ruby_raider 3.9.0 → 3.11.0

data/spec/integration/generators/helpers_generator_spec.rb

@@ -10,6 +10,18 @@ describe HelpersGenerator do
     end
   end
 
+  shared_examples 'creates a session state helper' do |name|
+    it 'creates a session state helper file' do
+      expect(File).to exist("#{name}/helpers/session_state.rb")
+    end
+  end
+
+  shared_examples 'skips the session state helper' do |name|
+    it 'does not create a session state helper file' do
+      expect(File).not_to exist("#{name}/helpers/session_state.rb")
+    end
+  end
+
   shared_examples 'creates selenium helpers' do |name|
     it 'creates a driver helper file' do
       expect(File).to exist("#{name}/helpers/driver_helper.rb")
@@ -42,54 +54,63 @@ describe HelpersGenerator do
 
   context 'with rspec and selenium' do
     include_examples 'creates common helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::SELENIUM}"
+    include_examples 'creates a session state helper', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::SELENIUM}"
     include_examples 'creates selenium helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::SELENIUM}"
     include_examples 'creates rspec helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::SELENIUM}"
   end
 
   context 'with rspec and watir' do
     include_examples 'creates common helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::WATIR}"
+    include_examples 'creates a session state helper', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::WATIR}"
     include_examples 'creates watir helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::WATIR}"
     include_examples 'creates rspec helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::WATIR}"
   end
 
   context 'with cucumber and selenium' do
     include_examples 'creates common helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::SELENIUM}"
+    include_examples 'creates a session state helper', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::SELENIUM}"
     include_examples 'creates selenium helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::SELENIUM}"
     include_examples 'creates cucumber helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::SELENIUM}"
   end
 
   context 'with cucumber and watir' do
     include_examples 'creates common helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::WATIR}"
+    include_examples 'creates a session state helper', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::WATIR}"
     include_examples 'creates watir helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::WATIR}"
     include_examples 'creates cucumber helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::WATIR}"
   end
 
   context 'with rspec and appium android' do
     include_examples 'creates common helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::ANDROID}"
+    include_examples 'skips the session state helper', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::ANDROID}"
     include_examples 'creates selenium helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::ANDROID}"
     include_examples 'creates rspec helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::ANDROID}"
   end
 
   context 'with rspec and appium ios' do
     include_examples 'creates common helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::IOS}"
+    include_examples 'skips the session state helper', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::IOS}"
     include_examples 'creates selenium helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::IOS}"
     include_examples 'creates rspec helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::IOS}"
   end
 
   context 'with cucumber and appium android' do
     include_examples 'creates common helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::ANDROID}"
+    include_examples 'skips the session state helper', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::ANDROID}"
     include_examples 'creates selenium helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::ANDROID}"
     include_examples 'creates cucumber helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::ANDROID}"
   end
 
   context 'with cucumber and appium ios' do
     include_examples 'creates common helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::IOS}"
+    include_examples 'skips the session state helper', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::IOS}"
     include_examples 'creates selenium helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::IOS}"
     include_examples 'creates cucumber helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::IOS}"
   end
 
   context 'with rspec and appium cross platform' do
     include_examples 'creates common helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::CROSS_PLATFORM}"
+    include_examples 'skips the session state helper', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::CROSS_PLATFORM}"
     include_examples 'creates selenium helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::CROSS_PLATFORM}"
     include_examples 'creates rspec helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::CROSS_PLATFORM}"
     include_examples 'creates cross platform helpers', "#{FrameworkIndex::RSPEC}_#{AutomationIndex::CROSS_PLATFORM}"
@@ -97,6 +118,7 @@ describe HelpersGenerator do
 
   context 'with cucumber and appium cross platform' do
     include_examples 'creates common helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::CROSS_PLATFORM}"
+    include_examples 'skips the session state helper', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::CROSS_PLATFORM}"
     include_examples 'creates selenium helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::CROSS_PLATFORM}"
     include_examples 'creates cucumber helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::CROSS_PLATFORM}"
     include_examples 'creates cross platform helpers', "#{FrameworkIndex::CUCUMBER}_#{AutomationIndex::CROSS_PLATFORM}"

data/spec/integration/generators/invoke_generators_spec.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'open3'
+require_relative '../spec_helper'
+
+describe InvokeGenerators do
+  after { FileUtils.rm_rf(Dir.glob('case_*')) }
+
+  context 'with option values in a different case' do
+    it 'accepts framework:Cucumber and automation:Selenium' do
+      described_class.generate_framework(framework: 'Cucumber', automation: 'Selenium', name: 'case_mixed')
+      expect(File).to exist('case_mixed/cucumber.yml')
+    end
+
+    it 'accepts upper-case values' do
+      described_class.generate_framework(framework: 'RSPEC', automation: 'WATIR', name: 'case_upper')
+      expect(File).to exist('case_upper/.rspec')
+    end
+
+    it 'accepts symbols' do
+      described_class.generate_framework(framework: :rspec, automation: :selenium, name: 'case_symbol')
+      expect(File).to exist('case_symbol/.rspec')
+    end
+  end
+
+  context 'with raider new and capitalised options' do
+    it 'generates the project and exits zero' do
+      root = File.expand_path('../../..', __dir__)
+      _out, status = Open3.capture2e('ruby', "#{root}/bin/raider", 'new', 'case_cli', '-p', 'framework:Cucumber',
+                                     'automation:Selenium')
+      expect(status.exitstatus).to eq(0)
+      expect(File).to exist('case_cli/cucumber.yml')
+    end
+  end
+
+  context 'with invalid values' do
+    it 'raises a Thor::Error for an unknown framework' do
+      expect { described_class.generate_framework(framework: 'minitest', automation: 'selenium', name: 'case_bad') }
+        .to raise_error(Thor::Error, /Invalid framework "minitest"/)
+    end
+
+    it 'sends an invalid ci to stderr and exits non-zero' do
+      root = File.expand_path('../../..', __dir__)
+      _out, err, status = Open3.capture3('ruby', "#{root}/bin/raider", 'new', 'case_bad_ci', '-p',
+                                         'framework:rspec', 'automation:selenium', 'ci:gitlab')
+      expect(status.exitstatus).to eq(1)
+      expect(err).to include('ci must be github or azure')
+      expect(File).not_to exist('case_bad_ci')
+    end
+  end
+end

data/spec/integration/helpers/session_state_spec.rb

@@ -0,0 +1,428 @@
+# frozen_string_literal: true
+
+require 'erb'
+require 'json'
+require 'selenium-webdriver'
+require 'time'
+require 'tmpdir'
+require 'yaml'
+
+module SessionStateSpec
+  TEMPLATE = File.expand_path('../../../lib/generators/templates/helpers/session_state.tt', __dir__)
+
+  # Renders the template and loads it from a temp file that is removed straight away.
+  def self.load_template
+    Dir.mktmpdir('session_state_tt') do |dir|
+      file = File.join(dir, 'session_state.rb')
+      File.write(file, ERB.new(File.read(TEMPLATE), trim_mode: '-').result)
+      load file
+    end
+  end
+end
+SessionStateSpec.load_template
+
+module SessionStateSpec
+  # Implements exactly the driver calls SessionState uses and records them in order.
+  class FakeDriver
+    ORIGIN_URL = 'https://raider-test-site.onrender.com/account'
+
+    def initialize(cookies: [], local: {}, session: {}, reject: nil, url: ORIGIN_URL)
+      @reject = reject
+      @page = { cookies:, url: }
+      @storage = { 'localStorage' => local, 'sessionStorage' => session }
+      @log = { calls: [], added: [] }
+    end
+
+    def calls = @log[:calls]
+    def added = @log[:added]
+    def local = @storage['localStorage']
+    def session = @storage['sessionStorage']
+
+    def manage = self
+    def navigate = self
+    def all_cookies = @page[:cookies]
+    def current_url = @page[:url]
+    def refresh = calls << :refresh
+    def delete_all_cookies = calls << :delete_all_cookies
+
+    def add_cookie(cookie)
+      raise 'rejected' if @reject&.call(cookie)
+
+      calls << :add_cookie
+      added << cookie
+    end
+
+    def to(url)
+      @page[:url] = url
+      calls << [:to, url]
+    end
+
+    def execute_script(_script, *args)
+      kind, values = args
+      return @storage[kind] if values.nil?
+
+      calls << [:write, kind]
+      @storage[kind] = values
+    end
+  end
+
+  # The browser end of a real Selenium::WebDriver::Manager: records the wire payloads it receives.
+  class FakeBridge
+    def initialize(log, reject)
+      @log = log
+      @reject = reject
+    end
+
+    def add_cookie(cookie)
+      raise Selenium::WebDriver::Error::InvalidArgumentError, 'rejected' if @reject&.call(cookie)
+
+      @log[:calls] << :add_cookie
+      @log[:added] << cookie
+    end
+
+    def delete_all_cookies = @log[:calls] << :delete_all_cookies
+    def cookies = []
+  end
+
+  # A FakeDriver whose manage is the real Selenium Manager, so its key translation is under test.
+  class ManagedDriver < FakeDriver
+    def manage
+      @manage ||= Selenium::WebDriver::Manager.new(FakeBridge.new(@log, @reject))
+    end
+  end
+end
+
+describe 'SessionState' do
+  let(:url) { 'https://raider-test-site.onrender.com/' }
+  let(:driver) { SessionStateSpec::FakeDriver.new(cookies:, local: { 'token' => 'abc' }, session: { 'tab' => '1' }) }
+  let(:state) { SessionState.new(driver) }
+  let(:config) { { 'url' => url } }
+
+  def origin = 'https://raider-test-site.onrender.com'
+  def state_file = File.join('.raider', 'auth', 'user.json')
+
+  def cookies
+    [{ name: 'sid', value: 's3cr3t', domain: 'raider-test-site.onrender.com', path: '/', expires: nil,
+       secure: true, http_only: true, same_site: 'Lax' }]
+  end
+
+  around do |example|
+    Dir.mktmpdir do |dir|
+      Dir.chdir(dir) do
+        FileUtils.mkdir_p('config')
+        example.run
+      end
+    end
+  end
+
+  before do
+    File.write('config/config.yml', YAML.dump(config))
+    stub_const('ENV', ENV.to_h.merge('RAIDER_LOGIN_STATE' => nil))
+  end
+
+  def write_state(overrides = {})
+    FileUtils.mkdir_p(File.dirname(state_file))
+    data = { 'format' => 1, 'name' => 'user', 'origin' => origin, 'saved_at' => (Time.now.utc - 10).iso8601,
+             'cookies' => [], 'local_storage' => {}, 'session_storage' => {} }.merge(overrides)
+    File.write(state_file, JSON.generate(data))
+  end
+
+  def saved
+    JSON.parse(File.read(state_file))
+  end
+
+  def saved_cookie(name, **attrs)
+    { 'name' => name, 'value' => 'v', 'domain' => 'raider-test-site.onrender.com', 'path' => '/',
+      'expires' => nil, 'secure' => false, 'http_only' => false, 'same_site' => nil }.merge(attrs.transform_keys(&:to_s))
+  end
+
+  it 'rejects a name outside [a-z0-9_-]' do
+    expect { SessionState.new(driver, name: '../x') }.to raise_error(ArgumentError)
+    expect { SessionState.new(driver, name: 'Admin') }.to raise_error(ArgumentError)
+  end
+
+  it 'saves format 1 with origin, saved_at, cookies and both storages' do
+    state.save
+    expect(saved).to include('format' => 1, 'name' => 'user', 'origin' => origin,
+                             'local_storage' => { 'token' => 'abc' }, 'session_storage' => { 'tab' => '1' })
+    expect { Time.iso8601(saved['saved_at']) }.not_to raise_error
+    expect(saved['cookies'].first).to include('name' => 'sid', 'http_only' => true, 'secure' => true)
+  end
+
+  it 'writes the file 0600 in a 0700 directory, atomically' do
+    state.save
+    expect(File.stat(state_file).mode & 0o777).to eq(0o600)
+    expect(File.stat(File.dirname(state_file)).mode & 0o777).to eq(0o700)
+    expect(Dir.glob('.raider/auth/*.tmp')).to be_empty
+  end
+
+  context 'with a url that has a port and a path' do
+    let(:url) { 'https://x.test:8443/app/' }
+
+    it 'derives the origin without path or trailing slash' do
+      state.save
+      expect(saved['origin']).to eq('https://x.test:8443')
+    end
+  end
+
+  describe '#save on another origin' do
+    it 'goes back to the origin before reading when the login ended elsewhere' do
+      sso = SessionStateSpec::FakeDriver.new(url: 'https://sso.other.test/x')
+      SessionState.new(sso).save
+      expect(sso.calls).to eq([[:to, "#{origin}/"]])
+    end
+
+    it 'stays put when the login ended on the origin' do
+      state.save
+      expect(driver.calls).to be_empty
+    end
+  end
+
+  describe '#fresh?' do
+    it 'is false when the file is missing' do
+      expect(state.fresh?).to be(false)
+    end
+
+    it 'is true for a recent file of the same format and origin' do
+      write_state
+      expect(state.fresh?).to be(true)
+    end
+
+    it 'is false for another format, another origin or an old file' do
+      write_state('format' => 2)
+      expect(state.fresh?).to be(false)
+      write_state('origin' => 'https://other.test')
+      expect(state.fresh?).to be(false)
+      write_state('saved_at' => (Time.now.utc - 3601).iso8601)
+      expect(state.fresh?).to be(false)
+    end
+
+    context 'with login_state max_age 30' do
+      let(:config) { { 'url' => url, 'login_state' => { 'max_age' => 30 } } }
+
+      it 'is false for a file older than max_age' do
+        write_state('saved_at' => (Time.now.utc - 59).iso8601)
+        expect(state.fresh?).to be(false)
+      end
+    end
+  end
+
+  describe '#restore' do
+    let(:driver) { SessionStateSpec::ManagedDriver.new }
+
+    it 'restores live cookies for the origin and skips expired and foreign ones' do
+      write_state('cookies' => [
+                    saved_cookie('session'),
+                    saved_cookie('future', expires: (Time.now.utc + 86_400).iso8601),
+                    saved_cookie('past', expires: (Time.now.utc - 1).iso8601),
+                    saved_cookie('dotted', domain: '.raider-test-site.onrender.com'),
+                    saved_cookie('foreign', domain: 'other.com')
+                  ], 'local_storage' => { 'a' => 'b' })
+      warning = "[login_state] 2 cookies skipped (expired or another domain) from #{state_file}\n"
+      expect { expect(state.restore).to be(true) }.to output(warning).to_stderr
+      expect(driver.added.map { |c| c[:name] }).to eq(%w[session future dotted])
+      expect(driver.calls).to eq([[:to, "#{origin}/"], :delete_all_cookies, :add_cookie, :add_cookie, :add_cookie,
+                                  [:write, 'localStorage'], [:write, 'sessionStorage'], :refresh])
+    end
+
+    it 'hands Selenium the cookie keys it translates to the wire format' do
+      write_state('cookies' => [saved_cookie('session', same_site: 'Lax', http_only: true),
+                                saved_cookie('future', expires: (Time.now.utc + 86_400).iso8601)])
+      expect(state.restore).to be(true)
+      expect(driver.added.first).to include(sameSite: 'Lax', httpOnly: true, secure: false)
+      expect(driver.added.flat_map(&:keys)).not_to include(:same_site, :http_only, :expires)
+      expect(driver.added.last[:expiry]).to be_a(Integer)
+    end
+
+    it 'returns false and warns for corrupt JSON' do
+      FileUtils.mkdir_p(File.dirname(state_file))
+      File.write(state_file, '{"format":')
+      expect { expect(state.restore).to be(false) }.to output(/\[login_state\].*user\.json/).to_stderr
+    end
+  end
+
+  it 'never prints cookie or storage values' do
+    leak = /s3cr3t|abc/
+    expect do
+      expect do
+        state.save
+        state.restore
+        write_state('cookies' => [saved_cookie('x', value: 's3cr3t')], 'local_storage' => { 'k' => 'abc' })
+        state.reuse(valid: -> { false }) { nil }
+      end.not_to output(leak).to_stdout
+    end.not_to output(leak).to_stderr
+  end
+
+  describe 'unsupported or unusable files' do
+    it 'warns once, naming the file, for another format' do
+      write_state('format' => 2)
+      expect { expect(state.restore).to be(false) }.to output(/\A\[login_state\] #{Regexp.escape(state_file)} has an unsupported format.*\n\z/).to_stderr
+    end
+
+    it 'stays silent for a missing, expired or other-origin file' do
+      expect do
+        state.fresh?
+        write_state('origin' => 'https://other.test')
+        state.fresh?
+        write_state('saved_at' => (Time.now.utc - 7200).iso8601)
+        state.fresh?
+      end.not_to output.to_stderr
+    end
+
+    it 'retries a cookie the browser rejects without sameSite' do
+      rejecting = SessionStateSpec::ManagedDriver.new(reject: ->(cookie) { cookie.key?(:sameSite) })
+      write_state('cookies' => [saved_cookie('a', same_site: 'None')])
+      expect(SessionState.new(rejecting).restore).to be(true)
+      expect(rejecting.added.map { |c| [c[:name], c.key?(:sameSite)] }).to eq([['a', false]])
+    end
+  end
+
+  describe '#reuse' do
+    def run_reuse(**options)
+      count = 0
+      silence { state.reuse(**options) { count += 1 } }
+      count
+    end
+
+    def silence
+      original = $stderr
+      $stderr = StringIO.new
+      yield
+    ensure
+      $stderr = original
+    end
+
+    def warnings
+      original = $stderr
+      $stderr = StringIO.new
+      yield
+      $stderr.string
+    ensure
+      $stderr = original
+    end
+
+    it 'logs in and saves when there is no file' do
+      expect(run_reuse).to eq(1)
+      expect(File).to exist(state_file)
+      expect(driver.calls).not_to include(:delete_all_cookies)
+    end
+
+    it 'clears the restored cookies and storage before the fallback login' do
+      managed = SessionStateSpec::ManagedDriver.new
+      write_state('cookies' => [saved_cookie('a')], 'local_storage' => { 'k' => 'v' })
+      silence { SessionState.new(managed).reuse(valid: -> { false }) { managed.calls << :login } }
+      after_refresh = managed.calls.drop(managed.calls.index(:refresh) + 1)
+      expect(after_refresh).to eq([:delete_all_cookies, [:write, 'localStorage'], [:write, 'sessionStorage'], :login])
+      expect(managed.local).to eq({})
+    end
+
+    it 'clears a half-applied restore before the fallback login' do
+      broken = SessionStateSpec::ManagedDriver.new(reject: ->(_cookie) { true })
+      write_state('cookies' => [saved_cookie('a')])
+      silence { SessionState.new(broken).reuse { broken.calls << :login } }
+      expect(broken.calls.last(4)).to eq([:delete_all_cookies, [:write, 'localStorage'], [:write, 'sessionStorage'],
+                                          :login])
+    end
+
+    it 'logs in without saving, with one warning, when the auth directory cannot be created' do
+      FileUtils.mkdir_p('.raider')
+      File.chmod(0o500, '.raider')
+      count = 0
+      output = warnings { expect(state.reuse { count += 1 }).to be(true) }
+      expect(count).to eq(1)
+      expect(output.lines).to match([start_with('[login_state] ')])
+    ensure
+      File.chmod(0o700, '.raider')
+    end
+
+    it 'logs in without saving, with one warning, when the lock cannot be opened' do
+      FileUtils.mkdir_p(File.join('.raider', 'auth', 'user.lock'))
+      count = 0
+      output = warnings { expect(state.reuse { count += 1 }).to be(true) }
+      expect(count).to eq(1)
+      expect(output.lines).to match([start_with('[login_state] ')])
+      expect(File).not_to exist(state_file)
+    end
+
+    it 'keeps the login, with one warning naming the file, when saving after it fails' do
+      allow(driver).to receive(:execute_script).and_raise(Selenium::WebDriver::Error::JavascriptError, 'abc')
+      count = 0
+      output = warnings { expect(state.reuse { count += 1 }).to be(true) }
+      expect(count).to eq(1)
+      expect(output.lines).to match([include(state_file, 'JavascriptError')])
+      expect(output).not_to include('abc')
+    end
+
+    it 'restores and skips the login when fresh and valid' do
+      write_state
+      expect(run_reuse(valid: -> { true })).to eq(0)
+      expect(driver.calls).to include(:refresh)
+    end
+
+    it 'falls back once when valid returns false' do
+      write_state('saved_at' => (Time.now.utc - 100).iso8601)
+      before = Time.iso8601(saved['saved_at'])
+      expect(run_reuse(valid: -> { false })).to eq(1)
+      expect(Time.iso8601(saved['saved_at'])).to be > before
+    end
+
+    it 'falls back when the file is corrupt' do
+      FileUtils.mkdir_p(File.dirname(state_file))
+      File.write(state_file, '{"format":')
+      expect(run_reuse).to eq(1)
+      expect(saved['format']).to eq(1)
+    end
+
+    it 'falls back once, with one warning, when valid raises' do
+      write_state
+      count = 0
+      expect { state.reuse(valid: -> { raise 'boom' }) { count += 1 } }.to output(/\A\[login_state\] validity check failed \(RuntimeError\), logging in again\n\z/).to_stderr
+      expect(count).to eq(1)
+    end
+
+    it 'falls back once, with one warning, when restore raises' do
+      write_state('cookies' => [saved_cookie('a')])
+      broken = SessionStateSpec::FakeDriver.new(reject: ->(_cookie) { true })
+      count = 0
+      expect { SessionState.new(broken).reuse { count += 1 } }.to output(/\A\[login_state\] could not restore.*\n\z/).to_stderr
+      expect(count).to eq(1)
+    end
+
+    it 'warns once for another format and logs in' do
+      write_state('format' => 2)
+      count = 0
+      expect { state.reuse { count += 1 } }.to output(/\A\[login_state\] .*unsupported format.*\n\z/).to_stderr
+      expect(count).to eq(1)
+    end
+
+    it 'RAIDER_LOGIN_STATE=off logs in and does not touch the disk' do
+      stub_const('ENV', ENV.to_h.merge('RAIDER_LOGIN_STATE' => 'off'))
+      expect(run_reuse).to eq(1)
+      expect(File).not_to exist('.raider')
+    end
+
+    it 'RAIDER_LOGIN_STATE=refresh logs in even when fresh' do
+      write_state('saved_at' => (Time.now.utc - 100).iso8601)
+      before = Time.iso8601(saved['saved_at'])
+      stub_const('ENV', ENV.to_h.merge('RAIDER_LOGIN_STATE' => 'refresh'))
+      expect(run_reuse).to eq(1)
+      expect(Time.iso8601(saved['saved_at'])).to be > before
+    end
+
+    it 'serializes concurrent callers on the lock' do
+      count = 0
+      drivers = Array.new(2) { SessionStateSpec::FakeDriver.new(cookies:) }
+      threads = drivers.map do |fake|
+        Thread.new do
+          SessionState.new(fake).reuse do
+            sleep 0.2
+            count += 1
+          end
+        end
+      end
+      threads.each(&:join)
+      expect(count).to eq(1)
+      expect(drivers.count { |fake| fake.calls.include?(:refresh) }).to eq(1)
+    end
+  end
+end

data/spec/integration/scaffolding_e2e_spec.rb

@@ -23,11 +23,7 @@ end
 
 # End-to-end scaffolding tests that verify the scaffold command creates the right
 # files with the right content across all automation × framework combinations.
-describe 'Scaffolding E2E' do # rubocop:disable RSpec/DescribeClass
-
-  WEB_AUTOMATIONS = %w[selenium watir].freeze
-  TEST_FRAMEWORKS = %w[rspec cucumber].freeze
-
+describe 'Scaffolding E2E' do
   def self.scaffold_style(framework)
     case framework
     when 'rspec'    then :spec
@@ -36,7 +32,7 @@ describe 'Scaffolding E2E' do # rubocop:disable RSpec/DescribeClass
   end
 
   # Build a minimal mock project that the scaffolding system can detect.
-  def self.build_mock_project(automation, framework) # rubocop:disable Metrics/MethodLength
+  def self.build_mock_project(automation, framework)
     dir = File.expand_path("tmp_scaffold_e2e_#{framework}_#{automation}")
     FileUtils.rm_rf(dir)
     FileUtils.mkdir_p("#{dir}/page_objects/pages")
@@ -61,7 +57,7 @@ describe 'Scaffolding E2E' do # rubocop:disable RSpec/DescribeClass
     when 'rspec'    then gems << "gem 'rspec'"
     when 'cucumber' then gems << "gem 'cucumber'"
     end
-    File.write("#{dir}/Gemfile", gems.join("\n") + "\n")
+    File.write("#{dir}/Gemfile", "#{gems.join("\n")}\n")
     File.write("#{dir}/config/config.yml", "browser: chrome\nurl: http://localhost:3000\n")
     File.write("#{dir}/page_objects/abstract/page.rb", "class Page; end\n")
     File.write("#{dir}/page_objects/abstract/component.rb", "class Component; end\n")
@@ -91,7 +87,7 @@ describe 'Scaffolding E2E' do # rubocop:disable RSpec/DescribeClass
     end
 
     it 'includes url method (config has url)' do
-      expect(page_content).to include("def url(_page)")
+      expect(page_content).to include('def url(_page)')
       expect(page_content).to include("'checkout'")
     end
   end
@@ -326,11 +322,11 @@ describe 'Scaffolding E2E' do # rubocop:disable RSpec/DescribeClass
   # Test matrix: automation × framework
   # ══════════════════════════════════════════════
 
-  WEB_AUTOMATIONS.each do |automation|
-    TEST_FRAMEWORKS.each do |framework|
+  %w[selenium watir].each do |automation|
+    %w[rspec cucumber].each do |framework|
       style = scaffold_style(framework)
 
-      context "with #{framework} and #{automation}" do # rubocop:disable RSpec/ContextWording
+      context "with #{framework} and #{automation}" do
         let(:scaffold) { ScaffoldingCommands }
 
         # Use absolute path so Dir.chdir is safe regardless of current CWD
@@ -367,6 +363,9 @@ describe 'Scaffolding E2E' do # rubocop:disable RSpec/DescribeClass
             end
           end
 
+          # Page content validation
+          let(:page_content) { File.read('page_objects/pages/checkout.rb') }
+
           it 'creates page object' do
             expect(Pathname.new('page_objects/pages/checkout.rb')).to be_file
           end
@@ -389,9 +388,6 @@ describe 'Scaffolding E2E' do # rubocop:disable RSpec/DescribeClass
             end
           end
 
-          # Page content validation
-          let(:page_content) { File.read('page_objects/pages/checkout.rb') }
-
           include_examples 'valid scaffolded page'
           include_examples "#{automation} scaffolded page"
 
@@ -459,16 +455,10 @@ describe 'Scaffolding E2E' do # rubocop:disable RSpec/DescribeClass
 
           it 'generates multiple scaffolds at once' do
             scaffold.new.invoke(:scaffold, nil, %w[search filter])
-            expect(Pathname.new('page_objects/pages/search.rb')).to be_file
-            expect(Pathname.new('page_objects/pages/filter.rb')).to be_file
-
-            if style == :spec
-              expect(Pathname.new('spec/search_page_spec.rb')).to be_file
-              expect(Pathname.new('spec/filter_page_spec.rb')).to be_file
-            else
-              expect(Pathname.new('features/search.feature')).to be_file
-              expect(Pathname.new('features/filter.feature')).to be_file
+            files = %w[search filter].flat_map do |name|
+              ["page_objects/pages/#{name}.rb", style == :spec ? "spec/#{name}_page_spec.rb" : "features/#{name}.feature"]
             end
+            expect(files.reject { |file| File.file?(file) }).to be_empty
           end
         end
 
@@ -496,7 +486,6 @@ describe 'Scaffolding E2E' do # rubocop:disable RSpec/DescribeClass
             expect(Pathname.new('page_objects/pages/checkout.rb')).to be_file
           end
         end
-
       end
     end
   end

data/spec/scaffolding/scaffold_project_detector_spec.rb

@@ -33,7 +33,6 @@ RSpec.describe ScaffoldProjectDetector do
     it 'reports selenium?' do
       expect(described_class.selenium?).to be true
     end
-
   end
 
   context 'with watir project' do