@camunda/e2e-test-suite 0.0.1241 → 0.0.1243

package/dist/fixtures/api.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Playwright fixture for the Orchestration Cluster REST v2 API suite.
+ *
+ * Provides an authenticated `api` client and a `resources` tracker whose
+ * contents are deleted after the worker finishes, so a spec never has to write
+ * its own teardown loop.
+ */
+import { ApiClient } from '../utils/api/http';
+import { ResourceTracker } from '../utils/api/cleanup';
+interface ApiFixtures {
+    api: ApiClient;
+    resources: ResourceTracker;
+}
+export declare const test: import("@playwright/test").TestType<import("@playwright/test").PlaywrightTestArgs & import("@playwright/test").PlaywrightTestOptions & ApiFixtures, import("@playwright/test").PlaywrightWorkerArgs & import("@playwright/test").PlaywrightWorkerOptions>;
+export { expect } from '@playwright/test';

package/dist/fixtures/api.js

@@ -0,0 +1,27 @@
+"use strict";
+/**
+ * Playwright fixture for the Orchestration Cluster REST v2 API suite.
+ *
+ * Provides an authenticated `api` client and a `resources` tracker whose
+ * contents are deleted after the worker finishes, so a spec never has to write
+ * its own teardown loop.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.expect = exports.test = void 0;
+const test_1 = require("@playwright/test");
+const http_1 = require("../utils/api/http");
+const cleanup_1 = require("../utils/api/cleanup");
+// Configuration is read once at module load, so specs that need it import
+// `apiConfig` directly rather than taking it as a fixture.
+exports.test = test_1.test.extend({
+    api: async ({ request }, use) => {
+        await use(new http_1.ApiClient(request));
+    },
+    resources: async ({ api }, use) => {
+        const tracker = new cleanup_1.ResourceTracker();
+        await use(tracker);
+        await tracker.cleanup(api);
+    },
+});
+var test_2 = require("@playwright/test");
+Object.defineProperty(exports, "expect", { enumerable: true, get: function () { return test_2.expect; } });

package/dist/pages/SM-8.10/NavigationPage.d.ts

@@ -8,18 +8,19 @@ declare class NavigationPage {
     readonly identityPageBanner: Locator;
     readonly keyboardPageBanner: Locator;
     readonly managementIdentityPageBanner: Locator;
+    private onboardingTourSuppressed;
     constructor(page: Page);
     private isGatewayErrorPage;
     private waitForBanner;
     goTo(url: string, banner: Locator, sleepTimeout?: number, { username, password, }?: {
         username?: string;
         password?: string;
-    }, maxRetries?: number, beforeBannerCheck?: () => Promise<void>): Promise<void>;
+    }, maxRetries?: number): Promise<void>;
     goToModeler(sleepTimeout?: number, credentials?: {
         username: string;
         password: string;
     }): Promise<void>;
-    private dismissOnboardingDialog;
+    private suppressOnboardingTour;
     goToTasklist(sleepTimeout?: number, credentials?: {
         username: string;
         password: string;

package/dist/pages/SM-8.10/NavigationPage.js

@@ -28,6 +28,7 @@ class NavigationPage {
     identityPageBanner;
     keyboardPageBanner;
     managementIdentityPageBanner;
+    onboardingTourSuppressed = false;
     constructor(page) {
         this.page = page;
         // Operate renders the Design System header (AppHeaderV2) whenever the
@@ -112,15 +113,12 @@ class NavigationPage {
     // that is exactly the reported "Login (/modeler) failed after 8 attempts".
     // The 60s budget is unchanged: a genuinely slow shell still gets all of it,
     // and a sustained outage still fails.
-    async waitForBanner(url, banner, submitted, beforeBannerCheck) {
+    async waitForBanner(url, banner, submitted) {
         const totalTimeout = constants_1._1_SECOND_IN_MS * 60;
         const deadline = Date.now() + totalTimeout;
         let lastState = 'no banner';
         while (Date.now() < deadline) {
             const round = Math.min(constants_1._1_SECOND_IN_MS * 20, deadline - Date.now());
-            if (beforeBannerCheck) {
-                await beforeBannerCheck();
-            }
             try {
                 await (0, test_1.expect)(banner).toBeVisible({ timeout: round });
                 return;
@@ -148,7 +146,7 @@ class NavigationPage {
         }
         throw new Error(`${url} did not render its banner within ${totalTimeout}ms: ${lastState}`);
     }
-    async goTo(url, banner, sleepTimeout, { username = IDENTITY_FIRSTUSER_USERNAME, password = IDENTITY_FIRSTUSER_PASSWORD, } = {}, maxRetries = 8, beforeBannerCheck) {
+    async goTo(url, banner, sleepTimeout, { username = IDENTITY_FIRSTUSER_USERNAME, password = IDENTITY_FIRSTUSER_PASSWORD, } = {}, maxRetries = 8) {
         const startTime = Date.now();
         let timeout = constants_1._1_SECOND_IN_MS * 10;
         if (url === '/modeler') {
@@ -217,7 +215,7 @@ class NavigationPage {
                 else {
                     submitted = await loginPage.login(username, password);
                 }
-                await this.waitForBanner(url, banner, submitted, beforeBannerCheck);
+                await this.waitForBanner(url, banner, submitted);
                 return;
             }
             catch (error) {
@@ -264,35 +262,27 @@ class NavigationPage {
         }
     }
     async goToModeler(sleepTimeout, credentials) {
-        await this.goTo(MODELER_CONTEXT_PATH, this.modelerPageBanner, sleepTimeout, credentials, 8, () => this.dismissOnboardingDialog());
+        await this.suppressOnboardingTour();
+        await this.goTo(MODELER_CONTEXT_PATH, this.modelerPageBanner, sleepTimeout, credentials, 8);
     }
-    // After the Camunda Hub rebrand a first visit to Modeler home greets the user
-    // with a multi-step "Welcome to Camunda Hub" onboarding dialog. It mounts over
-    // the home and marks the app shell inert, so the "Camunda Modeler home" banner
-    // link leaves the accessibility tree until the dialog is dismissed -- gating on
-    // the banner alone then loops until the whole login budget is spent. Close it
-    // through the dialog's own control before each banner check so the banner can
-    // resolve; only unambiguous dismissals are matched (never "Cancel", which is a
-    // form action on the dialogs other flows open on purpose).
-    async dismissOnboardingDialog() {
-        // On the Design System shell the onboarding is a multi-step wizard: its
-        // footer button reads "Next" (an advance, not a dismissal) and its only
-        // single-click close is the header control -- a ghost icon button
-        // (data-slot="dialog-close") wrapping an aria-hidden "x" svg, so it exposes
-        // no accessible name and getByRole({name}) cannot reach it. Target that
-        // control by its stable data-slot; keep the named-button fallback for the
-        // Carbon announcement modals other flows meet ("Got it"/"Close"/"Dismiss",
-        // never "Cancel", which is a form action). Scope to the visible dialog: the
-        // home keeps several hidden role="dialog" containers mounted.
-        const dialog = this.page.locator('[role="dialog"]:visible').first();
-        const dismiss = dialog
-            .locator('[data-slot="dialog-close"]')
-            .or(dialog.getByRole('button', { name: /^(Got it|Close|Dismiss)/i }))
-            .first();
-        await dismiss
-            .waitFor({ state: 'visible', timeout: 3000 })
-            .then(() => dismiss.click())
-            .catch(() => { });
+    // Mirrors camunda-hub@452978f: pre-seed the onboarding tour's "seen" localStorage flag
+    // (SEEN_KEY_PREFIX in .../tour-dialog/use-onboarding-seen.ts) so it never auto-opens, rather
+    // than dismissing it reactively (the two prior fixes here -- both raced the dialog's mount
+    // and lost, since the user id needed for the real key isn't known until after that same
+    // race). addInitScript avoids the race by running before any page script, matching the
+    // flag by prefix since the user id isn't known up front.
+    async suppressOnboardingTour() {
+        if (this.onboardingTourSuppressed) {
+            return;
+        }
+        this.onboardingTourSuppressed = true;
+        await this.page.addInitScript((prefixPattern) => {
+            const pattern = new RegExp(prefixPattern);
+            const originalGetItem = Storage.prototype.getItem;
+            Storage.prototype.getItem = function (key) {
+                return pattern.test(key) ? 'true' : originalGetItem.call(this, key);
+            };
+        }, '^hub\\.onboarding\\..*\\.seen\\.');
     }
     async goToTasklist(sleepTimeout, credentials) {
         await this.goTo(`${NORMALIZED_ORCHESTRATION_CONTEXT_PATH}/tasklist`, this.tasklistPageBanner, sleepTimeout, credentials);

package/dist/pages/SM-8.10/ProcessApplicationPage.js

@@ -156,6 +156,12 @@ class ProcessApplicationPage {
         await (0, test_1.expect)(this.defineStagesDialog).toBeVisible({ timeout: 60000 });
         await this.developmentClusterSelect.click({ timeout: 30000 });
         const escapedClusterName = clusterName?.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        // The listbox leads with a "No cluster" entry that unassigns the stage; the
+        // placeholder "Select a development cluster" is only the trigger's text, not an
+        // option. Excluding just the placeholder leaves "No cluster" first, so an
+        // unnamed pick binds no cluster and saves defaultDevClusterId=null -- which
+        // makes the later Deploy dialog report "Clusters not configured for stages".
+        // Exclude "No cluster" too so the fallback lands on a real cluster.
         const option = clusterName
             ? this.page
                 .getByRole('option', { name: new RegExp(`^${escapedClusterName}`) })
@@ -163,6 +169,7 @@ class ProcessApplicationPage {
             : this.page
                 .getByRole('option')
                 .filter({ hasNotText: 'Select a development cluster' })
+                .filter({ hasNotText: 'No cluster' })
                 .first();
         await option.click({ timeout: 30000 });
         await this.defineStagesSaveButton.click({ timeout: 30000 });

package/dist/tests/api/v2/authorization/authorization-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/authorization/authorization-api-tests.spec.js

@@ -0,0 +1,247 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const beans_1 = require("../../../../utils/api/beans");
+const eventually_1 = require("../../../../utils/api/eventually");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const deployments_1 = require("../../../../utils/api/deployments");
+const identity_1 = require("../../../../utils/api/identity");
+const keys_1 = require("../../../../utils/api/keys");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+async function createAuthorization(api, resources, body) {
+    const response = await api.post('/authorizations', { body, tenant: 'none' });
+    // The shell suite expected `201 409` throughout this section, so a run
+    // where every authorization already existed — or where creation kept
+    // conflicting — was indistinguishable from one where it worked.
+    const created = (await (0, assertions_1.assertCreated)(response));
+    const key = String(created.authorizationKey);
+    resources.track('authorization', key);
+    return key;
+}
+api_1.test.describe('Authorizations', () => {
+    (0, api_1.test)('creates an authorization for a group owner', async ({ api, resources, }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const processId = (0, bpmn_1.uniqueId)('authz-process');
+        const deployed = await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask((0, bpmn_1.uniqueId)('job'))));
+        const key = await createAuthorization(api, resources, {
+            ownerType: 'GROUP',
+            ownerId: group.groupId,
+            resourceType: 'PROCESS_DEFINITION',
+            resourceId: deployed.processDefinitionId,
+            permissionTypes: ['READ_PROCESS_INSTANCE'],
+        });
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/authorizations/{authorizationKey}', {
+                params: { authorizationKey: key },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(response));
+            (0, assertions_1.assertRequiredFields)(json, [
+                'authorizationKey',
+                'ownerId',
+                'ownerType',
+                'resourceType',
+                'permissionTypes',
+            ]);
+            (0, test_1.expect)(json.ownerId).toBe(group.groupId);
+            (0, test_1.expect)(json.permissionTypes).toEqual(['READ_PROCESS_INSTANCE']);
+        });
+    });
+    (0, api_1.test)('creates an authorization carrying several permissions', async ({ api, resources, }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const key = await createAuthorization(api, resources, {
+            ownerType: 'GROUP',
+            ownerId: group.groupId,
+            resourceType: 'PROCESS_DEFINITION',
+            resourceId: '*',
+            permissionTypes: ['READ_PROCESS_DEFINITION', 'READ_PROCESS_INSTANCE'],
+        });
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/authorizations/{authorizationKey}', {
+                params: { authorizationKey: key },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(response));
+            (0, test_1.expect)(json.permissionTypes).toEqual(test_1.expect.arrayContaining([
+                'READ_PROCESS_DEFINITION',
+                'READ_PROCESS_INSTANCE',
+            ]));
+        });
+    });
+    (0, api_1.test)('creates an authorization for a user owner', async ({ api, resources, }) => {
+        const username = await (0, identity_1.provisionUsername)(api, resources);
+        const key = await createAuthorization(api, resources, {
+            ownerType: 'USER',
+            ownerId: username,
+            resourceType: 'DECISION_DEFINITION',
+            resourceId: '*',
+            permissionTypes: ['READ_DECISION_DEFINITION'],
+        });
+        (0, test_1.expect)(key).toBeTruthy();
+    });
+    (0, api_1.test)('finds an authorization by owner', async ({ api, resources }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        await createAuthorization(api, resources, {
+            ownerType: 'GROUP',
+            ownerId: group.groupId,
+            resourceType: 'PROCESS_DEFINITION',
+            resourceId: '*',
+            permissionTypes: ['READ_PROCESS_DEFINITION'],
+        });
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/authorizations/search', {
+                body: { filter: { ownerId: group.groupId }, page: { limit: 10 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            for (const item of page.items) {
+                (0, test_1.expect)(item.ownerId).toBe(group.groupId);
+            }
+        });
+    });
+    (0, api_1.test)('filters an authorization search by owner type', async ({ api, resources, }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        await createAuthorization(api, resources, {
+            ownerType: 'GROUP',
+            ownerId: group.groupId,
+            resourceType: 'PROCESS_DEFINITION',
+            resourceId: '*',
+            permissionTypes: ['READ_PROCESS_DEFINITION'],
+        });
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/authorizations/search', {
+                body: { filter: { ownerType: 'GROUP' }, page: { limit: 50 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            for (const item of page.items) {
+                (0, test_1.expect)(item.ownerType).toBe('GROUP');
+            }
+        });
+    });
+    (0, api_1.test)('updates the permissions on an authorization', async ({ api, resources, }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const key = await createAuthorization(api, resources, {
+            ownerType: 'GROUP',
+            ownerId: group.groupId,
+            resourceType: 'PROCESS_DEFINITION',
+            resourceId: '*',
+            permissionTypes: ['READ_PROCESS_DEFINITION'],
+        });
+        const response = await api.put('/authorizations/{authorizationKey}', {
+            params: { authorizationKey: key },
+            body: {
+                ownerType: 'GROUP',
+                ownerId: group.groupId,
+                resourceType: 'PROCESS_DEFINITION',
+                resourceId: '*',
+                permissionTypes: ['READ_PROCESS_DEFINITION', 'UPDATE_PROCESS_INSTANCE'],
+            },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'the update is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/authorizations/{authorizationKey}', {
+                params: { authorizationKey: key },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(lookup));
+            (0, test_1.expect)(json.permissionTypes).toEqual(test_1.expect.arrayContaining(['UPDATE_PROCESS_INSTANCE']));
+        });
+    });
+    (0, api_1.test)('deletes an authorization', async ({ api, resources }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const key = await createAuthorization(api, resources, {
+            ownerType: 'GROUP',
+            ownerId: group.groupId,
+            resourceType: 'PROCESS_DEFINITION',
+            resourceId: '*',
+            permissionTypes: ['READ_PROCESS_DEFINITION'],
+        });
+        const response = await api.delete('/authorizations/{authorizationKey}', {
+            params: { authorizationKey: key },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'deletion is acknowledged');
+        resources.forget('authorization', key);
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/authorizations/{authorizationKey}', {
+                params: { authorizationKey: key },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertNotFound)(lookup);
+        });
+    });
+    (0, api_1.test)('rejects an authorization with no permission types', async ({ api, resources, }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const response = await api.post('/authorizations', {
+            body: {
+                ownerType: 'GROUP',
+                ownerId: group.groupId,
+                resourceType: 'PROCESS_DEFINITION',
+                resourceId: '*',
+                permissionTypes: [],
+            },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects an authorization with an unknown resource type', async ({ api, resources, }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const response = await api.post('/authorizations', {
+            body: {
+                ownerType: 'GROUP',
+                ownerId: group.groupId,
+                resourceType: 'NOT_A_RESOURCE_TYPE',
+                resourceId: '*',
+                permissionTypes: ['READ_PROCESS_DEFINITION'],
+            },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects a lookup for an absent authorization', async ({ api }) => {
+        const response = await api.get('/authorizations/{authorizationKey}', {
+            params: { authorizationKey: keys_1.ABSENT_KEY },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects an unauthenticated authorization search', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.post('/authorizations/search', {
+            body: { filter: {} },
+            tenant: 'none',
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+    (0, api_1.test)('honours the page size on an authorization search', async ({ api }) => {
+        const response = await api.post('/authorizations/search', {
+            body: { filter: {}, page: { limit: 1 } },
+            tenant: 'none',
+        });
+        const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+        (0, test_1.expect)(page.items.length).toBe(1);
+    });
+});

package/dist/tests/api/v2/authorization/authorization-enforcement-api-tests.spec.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Authorization *enforcement* — that the cluster actually refuses an
+ * unprivileged principal, not merely that the authorization API accepts writes.
+ *
+ * This is the coverage a Helm-upgrade run most needs, because role bindings are
+ * what an upgrade is most likely to lose. In the shell suite it was 2,700 lines
+ * (9506-12224) inside a single `if [[ "$TEST_CLIENT_TOKEN_VALID" ]]` block: if
+ * the token fetch failed, the entire section silently did not run and the script
+ * still exited 0.
+ *
+ * Two things change here. The gate is a hard failure rather than a silent skip,
+ * so "enforcement was never checked" can no longer look like success. And the
+ * unprivileged principal is a user this spec creates, rather than the suite's own
+ * admin client with its permissions temporarily stripped and restored — that
+ * approach mutated cluster-wide admin state mid-run, so a failure between the
+ * strip and the restore left the rest of the suite running without permissions.
+ */
+export {};