CompanySite/BUG_LIST.md

Bug List — WorkRoot IT Solutions Site

Date: 2026-05-11
Tester: QA Agent
Test Coverage: Playwright E2E (Chromium — live run), HTTP curl checks, HTML source analysis
Site URL: http://localhost:10000 (Astro SSR, Node/Express, port 10000)

---

Summary

Metric	Count
Total tests run (live chromium run)	494
Passing	394
Failing	100
Pass rate	~80%

Previous full-suite run (all 7 browsers): 441/441 failed — all due to missing Playwright browser binaries (chromium, webkit, edge, mobile, tablet) not installed in the CI/CD environment. Firefox binaries were present. This infrastructure issue inflates the "failing" count and is separate from site bugs.

---

P1 — Critical (blocks client demo)

1. API Rate Limiter Exhausted — Contact & Newsletter Forms Broken in Test Runs

Affected: /api/contact, /api/newsletter
Error: {"success":false,"error":"Too many requests. Please try again later."} HTTP 429
Root cause: The in-memory rate limiter (5 submissions/hour/IP) persists across test runs. After automated tests exhaust the limit, every subsequent API test call — including validation-failure tests that expect HTTP 422 — receives 429 instead. This means:

• Contact form submission in smoke test fails
• All API integration tests that validate error responses (missing name, invalid email, etc.) fail because they get 429 instead of 422
• Impact on demo: If the client submits the form more than 5 times during a demo or review session, the form silently stops working until the 1-hour window resets.
• Affected tests: 10 in api-integration.spec.ts, 4 in newsletter-subscription.spec.ts, multiple in e2e-form-interactions.spec.ts

Fix: Whitelist test IPs or add a test-environment bypass; expose a reset endpoint for CI; or increase rate limit threshold for the staging environment.

2. Contact Form Submit Success Message Text Mismatch

Affected: /contact — form submission success state
Error: Smoke test expects text=/sent successfully/i but the success state shows "Message Sent!" and "Message received! We will get back to you shortly."
Test: e2e-smoke-suite.spec.ts — "contact form submission works"
Impact on demo: The success message wording does not match the UX copy used in the PRD/spec and the automated tests. Low direct user impact but causes test regression.

3. SMTP Not Configured — Contact Form Emails Not Delivered

Affected: /api/contact email delivery
Evidence: Server startup logs "SMTP not configured — skipping connection verification". No .env file is present in the workspace. SMTP_HOST, SMTP_USER, SMTP_PASS are all unset. The API returns HTTP 200 (graceful degradation) but no email is ever sent to admin@workroot.in.
Impact on demo: Clients who submit the contact form will not receive a confirmation email, and the team will not receive any notification. This is a P1 for a real client handoff.

4. Blog Post Page Fails Smoke Test (Header/Footer Detection)

Affected: /blog/getting-started-with-astro
Test: e2e-smoke-suite.spec.ts — "Blog Post loads successfully" — FAILING
Evidence: A screenshot was captured (test-results/e2e-smoke-suite-Smoke-Suit-74f8c-log-Post-loads-successfully-chromium/test-failed-1.png). The page snapshot shows the page loaded with header, main, and footer present, but the test still fails. Likely a locator('header') vs ARIA banner role timing issue, or the blog post SSR page missing a literal <header> tag.
Note: All 5 blog posts return HTTP 200. The underlying content is intact.

---

P2 — Major (degrades experience)

5. Portfolio Filter Categories Changed — Tests Reference Non-Existent Filters

Affected: /portfolio — filter buttons
Expected by tests: Filters for "All", "Web", "Mobile", "AI & ML"
Actual on page: "All Projects", "Web Development", "Government", "Enterprise", "Mobile Apps" — no AI/ML filter
Failing tests (cross-browser.spec.ts):

• "All filter buttons are present"
• "'All Projects' filter is active by default"
• "'AI & ML' filter shows only AI projects"
• "Switching back to 'All' restores all projects"
• "Case study modal opens/closes with button/Escape"
• "Portfolio gallery modal shows project details"

Impact: 6 tests fail. The filter taxonomy has been redesigned without updating the test suite. The portfolio page itself looks functional but the AI/ML category is absent.

6. Contact Form Element Locators Mismatch in Tests

Affected: /contact — cross-browser and form interaction tests
Detail: Tests use input[name="name"] but the smoke test for keyboard navigation expects pressing Tab from the page body to immediately focus the name field. However, the contact page has a "Skip to main content" link as the first focusable element, nav links, theme toggle, and CTA button before reaching the form. The first Tab keystroke focuses the skip link, not the name field.
Failing tests: "contact form is keyboard navigable" (e2e-smoke-suite), "form field focus states and keyboard navigation" (e2e-form-interactions), "Focus order follows logical reading order on Home page" (accessibility)

7. Navigation Menu Test Logic Bug (Test Code Issue)

Affected: e2e-smoke-suite.spec.ts — "navigation menu works"
Detail: The test clicks "About" and then checks expect(page.url()).not.toContain('http://localhost:10000/'). However the navigated URL is http://localhost:10000/about, which does NOT contain the exact string http://localhost:10000/ with a trailing slash — so the assertion actually passes in some cases. But the test fails due to the Playwright a:has-text("About") selector matching footer links in addition to nav links (the About footer link has text "About Us", so the first match may be different). This is a test quality issue, not necessarily a site bug.

8. CORS Headers Missing on API Endpoints (Production Config)

Affected: /api/contact, /api/newsletter — OPTIONS preflight and POST responses
Test: bug-fix-verification.spec.ts BUG-4 — 4 tests failing
Detail: The API code returns Access-Control-Allow-Origin: * only in non-production mode. In the current server environment (which runs as production), CORS reflects the allowlist (https://workroot.in, https://www.workroot.in). Tests running against localhost:10000 send requests without an Origin header matching the production allowlist, so the reflected CORS header defaults to https://workroot.in rather than *, causing the test assertions to fail.
Impact: When the site is accessed from a different origin in production (e.g., an embedded form on a partner site), CORS will block legitimate cross-origin requests. The allowlist is hard-coded to the production domain only.

9. Contact Form Validation Errors Not Shown on Submit (Empty Form)

Affected: /contact — client-side form validation
Test: "Submitting empty form shows validation errors" — FAILING
Detail: The contact form uses novalidate and relies on JavaScript for validation. Multiple tests find that error messages are not displayed on blank submission, or that the submit button is not disabled as expected during the loading state.

10. SVG Icons Missing aria-hidden or aria-label on All Pages

Affected: Home, About, Services, Portfolio, Blog, Contact, Privacy, Terms, Sitemap
Test: accessibility.spec.ts — "SVGs are either decorative (aria-hidden) or have accessible labels" — 9 pages FAILING
WCAG Criterion: 1.1.1 Non-text Content
Detail: Multiple SVG elements throughout the site lack either aria-hidden="true" (for decorative icons) or an accessible label. This affects all pages. Screen reader users will encounter unlabeled icons.

11. Blog Page Dark Mode: Hero Section Background Transparent

Affected: /blog — dark mode styling
Test: bug-fix-verification.spec.ts BUG-2 — "Blog page hero section background is not transparent in dark mode"
Detail: In dark mode, the blog hero section background is computed as transparent, making text unreadable against whatever background shows through.

12. Horizontal Scroll Overflow on Mobile

Affected: / (homepage), /about, /services
Test: cross-browser.spec.ts — "No horizontal overflow at mobile on /" etc. — 3+ tests FAILING
Detail: At 375px viewport width, document.body.scrollWidth exceeds viewport.width + 20px tolerance. The homepage, about, and services pages have layout elements that extend beyond the mobile viewport, causing horizontal scrolling.
Impact: Poor UX on mobile devices (60%+ of web traffic).

---

P3 — Minor (polish)

13. 404 Page Returns HTTP 200 Instead of 404

Affected: Navigation to unknown pages (e.g., /nonexistent-page)
Detail: curl -s -o /dev/null -w "%{http_code}" http://localhost:10000/nonexistent-page returns 404 correctly. However, tests/cross-browser.spec.ts "404 page loads successfully" is failing — likely because the test navigates to a specific URL (possibly /404) that returns 404, and the test's response.status() check expects < 400.

14. Skip Link Does Not Focus Main Content on Activation

Affected: / — keyboard accessibility
Test: accessibility.spec.ts — "Skip link works - activating it focuses main content" — FAILING
Detail: The skip link (href="#main-content") is present and visually correct, but activating it via keyboard does not move browser focus to the #main-content element. The target element likely lacks tabindex="-1" to receive programmatic focus.

15. Portfolio Case Study Modal Not Accessible via Keyboard

Affected: /portfolio — case study modal
Tests failing: "Portfolio modal can be closed with Escape key", "Case study modal opens when 'View Case Study' is clicked", "Case study modal closes on Escape key"
Detail: The portfolio case study modal cannot be opened or closed via keyboard interaction. No Escape key handler detected.

16. Contact Form Labels Not Fully Associated (WCAG 1.3.1)

Affected: /contact — form label associations
Test: accessibility.spec.ts — "Contact: form inputs have associated labels" — FAILING
Detail: Budget radio buttons and possibly other fields may not have programmatically associated labels meeting WCAG 1.3.1.

17. Buttons Lack Distinct Background Colors (WCAG 1.4.3)

Affected: Site-wide — button color contrast
Test: accessibility.spec.ts — "Buttons have distinct background colors" — FAILING
Detail: Some buttons appear to not have a background color distinct from the page background, failing the color contrast test.

18. Reduced Motion Not Respected

Affected: Site-wide — animations
Test: accessibility.spec.ts — "Animations respect prefers-reduced-motion media query" — FAILING
Detail: CSS animations do not appear to have @media (prefers-reduced-motion: reduce) guards or the guards are insufficient.

19. Newsletter API Rate Limiting Prevents Test Validation

Affected: /api/newsletter
Tests: "newsletter API rejects empty email", "newsletter API rejects invalid email", "rejects excessively long email" — FAILING
Detail: Same in-memory rate limiter issue as P1 Bug #1. Newsletter API is also rate-limited, and validation tests receive 429 instead of expected 422 error codes.

20. Mobile Navigation Menu aria-expanded State Not Updating

Affected: Mobile header — hamburger menu
Test: accessibility.spec.ts — "Mobile menu toggle has correct aria-expanded state" — FAILING (30.8s timeout)
Detail: The mobile menu toggle button's aria-expanded attribute is not updating correctly, or the test timed out waiting for the state change.

21. Contact Page Social Links Count Mismatch

Affected: /contact — social links section
Test: "Social links section renders all 4 platforms" — FAILING
Detail: The test expects exactly 4 social platform links. Current page snapshot shows LinkedIn, Twitter/X, GitHub, and Facebook — 4 links. The test may be using a different selector or the links are rendered differently.

---

Test Infrastructure Issues (Not Site Bugs)

These are issues with the test environment that inflate the failure count:

1. Missing Playwright browser binaries — Chromium, WebKit, Edge, Mobile Chrome, Mobile Safari, Tablet profiles are all missing their browser executables. The full-suite run from playwright-report/index.html shows 441/441 failures, all with "Executable doesn't exist" or "msedge not found" errors. Only the Chromium binary is available for the live run (via npx playwright test which downloads on-demand), and Edge (msedge) is never installed.

2. Rate limiter not reset between test runs — The contact form and newsletter APIs use an in-memory rate limiter that persists across test suite runs. Running the full test suite multiple times exhausts the hourly limits and causes cascading failures in all API and form tests.

3. Test selectors reference old design — Several tests (portfolio filters, form field names, contact form layout) reference an older version of the page design. For example, portfolio filter buttons used to include "AI & ML" but the page was redesigned to use different categories.

---

Notes for Client Meeting

1. Site is live and all 10 pages return HTTP 200. Core navigation, blog posts (5 articles), portfolio, and contact pages all load correctly.

2. Security posture is strong — Full CSP headers, X-Frame-Options: DENY, Permissions-Policy, X-Content-Type-Options, HSTS-ready, rate limiting on API endpoints are all in place.

3. Email delivery is broken — No SMTP credentials are configured. Contact form submissions are logged server-side but no emails are sent. This must be configured before go-live.

4. Mobile layout has overflow issues — Homepage, about, and services pages have horizontal scroll on mobile viewports (375px). Needs CSS fix before launch.

5. Portfolio filter redesign broke tests — The portfolio page was redesigned with new filter categories ("Government", "Enterprise") but the test suite still references old categories ("AI & ML"). Either the site or the tests need to be updated to match.

6. Accessibility gaps — SVG icons sitewide are missing aria labels/hidden attributes. Skip link anchor target needs tabindex="-1". These are WCAG 2.1 AA blockers for government/enterprise clients.

7. Firefox tested manually (previous run) — The automated cross-browser run could not test Chromium, WebKit, Edge, or mobile due to missing binaries. Manual Firefox testing passed in a prior session (March 2026 TEST_REPORT.md). Recommend running npx playwright install to reinstall all browser binaries before the next automated run.