For v0 apps · Auth
v0 ships fast.
Auth keeps quietly breaking.
Every prompt regenerates the auth surface - sign-in form, session cookie wiring, redirect logic, protected-route gate. You don’t notice until a user can’t log in. Lastest records the auth flow once and replays it on every deploy.
Why this is hard
Auth is the part v0 quietly rewrites. And nobody’s testing it.
Two failure modes you keep hitting in the prompt-deploy loop - and why they hide from review.
v0 regenerates the auth surface every prompt.
Cookie name flips. Redirect changes from /dashboard to /app. Provider hook gets renamed. The sign-in screen still renders. The session never gets set. Nothing throws - the protected route just bounces the user back to login forever.
- No type error - auth lives across server actions and client
- No console error - middleware silently redirects
- Looks fine in the preview until you actually try to log in
- The PR diff hides it inside 14 changed files
Manual auth QA doesn’t scale to every prompt.
Logging in by hand on every PR works for a week. Then you stop. Then auth breaks. Asking the LLM to “test the auth flow” runs a different path every time, burns tokens, and grades its own homework.
- Non-deterministic - different selectors, different results
- No artifact - no screenshot, no proof what passed
- Tokens compound - auth re-checked on every preview is a real bill
- No history of what used to work
What Lastest does about it
Record the login. Replay forever.
Two features that turn auth from a hidden time-bomb into a green check or a screenshot diff.
01 · Record
Record the sign-in flow once. End of story.
Open the recorder, paste your Vercel preview URL, click sign in, type the test credentials, hit submit, watch the protected page load, stop. Lastest captures every click, every type, every navigation, every cookie set - and emits deterministic Playwright code with seven-layer selector fallback.
- Captures real cookies set by Supabase / Clerk / NextAuth
- Asserts the protected page actually renders
- Multi-step screenshots - sign-in, redirect, dashboard
02 · Replay on every deploy
Wire it into your Vercel preview. Catch auth regressions on the PR.
Every push to a v0 PR triggers Lastest against the preview URL. The auth flow runs, screenshots come back, and the diff slider tells you whether the dashboard rendered after login - or whether the cookie quietly got renamed.
- GitHub Action:
las-team/lastest/action@main - Branch-to-branch screenshot compare
- AI failure triage: real regression vs. flake vs. env
Keep reading
- Audience landing: E2E and visual testing for v0 apps
- Bigger picture: Vibe testing vs vibe coding - closing the loop
- CI wiring: Visual regression testing in GitHub Actions
- Setup deep dive: Lastest visual regression testing setup
v0 auth regression FAQ
- Why does v0 keep breaking my authentication?
- v0 generates and regenerates entire route trees on each prompt. The sign-in page, the session-cookie wiring, the post-login redirect, the protected-route gate all live inside the surface v0 rewrites. A prompt to “clean up the dashboard” can swap the auth provider hook, change a redirect, or rename a cookie. The site looks fine; the user can’t log in anymore.
- Can’t I just write a Playwright test?
- You can. Most teams shipping with v0 do not. Writing a stable Playwright test for an auth flow takes an hour, breaks every time v0 changes a class name, and lives in a repo your AI agent doesn’t look at. Lastest records the flow once in the browser, generates Playwright code with a 7-layer selector fallback, and replays the same flow forever, with no tokens and no maintenance.
- Does Lastest test the actual session cookie, not just the UI?
- Yes. The recorded flow signs in through the real form, lets the real auth provider issue a real session, and then asserts the protected page renders. If the cookie is missing, expired, or scoped wrong, the protected screenshot fails. You catch session bugs as visual diffs, not as a 4 AM “I can’t log in” ticket.
- What about OAuth providers like Google or GitHub?
- For CI replays, use a test account with email/password. Most v0 stacks (Supabase, Clerk, NextAuth credentials) ship that path. Save the OAuth round-trip for manual smoke tests. Lastest records what you click, so an email/password sign-in flow is a 30-second recording.
- How do I run this on every v0 deploy?
- Wire it into your Vercel preview hook. Lastest ships a Docker image and a GitHub Action. Point it at the preview URL on PR open, fail the PR on a non-trivial diff. Approved baselines replay deterministically with $0 token cost forever.
- What if v0 renames every selector again?
- The recorder captures seven layers of selector fallback: data-testid, role, label, visible text, structural position, neighbor anchors, and image-search position. When v0 swaps Tailwind classes or renames a wrapper, the selector still finds the button. When the visible UI shifts, the visual diff catches it.
- What does this cost?
- Zero. Lastest is open source (FSL-1.1-ALv2), self-hosted via Docker. Generate the auth-flow tests once, replay on every push for $0. No per-screenshot fee, no per-seat fee, no token cost on replay.
Lock down v0 auth.
On every preview.
In five minutes.
No cloud account. No API key. Point it at your Vercel preview URL, record the sign-in once, and replay it forever. Open source, FSL-1.1-ALv2 licensed, $0 forever.
★ Star & Install from GitHub →# 1. clone
$ git clone https://github.com/las-team/lastest
# 2. start
$ cd lastest && docker-compose up -d
# 3. point at your v0 preview URL
$ open http://localhost:3000
✓ View the source