kandev/docs/plans/fix-multi-instance-cookie-isolation/task-05-e2e-cookie-scope-assertions.md

id, title, status, wave, depends_on, plan, spec

id	title	status	wave	depends_on	plan	spec
05-e2e-cookie-scope-assertions	E2E cookie-name assertions	done	3	02-session-cookie-port-scope-backend 04-workspace-cookie-port-scope-frontend	plan.md	../../specs/auth/requirements/fix-multi-instance-cookie-isolation.md

Task 05: E2E cookie-name assertions

Acceptance

• The auth e2e project asserts that the login response's Set-Cookie names the session cookie kandev_session_<port> (port = the fixture's backend port), and that after login the app renders authenticated content.
• The workspace-switch e2e spec (or a new focused spec) asserts that selecting a workspace in the sidebar writes kandev-active-workspace_<port> rather than the unprefixed name. E2E covers the Kanban cookie only: the existing workspace-switch-sidebar-isolation.spec.ts runs with Office disabled, so the office-active-workspace_<port> write is asserted at the unit level (task 04 sidebar test), not in E2E. An Office-enabled workspace-switch E2E setup is recorded as a follow-up, not a blocker.
• Both assertions fail pre-change (the cookies are unprefixed today).
• Scope limitation (from review round 1): the Playwright fixture runs one backend per worker (apps/web/e2e/fixtures/backend.ts, restart() replaces that same process), so e2e here proves the browser-observable cookie naming contract only. The two-instance behavioral regression (independent sessions and workspace state per port) is proven by the Go integration tests in tasks 02 and 03. A two-backend Playwright fixture is explicitly out of scope; note it as a follow-up in the task output.
• The e2e files live in apps/web/e2e/tests/ following the existing auth and workspace-switch spec conventions; no new infrastructure.

Verification

cd apps/web && pnpm e2e:raw --project=auth
# plus the workspace-switch spec's exact command from apps/web/e2e/README.md

Files likely touched

• apps/web/e2e/tests/auth/login.spec.ts (or the auth project's login spec)
• apps/web/e2e/tests/task/workspace-switch-sidebar-isolation.spec.ts (or a sibling spec asserting cookie names)

Dependencies

Shipped behavior of tasks 02 and 04.

Parallelism

Sequential with task 06? No — both are Wave 3 and disjoint (e2e specs vs docs); parallel-safe.

Inputs

• Spec: API surface (cookie names observable via Set-Cookie / document cookie), Scenarios (first, second, fourth).
• Existing helpers: apps/web/e2e/helpers/api-client.ts, apps/web/e2e/helpers/causal-waits.ts.

Risks

• The session cookie is HttpOnly, so assertions must read the response Set-Cookie header, not document.cookie.
• The auth project gates on KANDEV_FEATURES_AUTH=true per-spec via backend.restart(env); the workspace-switch spec runs auth-off and only asserts the workspace cookie names.

Output contract

Report the asserted cookie names, spec files, exact commands and results, the noted two-backend-e2e follow-up, blockers/risks, then mark this task done and update plan.md.