@camunda/e2e-test-suite 0.0.1241 → 0.0.1243

package/dist/tests/api/v2/decision/decision-api-tests.spec.js

@@ -0,0 +1,233 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const deployments_1 = require("../../../../utils/api/deployments");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const eventually_1 = require("../../../../utils/api/eventually");
+const keys_1 = require("../../../../utils/api/keys");
+/**
+ * Deploys a decision for one test and tracks it for deletion.
+ *
+ * Per test rather than once per file: a definition shared through `beforeAll`
+ * outlives the test that needs it, so no single test can clean it up and the
+ * tests that evaluate it compete for the same instances — this file already
+ * carries two comments about a definition-scoped search returning a sibling
+ * test's instance. A private decision id per test removes that competition at
+ * the source.
+ */
+async function deployTestDecision(api, resources, prefix) {
+    const decisionId = (0, bpmn_1.uniqueId)(prefix);
+    const deployed = await (0, deployments_1.deployDecision)(api, resources, decisionId, (0, bpmn_1.simpleDecision)(decisionId));
+    return { decisionId, deployed };
+}
+api_1.test.describe('Decision definitions and instances', () => {
+    (0, api_1.test)('finds the deployed decision by id', async ({ api, resources }) => {
+        const { decisionId, deployed } = await deployTestDecision(api, resources, 'decision-api');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/decision-definitions/search', {
+                body: { filter: { decisionDefinitionId: decisionId } },
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            const item = page.items[0];
+            (0, test_1.expect)(String(item.decisionDefinitionKey)).toBe(deployed.decisionDefinitionKey);
+        });
+    });
+    (0, api_1.test)('returns the decision definition by key', async ({ api, resources }) => {
+        const { decisionId, deployed } = await deployTestDecision(api, resources, 'decision-api');
+        // `x-eventually-consistent: true` — served from secondary storage, so it
+        // can 404 briefly after the deployment.
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/decision-definitions/{decisionDefinitionKey}', { params: { decisionDefinitionKey: deployed.decisionDefinitionKey } });
+            const definition = (await (0, assertions_1.assertOk)(response));
+            (0, assertions_1.assertRequiredFields)(definition, [
+                'decisionDefinitionKey',
+                'decisionDefinitionId',
+                'version',
+                'decisionRequirementsKey',
+            ]);
+            (0, test_1.expect)(definition.decisionDefinitionId).toBe(decisionId);
+        });
+    });
+    (0, api_1.test)('returns the decision XML by key', async ({ api, resources }) => {
+        const { decisionId, deployed } = await deployTestDecision(api, resources, 'decision-api');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/decision-definitions/{decisionDefinitionKey}/xml', { params: { decisionDefinitionKey: deployed.decisionDefinitionKey } });
+            // assertOk parses the body as JSON; this endpoint returns XML text.
+            await (0, assertions_1.assertStatus)(response, 200);
+            const xml = await response.text();
+            (0, test_1.expect)(xml).toContain(decisionId);
+        });
+    });
+    (0, api_1.test)('evaluates the decision and returns the matching output', async ({ api, resources, }) => {
+        const { deployed } = await deployTestDecision(api, resources, 'decision-api');
+        const response = await api.post('/decision-definitions/evaluation', {
+            body: {
+                decisionDefinitionKey: deployed.decisionDefinitionKey,
+                variables: { inputVariable: 'match' },
+            },
+            tenant: 'root',
+        });
+        const result = (await (0, assertions_1.assertOk)(response));
+        (0, assertions_1.assertRequiredFields)(result, [
+            'decisionDefinitionKey',
+            'decisionEvaluationKey',
+            'output',
+        ]);
+        // The shell suite accepted `200 400 404` here, so a decision that failed
+        // to evaluate passed. The rule table maps "match" to "matched", and
+        // `output` carries the JSON encoding of the value, not the bare value.
+        (0, test_1.expect)(result.output).toBe('"matched"');
+    });
+    (0, api_1.test)('evaluates the decision to its default rule', async ({ api, resources, }) => {
+        const { deployed } = await deployTestDecision(api, resources, 'decision-api');
+        const response = await api.post('/decision-definitions/evaluation', {
+            body: {
+                decisionDefinitionKey: deployed.decisionDefinitionKey,
+                variables: { inputVariable: 'anything-else' },
+            },
+            tenant: 'root',
+        });
+        const result = (await (0, assertions_1.assertOk)(response));
+        (0, test_1.expect)(result.output).toBe('"default"');
+    });
+    (0, api_1.test)('records an instance for each evaluation', async ({ api, resources }) => {
+        const { decisionId, deployed } = await deployTestDecision(api, resources, 'decision-api');
+        const evaluation = await api.post('/decision-definitions/evaluation', {
+            body: {
+                decisionDefinitionKey: deployed.decisionDefinitionKey,
+                variables: { inputVariable: 'match' },
+            },
+            tenant: 'root',
+        });
+        const evaluated = (await (0, assertions_1.assertOk)(evaluation));
+        const evaluationKey = String(evaluated.decisionEvaluationKey);
+        // Filtered by the evaluation, not by the definition: this test evaluates
+        // once, but a definition-scoped search would be satisfied by whichever
+        // instance is exported first, so as soon as a test evaluates twice
+        // `items[0]` is whichever evaluation landed first rather than the one
+        // under assertion. That is how it failed when the whole file shared one
+        // definition — one flake in run 35606946161, where the search returned a
+        // sibling test's instance.
+        const instances = await (0, eventually_1.eventuallyGet)(async () => {
+            const response = await api.post('/decision-instances/search', {
+                body: {
+                    filter: { decisionEvaluationKey: evaluationKey },
+                    page: { limit: 10 },
+                },
+            });
+            return (await (0, assertions_1.assertPaginated)(response)).items;
+        }, (items) => items.length > 0, { description: `decision instance for evaluation ${evaluationKey}` });
+        // The single-instance GET is addressed by `decisionEvaluationInstanceKey`
+        // — the compound `<decisionEvaluationKey>-<index>` that identifies one
+        // decision inside an evaluation, not the plain numeric evaluation key.
+        // Passing the numeric key earns a 400 naming the `^\d+-\d+$` pattern.
+        const byKey = await api.get('/decision-instances/{decisionEvaluationInstanceKey}', {
+            params: {
+                decisionEvaluationInstanceKey: String(instances[0].decisionEvaluationInstanceKey),
+            },
+        });
+        const json = (await (0, assertions_1.assertOk)(byKey));
+        (0, assertions_1.assertRequiredFields)(json, [
+            'decisionEvaluationInstanceKey',
+            'decisionDefinitionId',
+            'state',
+        ]);
+        (0, test_1.expect)(json.decisionDefinitionId).toBe(decisionId);
+    });
+    (0, api_1.test)('exposes the evaluated inputs and outputs of an instance', async ({ api, resources, }) => {
+        const { deployed } = await deployTestDecision(api, resources, 'decision-api');
+        const evaluation = await api.post('/decision-definitions/evaluation', {
+            body: {
+                decisionDefinitionKey: deployed.decisionDefinitionKey,
+                variables: { inputVariable: 'match' },
+            },
+            tenant: 'root',
+        });
+        const evaluated = (await (0, assertions_1.assertOk)(evaluation));
+        const evaluationKey = String(evaluated.decisionEvaluationKey);
+        // There are no `/evaluated-inputs` and `/evaluated-outputs`
+        // sub-resources: the single-instance GET carries `evaluatedInputs` and
+        // `matchedRules` inline, and the v2 spec marks both required on it. That
+        // also lets this assert the values rather than only that an array came
+        // back.
+        //
+        // The key comes from the search rather than the evaluation response: the
+        // GET is addressed by the compound `<evaluationKey>-<index>`, which the
+        // evaluation result does not carry. The search is scoped to this
+        // evaluation for the same reason as above — a definition-scoped one can
+        // return a sibling test's instance, whose input value differs.
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/decision-instances/search', {
+                body: {
+                    filter: { decisionEvaluationKey: evaluationKey },
+                    page: { limit: 1 },
+                },
+            });
+            const page = await (0, assertions_1.assertPaginated)(search, { minItems: 1 });
+            const decisionEvaluationInstanceKey = String(page.items[0]
+                .decisionEvaluationInstanceKey);
+            const response = await api.get('/decision-instances/{decisionEvaluationInstanceKey}', { params: { decisionEvaluationInstanceKey } });
+            const json = (await (0, assertions_1.assertOk)(response));
+            (0, test_1.expect)(json.evaluatedInputs).toEqual([
+                test_1.expect.objectContaining({ inputValue: '"match"' }),
+            ]);
+            (0, test_1.expect)(json.matchedRules).toEqual([
+                test_1.expect.objectContaining({ ruleId: 'rule_match' }),
+            ]);
+        });
+    });
+    (0, api_1.test)('rejects evaluating an absent decision', async ({ api }) => {
+        const response = await api.post('/decision-definitions/evaluation', {
+            body: { decisionDefinitionKey: keys_1.ABSENT_ROUTABLE_KEY, variables: {} },
+            tenant: 'root',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects a lookup for an absent decision key', async ({ api }) => {
+        const response = await api.get('/decision-definitions/{decisionDefinitionKey}', { params: { decisionDefinitionKey: keys_1.ABSENT_KEY } });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects a malformed decision key', async ({ api }) => {
+        const response = await api.get('/decision-definitions/{decisionDefinitionKey}', { params: { decisionDefinitionKey: 'not-a-key' } });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+});
+api_1.test.describe('Decision requirements', () => {
+    (0, api_1.test)('returns the requirements definition by key', async ({ api, resources, }) => {
+        const { deployed } = await deployTestDecision(api, resources, 'drd-api');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/decision-requirements/{decisionRequirementsKey}', { params: { decisionRequirementsKey: deployed.decisionRequirementsKey } });
+            const json = (await (0, assertions_1.assertOk)(response));
+            (0, assertions_1.assertRequiredFields)(json, [
+                'decisionRequirementsKey',
+                'decisionRequirementsId',
+                'version',
+            ]);
+        });
+    });
+    (0, api_1.test)('returns the requirements XML by key', async ({ api, resources }) => {
+        const { decisionId, deployed } = await deployTestDecision(api, resources, 'drd-api');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/decision-requirements/{decisionRequirementsKey}/xml', { params: { decisionRequirementsKey: deployed.decisionRequirementsKey } });
+            await (0, assertions_1.assertStatus)(response, 200);
+            (0, test_1.expect)(await response.text()).toContain(decisionId);
+        });
+    });
+    (0, api_1.test)('finds the requirements through search', async ({ api, resources }) => {
+        const { deployed } = await deployTestDecision(api, resources, 'drd-api');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/decision-requirements/search', {
+                body: {
+                    filter: { decisionRequirementsKey: deployed.decisionRequirementsKey },
+                },
+            });
+            await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+        });
+    });
+    (0, api_1.test)('rejects a lookup for absent requirements', async ({ api }) => {
+        const response = await api.get('/decision-requirements/{decisionRequirementsKey}', { params: { decisionRequirementsKey: keys_1.ABSENT_KEY } });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+});

package/dist/tests/api/v2/deployment/deployment-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/deployment/deployment-api-tests.spec.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const deployments_1 = require("../../../../utils/api/deployments");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const eventually_1 = require("../../../../utils/api/eventually");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+const keys_1 = require("../../../../utils/api/keys");
+api_1.test.describe('Deployments', () => {
+    (0, api_1.test)('deploys a single process', async ({ api, resources }) => {
+        const processId = (0, bpmn_1.uniqueId)('deploy-single');
+        const response = await (0, deployments_1.deployResources)(api, resources, [
+            { name: `${processId}.bpmn`, content: (0, bpmn_1.emptyProcess)(processId) },
+        ]);
+        const json = (await (0, assertions_1.assertOk)(response));
+        (0, assertions_1.assertRequiredFields)(json, ['deploymentKey', 'deployments']);
+        const deployments = json.deployments;
+        (0, test_1.expect)(deployments.length).toBe(1);
+        const definition = deployments[0].processDefinition;
+        // A deployment result carries `processDefinitionVersion`; only the search
+        // and get-by-key results call it `version`.
+        (0, assertions_1.assertRequiredFields)(definition, [
+            'processDefinitionKey',
+            'processDefinitionId',
+            'processDefinitionVersion',
+            'resourceName',
+        ]);
+        (0, test_1.expect)(definition.processDefinitionId).toBe(processId);
+        (0, test_1.expect)(definition.processDefinitionVersion).toBe(1);
+    });
+    (0, api_1.test)('deploys several resources in one request', async ({ api, resources }) => {
+        const first = (0, bpmn_1.uniqueId)('deploy-multi-a');
+        const second = (0, bpmn_1.uniqueId)('deploy-multi-b');
+        const response = await (0, deployments_1.deployResources)(api, resources, [
+            { name: `${first}.bpmn`, content: (0, bpmn_1.emptyProcess)(first) },
+            {
+                name: `${second}.bpmn`,
+                content: (0, bpmn_1.linearProcess)(second, bpmn_1.element.serviceTask((0, bpmn_1.uniqueId)('job'))),
+            },
+        ]);
+        const json = (await (0, assertions_1.assertOk)(response));
+        const ids = json.deployments.map((entry) => entry.processDefinition
+            .processDefinitionId);
+        (0, test_1.expect)(ids).toEqual(test_1.expect.arrayContaining([first, second]));
+    });
+    (0, api_1.test)('deploys a decision model', async ({ api, resources }) => {
+        const decisionId = (0, bpmn_1.uniqueId)('deploy-decision');
+        const response = await (0, deployments_1.deployResources)(api, resources, [
+            { name: `${decisionId}.dmn`, content: (0, bpmn_1.simpleDecision)(decisionId) },
+        ]);
+        const json = (await (0, assertions_1.assertOk)(response));
+        const decision = json.deployments.find((entry) => entry.decisionDefinition !== undefined);
+        (0, test_1.expect)(decision, 'deployment should report a decisionDefinition').toBeTruthy();
+        (0, assertions_1.assertRequiredFields)(decision.decisionDefinition, [
+            'decisionDefinitionKey',
+            'decisionDefinitionId',
+            'decisionRequirementsKey',
+        ]);
+    });
+    (0, api_1.test)('increments the version when redeploying a changed model', async ({ api, resources, }) => {
+        const processId = (0, bpmn_1.uniqueId)('deploy-version');
+        const first = await (0, deployments_1.deployResources)(api, resources, [
+            { name: `${processId}.bpmn`, content: (0, bpmn_1.emptyProcess)(processId) },
+        ]);
+        await (0, assertions_1.assertOk)(first);
+        const second = await (0, deployments_1.deployResources)(api, resources, [
+            {
+                name: `${processId}.bpmn`,
+                content: (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask((0, bpmn_1.uniqueId)('job'))),
+            },
+        ]);
+        const json = (await (0, assertions_1.assertOk)(second));
+        const definition = json.deployments[0].processDefinition;
+        (0, test_1.expect)(definition.processDefinitionVersion).toBe(2);
+    });
+    (0, api_1.test)('rejects a resource that is not valid BPMN', async ({ api, resources, }) => {
+        const response = await (0, deployments_1.deployResources)(api, resources, [
+            { name: 'broken.bpmn', content: '<not-bpmn>nonsense</not-bpmn>' },
+        ]);
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects an unauthenticated deployment', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const processId = (0, bpmn_1.uniqueId)('deploy-unauth');
+        const response = await api.post('/deployments', {
+            tenant: 'none',
+            authorization: null,
+            multipart: {
+                resources: {
+                    name: `${processId}.bpmn`,
+                    mimeType: 'application/xml',
+                    buffer: Buffer.from((0, bpmn_1.emptyProcess)(processId), 'utf-8'),
+                },
+            },
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+    // There is no POST /v2/deployments/search on any supported version. The
+    // test that lived here called it "undocumented on some minors" and accepted
+    // `200 404`, so the 404 it always received passed — the same shape of
+    // vacuous assertion this suite replaced.
+    //
+    // Its first replacement read the deployment back through
+    // /v2/resources/{key}, which was also wrong: that tree serves standalone
+    // resources, and a processDefinitionKey passed to it answers 404. Reading a
+    // deployment back is covered by the process-definition get-by-key and
+    // search tests, so nothing is owed here.
+});
+api_1.test.describe('Resource deletion', () => {
+    (0, api_1.test)('deletes a deployed process definition', async ({ api, resources }) => {
+        const processId = (0, bpmn_1.uniqueId)('resource-delete');
+        const deployResponse = await (0, deployments_1.deployResources)(api, resources, [
+            { name: `${processId}.bpmn`, content: (0, bpmn_1.emptyProcess)(processId) },
+        ]);
+        const json = (await (0, assertions_1.assertOk)(deployResponse));
+        const key = String(json.deployments[0].processDefinition
+            .processDefinitionKey);
+        const response = await api.post('/resources/{resourceKey}/deletion', {
+            params: { resourceKey: key },
+            body: {},
+            tenant: 'none',
+        });
+        // The endpoint answers 200 with a `DeleteResourceResponse` body naming
+        // the deleted resource (and the batch operation that clears its history),
+        // not a bare 204.
+        const deletion = (await (0, assertions_1.assertOk)(response));
+        (0, test_1.expect)(String(deletion.resourceKey)).toBe(key);
+        // The test is the deletion, so cleanup has nothing left to do.
+        resources.forget('resource', key);
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/process-definitions/{processDefinitionKey}', { params: { processDefinitionKey: key } });
+            await (0, assertions_1.assertNotFound)(lookup);
+        });
+    });
+    (0, api_1.test)('rejects deleting an absent resource', async ({ api }) => {
+        const response = await api.post('/resources/{resourceKey}/deletion', {
+            params: { resourceKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: {},
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+});

package/dist/tests/api/v2/document/document-api-tests.spec.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Document store endpoints.
+ *
+ * The shell suite exercised these only from inside its authorization
+ * enforcement block, so on any run where that block did not execute — the
+ * common case, since it was gated on a token fetch — the document endpoints
+ * were never called at all.
+ */
+export {};

package/dist/tests/api/v2/document/document-api-tests.spec.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * Document store endpoints.
+ *
+ * The shell suite exercised these only from inside its authorization
+ * enforcement block, so on any run where that block did not execute — the
+ * common case, since it was gated on a token fetch — the document endpoints
+ * were never called at all.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const config_1 = require("../../../../utils/api/config");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+async function upload(api, content, fileName = `${(0, bpmn_1.uniqueId)('doc')}.txt`) {
+    const multipart = {
+        file: {
+            name: fileName,
+            mimeType: 'text/plain',
+            buffer: Buffer.from(content, 'utf-8'),
+        },
+    };
+    if (config_1.apiConfig.multiTenancy) {
+        multipart.tenantId = config_1.apiConfig.tenantId;
+    }
+    return api.post('/documents', { multipart, tenant: 'none' });
+}
+async function uploadAndTrack(api, content) {
+    const response = await upload(api, content);
+    await (0, assertions_1.assertStatusIn)(response, [201], 'a stored document is reported as created');
+    const json = (await response.json());
+    (0, assertions_1.assertRequiredFields)(json, ['documentId', 'contentHash']);
+    return {
+        documentId: String(json.documentId),
+        contentHash: String(json.contentHash),
+    };
+}
+api_1.test.describe('Documents', () => {
+    (0, api_1.test)('stores a document', async ({ api, resources }) => {
+        const document = await uploadAndTrack(api, 'stored by the API suite');
+        resources.track('document', document.documentId);
+        (0, test_1.expect)(document.documentId).toBeTruthy();
+        (0, test_1.expect)(document.contentHash).toBeTruthy();
+    });
+    (0, api_1.test)('returns the stored content', async ({ api, resources }) => {
+        const content = `payload ${(0, bpmn_1.uniqueId)('body')}`;
+        const document = await uploadAndTrack(api, content);
+        resources.track('document', document.documentId);
+        const response = await api.get('/documents/{documentId}', {
+            params: { documentId: document.documentId },
+            query: { contentHash: document.contentHash },
+            tenant: 'none',
+            headers: { Accept: 'application/octet-stream' },
+        });
+        await (0, assertions_1.assertStatusIn)(response, [200], 'a stored document is retrievable');
+        // The shell suite checked only the status. A download returning the wrong
+        // bytes, or none, would have passed.
+        (0, test_1.expect)(await response.text()).toBe(content);
+    });
+    (0, api_1.test)('rejects a download whose content hash does not match', async ({ api, resources, }) => {
+        const document = await uploadAndTrack(api, 'hash check');
+        resources.track('document', document.documentId);
+        const response = await api.get('/documents/{documentId}', {
+            params: { documentId: document.documentId },
+            query: { contentHash: 'not-the-right-hash' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [400, 404], 'a mismatched content hash is rejected as a bad request or reported as not found');
+    });
+    (0, api_1.test)('deletes a document', async ({ api }) => {
+        const document = await uploadAndTrack(api, 'to be deleted');
+        const response = await api.delete('/documents/{documentId}', {
+            params: { documentId: document.documentId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'deletion is acknowledged');
+        const lookup = await api.get('/documents/{documentId}', {
+            params: { documentId: document.documentId },
+            query: { contentHash: document.contentHash },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(lookup);
+    });
+    (0, api_1.test)('rejects a lookup for an absent document', async ({ api }) => {
+        const response = await api.get('/documents/{documentId}', {
+            params: { documentId: (0, bpmn_1.uniqueId)('absent-document') },
+            query: { contentHash: 'irrelevant' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects an unauthenticated upload', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.post('/documents', {
+            tenant: 'none',
+            authorization: null,
+            multipart: {
+                file: {
+                    name: `${(0, bpmn_1.uniqueId)('doc')}.txt`,
+                    mimeType: 'text/plain',
+                    buffer: Buffer.from('unauthenticated', 'utf-8'),
+                },
+            },
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+});

package/dist/tests/api/v2/element-instance/element-instance-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/element-instance/element-instance-api-tests.spec.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const deployments_1 = require("../../../../utils/api/deployments");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const eventually_1 = require("../../../../utils/api/eventually");
+const keys_1 = require("../../../../utils/api/keys");
+async function startAndAwaitElement(api, resources) {
+    const processId = (0, bpmn_1.uniqueId)('element-instance-api');
+    await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask((0, bpmn_1.uniqueId)('job'))));
+    const start = await api.post('/process-instances', {
+        body: { processDefinitionId: processId },
+        tenant: 'root',
+    });
+    await (0, assertions_1.assertStatusIn)(start, [200], 'instance creation is synchronous');
+    const instance = (await start.json());
+    const processInstanceKey = String(instance.processInstanceKey);
+    const items = await (0, eventually_1.eventuallyGet)(async () => {
+        const response = await api.post('/element-instances/search', {
+            body: {
+                filter: { processInstanceKey, elementId: 'task' },
+                page: { limit: 10 },
+            },
+        });
+        const page = await (0, assertions_1.assertPaginated)(response);
+        return page.items;
+    }, (found) => found.length > 0, { description: `element instances for ${processInstanceKey}` });
+    return {
+        elementInstanceKey: String(items[0].elementInstanceKey),
+        processInstanceKey,
+    };
+}
+api_1.test.describe('Element instances', () => {
+    (0, api_1.test)('finds the active element of a running instance', async ({ api, resources, }) => {
+        const { elementInstanceKey, processInstanceKey } = await startAndAwaitElement(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const response = await api.post('/element-instances/search', {
+            body: { filter: { processInstanceKey, elementId: 'task' } },
+        });
+        const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+        const item = page.items[0];
+        (0, test_1.expect)(String(item.elementInstanceKey)).toBe(elementInstanceKey);
+        (0, test_1.expect)(item.type).toBe('SERVICE_TASK');
+    });
+    (0, api_1.test)('returns an element instance by key', async ({ api, resources }) => {
+        const { elementInstanceKey, processInstanceKey } = await startAndAwaitElement(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const response = await api.get('/element-instances/{elementInstanceKey}', {
+            params: { elementInstanceKey },
+        });
+        const json = (await (0, assertions_1.assertOk)(response));
+        (0, assertions_1.assertRequiredFields)(json, [
+            'elementInstanceKey',
+            'elementId',
+            'state',
+            'processInstanceKey',
+        ]);
+        (0, test_1.expect)(json.elementId).toBe('task');
+        (0, test_1.expect)(json.state).toBe('ACTIVE');
+    });
+    (0, api_1.test)('filters element instances by state', async ({ api, resources }) => {
+        const { processInstanceKey } = await startAndAwaitElement(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const response = await api.post('/element-instances/search', {
+            body: { filter: { processInstanceKey, state: 'ACTIVE' }, page: { limit: 20 } },
+        });
+        const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+        for (const item of page.items) {
+            (0, test_1.expect)(item.state).toBe('ACTIVE');
+        }
+    });
+    (0, api_1.test)('sets a variable on an element instance', async ({ api, resources }) => {
+        const { elementInstanceKey, processInstanceKey } = await startAndAwaitElement(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const response = await api.put('/element-instances/{elementInstanceKey}/variables', {
+            params: { elementInstanceKey },
+            body: { variables: { scoped: 'value' }, local: true },
+            tenant: 'none',
+        });
+        // The shell suite accepted `200 204 400 404 405 501 503` for this call —
+        // seven statuses, including three that mean the endpoint does not exist.
+        await (0, assertions_1.assertStatusIn)(response, [204], 'the variable update is acknowledged once the command is written');
+        await (0, eventually_1.eventually)(async () => {
+            const variables = await api.post('/variables/search', {
+                body: {
+                    filter: { processInstanceKey, name: 'scoped' },
+                    page: { limit: 10 },
+                },
+            });
+            await (0, assertions_1.assertPaginated)(variables, { minItems: 1 });
+        });
+    });
+    (0, api_1.test)('honours the page size on an element-instance search', async ({ api, resources, }) => {
+        const { processInstanceKey } = await startAndAwaitElement(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const response = await api.post('/element-instances/search', {
+            body: { filter: { processInstanceKey }, page: { limit: 1 } },
+        });
+        const page = await (0, assertions_1.assertPaginated)(response, { exactItems: 1 });
+        (0, test_1.expect)(page.items.length).toBe(1);
+    });
+    (0, api_1.test)('rejects a lookup for an absent element instance', async ({ api }) => {
+        const response = await api.get('/element-instances/{elementInstanceKey}', {
+            params: { elementInstanceKey: keys_1.ABSENT_KEY },
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects setting variables on an absent element instance', async ({ api, }) => {
+        // A command, so the key has to reach a real partition — see
+        // `ABSENT_ROUTABLE_KEY`. With the query-side key this asserted the
+        // gateway's router (503, undeliverable) rather than the handler's 404.
+        const response = await api.put('/element-instances/{elementInstanceKey}/variables', {
+            params: { elementInstanceKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: { variables: { a: 1 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects a variable update carrying no variables', async ({ api, resources, }) => {
+        const { elementInstanceKey, processInstanceKey } = await startAndAwaitElement(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const response = await api.put('/element-instances/{elementInstanceKey}/variables', { params: { elementInstanceKey }, body: {}, tenant: 'none' });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+});

package/dist/tests/api/v2/flows/end-to-end-flows.spec.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Multi-step flows spanning several endpoints.
+ *
+ * These correspond to the shell suite's "Integration Test 1-4" (lines
+ * 8386-9353), which tracked their own `INTEGRATION_TEST_N_PASSED` booleans and
+ * incremented TESTS_PASSED by hand — 50 increment sites against 27 failure
+ * sites, so a step could report success with no path that reported failure.
+ */
+export {};