fix: add CSRF token handling and fix login selectors

CSRF Token:
- Add getCsrfToken() that fetches token from frappe.auth.get_csrf_token
- Cache CSRF token per request context to avoid repeated calls
- Include X-Frappe-CSRF-Token header in POST/PUT/DELETE requests

Login Selectors:
- Use exact Frappe login page IDs (#login_email, #login_password)
- Use button.btn-login for submit button
- Reference: frappe/frappe/www/login.html

Author: claude

e2e/helpers/frappe.ts

@@ -10,6 +10,33 @@ export interface FrappeResponse<T = unknown> {
 	_server_messages?: string;
 }
 
+// Cache CSRF token per request context
+const csrfTokenCache = new WeakMap<APIRequestContext, string>();
+
+/**
+ * Get CSRF token from Frappe.
+ * Makes a request to get the token from cookies/response.
+ */
+async function getCsrfToken(request: APIRequestContext): Promise<string> {
+	// Check cache first
+	const cached = csrfTokenCache.get(request);
+	if (cached) {
+		return cached;
+	}
+
+	// Get CSRF token from Frappe's session info endpoint
+	const response = await request.get('/api/method/frappe.auth.get_csrf_token');
+
+	if (response.ok()) {
+		const data = await response.json();
+		const token = data.message || '';
+		csrfTokenCache.set(request, token);
+		return token;
+	}
+
+	return '';
+}
+
 /**
  * Create a new document via Frappe REST API.
  */
@@ -18,8 +45,14 @@ export async function createDoc<T = Record<string, unknown>>(
 	doctype: string,
 	doc: Record<string, unknown>
 ): Promise<T> {
+	const csrfToken = await getCsrfToken(request);
+
 	const response = await request.post(`/api/resource/${doctype}`, {
 		data: doc,
+		headers: {
+			'Content-Type': 'application/json',
+			...(csrfToken ? { 'X-Frappe-CSRF-Token': csrfToken } : {}),
+		},
 	});
 
 	if (!response.ok()) {
@@ -61,9 +94,17 @@ export async function updateDoc<T = Record<string, unknown>>(
 	name: string,
 	updates: Record<string, unknown>
 ): Promise<T> {
+	const csrfToken = await getCsrfToken(request);
+
 	const response = await request.put(
 		`/api/resource/${doctype}/${encodeURIComponent(name)}`,
-		{ data: updates }
+		{
+			data: updates,
+			headers: {
+				'Content-Type': 'application/json',
+				...(csrfToken ? { 'X-Frappe-CSRF-Token': csrfToken } : {}),
+			},
+		}
 	);
 
 	if (!response.ok()) {
@@ -83,8 +124,15 @@ export async function deleteDoc(
 	doctype: string,
 	name: string
 ): Promise<void> {
+	const csrfToken = await getCsrfToken(request);
+
 	const response = await request.delete(
-		`/api/resource/${doctype}/${encodeURIComponent(name)}`
+		`/api/resource/${doctype}/${encodeURIComponent(name)}`,
+		{
+			headers: {
+				...(csrfToken ? { 'X-Frappe-CSRF-Token': csrfToken } : {}),
+			},
+		}
 	);
 
 	if (!response.ok()) {
@@ -101,8 +149,14 @@ export async function callMethod<T = unknown>(
 	method: string,
 	args: Record<string, unknown> = {}
 ): Promise<T> {
+	const csrfToken = await getCsrfToken(request);
+
 	const response = await request.post(`/api/method/${method}`, {
 		data: args,
+		headers: {
+			'Content-Type': 'application/json',
+			...(csrfToken ? { 'X-Frappe-CSRF-Token': csrfToken } : {}),
+		},
 	});
 
 	if (!response.ok()) {

e2e/pages/login.page.ts

@@ -17,19 +17,12 @@ export class LoginPage {
 
 	constructor(page: Page) {
 		this.page = page;
-		// Frappe login page selectors - try multiple options for compatibility
-		this.emailInput = page.locator(
-			'input#login_email, input[autocomplete="username"], input[name="usr"]'
-		);
-		this.passwordInput = page.locator(
-			'input#login_password, input[type="password"]'
-		);
-		this.submitButton = page.locator(
-			'.btn-login, .btn-login-area button, button:has-text("Login")'
-		);
-		this.errorMessage = page.locator(
-			'.alert-danger, .msgprint, .login-content .alert'
-		);
+		// Frappe login page selectors - use exact IDs from frappe/www/login.html
+		// See: https://github.com/frappe/frappe/blob/develop/frappe/www/login.html
+		this.emailInput = page.locator('#login_email');
+		this.passwordInput = page.locator('#login_password');
+		this.submitButton = page.locator('button.btn-login');
+		this.errorMessage = page.locator('.msgprint, .alert-danger').first();
 	}
 
 	/**