@appsemble/e2e 0.36.10-test.4 → 0.37.0

package/README.md

@@ -1,8 +1,8 @@
-# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.36.10-test.4/config/assets/logo.svg) Appsemble End 2 End Tests
+# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.37.0/config/assets/logo.svg) Appsemble End 2 End Tests
 
 > Run end 2 end tests on an Appsemble environment and provide Appsemble fixtures
 
-[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.36.10-test.4/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.36.10-test.4)
+[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.37.0/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.37.0)
 [![Prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg)](https://prettier.io)
 
 ## Table of Contents
@@ -102,5 +102,5 @@ When writing end-to-end tests, have a look at the
 
 ## License
 
-[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.36.10-test.4/LICENSE.md) ©
+[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.37.0/LICENSE.md) ©
 [Appsemble](https://appsemble.com)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appsemble/e2e",
-  "version": "0.36.10-test.4",
+  "version": "0.37.0",
   "description": "End-to-end tests used for testing Appsemble apps in an existing environment.",
   "keywords": [
     "app",
@@ -41,9 +41,9 @@
     "@playwright/test": "Pinned exact and kept in sync with the mcr.microsoft.com/playwright:v<version>-noble tag of the `e2e node` job in .gitlab-ci.yml; Renovate bumps both together (see renovate.json)."
   },
   "dependencies": {
-    "@appsemble/lang-sdk": "0.36.10-test.4",
-    "@appsemble/node-utils": "0.36.10-test.4",
-    "@appsemble/types": "0.36.10-test.4",
+    "@appsemble/lang-sdk": "0.37.0",
+    "@appsemble/node-utils": "0.37.0",
+    "@appsemble/types": "0.37.0",
     "@playwright/test": "1.58.2",
     "strip-indent": "^4.0.0"
   },

package/tests/demo-apps/person.spec.js

@@ -24,14 +24,16 @@ test.describe('Person', () => {
         const lastName = `Last name ${date}`;
         const email = `Email${date}@example.com`;
         const description = `Description ${date}`;
+        const submitButton = page.locator('button[type="submit"]');
+        await expect(submitButton).toBeEnabled({ timeout: 15000 });
         // The form block resets field values while it finishes initializing (the
         // file field briefly holds the form in a loading state), dropping values
         // typed too early. Re-fill until every field keeps its value.
         await expect(async () => {
-            await page.getByPlaceholder('First name').fill(firstName);
             await page.getByPlaceholder('Last name').fill(lastName);
             await page.getByPlaceholder('Email').fill(email);
             await page.getByPlaceholder('Description').fill(description);
+            await page.getByPlaceholder('First name').fill(firstName);
             await expect(page.getByPlaceholder('First name')).toHaveValue(firstName, {
                 timeout: 1000,
             });
@@ -45,7 +47,7 @@ test.describe('Person', () => {
                 timeout: 1000,
             });
         }).toPass({ timeout: 10000 });
-        await page.click('button[type="submit"]');
+        await submitButton.click();
         await page.click(`td:has-text("${firstName}")`);
         await expect(page.getByText(firstName)).toBeVisible();
         await expect(page.getByText(lastName)).toBeVisible();

package/tests/studio/individual-app.spec.js

@@ -41,10 +41,12 @@ test.describe('Individual app', () => {
         await codeEditor.getByText('name: test app').press('End');
         await codeEditor.getByText('name: test app').press('Backspace');
         await codeEditor.getByText('name: test ap').press('p');
-        const responsePromise = page.waitForResponse((response) => response.url().includes('/api/apps/') && response.request().method() === 'PATCH');
+        const responsePromise = page.waitForResponse((response) => response.url().includes('/api/apps/') &&
+            response.request().method() === 'PATCH' &&
+            response.status() === 200);
         await page.getByRole('button', { name: 'Publish' }).click();
         await responsePromise;
-        await expect(page.getByText('Successfully updated app definition')).toBeVisible();
+        await expect(page.getByRole('button', { name: 'Publish' })).toBeDisabled();
         await page.getByRole('link', { name: 'Details' }).click();
         await expect(page.getByText('Clone App')).toBeVisible();
     });

package/tests/studio/logins/keycloak-oidc.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/tests/studio/logins/keycloak-oidc.spec.js

@@ -0,0 +1,225 @@
+import { expect, authenticatedTest as test } from '../../../index.js';
+const { KEYCLOAK_ADMIN_PASSWORD = 'password', KEYCLOAK_ADMIN_USERNAME = 'admin', KEYCLOAK_BASE_URL, KEYCLOAK_REALM = 'appsemble-e2e', } = process.env;
+const clientId = 'appsemble-oidc';
+const clientSecret = 'appsemble-oidc-secret';
+const userEmail = 'keycloak-user@appsemble.com';
+const userPassword = 'password';
+let app;
+let organizationId;
+let secret;
+async function requestKc(path, { body, expectedStatuses, method, token, }) {
+    const response = await fetch(`${KEYCLOAK_BASE_URL}${path}`, {
+        body,
+        headers: {
+            authorization: `Bearer ${token}`,
+            'content-type': 'application/json',
+        },
+        method,
+    });
+    if (!expectedStatuses.includes(response.status)) {
+        throw new Error(`${method} ${path} returned ${response.status}: ${await response.text()}`);
+    }
+    return response;
+}
+async function getAdminToken() {
+    for (let attempt = 0; attempt < 60; attempt += 1) {
+        try {
+            const response = await fetch(`${KEYCLOAK_BASE_URL}/realms/master/protocol/openid-connect/token`, {
+                body: new URLSearchParams({
+                    client_id: 'admin-cli',
+                    grant_type: 'password',
+                    password: KEYCLOAK_ADMIN_PASSWORD,
+                    username: KEYCLOAK_ADMIN_USERNAME,
+                }),
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                method: 'POST',
+            });
+            if (response.ok) {
+                const { access_token: token } = (await response.json());
+                return token;
+            }
+        }
+        catch {
+            // The service may still be starting.
+        }
+        await new Promise((resolve) => {
+            setTimeout(resolve, 1000);
+        });
+    }
+    throw new Error('Could not obtain Keycloak admin token');
+}
+async function createGroup(token, name, parentGroupId) {
+    const path = parentGroupId
+        ? `/admin/realms/${KEYCLOAK_REALM}/groups/${parentGroupId}/children`
+        : `/admin/realms/${KEYCLOAK_REALM}/groups`;
+    const response = await requestKc(path, {
+        body: JSON.stringify({ name }),
+        expectedStatuses: [201],
+        method: 'POST',
+        token,
+    });
+    return response.headers.get('location').split('/').pop();
+}
+async function createUser(token) {
+    const response = await requestKc(`/admin/realms/${KEYCLOAK_REALM}/users`, {
+        body: JSON.stringify({
+            credentials: [{ temporary: false, type: 'password', value: userPassword }],
+            email: userEmail,
+            emailVerified: true,
+            enabled: true,
+            firstName: 'Keycloak',
+            lastName: 'User',
+            username: userEmail,
+        }),
+        expectedStatuses: [201],
+        method: 'POST',
+        token,
+    });
+    return response.headers.get('location').split('/').pop();
+}
+async function joinGroup(token, userId, groupId) {
+    await requestKc(`/admin/realms/${KEYCLOAK_REALM}/users/${userId}/groups/${groupId}`, {
+        expectedStatuses: [204],
+        method: 'PUT',
+        token,
+    });
+}
+async function configureRealm() {
+    const token = await getAdminToken();
+    await requestKc(`/admin/realms/${KEYCLOAK_REALM}`, {
+        expectedStatuses: [204, 404],
+        method: 'DELETE',
+        token,
+    });
+    await requestKc('/admin/realms', {
+        body: JSON.stringify({ enabled: true, realm: KEYCLOAK_REALM }),
+        expectedStatuses: [201],
+        method: 'POST',
+        token,
+    });
+    const parentGroupId = await createGroup(token, 'Appsemble');
+    const managersGroupId = await createGroup(token, 'Managers', parentGroupId);
+    const editorsGroupId = await createGroup(token, 'Editors', parentGroupId);
+    await requestKc(`/admin/realms/${KEYCLOAK_REALM}/clients`, {
+        body: JSON.stringify({
+            clientAuthenticatorType: 'client-secret',
+            clientId,
+            directAccessGrantsEnabled: true,
+            enabled: true,
+            protocol: 'openid-connect',
+            protocolMappers: [
+                {
+                    config: {
+                        'access.token.claim': 'true',
+                        'claim.name': 'groups',
+                        'full.path': 'true',
+                        'id.token.claim': 'true',
+                        'userinfo.token.claim': 'true',
+                    },
+                    name: 'groups',
+                    protocol: 'openid-connect',
+                    protocolMapper: 'oidc-group-membership-mapper',
+                },
+            ],
+            publicClient: false,
+            redirectUris: ['http://appsemble:9999/callback'],
+            secret: clientSecret,
+            standardFlowEnabled: true,
+            webOrigins: ['+'],
+        }),
+        expectedStatuses: [201],
+        method: 'POST',
+        token,
+    });
+    const userId = await createUser(token);
+    await joinGroup(token, userId, managersGroupId);
+    await joinGroup(token, userId, editorsGroupId);
+}
+test.describe('App Keycloak OIDC login', () => {
+    test.skip(!KEYCLOAK_BASE_URL, 'Keycloak OIDC login requires KEYCLOAK_BASE_URL');
+    test.beforeAll(async ({ createApp, createOrganization, randomTestId, request }) => {
+        await configureRealm();
+        organizationId = (await createOrganization({ id: randomTestId() })).id;
+        app = await createApp(organizationId, `
+        name: Keycloak Role Mapping App
+        defaultPage: Manager Page
+        security:
+          default:
+            role: Viewer
+            policy: everyone
+          roles:
+            Viewer: {}
+            Manager: {}
+            Editor: {}
+            Auditor: {}
+        pages:
+          - name: Manager Page
+            roles:
+              - Manager
+            blocks:
+              - type: html
+                version: 0.36.10
+                parameters:
+                  content: <h1>Manager content</h1>
+          - name: Editor Page
+            roles:
+              - Editor
+            blocks:
+              - type: html
+                version: 0.36.10
+                parameters:
+                  content: <h1>Editor content</h1>
+          - name: Auditor Page
+            roles:
+              - Auditor
+            blocks:
+              - type: html
+                version: 0.36.10
+                parameters:
+                  content: <h1>Auditor content</h1>
+      `);
+        const response = await request.post(`/api/apps/${app.id}/secrets/oauth2`, {
+            data: {
+                name: 'Keycloak OIDC',
+                icon: 'key',
+                authorizationUrl: `${KEYCLOAK_BASE_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/auth`,
+                tokenUrl: `${KEYCLOAK_BASE_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token`,
+                clientId,
+                clientSecret,
+                userInfoUrl: `${KEYCLOAK_BASE_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/userinfo`,
+                scope: 'email openid profile',
+                roleMappings: [
+                    { group: '/Appsemble/Managers', role: 'Manager' },
+                    { group: '/Appsemble/Editors', role: 'Editor' },
+                ],
+            },
+        });
+        expect(response.status()).toBe(201);
+        secret = (await response.json());
+    });
+    test.afterAll(async ({ deleteApp, deleteOrganization }) => {
+        if (app?.id != null) {
+            await deleteApp(app.id);
+        }
+        if (organizationId) {
+            await deleteOrganization(organizationId);
+        }
+    });
+    test('should map Keycloak groups to cumulative app roles', async ({ page, visitApp }) => {
+        const appUrl = await visitApp(app.id);
+        await page.goto(`${appUrl}/Login`);
+        await page.getByRole('button', { name: `Login with ${secret.name}` }).click();
+        await page.locator('#username').fill(userEmail);
+        await page.locator('#password').fill(userPassword);
+        await page.locator('#kc-login').click();
+        await expect(page.getByRole('heading', { name: 'Manager content' })).toBeVisible();
+        await expect(page.getByRole('link', { name: 'Manager Page' })).toBeVisible();
+        await expect(page.getByRole('link', { name: 'Editor Page' })).toBeVisible();
+        await expect(page.getByRole('link', { name: 'Auditor Page' })).toBeHidden();
+        await page.getByRole('link', { name: 'Editor Page' }).click();
+        await expect(page.getByRole('heading', { name: 'Editor content' })).toBeVisible();
+        await page.goto(`${appUrl}/Auditor%20Page`);
+        await expect(page.getByRole('heading', { name: 'Auditor content' })).toBeHidden();
+    });
+});
+//# sourceMappingURL=keycloak-oidc.spec.js.map

package/tests/studio/logins/keycloak-saml.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/tests/studio/logins/keycloak-saml.spec.js

@@ -0,0 +1,291 @@
+import { expect, authenticatedTest as test } from '../../../index.js';
+const { KEYCLOAK_ADMIN_PASSWORD = 'password', KEYCLOAK_ADMIN_USERNAME = 'admin', KEYCLOAK_BASE_URL, KEYCLOAK_REALM = 'appsemble-e2e', } = process.env;
+const appsembleBaseUrl = 'http://appsemble:9999';
+const samlAttributeNameFormat = 'attribute.nameformat';
+const samlAssertionConsumerUrlPostAttribute = 'saml_assertion_consumer_url_post';
+const samlAuthnStatementAttribute = 'saml.authnstatement';
+const samlNameIdFormatAttribute = 'saml_name_id_format';
+const userEmail = 'keycloak-saml-user@appsemble.com';
+const userPassword = 'password';
+let app;
+let idpCertificate;
+let organizationId;
+let secret;
+test.use({ timezoneId: 'Europe/Amsterdam' });
+async function requestKc(path, { body, expectedStatuses, method, token, }) {
+    const response = await fetch(`${KEYCLOAK_BASE_URL}${path}`, {
+        body,
+        headers: {
+            authorization: `Bearer ${token}`,
+            'content-type': 'application/json',
+        },
+        method,
+    });
+    if (!expectedStatuses.includes(response.status)) {
+        throw new Error(`${method} ${path} returned ${response.status}: ${await response.text()}`);
+    }
+    return response;
+}
+async function getAdminToken() {
+    for (let attempt = 0; attempt < 60; attempt += 1) {
+        try {
+            const response = await fetch(`${KEYCLOAK_BASE_URL}/realms/master/protocol/openid-connect/token`, {
+                body: new URLSearchParams({
+                    client_id: 'admin-cli',
+                    grant_type: 'password',
+                    password: KEYCLOAK_ADMIN_PASSWORD,
+                    username: KEYCLOAK_ADMIN_USERNAME,
+                }),
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                method: 'POST',
+            });
+            if (response.ok) {
+                const { access_token: token } = (await response.json());
+                return token;
+            }
+        }
+        catch {
+            // The service may still be starting.
+        }
+        await new Promise((resolve) => {
+            setTimeout(resolve, 1000);
+        });
+    }
+    throw new Error('Could not obtain Keycloak admin token');
+}
+async function createGroup(token, name, parentGroupId) {
+    const path = parentGroupId
+        ? `/admin/realms/${KEYCLOAK_REALM}/groups/${parentGroupId}/children`
+        : `/admin/realms/${KEYCLOAK_REALM}/groups`;
+    const response = await requestKc(path, {
+        body: JSON.stringify({ name }),
+        expectedStatuses: [201],
+        method: 'POST',
+        token,
+    });
+    return response.headers.get('location').split('/').pop();
+}
+async function createUser(token) {
+    const response = await requestKc(`/admin/realms/${KEYCLOAK_REALM}/users`, {
+        body: JSON.stringify({
+            credentials: [{ temporary: false, type: 'password', value: userPassword }],
+            email: userEmail,
+            emailVerified: true,
+            enabled: true,
+            firstName: 'Keycloak',
+            lastName: 'SAML User',
+            username: userEmail,
+        }),
+        expectedStatuses: [201],
+        method: 'POST',
+        token,
+    });
+    return response.headers.get('location').split('/').pop();
+}
+function wrapCertificate(certificate) {
+    const lines = certificate.match(/.{1,64}/g);
+    if (!lines) {
+        throw new Error('Could not wrap Keycloak signing certificate');
+    }
+    return `-----BEGIN CERTIFICATE-----\n${lines.join('\n')}\n-----END CERTIFICATE-----`;
+}
+async function getSigningCertificate(token) {
+    const response = await requestKc(`/admin/realms/${KEYCLOAK_REALM}/keys`, {
+        expectedStatuses: [200],
+        method: 'GET',
+        token,
+    });
+    const { keys } = (await response.json());
+    const certificate = keys.find((key) => key.use === 'SIG' && key.status === 'ACTIVE' && key.certificate)?.certificate;
+    if (!certificate) {
+        throw new Error('Could not find Keycloak signing certificate');
+    }
+    return wrapCertificate(certificate);
+}
+async function joinGroup(token, userId, groupId) {
+    await requestKc(`/admin/realms/${KEYCLOAK_REALM}/users/${userId}/groups/${groupId}`, {
+        expectedStatuses: [204],
+        method: 'PUT',
+        token,
+    });
+}
+async function configureRealm() {
+    const token = await getAdminToken();
+    await requestKc(`/admin/realms/${KEYCLOAK_REALM}`, {
+        expectedStatuses: [204, 404],
+        method: 'DELETE',
+        token,
+    });
+    await requestKc('/admin/realms', {
+        body: JSON.stringify({ enabled: true, realm: KEYCLOAK_REALM }),
+        expectedStatuses: [201],
+        method: 'POST',
+        token,
+    });
+    idpCertificate = await getSigningCertificate(token);
+    const parentGroupId = await createGroup(token, 'Appsemble');
+    const managersGroupId = await createGroup(token, 'Managers', parentGroupId);
+    const editorsGroupId = await createGroup(token, 'Editors', parentGroupId);
+    const userId = await createUser(token);
+    await joinGroup(token, userId, managersGroupId);
+    await joinGroup(token, userId, editorsGroupId);
+}
+async function createSamlClient(token, appId, secretId) {
+    const samlBaseUrl = `${appsembleBaseUrl}/api/apps/${appId}/saml/${secretId}`;
+    const acsUrl = `${samlBaseUrl}/acs`;
+    const metadataUrl = `${samlBaseUrl}/metadata.xml`;
+    await requestKc(`/admin/realms/${KEYCLOAK_REALM}/clients`, {
+        body: JSON.stringify({
+            attributes: {
+                'saml.assertion.signature': 'true',
+                [samlAuthnStatementAttribute]: 'true',
+                'saml.client.signature': 'false',
+                'saml.encrypt': 'false',
+                'saml.force.post.binding': 'true',
+                'saml.server.signature': 'true',
+                'saml.signature.algorithm': 'RSA_SHA256',
+                [samlAssertionConsumerUrlPostAttribute]: acsUrl,
+                [samlNameIdFormatAttribute]: 'email',
+            },
+            clientId: metadataUrl,
+            enabled: true,
+            name: 'Appsemble SAML',
+            protocol: 'saml',
+            protocolMappers: [
+                {
+                    config: {
+                        'attribute.name': 'email',
+                        [samlAttributeNameFormat]: 'Basic',
+                        'user.attribute': 'email',
+                    },
+                    name: 'email',
+                    protocol: 'saml',
+                    protocolMapper: 'saml-user-property-mapper',
+                },
+                {
+                    config: {
+                        'attribute.name': 'emailVerified',
+                        [samlAttributeNameFormat]: 'Basic',
+                        'attribute.value': 'true',
+                    },
+                    name: 'email verified',
+                    protocol: 'saml',
+                    protocolMapper: 'saml-hardcode-attribute-mapper',
+                },
+                {
+                    config: {
+                        'attribute.name': 'name',
+                        [samlAttributeNameFormat]: 'Basic',
+                        'user.attribute': 'firstName',
+                    },
+                    name: 'name',
+                    protocol: 'saml',
+                    protocolMapper: 'saml-user-property-mapper',
+                },
+                {
+                    config: {
+                        'attribute.name': 'memberOf',
+                        [samlAttributeNameFormat]: 'Basic',
+                        'full.path': 'true',
+                        single: 'true',
+                    },
+                    name: 'groups',
+                    protocol: 'saml',
+                    protocolMapper: 'saml-group-membership-mapper',
+                },
+            ],
+            redirectUris: [acsUrl],
+        }),
+        expectedStatuses: [201],
+        method: 'POST',
+        token,
+    });
+}
+test.describe('App Keycloak SAML login', () => {
+    test.skip(!KEYCLOAK_BASE_URL, 'Keycloak SAML login requires KEYCLOAK_BASE_URL');
+    test.beforeAll(async ({ createApp, createOrganization, randomTestId, request }) => {
+        await configureRealm();
+        organizationId = (await createOrganization({ id: randomTestId() })).id;
+        app = await createApp(organizationId, `
+        name: Keycloak SAML Roles App
+        defaultPage: Manager Page
+        security:
+          default:
+            role: Viewer
+            policy: everyone
+          roles:
+            Viewer: {}
+            Manager: {}
+            Editor: {}
+            Auditor: {}
+        pages:
+          - name: Manager Page
+            roles:
+              - Manager
+            blocks:
+              - type: html
+                version: 0.36.7
+                parameters:
+                  content: <h1>Manager content</h1>
+          - name: Editor Page
+            roles:
+              - Editor
+            blocks:
+              - type: html
+                version: 0.36.7
+                parameters:
+                  content: <h1>Editor content</h1>
+          - name: Auditor Page
+            roles:
+              - Auditor
+            blocks:
+              - type: html
+                version: 0.36.7
+                parameters:
+                  content: <h1>Auditor content</h1>
+      `);
+        const response = await request.post(`/api/apps/${app.id}/secrets/saml`, {
+            data: {
+                name: 'Keycloak SAML',
+                icon: 'key',
+                entityId: `${KEYCLOAK_BASE_URL}/realms/${KEYCLOAK_REALM}/protocol/saml/descriptor`,
+                ssoUrl: `${KEYCLOAK_BASE_URL}/realms/${KEYCLOAK_REALM}/protocol/saml`,
+                idpCertificate,
+                emailAttribute: 'email',
+                emailVerifiedAttribute: 'emailVerified',
+                nameAttribute: 'name',
+                groupAttribute: 'memberOf',
+                roleMappings: [
+                    { group: '/Appsemble/Managers', role: 'Manager' },
+                    { group: '/Appsemble/Editors', role: 'Editor' },
+                ],
+            },
+        });
+        expect(response.status()).toBe(201);
+        secret = (await response.json());
+        await createSamlClient(await getAdminToken(), app.id, secret.id);
+    });
+    test.afterAll(async ({ deleteApp, deleteOrganization }) => {
+        if (app?.id != null) {
+            await deleteApp(app.id);
+        }
+        if (organizationId) {
+            await deleteOrganization(organizationId);
+        }
+    });
+    test('should map Keycloak groups to cumulative app roles', async ({ page, visitApp }) => {
+        const appUrl = await visitApp(app.id);
+        await page.goto(`${appUrl}/Login`);
+        await page.getByRole('button', { name: `Login with ${secret.name}` }).click();
+        await page.locator('#username').fill(userEmail);
+        await page.locator('#password').fill(userPassword);
+        await page.locator('#kc-login').click();
+        await expect(page.getByRole('heading', { name: 'Manager content' })).toBeVisible();
+        await expect(page.getByRole('link', { name: 'Manager Page' })).toBeVisible();
+        await expect(page.getByRole('link', { name: 'Editor Page' })).toBeVisible();
+        await expect(page.getByRole('link', { name: 'Auditor Page' })).toBeHidden();
+        await page.getByRole('link', { name: 'Editor Page' }).click();
+        await expect(page.getByRole('heading', { name: 'Editor content' })).toBeVisible();
+    });
+});
+//# sourceMappingURL=keycloak-saml.spec.js.map