[Audit] E2E: auth Unauthorized UX + RBAC denial coverage

[RaminNietzsche]

Background

E2E surface is thin relative to security-critical UI.

Problem

tests/e2e/ only covers mocked watch/export/tenant-prefs. No unauthenticated Unauthorized UX, OIDC callback, or viewer-vs-admin RBAC denial — regressions can ship with green e2e.

Proposed solution

• E2E: unauthenticated API → Unauthorized UX
• OIDC callback happy/error with mocked IdP
• Viewer vs admin denial on Ops/admin actions

Acceptance criteria

• CI e2e includes ≥1 auth and ≥1 RBAC case
• Deterministic fixtures

Priority

P2 / Medium

Complexity

Medium

Evidence

tests/e2e/ (3 specs only)

[github-actions]

The issue highlights gaps in end-to-end (E2E) test coverage for security-critical user interfaces, particularly lacking tests for unauthorized UX handling, OpenID Connect (OIDC) callbacks, and role-based access control (RBAC) denial scenarios. The proposed solution involves adding E2E tests for unauthenticated API behavior, OIDC callback scenarios, and differentiating viewer vs. admin access. The goal is to ensure CI includes at least one authentication and one RBAC case with deterministic fixtures to prevent regressions. The issue is prioritized as medium complexity and priority.