@camunda/e2e-test-suite 0.0.1056 → 0.0.1058

package/dist/pages/8.8/Authorization.js

@@ -105,10 +105,21 @@ class Authorization {
                 force: true,
             });
         }
-        await this.createAuthorizationSubmitButton.click();
-        await (0, test_1.expect)(this.createAuthorizationModal).not.toBeVisible({
-            timeout: 30000,
-        });
+        // Submitting POSTs to the orchestration cluster's Identity API, which
+        // answers 503 while the cluster is still settling. Carbon then leaves the
+        // modal open with the form still filled, so the only thing the old
+        // single-shot submit could do was wait out its 30s and fail. Re-submitting
+        // replays the same request from the same form rather than building a
+        // second authorization; the guard keeps a slow-but-successful close from
+        // clicking a button that is already gone.
+        await (0, test_1.expect)(async () => {
+            if (await this.createAuthorizationModal.isVisible()) {
+                await this.createAuthorizationSubmitButton.click();
+            }
+            await (0, test_1.expect)(this.createAuthorizationModal).not.toBeVisible({
+                timeout: 30000,
+            });
+        }).toPass({ timeout: 150000, intervals: [5000, 10000, 15000] });
         await this.selectResourceTypeTab(authorization.resourceType).click();
         const item = this.page.getByRole('row').filter({
             hasText: `${authorization.ownerId}${authorization.resourceId}`,

package/dist/pages/8.8/LoginPage.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LoginPage = void 0;
 const test_1 = require("@playwright/test");
 const UtilitiesPage_1 = require("./UtilitiesPage");
+const sessionRecovery_1 = require("../../utils/sessionRecovery");
 class LoginPage {
     page;
     usernameInput;
@@ -55,6 +56,7 @@ class LoginPage {
     }
     async login(credentials = {}) {
         const { username = process.env.C8_USERNAME, password = process.env.C8_PASSWORD, } = credentials;
+        (0, sessionRecovery_1.trackSignedInUser)(this.page, username);
         await (0, test_1.expect)(this.usernameInput).toBeVisible({ timeout: 200000 });
         await this.fillUsername(username);
         await this.clickContinueButton();
@@ -65,6 +67,7 @@ class LoginPage {
     }
     async loginWithTestUser(credentials = {}) {
         const { username = process.env.C8_USERNAME_TEST, password = process.env.C8_PASSWORD_TEST, } = credentials;
+        (0, sessionRecovery_1.trackSignedInUser)(this.page, username);
         // SSO re-auth may silently log us back in as the previous user after logout.
         // Detect Console (settings button visible) and retry logout until Auth0 form appears.
         const settingsBtn = this.page.getByLabel('Open Settings');
@@ -114,6 +117,7 @@ class LoginPage {
     }
     async loginWithoutOrgAssertion(credentials = {}) {
         const { username = process.env.C8_USERNAME, password = process.env.C8_PASSWORD, } = credentials;
+        (0, sessionRecovery_1.trackSignedInUser)(this.page, username);
         await (0, test_1.expect)(this.usernameInput).toBeVisible({ timeout: 180000 });
         await this.fillUsername(username);
         await this.clickContinueButton();

package/dist/pages/8.8/ModelerHomePage.js

@@ -4,6 +4,7 @@ exports.ModelerHomePage = void 0;
 const test_1 = require("@playwright/test");
 const sleep_1 = require("../../utils/sleep");
 const clickLocatorWithRetry_1 = require("../../utils/assertionHelpers/clickLocatorWithRetry");
+const sessionRecovery_1 = require("../../utils/sessionRecovery");
 const randomName_1 = require("../../utils/randomName");
 const ProcessApplicationPage_1 = require("./ProcessApplicationPage");
 class ModelerHomePage {
@@ -172,6 +173,10 @@ class ModelerHomePage {
     async clickCreateNewProjectButton() {
         await (0, clickLocatorWithRetry_1.clickLocatorWithRetry)(this.page, this.createNewProjectButton, {
             preAction: async () => {
+                // Modeler logs the SPA out on its own when a backend call fails, and
+                // every later attempt then waits for this button on the Auth0 form
+                // instead of on Modeler. Get the session back before looking for it.
+                await (0, sessionRecovery_1.restoreSessionIfLoggedOut)(this.page);
                 await this.dismissOverlays();
             },
             totalTimeout: 120000,
@@ -204,6 +209,16 @@ class ModelerHomePage {
             // editor unmounts, and the click below then waits out its whole timeout
             // on an element that never comes back.
             await this.dismissOverlays();
+            // Modeler can answer the create-project POST with a 5xx. The click that
+            // got us here still "succeeded", but no project exists and the browser
+            // stayed on the projects list, so the inline editor never mounts and
+            // every retry below re-clicks a control that is not there until toPass
+            // gives up. Re-issue the creation when that is what happened -- a rename
+            // needs a project to rename.
+            if (!(await this.becameVisible(this.projectNameInput.first(), 5000)) &&
+                (await this.becameVisible(this.createNewProjectButton, 5000))) {
+                await this.createNewProjectButton.click({ timeout: 15000 });
+            }
             await this.projectNameInput.first().click({ timeout: 15000 });
             await this.projectNameInput.first().fill(name);
             // Confirm the value actually landed in the edit field before committing;
@@ -514,7 +529,14 @@ class ModelerHomePage {
             // Widened from 180s: dismissing the announcement dialog costs up to ~25s
             // of settle-and-probe per attempt, which at 180s left room for barely one
             // retry after an intercepted click had already burnt its 60s.
-            totalTimeout: 240000,
+            //
+            // Widened again from 240s. When Modeler answers `/api/internal/login`
+            // with a 5xx the app hangs on its bootstrap spinner, and then
+            // dismissBlockingDialog's networkidle wait never settles either -- an
+            // attempt costs ~80s instead of ~25s, so the 240s budget ran out after
+            // three of the five retries configured below. The 2026-09-01 nightly
+            // took two such 5xx to bury a test that had three unused attempts left.
+            totalTimeout: 360000,
             maxRetries: 5,
             preAction: async () => {
                 // Dismiss the dialog BEFORE the banner: the Modeler home page can
@@ -527,6 +549,15 @@ class ModelerHomePage {
                 await this.clickMessageBanner();
             },
             postAction: async () => {
+                // Before anything else: a 5xx from Modeler's own /api/internal/login
+                // makes the SPA log itself out, and from then on the reload below only
+                // re-renders the Auth0 form -- the tile can never come back, so every
+                // remaining attempt burns its visibility timeout for nothing. Recover
+                // the session as the current test user and let the next attempt probe
+                // the tile again.
+                if (await (0, sessionRecovery_1.restoreSessionIfLoggedOut)(this.page)) {
+                    return;
+                }
                 // The project tile only renders on the Modeler home page. A failure
                 // that leaves the browser inside the project -- createForm's recovery
                 // path below reloads and calls straight back in here -- makes the tile

package/dist/utils/formatDate.js

@@ -5,8 +5,14 @@ function formatDate(date = new Date()) {
     const day = date.getDate();
     const year = date.getFullYear();
     const dayPattern = `0?${day}`;
+    // September is the one month whose short form differs between locales/ICU
+    // builds: en-GB renders "Sept" while Console renders the en-US "Sep". The
+    // `=== 'Sep'` test this replaces could never fire, because en-GB had already
+    // produced "Sept" -- so every September the expectation was /Sept 0?1, .../
+    // against a UI showing "Sep 1", and the assertion failed on calendar date
+    // alone. Match on the shared prefix so either rendering is accepted.
     const month = date.toLocaleString('en-GB', { month: 'short' });
-    const monthPattern = month === 'Sep' ? 'Sept?' : month;
+    const monthPattern = month.startsWith('Sep') ? 'Sept?' : month;
     return new RegExp(`${monthPattern} ${dayPattern}, ${year}`);
 }
 exports.formatDate = formatDate;

package/dist/utils/sessionRecovery.d.ts

@@ -0,0 +1,25 @@
+import type { Page } from '@playwright/test';
+/**
+ * Records which user this page is currently signed in as, so a later recovery
+ * re-authenticates as that same user instead of falling back to a default.
+ * Getting this wrong would silently change what an RBA/permission spec
+ * verifies, so recovery is skipped entirely when nothing was recorded.
+ */
+export declare function trackSignedInUser(page: Page, username: string): void;
+/**
+ * Re-authenticates when the page has been bounced to the identity provider
+ * mid-test, and reports whether it had to.
+ *
+ * Web Modeler drops the session on its own when a backend call fails: a 5xx
+ * from `/api/internal/login` (or `/api/internal/self`) makes the SPA call Auth0
+ * logout, and from that point every navigation lands on the universal login
+ * form. Retry loops that recover by reloading then reload that form until they
+ * run out of attempts, which is why a single Modeler auth blip on the
+ * 2026-09-01 nightly turned into 26 failures whose only visible symptom was a
+ * Modeler locator that "never appeared".
+ *
+ * Auth0 sends us back to whichever app triggered the logout, so re-entering the
+ * credentials on the form returns the browser to that app -- no navigation
+ * needed here.
+ */
+export declare function restoreSessionIfLoggedOut(page: Page): Promise<boolean>;

package/dist/utils/sessionRecovery.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.restoreSessionIfLoggedOut = exports.trackSignedInUser = void 0;
+// Only the username is kept -- no password, no cookie, no token. Keyed by the
+// Playwright Page because the object that logs in (LoginPage) and the objects
+// that later have to recover a dropped session (ModelerHomePage) are separate
+// instances, and several specs build their own `new LoginPage(page)` rather
+// than taking the fixture's, so instance-scoped state would silently miss them.
+const signedInUser = new WeakMap();
+/**
+ * Records which user this page is currently signed in as, so a later recovery
+ * re-authenticates as that same user instead of falling back to a default.
+ * Getting this wrong would silently change what an RBA/permission spec
+ * verifies, so recovery is skipped entirely when nothing was recorded.
+ */
+function trackSignedInUser(page, username) {
+    signedInUser.set(page, username);
+}
+exports.trackSignedInUser = trackSignedInUser;
+// Read back out of the environment at the moment it is needed, from the
+// `C8_USERNAME*` / `C8_PASSWORD*` pair that defines this user -- the same
+// source LoginPage reads its own defaults from. Nothing secret is carried
+// between the login and the recovery.
+function resolvePassword(username) {
+    const prefix = 'C8_USERNAME';
+    for (const [key, value] of Object.entries(process.env)) {
+        if (!key.startsWith(prefix) || value !== username) {
+            continue;
+        }
+        const password = process.env[`C8_PASSWORD${key.slice(prefix.length)}`];
+        if (password) {
+            return password;
+        }
+    }
+    return undefined;
+}
+const emailInput = (page) => page
+    .getByLabel('Email address')
+    .and(page.locator(':not([id="c4-invite-email"])'));
+const passwordInput = (page) => page
+    .getByLabel(/^Password\s*\*?$/i)
+    .or(page.locator('input[type="password"]'))
+    .first();
+const continueButton = (page) => page.getByRole('button', { name: 'Continue', exact: true });
+const passwordHeading = (page) => page.getByRole('heading', { name: 'Enter Your Password' });
+const isVisibleWithin = (locator, timeout) => locator
+    .waitFor({ state: 'visible', timeout })
+    .then(() => true)
+    .catch(() => false);
+// Which identity the password step is about to authenticate. Auth0 carries it
+// in the username field it keeps on that step, and renders it as text as well;
+// read the field first because the text can also contain the app's own address.
+async function offeredIdentity(page) {
+    const field = page
+        .locator('input[name="username"], input[type="email"]')
+        .first();
+    const value = await field.inputValue({ timeout: 5000 }).catch(() => undefined);
+    if (value?.includes('@')) {
+        return value.trim();
+    }
+    const rendered = await page
+        .locator('form')
+        .first()
+        .innerText({ timeout: 5000 })
+        .catch(() => undefined);
+    return rendered?.match(/[^\s<>]+@[^\s<>]+\.[^\s<>]+/)?.[0];
+}
+/**
+ * Re-authenticates when the page has been bounced to the identity provider
+ * mid-test, and reports whether it had to.
+ *
+ * Web Modeler drops the session on its own when a backend call fails: a 5xx
+ * from `/api/internal/login` (or `/api/internal/self`) makes the SPA call Auth0
+ * logout, and from that point every navigation lands on the universal login
+ * form. Retry loops that recover by reloading then reload that form until they
+ * run out of attempts, which is why a single Modeler auth blip on the
+ * 2026-09-01 nightly turned into 26 failures whose only visible symptom was a
+ * Modeler locator that "never appeared".
+ *
+ * Auth0 sends us back to whichever app triggered the logout, so re-entering the
+ * credentials on the form returns the browser to that app -- no navigation
+ * needed here.
+ */
+async function restoreSessionIfLoggedOut(page) {
+    const username = signedInUser.get(page);
+    if (username === undefined) {
+        return false;
+    }
+    // Cheap first: the identity provider is a different host, so the URL settles
+    // this without touching the DOM. Only pages that are NOT obviously on it pay
+    // for a probe, and that probe has to be a real wait -- isVisible() does not
+    // wait, and the logout redirect is often still in flight when we look.
+    const atIdentityProvider = /:\/\/(weblogin|login)\./.test(page.url());
+    const probeTimeout = atIdentityProvider ? 30000 : 2000;
+    const onEmailStep = await isVisibleWithin(emailInput(page), probeTimeout);
+    const onPasswordStep = !onEmailStep && (await isVisibleWithin(passwordHeading(page), 1000));
+    if (!onEmailStep && !onPasswordStep) {
+        return false;
+    }
+    const password = resolvePassword(username);
+    if (password === undefined) {
+        console.warn(`restoreSessionIfLoggedOut: session was dropped at ${page.url()}, but no ` +
+            `C8_PASSWORD* variable pairs with ${username} -- not guessing one.`);
+        return false;
+    }
+    // Landing straight on the password step means Auth0 is offering an identity
+    // we did not pick, and every SaaS test user shares one password -- so typing
+    // it here would authenticate as whoever Auth0 remembered and silently change
+    // which user an RBA spec is exercising. Only continue when the form is
+    // offering the user this page was actually signed in as. Coming through the
+    // email step is safe by construction: we type the username ourselves.
+    if (onPasswordStep) {
+        const offered = await offeredIdentity(page);
+        if (offered !== username) {
+            const shown = offered ?? 'an identity it does not disclose';
+            console.warn(`restoreSessionIfLoggedOut: identity provider is offering ${shown}, ` +
+                `but this page was signed in as ${username} -- refusing to ` +
+                're-authenticate.');
+            return false;
+        }
+    }
+    console.warn(`restoreSessionIfLoggedOut: session was dropped at ${page.url()}, ` +
+        `re-authenticating as ${username}`);
+    if (onEmailStep) {
+        await emailInput(page).fill(username);
+        await continueButton(page).click({ timeout: 30000 });
+    }
+    await passwordInput(page).waitFor({ state: 'visible', timeout: 60000 });
+    await passwordInput(page).fill(password);
+    await continueButton(page).click({ timeout: 60000 });
+    await page.waitForLoadState('domcontentloaded', { timeout: 60000 });
+    return true;
+}
+exports.restoreSessionIfLoggedOut = restoreSessionIfLoggedOut;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/e2e-test-suite",
-  "version": "0.0.1056",
+  "version": "0.0.1058",
   "description": "End-to-end test helpers for Camunda 8",
   "repository": {
     "type": "git",