55 - Move the dev image to Debian so Playwright can run

Dockerfile.dev

@@ -1,26 +1,34 @@
 # Development Dockerfile with FrankenPHP
-FROM dunglas/frankenphp:latest-php8.3-alpine
+#
+# Debian rather than Alpine so Playwright can run its own Chromium: it treats
+# debian12 as an officially supported platform and has no musl build at all.
+FROM dunglas/frankenphp:latest-php8.3-bookworm
 
-# Install system dependencies + development tools
-RUN apk add --no-cache \
-    nodejs \
-    npm \
+# Install system dependencies + development tools. Node comes from NodeSource
+# rather than apt: bookworm ships Node 18, below what Vite 6 targets.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        gnupg \
         git \
-    mysql-client \
+        default-mysql-client \
         vim \
-    bash \
         nano \
-    chromium \
-    nss \
-    freetype \
-    harfbuzz \
-    ttf-freefont \
-    font-noto-emoji
+        bash \
+        unzip \
+    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && rm -rf /var/lib/apt/lists/*
 
-# Playwright ships glibc-linked browser builds that do not run on Alpine (musl),
-# so drive Alpine's own Chromium instead of downloading one.
-ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \
-    PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium-browser
+# Playwright's browser lives outside the bind-mounted /app so a host node_modules
+# never shadows it; --with-deps pulls the shared libraries Chromium needs.
+ENV PLAYWRIGHT_BROWSERS_PATH=/opt/playwright
+COPY package.json package-lock.json /tmp/pw/
+RUN cd /tmp/pw \
+    && npm ci --no-audit --no-fund \
+    && ./node_modules/.bin/playwright install --with-deps chromium \
+    && rm -rf /tmp/pw
 
 # Install PHP extensions including xdebug for development
 RUN install-php-extensions \

docker/dev/docker-compose.yml

@@ -41,9 +41,8 @@ services:
       # Vite
       VITE_HOST: "0.0.0.0"
 
-      # Playwright drives Alpine's system Chromium (musl); see Dockerfile.dev
-      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
-      PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH: "/usr/bin/chromium-browser"
+      # Chromium is baked into the image outside /app; see Dockerfile.dev
+      PLAYWRIGHT_BROWSERS_PATH: "/opt/playwright"
     volumes:
       # Mount entire project for hot reload with SELinux context
       - ../..:/app:Z

tests/Feature/AuthenticationTest.php

@@ -91,6 +91,24 @@ public function test_users_can_logout(): void
         $this->assertGuest();
     }
 
+    public function test_refresh_csrf_returns_the_current_token_to_a_guest(): void
+    {
+        $response = $this->getJson('/refresh-csrf');
+
+        $response->assertStatus(200);
+        $response->assertJson(['token' => csrf_token()]);
+    }
+
+    public function test_refresh_csrf_returns_the_current_token_to_an_authenticated_user(): void
+    {
+        $user = Planner::factory()->create();
+
+        $response = $this->actingAs($user)->getJson('/refresh-csrf');
+
+        $response->assertStatus(200);
+        $response->assertJson(['token' => csrf_token()]);
+    }
+
     public function test_logout_invalidates_the_session(): void
     {
         $user = Planner::factory()->create();