@camunda/e2e-test-suite 0.0.1241 → 0.0.1243

package/dist/tests/api/v2/authorization/authorization-enforcement-api-tests.spec.js

@@ -0,0 +1,208 @@
+"use strict";
+/**
+ * Authorization *enforcement* — that the cluster actually refuses an
+ * unprivileged principal, not merely that the authorization API accepts writes.
+ *
+ * This is the coverage a Helm-upgrade run most needs, because role bindings are
+ * what an upgrade is most likely to lose. In the shell suite it was 2,700 lines
+ * (9506-12224) inside a single `if [[ "$TEST_CLIENT_TOKEN_VALID" ]]` block: if
+ * the token fetch failed, the entire section silently did not run and the script
+ * still exited 0.
+ *
+ * Two things change here. The gate is a hard failure rather than a silent skip,
+ * so "enforcement was never checked" can no longer look like success. And the
+ * unprivileged principal is a user this spec creates, rather than the suite's own
+ * admin client with its permissions temporarily stripped and restored — that
+ * approach mutated cluster-wide admin state mid-run, so a failure between the
+ * strip and the restore left the rest of the suite running without permissions.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const beans_1 = require("../../../../utils/api/beans");
+const config_1 = require("../../../../utils/api/config");
+const auth_1 = require("../../../../utils/api/auth");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+const eventually_1 = require("../../../../utils/api/eventually");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const deployments_1 = require("../../../../utils/api/deployments");
+/**
+ * Obtains a principal that holds no roles, by whichever route the cluster
+ * allows.
+ *
+ * Throws when neither route works. That is deliberate: without a second
+ * principal there is no way to observe enforcement, and a suite that quietly
+ * reports success in that state is worse than one that fails. The tests are
+ * gated on `enforcementPrincipalUnavailable` before they get here, so a throw
+ * means a configured route broke rather than that none was configured.
+ */
+async function unprivilegedPrincipal(api, request, resources) {
+    // OIDC cluster: act as a second identity-provider client. It must hold no
+    // roles for the assertions below to mean anything, which is a property of
+    // how it was provisioned rather than something this suite can enforce.
+    if (!config_1.apiConfig.usersApiEnabled) {
+        const { clientId, clientSecret } = config_1.apiConfig.secondaryClient;
+        const header = await (0, auth_1.clientAuthHeader)(request, clientId, clientSecret);
+        if (!header) {
+            throw new Error(`Could not obtain a token for the secondary client "${clientId}" from ` +
+                `${config_1.apiConfig.oauth.tokenUrl}. Enforcement cannot be observed without a ` +
+                `second principal, so this is a failure rather than a skip. Check that ` +
+                `SECONDARY_CLIENT_SECRET matches the client and that client credentials ` +
+                `are enabled for it.`);
+        }
+        return { ownerId: clientId, ownerType: 'CLIENT', authorization: header };
+    }
+    const user = (0, beans_1.newUser)();
+    await (0, assertions_1.assertCreated)(await api.post('/users', { body: user, tenant: 'none' }));
+    resources.track('user', user.username);
+    if (config_1.apiConfig.authMethod === 'basic') {
+        const encoded = Buffer.from(`${user.username}:${user.password}`).toString('base64');
+        return {
+            ownerId: user.username,
+            ownerType: 'USER',
+            authorization: `Basic ${encoded}`,
+        };
+    }
+    const header = await (0, auth_1.userAuthHeader)(request, user.username, user.password);
+    if (!header) {
+        throw new Error(`Could not obtain a token for the freshly created user "${user.username}" ` +
+            `from ${config_1.apiConfig.oauth.tokenUrl}. Enforcement cannot be observed without a ` +
+            `second principal, so this is a failure rather than a skip. Check that the ` +
+            `"${config_1.apiConfig.oauth.clientId}" client has direct access grants enabled and that ` +
+            `users created through /v2/users are resolvable by the identity provider.`);
+    }
+    return { ownerId: user.username, ownerType: 'USER', authorization: header };
+}
+api_1.test.describe('Authorization enforcement', () => {
+    // Without a second, unprivileged principal there is nothing to enforce
+    // against. The reason names what to configure so this reads as a gap to
+    // close rather than a test that mysteriously does not run.
+    api_1.test.skip(capabilities_1.enforcementPrincipalUnavailable !== false, capabilities_1.enforcementPrincipalUnavailable === false
+        ? ''
+        : capabilities_1.enforcementPrincipalUnavailable);
+    (0, api_1.test)('refuses a process-definition search to an unprivileged user', async ({ api, request, resources, }) => {
+        const principal = await unprivilegedPrincipal(api, request, resources);
+        const response = await api.post('/process-definitions/search', {
+            body: { filter: {} },
+            authorization: principal.authorization,
+        });
+        // A cluster that has lost its authorization wiring answers 200 here.
+        await (0, assertions_1.assertStatusIn)(response, [200, 403], 'an unprivileged principal is refused outright, or served an empty result set');
+        if (response.status() === 200) {
+            // Where the API filters rather than refuses, the result must be empty —
+            // seeing another principal's definitions is the same defect as a 200 on
+            // a forbidden call.
+            await (0, assertions_1.assertPaginated)(response, { exactItems: 0 });
+        }
+    });
+    (0, api_1.test)('refuses a user list to an unprivileged user', async ({ api, request, resources, }) => {
+        // In OIDC mode /v2/users/** is closed to everyone, so a 403 here would
+        // come from the endpoint filter rather than from the authorization check
+        // this test is about — it would pass without enforcement working at all.
+        api_1.test.skip(capabilities_1.usersApiUnavailable !== false, capabilities_1.usersApiUnavailable === false ? '' : capabilities_1.usersApiUnavailable);
+        const principal = await unprivilegedPrincipal(api, request, resources);
+        const response = await api.post('/users/search', {
+            body: { filter: {} },
+            tenant: 'none',
+            authorization: principal.authorization,
+        });
+        await (0, assertions_1.assertStatusIn)(response, [200, 403], 'an unprivileged principal is refused outright, or served an empty result set');
+        if (response.status() === 200) {
+            await (0, assertions_1.assertPaginated)(response, { exactItems: 0 });
+        }
+    });
+    (0, api_1.test)('refuses a deployment to an unprivileged user', async ({ api, request, resources, }) => {
+        const principal = await unprivilegedPrincipal(api, request, resources);
+        const processId = (0, bpmn_1.uniqueId)('enforcement-deploy');
+        const response = await api.post('/deployments', {
+            tenant: 'none',
+            authorization: principal.authorization,
+            multipart: {
+                resources: {
+                    name: `${processId}.bpmn`,
+                    mimeType: 'application/xml',
+                    buffer: Buffer.from((0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask((0, bpmn_1.uniqueId)('job'))), 'utf-8'),
+                },
+            },
+        });
+        await (0, assertions_1.assertForbidden)(response);
+        // Backcheck: the refusal must also mean nothing was created. The shell
+        // suite called this step "BACKCHECK" and it is the part worth keeping.
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/process-definitions/search', {
+                body: { filter: { processDefinitionId: processId } },
+            });
+            await (0, assertions_1.assertPaginated)(search, { exactItems: 0 });
+        });
+    });
+    (0, api_1.test)('refuses role creation to an unprivileged user', async ({ api, request, resources, }) => {
+        const principal = await unprivilegedPrincipal(api, request, resources);
+        const roleId = (0, bpmn_1.uniqueId)('enforcement-role');
+        const response = await api.post('/roles', {
+            body: { roleId, name: 'should not be created' },
+            tenant: 'none',
+            authorization: principal.authorization,
+        });
+        await (0, assertions_1.assertForbidden)(response);
+        const lookup = await api.get('/roles/{roleId}', {
+            params: { roleId },
+            tenant: 'none',
+        });
+        (0, test_1.expect)(lookup.status(), 'a refused role creation must leave no role behind').toBe(404);
+    });
+    (0, api_1.test)('refuses starting a process instance to an unprivileged user', async ({ api, request, resources, }) => {
+        const principal = await unprivilegedPrincipal(api, request, resources);
+        const processId = (0, bpmn_1.uniqueId)('enforcement-start');
+        await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask((0, bpmn_1.uniqueId)('job'))));
+        const response = await api.post('/process-instances', {
+            body: { processDefinitionId: processId },
+            tenant: 'root',
+            authorization: principal.authorization,
+        });
+        await (0, assertions_1.assertForbidden)(response);
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/process-instances/search', {
+                body: { filter: { processDefinitionId: processId } },
+            });
+            await (0, assertions_1.assertPaginated)(search, { exactItems: 0 });
+        });
+    });
+    (0, api_1.test)('admits a user once granted the matching authorization', async ({ api, request, resources, }) => {
+        const principal = await unprivilegedPrincipal(api, request, resources);
+        const processId = (0, bpmn_1.uniqueId)('enforcement-grant');
+        await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask((0, bpmn_1.uniqueId)('job'))));
+        // Refused before the grant.
+        const before = await api.post('/process-definitions/search', {
+            body: { filter: { processDefinitionId: processId } },
+            authorization: principal.authorization,
+        });
+        if (before.status() === 200) {
+            await (0, assertions_1.assertPaginated)(before, { exactItems: 0 });
+        }
+        else {
+            await (0, assertions_1.assertForbidden)(before);
+        }
+        const grant = await api.post('/authorizations', {
+            body: {
+                ownerType: principal.ownerType,
+                ownerId: principal.ownerId,
+                resourceType: 'PROCESS_DEFINITION',
+                resourceId: processId,
+                permissionTypes: ['READ_PROCESS_DEFINITION'],
+            },
+            tenant: 'none',
+        });
+        const created = (await (0, assertions_1.assertCreated)(grant));
+        resources.track('authorization', String(created.authorizationKey));
+        // Admitted after it. This direction is what proves the refusal above came
+        // from the authorization check rather than from the resource being absent.
+        await (0, eventually_1.eventually)(async () => {
+            const after = await api.post('/process-definitions/search', {
+                body: { filter: { processDefinitionId: processId } },
+                authorization: principal.authorization,
+            });
+            await (0, assertions_1.assertPaginated)(after, { exactItems: 1 });
+        });
+    });
+});

package/dist/tests/api/v2/batch-operation/batch-operation-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/batch-operation/batch-operation-api-tests.spec.js

@@ -0,0 +1,264 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const deployments_1 = require("../../../../utils/api/deployments");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const eventually_1 = require("../../../../utils/api/eventually");
+const keys_1 = require("../../../../utils/api/keys");
+/**
+ * Deploys a process, starts `count` instances, and returns a filter that
+ * selects exactly those instances.
+ *
+ * The shell suite ran its batch operations against `{"filter":{}}` — every
+ * instance on the cluster — which is why its batch section had to be serial
+ * and why it needed a 900-line concurrency block to cope with the collisions
+ * that caused. Scoping each batch to its own process definition removes both.
+ */
+async function seedInstances(api, resources, count) {
+    const processId = (0, bpmn_1.uniqueId)('batch-api');
+    await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask((0, bpmn_1.uniqueId)('job'))));
+    const instanceKeys = [];
+    for (let i = 0; i < count; i++) {
+        const response = await api.post('/process-instances', {
+            body: { processDefinitionId: processId },
+            tenant: 'root',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [200], 'instance creation is synchronous');
+        const json = (await response.json());
+        instanceKeys.push(String(json.processInstanceKey));
+    }
+    // The batch resolves its scope from the search store, so the instances must
+    // be exported before the batch is created or it selects nothing.
+    await (0, eventually_1.eventually)(async () => {
+        const search = await api.post('/process-instances/search', {
+            body: { filter: { processDefinitionId: processId }, page: { limit: 50 } },
+        });
+        await (0, assertions_1.assertPaginated)(search, { minItems: count });
+    });
+    return { processId, instanceKeys };
+}
+async function createCancellationBatch(api, processId) {
+    const response = await api.post('/process-instances/cancellation', {
+        body: { filter: { processDefinitionId: processId } },
+        tenant: 'filter',
+    });
+    await (0, assertions_1.assertStatusIn)(response, [200], 'the batch is accepted and its key returned synchronously');
+    const json = (await response.json());
+    (0, assertions_1.assertRequiredFields)(json, ['batchOperationKey']);
+    return String(json.batchOperationKey);
+}
+api_1.test.describe('Batch operations', () => {
+    (0, api_1.test)('creates a cancellation batch and cancels its instances', async ({ api, resources, }) => {
+        const { processId, instanceKeys } = await seedInstances(api, resources, 3);
+        const batchKey = await createCancellationBatch(api, processId);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/batch-operations/{batchOperationKey}', {
+                params: { batchOperationKey: batchKey },
+                tenant: 'none',
+            });
+            const batch = (await (0, assertions_1.assertOk)(response));
+            (0, assertions_1.assertRequiredFields)(batch, [
+                'batchOperationKey',
+                'state',
+                'batchOperationType',
+            ]);
+            (0, test_1.expect)(batch.batchOperationType).toBe('CANCEL_PROCESS_INSTANCE');
+            (0, test_1.expect)(['COMPLETED', 'PARTIALLY_COMPLETED']).toContain(batch.state);
+        });
+        // The shell suite asserted only that the batch endpoint answered. Whether
+        // the instances were actually cancelled was never checked.
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/process-instances/search', {
+                body: {
+                    filter: { processDefinitionId: processId, state: 'ACTIVE' },
+                    page: { limit: 50 },
+                },
+            });
+            await (0, assertions_1.assertPaginated)(search, { exactItems: 0 });
+        });
+        (0, test_1.expect)(instanceKeys.length).toBe(3);
+    });
+    (0, api_1.test)('finds a created batch through search', async ({ api, resources }) => {
+        const { processId } = await seedInstances(api, resources, 1);
+        const batchKey = await createCancellationBatch(api, processId);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/batch-operations/search', {
+                body: { filter: { batchOperationKey: batchKey }, page: { limit: 10 } },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertPaginated)(response, { exactItems: 1 });
+        });
+    });
+    (0, api_1.test)('filters a batch search by state', async ({ api, resources }) => {
+        const { processId } = await seedInstances(api, resources, 1);
+        const batchKey = await createCancellationBatch(api, processId);
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/batch-operations/{batchOperationKey}', {
+                params: { batchOperationKey: batchKey },
+                tenant: 'none',
+            });
+            const batch = (await (0, assertions_1.assertOk)(lookup));
+            const response = await api.post('/batch-operations/search', {
+                body: {
+                    filter: { state: batch.state },
+                    page: { limit: 20 },
+                },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            for (const item of page.items) {
+                (0, test_1.expect)(item.state).toBe(batch.state);
+            }
+        });
+    });
+    (0, api_1.test)('lists the items belonging to a batch', async ({ api, resources }) => {
+        const { processId } = await seedInstances(api, resources, 2);
+        const batchKey = await createCancellationBatch(api, processId);
+        await (0, eventually_1.eventuallyGet)(async () => {
+            const response = await api.post('/batch-operation-items/search', {
+                body: { filter: { batchOperationKey: batchKey }, page: { limit: 20 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response);
+            return page.items;
+        }, (items) => items.length >= 2, { description: `items of batch ${batchKey}` });
+    });
+    (0, api_1.test)('suspends and resumes a batch', async ({ api, resources }) => {
+        // A larger batch keeps the operation in flight long enough to suspend.
+        const { processId } = await seedInstances(api, resources, 5);
+        const batchKey = await createCancellationBatch(api, processId);
+        const suspend = await api.post('/batch-operations/{batchOperationKey}/suspension', { params: { batchOperationKey: batchKey }, body: {}, tenant: 'none' });
+        await (0, assertions_1.assertStatusIn)(suspend, [204, 409], 'a batch that has already finished cannot be suspended');
+        if (suspend.status() === 204) {
+            await (0, eventually_1.eventually)(async () => {
+                const lookup = await api.get('/batch-operations/{batchOperationKey}', {
+                    params: { batchOperationKey: batchKey },
+                    tenant: 'none',
+                });
+                const batch = (await (0, assertions_1.assertOk)(lookup));
+                (0, test_1.expect)(batch.state).toBe('SUSPENDED');
+            });
+            const resume = await api.post('/batch-operations/{batchOperationKey}/resumption', { params: { batchOperationKey: batchKey }, body: {}, tenant: 'none' });
+            await (0, assertions_1.assertStatusIn)(resume, [204], 'resumption is acknowledged');
+            await (0, eventually_1.eventually)(async () => {
+                const lookup = await api.get('/batch-operations/{batchOperationKey}', {
+                    params: { batchOperationKey: batchKey },
+                    tenant: 'none',
+                });
+                const batch = (await (0, assertions_1.assertOk)(lookup));
+                (0, test_1.expect)(batch.state).not.toBe('SUSPENDED');
+            });
+        }
+    });
+    (0, api_1.test)('cancels a suspended batch', async ({ api, resources }) => {
+        const { processId } = await seedInstances(api, resources, 5);
+        const batchKey = await createCancellationBatch(api, processId);
+        const suspend = await api.post('/batch-operations/{batchOperationKey}/suspension', { params: { batchOperationKey: batchKey }, body: {}, tenant: 'none' });
+        await (0, assertions_1.assertStatusIn)(suspend, [204, 409], 'a batch that has already finished cannot be suspended');
+        if (suspend.status() === 204) {
+            const cancel = await api.post('/batch-operations/{batchOperationKey}/cancellation', { params: { batchOperationKey: batchKey }, body: {}, tenant: 'none' });
+            await (0, assertions_1.assertStatusIn)(cancel, [204], 'cancellation is acknowledged');
+            await (0, eventually_1.eventually)(async () => {
+                const lookup = await api.get('/batch-operations/{batchOperationKey}', {
+                    params: { batchOperationKey: batchKey },
+                    tenant: 'none',
+                });
+                const batch = (await (0, assertions_1.assertOk)(lookup));
+                (0, test_1.expect)(batch.state).toBe('CANCELED');
+            });
+        }
+    });
+    (0, api_1.test)('creates a migration batch', async ({ api, resources }) => {
+        const processId = (0, bpmn_1.uniqueId)('batch-migration');
+        const jobType = (0, bpmn_1.uniqueId)('job');
+        const v1 = await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask(jobType), { name: 'v1' }));
+        const v2 = await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask(jobType), { name: 'v2' }));
+        (0, test_1.expect)(v2.version).toBe(v1.version + 1);
+        const start = await api.post('/process-instances', {
+            body: { processDefinitionId: processId },
+            tenant: 'root',
+        });
+        const instance = (await start.json());
+        resources.track('processInstance', String(instance.processInstanceKey));
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/process-instances/search', {
+                body: { filter: { processInstanceKey: instance.processInstanceKey } },
+            });
+            await (0, assertions_1.assertPaginated)(search, { exactItems: 1 });
+        });
+        const response = await api.post('/process-instances/migration', {
+            body: {
+                filter: { processDefinitionKey: v1.processDefinitionKey },
+                migrationPlan: {
+                    targetProcessDefinitionKey: v2.processDefinitionKey,
+                    mappingInstructions: [
+                        { sourceElementId: 'task', targetElementId: 'task' },
+                    ],
+                },
+            },
+            tenant: 'filter',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [200], 'the batch key is returned');
+        const json = (await response.json());
+        (0, assertions_1.assertRequiredFields)(json, ['batchOperationKey']);
+    });
+    (0, api_1.test)('rejects a lookup for an absent batch', async ({ api }) => {
+        const response = await api.get('/batch-operations/{batchOperationKey}', {
+            params: { batchOperationKey: keys_1.ABSENT_KEY },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects suspending an absent batch', async ({ api }) => {
+        const response = await api.post('/batch-operations/{batchOperationKey}/suspension', {
+            params: { batchOperationKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: {},
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects resuming an absent batch', async ({ api }) => {
+        const response = await api.post('/batch-operations/{batchOperationKey}/resumption', {
+            params: { batchOperationKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: {},
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects cancelling an absent batch', async ({ api }) => {
+        const response = await api.post('/batch-operations/{batchOperationKey}/cancellation', {
+            params: { batchOperationKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: {},
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('reports an unknown batch operation id as not found', async ({ api }) => {
+        // A batch operation is addressed by a string id, not a numeric key, so
+        // there is no "malformed" shape to reject here — any string the cluster
+        // does not hold is simply absent.
+        const response = await api.get('/batch-operations/{batchOperationKey}', {
+            params: { batchOperationKey: 'not-a-key' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response, /not found/i);
+    });
+    (0, api_1.test)('rejects a cancellation batch with an empty filter', async ({ api }) => {
+        const response = await api.post('/process-instances/cancellation', {
+            body: { filter: {} },
+            tenant: 'none',
+        });
+        // An unscoped batch would cancel every instance on the cluster. The shell
+        // suite asserted `200 202 400` here, so it accepted that outcome.
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects a batch search with an unknown state filter', async ({ api }) => {
+        const response = await api.post('/batch-operations/search', {
+            body: { filter: { state: 'NOT_A_STATE' } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+});

package/dist/tests/api/v2/cluster/cluster-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/cluster/cluster-api-tests.spec.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const assertions_1 = require("../../../../utils/api/assertions");
+const test_1 = require("@playwright/test");
+const config_1 = require("../../../../utils/api/config");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+api_1.test.describe('Cluster and authentication', () => {
+    (0, api_1.test)('returns the authenticated principal', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.get('/authentication/me', { tenant: 'none' });
+        const me = (await (0, assertions_1.assertOk)(response));
+        // The shell suite accepted any 200 here and read the user id with a
+        // `// empty` fallback, so an empty body passed. What the endpoint
+        // guarantees is `CamundaUserResult`, whose required fields describe what
+        // the caller may do — assert those.
+        (0, assertions_1.assertRequiredFields)(me, [
+            'authorizedComponents',
+            'tenants',
+            'groups',
+            'roles',
+            'canLogout',
+        ]);
+        (0, test_1.expect)(Array.isArray(me.authorizedComponents)).toBe(true);
+        (0, test_1.expect)(Array.isArray(me.tenants)).toBe(true);
+        // `username` names a *user*. Authenticating with client credentials —
+        // which is how every OIDC cluster runs this suite — means the principal
+        // is a client and there is no username to return, so requiring one here
+        // asserted a property of the auth method rather than of the endpoint.
+        if (config_1.apiConfig.usersApiEnabled) {
+            (0, test_1.expect)(me.username, 'a user principal is identified by name').toBeTruthy();
+        }
+    });
+    // Not gated on `unauthenticatedAccessAllowed`: /v2/authentication/me
+    // refuses an anonymous caller even where the rest of the tree does not,
+    // so this one holds on an open cluster too and passed on c8Run.
+    (0, api_1.test)('rejects an unauthenticated principal lookup', async ({ api }) => {
+        const response = await api.get('/authentication/me', {
+            tenant: 'none',
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+    (0, api_1.test)('reports cluster topology with at least one broker', async ({ api }) => {
+        const response = await api.get('/topology', { tenant: 'none' });
+        const topology = (await (0, assertions_1.assertOk)(response));
+        (0, assertions_1.assertRequiredFields)(topology, ['brokers', 'clusterSize']);
+        (0, test_1.expect)(topology.brokers?.length ?? 0).toBeGreaterThan(0);
+        (0, test_1.expect)(topology.clusterSize).toBeGreaterThan(0);
+        for (const broker of topology.brokers ?? []) {
+            (0, assertions_1.assertRequiredFields)(broker, ['nodeId', 'host', 'port', 'partitions']);
+        }
+    });
+    (0, api_1.test)('reports the cluster licence state', async ({ api }) => {
+        const response = await api.get('/license', { tenant: 'none' });
+        const license = (await (0, assertions_1.assertOk)(response));
+        (0, assertions_1.assertRequiredFields)(license, ['validLicense', 'licenseType']);
+        (0, test_1.expect)(typeof license.validLicense).toBe('boolean');
+    });
+    (0, api_1.test)('reports readiness on the status endpoint', async ({ api }) => {
+        const response = await api.get('/status', { tenant: 'none' });
+        await (0, assertions_1.assertNoContent)(response);
+    });
+    (0, api_1.test)('rejects an unauthenticated topology request', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.get('/topology', {
+            tenant: 'none',
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+    (0, api_1.test)('rejects a request bearing a malformed token', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.get('/topology', {
+            tenant: 'none',
+            authorization: 'Bearer not-a-real-token',
+        });
+        await (0, assertions_1.assertStatus)(response, 401);
+    });
+});

package/dist/tests/api/v2/decision/decision-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};