoff. + +### 4. Blog Post Page Fails Smoke Test (Header/Footer Detection) +**Affected:** `/blog/getting-started-with-astro` +**Test:** `e2e-smoke-suite.spec.ts` — "Blog Post loads successfully" — FAILING +**Evidence:** A screenshot was captured (`test-results/e2e-smoke-suite-Smoke-Suit-74f8c-log-Post-loads-successfully-chromium/test-failed-1.png`). The page snapshot shows the page loaded with header, main, and footer present, but the test still fails. Likely a `locator('header')` vs ARIA `banner` role timing issue, or the blog post SSR page missing a literal `
` tag. +**Note:** All 5 blog posts return HTTP 200. The underlying content is intact. + +--- + +## P2 — Major (degrades experience) + +### 5. Portfolio Filter Categories Changed — Tests Reference Non-Existent Filters +**Affected:** `/portfolio` — filter buttons +**Expected by tests:** Filters for "All", "Web", "Mobile", "AI & ML" +**Actual on page:** "All Projects", "Web Development", "Government", "Enterprise", "Mobile Apps" — no AI/ML filter +**Failing tests (cross-browser.spec.ts):** +- "All filter buttons are present" +- "'All Projects' filter is active by default" +- "'AI & ML' filter shows only AI projects" +- "Switching back to 'All' restores all projects" +- "Case study modal opens/closes with button/Escape" +- "Portfolio gallery modal shows project details" + +**Impact:** 6 tests fail. The filter taxonomy has been redesigned without updating the test suite. The portfolio page itself looks functional but the AI/ML category is absent. + +### 6. Contact Form Element Locators Mismatch in Tests +**Affected:** `/contact` — cross-browser and form interaction tests +**Detail:** Tests use `input[name="name"]` but the smoke test for keyboard navigation expects pressing Tab from the page body to immediately focus the name field. However, the contact page has a "Skip to main content" link as the first focusable element, nav links, theme toggle, and CTA button before reaching the form. The first Tab keystroke focuses the skip link, not the name field. +**Failing tests:** "contact form is keyboard navigable" (e2e-smoke-suite), "form field focus states and keyboard navigation" (e2e-form-interactions), "Focus order follows logical reading order on Home page" (accessibility) + +### 7. Navigation Menu Test Logic Bug (Test Code Issue) +**Affected:** `e2e-smoke-suite.spec.ts` — "navigation menu works" +**Detail:** The test clicks "About" and then checks `expect(page.url()).not.toContain('http://localhost:10000/')`. However the navigated URL is `http://localhost:10000/about`, which does NOT contain the exact string `http://localhost:10000/` with a trailing slash — so the assertion actually passes in some cases. But the test fails due to the Playwright `a:has-text("About")` selector matching footer links in addition to nav links (the About footer link has text "About Us", so the first match may be different). This is a test quality issue, not necessarily a site bug. + +### 8. CORS Headers Missing on API Endpoints (Production Config) +**Affected:** `/api/contact`, `/api/newsletter` — OPTIONS preflight and POST responses +**Test:** `bug-fix-verification.spec.ts` BUG-4 — 4 tests failing +**Detail:** The API code returns `Access-Control-Allow-Origin: *` only in non-production mode. In the current server environment (which runs as production), CORS reflects the allowlist (`https://workroot.in`, `https://www.workroot.in`). Tests running against `localhost:10000` send requests without an `Origin` header matching the production allowlist, so the reflected CORS header defaults to `https://workroot.in` rather than `*`, causing the test assertions to fail. +**Impact:** When the site is accessed from a different origin in production (e.g., an embedded form on a partner site), CORS will block legitimate cross-origin requests. The allowlist is hard-coded to the production domain only. + +### 9. Contact Form Validation Errors Not Shown on Submit (Empty Form) +**Affected:** `/contact` — client-side form validation +**Test:** "Submitting empty form shows validation errors" — FAILING +**Detail:** The contact form uses `novalidate` and relies on JavaScript for validation. Multiple tests find that error messages are not displayed on blank submission, or that the submit button is not disabled as expected during the loading state. + +### 10. SVG Icons Missing aria-hidden or aria-label on All Pages +**Affected:** Home, About, Services, Portfolio, Blog, Contact, Privacy, Terms, Sitemap +**Test:** `accessibility.spec.ts` — "SVGs are either decorative (aria-hidden) or have accessible labels" — 9 pages FAILING +**WCAG Criterion:** 1.1.1 Non-text Content +**Detail:** Multiple SVG elements throughout the site lack either `aria-hidden="true"` (for decorative icons) or an accessible label. This affects all pages. Screen reader users will encounter unlabeled icons. + +### 11. Blog Page Dark Mode: Hero Section Background Transparent +**Affected:** `/blog` — dark mode styling +**Test:** `bug-fix-verification.spec.ts` BUG-2 — "Blog page hero section background is not transparent in dark mode" +**Detail:** In dark mode, the blog hero section background is computed as transparent, making text unreadable against whatever background shows through. + +### 12. Horizontal Scroll Overflow on Mobile +**Affected:** `/` (homepage), `/about`, `/services` +**Test:** `cross-browser.spec.ts` — "No horizontal overflow at mobile on /" etc. — 3+ tests FAILING +**Detail:** At 375px viewport width, `document.body.scrollWidth` exceeds `viewport.width + 20px` tolerance. The homepage, about, and services pages have layout elements that extend beyond the mobile viewport, causing horizontal scrolling. +**Impact:** Poor UX on mobile devices (60%+ of web traffic). + +--- + +## P3 — Minor (polish) + +### 13. 404 Page Returns HTTP 200 Instead of 404 +**Affected:** Navigation to unknown pages (e.g., `/nonexistent-page`) +**Detail:** `curl -s -o /dev/null -w "%{http_code}" http://localhost:10000/nonexistent-page` returns 404 correctly. However, `tests/cross-browser.spec.ts` "404 page loads successfully" is failing — likely because the test navigates to a specific URL (possibly `/404`) that returns 404, and the test's `response.status()` check expects `< 400`. + +### 14. Skip Link Does Not Focus Main Content on Activation +**Affected:** `/` — keyboard accessibility +**Test:** `accessibility.spec.ts` — "Skip link works - activating it focuses main content" — FAILING +**Detail:** The skip link (`href="#main-content"`) is present and visually correct, but activating it via keyboard does not move browser focus to the `#main-content` element. The target element likely lacks `tabindex="-1"` to receive programmatic focus. + +### 15. Portfolio Case Study Modal Not Accessible via Keyboard +**Affected:** `/portfolio` — case study modal +**Tests failing:** "Portfolio modal can be closed with Escape key", "Case study modal opens when 'View Case Study' is clicked", "Case study modal closes on Escape key" +**Detail:** The portfolio case study modal cannot be opened or closed via keyboard interaction. No Escape key handler detected. + +### 16. Contact Form Labels Not Fully Associated (WCAG 1.3.1) +**Affected:** `/contact` — form label associations +**Test:** `accessibility.spec.ts` — "Contact: form inputs have associated labels" — FAILING +**Detail:** Budget radio buttons and possibly other fields may not have programmatically associated labels meeting WCAG 1.3.1. + +### 17. Buttons Lack Distinct Background Colors (WCAG 1.4.3) +**Affected:** Site-wide — button color contrast +**Test:** `accessibility.spec.ts` — "Buttons have distinct background colors" — FAILING +**Detail:** Some buttons appear to not have a background color distinct from the page background, failing the color contrast test. + +### 18. Reduced Motion Not Respected +**Affected:** Site-wide — animations +**Test:** `accessibility.spec.ts` — "Animations respect prefers-reduced-motion media query" — FAILING +**Detail:** CSS animations do not appear to have `@media (prefers-reduced-motion: reduce)` guards or the guards are insufficient. + +### 19. Newsletter API Rate Limiting Prevents Test Validation +**Affected:** `/api/newsletter` +**Tests:** "newsletter API rejects empty email", "newsletter API rejects invalid email", "rejects excessively long email" — FAILING +**Detail:** Same in-memory rate limiter issue as P1 Bug #1. Newsletter API is also rate-limited, and validation tests receive 429 instead of expected 422 error codes. + +### 20. Mobile Navigation Menu aria-expanded State Not Updating +**Affected:** Mobile header — hamburger menu +**Test:** `accessibility.spec.ts` — "Mobile menu toggle has correct aria-expanded state" — FAILING (30.8s timeout) +**Detail:** The mobile menu toggle button's `aria-expanded` attribute is not updating correctly, or the test timed out waiting for the state change. + +### 21. Contact Page Social Links Count Mismatch +**Affected:** `/contact` — social links section +**Test:** "Social links section renders all 4 platforms" — FAILING +**Detail:** The test expects exactly 4 social platform links. Current page snapshot shows LinkedIn, Twitter/X, GitHub, and Facebook — 4 links. The test may be using a different selector or the links are rendered differently. + +--- + +## Test Infrastructure Issues (Not Site Bugs) + +These are issues with the test environment that inflate the failure count: + +1. **Missing Playwright browser binaries** — Chromium, WebKit, Edge, Mobile Chrome, Mobile Safari, Tablet profiles are all missing their browser executables. The full-suite run from `playwright-report/index.html` shows 441/441 failures, all with "Executable doesn't exist" or "msedge not found" errors. Only the Chromium binary is available for the live run (via `npx playwright test` which downloads on-demand), and Edge (msedge) is never installed. + +2. **Rate limiter not reset between test runs** — The contact form and newsletter APIs use an in-memory rate limiter that persists across test suite runs. Running the full test suite multiple times exhausts the hourly limits and causes cascading failures in all API and form tests. + +3. **Test selectors reference old design** — Several tests (portfolio filters, form field names, contact form layout) reference an older version of the page design. For example, portfolio filter buttons used to include "AI & ML" but the page was redesigned to use different categories. + +--- + +## Notes for Client Meeting + +1. **Site is live and all 10 pages return HTTP 200.** Core navigation, blog posts (5 articles), portfolio, and contact pages all load correctly. + +2. **Security posture is strong** — Full CSP headers, X-Frame-Options: DENY, Permissions-Policy, X-Content-Type-Options, HSTS-ready, rate limiting on API endpoints are all in place. + +3. **Email delivery is broken** — No SMTP credentials are configured. Contact form submissions are logged server-side but no emails are sent. This must be configured before go-live. + +4. **Mobile layout has overflow issues** — Homepage, about, and services pages have horizontal scroll on mobile viewports (375px). Needs CSS fix before launch. + +5. **Portfolio filter redesign broke tests** — The portfolio page was redesigned with new filter categories ("Government", "Enterprise") but the test suite still references old categories ("AI & ML"). Either the site or the tests need to be updated to match. + +6. **Accessibility gaps** — SVG icons sitewide are missing aria labels/hidden attributes. Skip link anchor target needs `tabindex="-1"`. These are WCAG 2.1 AA blockers for government/enterprise clients. + +7. **Firefox tested manually (previous run)** — The automated cross-browser run could not test Chromium, WebKit, Edge, or mobile due to missing binaries. Manual Firefox testing passed in a prior session (March 2026 TEST_REPORT.md). Recommend running `npx playwright install` to reinstall all browser binaries before the next automated run.