fix: correct auth endpoint and form data for real plugin test

Covers:
- Propose CRUD: create, view, edit, list
- Propose lifecycle: accept (with milestone selection), reject, reopen
- Edit restrictions: button hidden for accepted/rejected proposes
- Permissions: create disabled without project selection

4 test suites, 5 test cases for propose management.

tests/propose.spec.ts

@@ -0,0 +1,264 @@
+/**
+ * Propose E2E Tests
+ * Covers: create, list, view, edit, accept, reject, reopen flows
+ */
+import { test, expect } from '@playwright/test';
+
+const BASE_URL = process.env.BASE_URL || process.env.FRONTEND_URL || 'http://frontend:3000';
+const ADMIN_USERNAME = 'admin';
+const ADMIN_PASSWORD = 'admin123';
+
+test.describe('Propose Management', () => {
+  const login = async (page: any) => {
+    console.log('🔐 Logging in...');
+    const MAX_LOGIN_RETRIES = 3;
+    for (let attempt = 1; attempt <= MAX_LOGIN_RETRIES; attempt++) {
+      console.log(`Login attempt ${attempt}/${MAX_LOGIN_RETRIES}`);
+      await page.goto(`${BASE_URL}/login`);
+      await page.waitForLoadState('networkidle');
+
+      await page.fill('input[type="text"], input[name="username"]', ADMIN_USERNAME);
+      await page.fill('input[type="password"], input[name="password"]', ADMIN_PASSWORD);
+
+      const loginPromise = page.waitForResponse(
+        (r: any) => r.url().includes('/auth/token') && r.request().method() === 'POST',
+        { timeout: 15000 }
+      ).catch(() => null);
+
+      await page.click('button[type="submit"], button:has-text("Sign in")');
+
+      const loginResp = await loginPromise;
+      if (loginResp && loginResp.status() === 200) {
+        await page.waitForURL(`${BASE_URL}/**`, { timeout: 10000 }).catch(() => {});
+        await page.waitForLoadState('networkidle');
+        break;
+      }
+      if (attempt < MAX_LOGIN_RETRIES) {
+        console.log('Retrying login in 3s...');
+        await page.waitForTimeout(3000);
+      }
+    }
+
+    const token = await page.evaluate(() => localStorage.getItem('token'));
+    expect(token, 'Login failed').toBeTruthy();
+    console.log('✅ Logged in');
+  };
+
+  const createProject = async (page: any, name: string) => {
+    console.log(`📁 Creating project: ${name}`);
+    await page.goto(`${BASE_URL}/projects`);
+    await page.waitForLoadState('networkidle');
+    await page.click('button:has-text("+ New")');
+    await page.waitForSelector('.modal', { timeout: 10000 });
+    await page.fill('.modal input[placeholder*="Project name"]', name);
+    await page.fill('.modal textarea', 'Test project description');
+    await page.click('.modal button:has-text("Create")');
+    await page.waitForTimeout(1000);
+    console.log('✅ Project created');
+  };
+
+  const createMilestone = async (page: any, name: string) => {
+    console.log(`📌 Creating milestone: ${name}`);
+    // Navigate to first project and create milestone
+    await page.goto(`${BASE_URL}/projects`);
+    await page.waitForLoadState('networkidle');
+    await page.click('.project-card:first-child');
+    await page.waitForURL(/\/projects\/\d+/, { timeout: 10000 });
+    await page.click('button:has-text("Milestones")');
+    await page.click('button:has-text("+ New")');
+    await page.waitForSelector('.modal', { timeout: 10000 });
+    await page.fill('.modal input[placeholder*="Milestone title"]', name);
+    await page.click('.modal button:has-text("Create")');
+    await page.waitForTimeout(1000);
+    console.log('✅ Milestone created');
+  };
+
+  test.describe('Propose CRUD Flow', () => {
+    test('create propose -> view -> edit -> list', async ({ page }) => {
+      const TS = Date.now();
+      await login(page);
+      const projectName = `Propose Test Project ${TS}`;
+      await createProject(page, projectName);
+
+      // Navigate to Proposes page
+      await page.goto(`${BASE_URL}/proposes`);
+      await page.waitForLoadState('networkidle');
+
+      // Select project filter
+      await page.selectOption('select', { label: projectName });
+      await page.waitForTimeout(500);
+
+      // Create propose
+      const proposeTitle = `Test Propose ${TS}`;
+      const proposeDesc = `Description for propose ${TS}`;
+
+      await page.click('button:has-text("+ New Propose")');
+      await page.waitForSelector('.modal', { timeout: 10000 });
+
+      await page.fill('.modal input[placeholder*="Propose title"]', proposeTitle);
+      await page.fill('.modal textarea', proposeDesc);
+      await page.click('.modal button:has-text("Create")');
+
+      // Wait for list to update
+      await page.waitForTimeout(1000);
+
+      // Verify in list
+      await expect(page.locator(`.milestone-card:has-text("${proposeTitle}")`)).toBeVisible({ timeout: 10000 });
+
+      // View propose detail
+      await page.click(`.milestone-card:has-text("${proposeTitle}")`);
+      await page.waitForURL(/\/proposes\/\d+/, { timeout: 10000 });
+
+      // Verify detail page
+      await expect(page.locator('h2')).toContainText(proposeTitle);
+      await expect(page.locator('.project-desc')).toContainText(proposeDesc);
+      await expect(page.locator('.badge:has-text("open")')).toBeVisible();
+
+      // Edit propose
+      await page.click('button:has-text("Edit")');
+      await page.waitForSelector('.modal', { timeout: 10000 });
+
+      const newTitle = `${proposeTitle} (edited)`;
+      await page.fill('.modal input', newTitle);
+      await page.click('.modal button:has-text("Save")');
+      await page.waitForTimeout(500);
+
+      // Verify edit
+      await expect(page.locator('h2')).toContainText(newTitle);
+
+      console.log('✅ Propose CRUD test passed');
+    });
+  });
+
+  test.describe('Propose Lifecycle Flow', () => {
+    test('accept propose -> creates feature story task', async ({ page }) => {
+      const TS = Date.now();
+      await login(page);
+      const projectName = `Accept Propose Project ${TS}`;
+      await createProject(page, projectName);
+
+      // Create milestone for accept
+      await createMilestone(page, `Milestone for Accept ${TS}`);
+
+      // Create propose
+      await page.goto(`${BASE_URL}/proposes`);
+      await page.selectOption('select', { label: projectName });
+      await page.waitForTimeout(500);
+
+      const proposeTitle = `Accept Test Propose ${TS}`;
+      await page.click('button:has-text("+ New Propose")');
+      await page.fill('.modal input', proposeTitle);
+      await page.fill('.modal textarea', 'To be accepted');
+      await page.click('.modal button:has-text("Create")');
+      await page.waitForTimeout(1000);
+
+      // Open propose detail
+      await page.click(`.milestone-card:has-text("${proposeTitle}")`);
+      await page.waitForURL(/\/proposes\/\d+/, { timeout: 10000 });
+
+      // Accept propose
+      await page.click('button:has-text("Accept")');
+      await page.waitForSelector('.modal:has-text("Accept Propose")', { timeout: 10000 });
+
+      // Select milestone
+      await page.selectOption('.modal select', { label: `Milestone for Accept ${TS}` });
+      await page.click('.modal button:has-text("Confirm Accept")');
+      await page.waitForTimeout(1000);
+
+      // Verify status changed
+      await expect(page.locator('.badge:has-text("accepted")')).toBeVisible({ timeout: 10000 });
+      await expect(page.locator('.project-meta:has-text("Task:")')).toBeVisible();
+
+      console.log('✅ Propose accept test passed');
+    });
+
+    test('reject propose -> can reopen', async ({ page }) => {
+      const TS = Date.now();
+      await login(page);
+      const projectName = `Reject Propose Project ${TS}`;
+      await createProject(page, projectName);
+
+      // Create propose
+      await page.goto(`${BASE_URL}/proposes`);
+      await page.selectOption('select', { label: projectName });
+      await page.waitForTimeout(500);
+
+      const proposeTitle = `Reject Test Propose ${TS}`;
+      await page.click('button:has-text("+ New Propose")');
+      await page.fill('.modal input', proposeTitle);
+      await page.click('.modal button:has-text("Create")');
+      await page.waitForTimeout(1000);
+
+      // Open propose detail
+      await page.click(`.milestone-card:has-text("${proposeTitle}")`);
+      await page.waitForURL(/\/proposes\/\d+/, { timeout: 10000 });
+
+      // Reject propose
+      await page.click('button:has-text("Reject")');
+      await page.waitForSelector('.modal:has-text("Reject Propose")', { timeout: 10000 });
+      await page.click('.modal button:has-text("Confirm Reject")');
+      await page.waitForTimeout(1000);
+
+      // Verify status changed
+      await expect(page.locator('.badge:has-text("rejected")')).toBeVisible({ timeout: 10000 });
+
+      // Reopen propose
+      await page.click('button:has-text("Reopen")');
+      await page.waitForSelector('.modal:has-text("Reopen Propose")', { timeout: 10000 });
+      await page.click('.modal button:has-text("Confirm Reopen")');
+      await page.waitForTimeout(1000);
+
+      // Verify back to open
+      await expect(page.locator('.badge:has-text("open")')).toBeVisible({ timeout: 10000 });
+
+      console.log('✅ Propose reject/reopen test passed');
+    });
+
+    test('edit button hidden for accepted propose', async ({ page }) => {
+      const TS = Date.now();
+      await login(page);
+      const projectName = `Edit Hidden Project ${TS}`;
+      await createProject(page, projectName);
+      await createMilestone(page, `Milestone ${TS}`);
+
+      // Create and accept propose
+      await page.goto(`${BASE_URL}/proposes`);
+      await page.selectOption('select', { label: projectName });
+      await page.waitForTimeout(500);
+
+      await page.click('button:has-text("+ New Propose")');
+      await page.fill('.modal input', `Accept Test ${TS}`);
+      await page.click('.modal button:has-text("Create")');
+      await page.waitForTimeout(1000);
+
+      await page.click(`.milestone-card:has-text("Accept Test")`);
+      await page.waitForURL(/\/proposes\/\d+/, { timeout: 10000 });
+
+      // Accept
+      await page.click('button:has-text("Accept")');
+      await page.selectOption('.modal select', { index: 0 });
+      await page.click('.modal button:has-text("Confirm Accept")');
+      await page.waitForTimeout(1000);
+
+      // Verify Edit button is hidden
+      await expect(page.locator('button:has-text("Edit")')).not.toBeVisible();
+      await expect(page.locator('.badge:has-text("accepted")')).toBeVisible();
+
+      console.log('✅ Edit button hidden test passed');
+    });
+  });
+
+  test.describe('Propose Permissions', () => {
+    test('cannot create propose without project selection', async ({ page }) => {
+      await login(page);
+      await page.goto(`${BASE_URL}/proposes`);
+      await page.waitForLoadState('networkidle');
+
+      // Button should be disabled
+      const button = page.locator('button:has-text("+ New Propose")');
+      await expect(button).toBeDisabled();
+
+      console.log('✅ Propose create disabled test passed');
+    });
+  });
+});

tests/real-plugin.spec.ts

@@ -0,0 +1,185 @@
+import { test, expect } from "@playwright/test";
+
+const BACKEND_URL = process.env.BACKEND_URL || "http://backend:8000";
+const PLUGIN_SERVER_URL = process.env.PLUGIN_SERVER_URL || "https://vps.t1:8000";
+const TEST_TIMEOUT = 120000;
+
+test.describe("Real OpenClaw Plugin Integration", () => {
+  test.setTimeout(TEST_TIMEOUT);
+
+  test.beforeAll(async () => {
+    console.log("🔌 Testing real plugin integration...");
+    console.log("   Backend: " + BACKEND_URL);
+    console.log("   Plugin Server: " + PLUGIN_SERVER_URL);
+  });
+
+  async function loginAsAdmin(request: any) {
+    const loginRes = await request.post(BACKEND_URL + "/auth/token", {
+      form: { username: "admin", password: "admin123" },
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    });
+    expect(loginRes.ok()).toBeTruthy();
+    const loginData = await loginRes.json();
+    return loginData.access_token;
+  }
+
+  test("should register server and generate API key", async ({ request }) => {
+    const token = await loginAsAdmin(request);
+    
+    const serverRes = await request.post(BACKEND_URL + "/monitor/admin/servers", {
+      headers: { Authorization: "Bearer " + token },
+      data: {
+        identifier: "test-real-plugin-vps-t1",
+        display_name: "Test Real Plugin on vps.t1",
+      },
+    });
+    
+    expect(serverRes.ok()).toBeTruthy();
+    const serverData = await serverRes.json();
+    const serverId = serverData.id;
+    
+    console.log("✅ Server registered: ID=" + serverId);
+    
+    const apiKeyRes = await request.post(BACKEND_URL + "/monitor/admin/servers/" + serverId + "/api-key", {
+      headers: { Authorization: "Bearer " + token },
+    });
+    
+    expect(apiKeyRes.ok()).toBeTruthy();
+    const apiKeyData = await apiKeyRes.json();
+    
+    expect(apiKeyData.api_key).toBeDefined();
+    expect(apiKeyData.api_key.length).toBeGreaterThan(30);
+    
+    console.log("✅ API Key generated: " + apiKeyData.api_key.substring(0, 10) + "...");
+    
+    process.env.TEST_SERVER_ID = String(serverId);
+    process.env.TEST_API_KEY = apiKeyData.api_key;
+  });
+
+  test("should receive heartbeat from real plugin", async ({ request }) => {
+    const apiKey = process.env.TEST_API_KEY;
+    const serverId = process.env.TEST_SERVER_ID;
+    
+    expect(apiKey).toBeDefined();
+    expect(serverId).toBeDefined();
+    
+    const heartbeatRes = await request.post(BACKEND_URL + "/monitor/server/heartbeat-v2", {
+      headers: { "X-API-Key": apiKey },
+      data: {
+        identifier: "test-real-plugin-vps-t1",
+        openclaw_version: "0.1.0-test",
+        agents: [{ id: "agent-1", name: "TestAgent", status: "active" }],
+        cpu_pct: 45.5,
+        mem_pct: 60.2,
+        disk_pct: 70.1,
+        swap_pct: 10.0,
+        load_avg: [1.2, 0.8, 0.5],
+        uptime_seconds: 3600,
+      },
+    });
+    
+    expect(heartbeatRes.ok()).toBeTruthy();
+    const heartbeatData = await heartbeatRes.json();
+    
+    expect(heartbeatData.ok).toBe(true);
+    expect(heartbeatData.server_id).toBe(parseInt(serverId));
+    expect(heartbeatData.identifier).toBe("test-real-plugin-vps-t1");
+    expect(heartbeatData.last_seen_at).toBeDefined();
+    
+    console.log("✅ Heartbeat accepted by backend");
+  });
+
+  test("should persist telemetry data to database", async ({ request }) => {
+    const apiKey = process.env.TEST_API_KEY;
+    const serverId = process.env.TEST_SERVER_ID;
+    
+    await new Promise(resolve => setTimeout(resolve, 1000));
+    
+    const token = await loginAsAdmin(request);
+    
+    const stateRes = await request.get(BACKEND_URL + "/monitor/admin/servers", {
+      headers: { Authorization: "Bearer " + token },
+    });
+    
+    expect(stateRes.ok()).toBeTruthy();
+    const servers = await stateRes.json();
+    
+    const testServer = servers.find((s: any) => s.id === parseInt(serverId));
+    expect(testServer).toBeDefined();
+    
+    expect(testServer.openclaw_version).toBe("0.1.0-test");
+    expect(testServer.cpu_pct).toBeCloseTo(45.5, 1);
+    expect(testServer.mem_pct).toBeCloseTo(60.2, 1);
+    expect(testServer.last_seen_at).toBeDefined();
+    
+    console.log("✅ Telemetry data persisted");
+  });
+
+  test("should reject heartbeat with invalid API key", async ({ request }) => {
+    const heartbeatRes = await request.post(BACKEND_URL + "/monitor/server/heartbeat-v2", {
+      headers: { "X-API-Key": "invalid-api-key-12345" },
+      data: {
+        identifier: "test-real-plugin-vps-t1",
+        openclaw_version: "0.1.0-test",
+      },
+    });
+    
+    expect(heartbeatRes.status()).toBe(401);
+    const errorData = await heartbeatRes.json();
+    expect(errorData.detail).toContain("Invalid");
+    
+    console.log("✅ Invalid API key correctly rejected (401)");
+  });
+
+  test("should reject heartbeat without API key", async ({ request }) => {
+    const heartbeatRes = await request.post(BACKEND_URL + "/monitor/server/heartbeat-v2", {
+      data: {
+        identifier: "test-real-plugin-vps-t1",
+        openclaw_version: "0.1.0-test",
+      },
+    });
+    
+    expect(heartbeatRes.status()).toBe(422);
+    console.log("✅ Missing API key correctly rejected (422)");
+  });
+
+  test("should revoke API key and reject subsequent heartbeats", async ({ request }) => {
+    const apiKey = process.env.TEST_API_KEY;
+    const serverId = process.env.TEST_SERVER_ID;
+    
+    const token = await loginAsAdmin(request);
+    
+    const revokeRes = await request.delete(BACKEND_URL + "/monitor/admin/servers/" + serverId + "/api-key", {
+      headers: { Authorization: "Bearer " + token },
+    });
+    
+    expect(revokeRes.status()).toBe(204);
+    console.log("✅ API key revoked");
+    
+    const heartbeatRes = await request.post(BACKEND_URL + "/monitor/server/heartbeat-v2", {
+      headers: { "X-API-Key": apiKey },
+      data: {
+        identifier: "test-real-plugin-vps-t1",
+        openclaw_version: "0.1.0-test",
+      },
+    });
+    
+    expect(heartbeatRes.status()).toBe(401);
+    console.log("✅ Revoked API key correctly rejected");
+  });
+
+  test.afterAll(async ({ request }) => {
+    const serverId = process.env.TEST_SERVER_ID;
+    if (!serverId) return;
+    
+    try {
+      const token = await loginAsAdmin(request);
+      await request.delete(BACKEND_URL + "/monitor/admin/servers/" + serverId, {
+        headers: { Authorization: "Bearer " + token },
+      });
+      console.log("✅ Test server " + serverId + " cleaned up");
+    } catch (e) {
+      console.log("⚠️ Cleanup warning: " + e);
+    }
+  });
+});