@camunda/e2e-test-suite 0.0.1241 → 0.0.1243

package/dist/tests/api/v2/identity/user-api-tests.spec.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const beans_1 = require("../../../../utils/api/beans");
+const eventually_1 = require("../../../../utils/api/eventually");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+async function createUser(api, resources, overrides = {}) {
+    const user = (0, beans_1.newUser)(overrides);
+    await (0, assertions_1.assertCreated)(await api.post('/users', { body: user, tenant: 'none' }));
+    resources.track('user', user.username);
+    return user;
+}
+api_1.test.describe('Users', () => {
+    // Every test below creates or reads a local user. On an OIDC cluster the
+    // whole /v2/users/** tree is turned off, so none of them has a subject.
+    // `system-api-tests.spec.ts` asserts that the tree really is closed there,
+    // so this gate cannot quietly drop coverage if the mode is misread.
+    api_1.test.skip(capabilities_1.usersApiUnavailable !== false, capabilities_1.usersApiUnavailable === false ? '' : capabilities_1.usersApiUnavailable);
+    (0, api_1.test)('creates a user', async ({ api, resources }) => {
+        const user = (0, beans_1.newUser)();
+        const response = await api.post('/users', { body: user, tenant: 'none' });
+        const created = (await (0, assertions_1.assertCreated)(response));
+        (0, assertions_1.assertRequiredFields)(created, beans_1.userRequiredFields);
+        (0, test_1.expect)(created.username).toBe(user.username);
+        (0, test_1.expect)(created.email).toBe(user.email);
+        // A password must never be echoed back by the API.
+        (0, test_1.expect)(created.password).toBeUndefined();
+        resources.track('user', user.username);
+    });
+    (0, api_1.test)('returns a created user by username', async ({ api, resources }) => {
+        const user = await createUser(api, resources);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/users/{username}', {
+                params: { username: user.username },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(response));
+            (0, test_1.expect)(json.username).toBe(user.username);
+            (0, test_1.expect)(json.email).toBe(user.email);
+        });
+    });
+    (0, api_1.test)('updates a user profile', async ({ api, resources }) => {
+        const user = await createUser(api, resources);
+        const updatedName = `Updated ${user.name}`;
+        const response = await api.put('/users/{username}', {
+            params: { username: user.username },
+            body: { name: updatedName, email: user.email },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [200, 204], 'the update returns the user on 8.8+ and an empty body on earlier minors');
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/users/{username}', {
+                params: { username: user.username },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(lookup));
+            (0, test_1.expect)(json.name).toBe(updatedName);
+        });
+    });
+    (0, api_1.test)('finds a created user through search', async ({ api, resources }) => {
+        const user = await createUser(api, resources);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/users/search', {
+                body: { filter: { username: user.username }, page: { limit: 10 } },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertPaginated)(response, { exactItems: 1 });
+        });
+    });
+    (0, api_1.test)('deletes a user', async ({ api, resources }) => {
+        const user = await createUser(api, resources);
+        const response = await api.delete('/users/{username}', {
+            params: { username: user.username },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'deletion is acknowledged');
+        resources.forget('user', user.username);
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/users/{username}', {
+                params: { username: user.username },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertNotFound)(lookup);
+        });
+    });
+    // There is no /users/{username}/roles|groups|tenants sub-search on any
+    // supported version — membership is only queryable from the owning side.
+    // The two tests that stood here asserted `exactItems: 0` against a 404 from
+    // an unrouted path, so neither could report anything. Role, group and
+    // tenant membership is asserted in role-api-tests, group-api-tests and
+    // tenant-api-tests, each through the endpoint that exists.
+    (0, api_1.test)('rejects a username that already exists', async ({ api, resources }) => {
+        const user = await createUser(api, resources);
+        const response = await api.post('/users', {
+            body: (0, beans_1.newUser)({ username: user.username }),
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertConflict)(response);
+    });
+    (0, api_1.test)('rejects a malformed email address', async ({ api }) => {
+        const response = await api.post('/users', {
+            body: (0, beans_1.newUser)({ email: 'not-an-email' }),
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response, /email/i);
+    });
+    (0, api_1.test)('rejects a user with no password', async ({ api }) => {
+        const user = (0, beans_1.newUser)();
+        delete user.password;
+        const response = await api.post('/users', { body: user, tenant: 'none' });
+        await (0, assertions_1.assertBadRequest)(response, /password/i);
+    });
+    (0, api_1.test)('rejects updating an absent user', async ({ api }) => {
+        const response = await api.put('/users/{username}', {
+            params: { username: (0, bpmn_1.uniqueId)('absent-user') },
+            body: { name: 'does not exist', email: 'nobody@example.com' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects a lookup for an absent user', async ({ api }) => {
+        const response = await api.get('/users/{username}', {
+            params: { username: (0, bpmn_1.uniqueId)('absent-user') },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+});
+// Outside the capability gate above: the security filter chain answers before
+// the OIDC endpoint filter does, so an unauthenticated call is rejected with
+// 401 whether or not the cluster serves the Users API. That holds in both
+// modes and is worth asserting in both.
+api_1.test.describe('Users, unauthenticated', () => {
+    (0, api_1.test)('rejects an unauthenticated user creation', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.post('/users', {
+            body: (0, beans_1.newUser)(),
+            tenant: 'none',
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+});

package/dist/tests/api/v2/job/job-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/job/job-api-tests.spec.js

@@ -0,0 +1,260 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const deployments_1 = require("../../../../utils/api/deployments");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const eventually_1 = require("../../../../utils/api/eventually");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+const keys_1 = require("../../../../utils/api/keys");
+/**
+ * Deploys a one-service-task process, starts `count` instances of it, and
+ * activates the resulting jobs.
+ *
+ * Each test gets its own job type. The shell suite shared one type across the
+ * whole job section, picked by searching the cluster for `.items[0].type` —
+ * so it could activate a job another part of the run was relying on, and its
+ * per-job tests were index-dependent (`ACTIVE_JOB_KEYS[0]` completed,
+ * `[1]` failed, and so on), which made any shortfall silently skip tests.
+ */
+async function activateJobs(api, resources, count) {
+    const processId = (0, bpmn_1.uniqueId)('job-api');
+    const jobType = (0, bpmn_1.uniqueId)('job-type');
+    await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask(jobType)));
+    const instanceKeys = [];
+    for (let i = 0; i < count; i++) {
+        const response = await api.post('/process-instances', {
+            body: { processDefinitionId: processId },
+            tenant: 'root',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [200], 'instance creation is synchronous');
+        const json = (await response.json());
+        instanceKeys.push(String(json.processInstanceKey));
+    }
+    const jobs = await (0, eventually_1.eventuallyGet)(async () => {
+        const response = await api.post('/jobs/activation', {
+            body: {
+                type: jobType,
+                worker: 'api-v2-suite',
+                maxJobsToActivate: count,
+                timeout: 60000,
+            },
+            tenant: 'tenantIds',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [200], 'activation is synchronous');
+        const json = (await response.json());
+        return json.jobs ?? [];
+    }, (activated) => activated.length >= count, { description: `jobs of type ${jobType}` });
+    return { jobType, jobs, instanceKeys };
+}
+api_1.test.describe('Jobs', () => {
+    (0, api_1.test)('activates jobs created by a service task', async ({ api, resources }) => {
+        const { jobType, jobs, instanceKeys } = await activateJobs(api, resources, 2);
+        instanceKeys.forEach((key) => resources.track('processInstance', key));
+        (0, test_1.expect)(jobs.length).toBe(2);
+        for (const job of jobs) {
+            (0, assertions_1.assertRequiredFields)(job, [
+                'jobKey',
+                'type',
+                'processInstanceKey',
+                'retries',
+            ]);
+            (0, test_1.expect)(job.type).toBe(jobType);
+        }
+    });
+    (0, api_1.test)('completes an activated job', async ({ api, resources }) => {
+        const { jobs, instanceKeys } = await activateJobs(api, resources, 1);
+        instanceKeys.forEach((key) => resources.track('processInstance', key));
+        const response = await api.post('/jobs/{jobKey}/completion', {
+            params: { jobKey: jobs[0].jobKey },
+            body: { variables: { result: 'success' } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'completion is acknowledged once the command is written');
+        // Completing the only task lets the instance run to its end event.
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/process-instances/search', {
+                body: { filter: { processInstanceKey: instanceKeys[0] } },
+            });
+            const page = await (0, assertions_1.assertPaginated)(search, { exactItems: 1 });
+            (0, test_1.expect)(page.items[0].state).toBe('COMPLETED');
+        });
+    });
+    (0, api_1.test)('fails an activated job and decrements its retries', async ({ api, resources, }) => {
+        const { jobs, instanceKeys } = await activateJobs(api, resources, 1);
+        instanceKeys.forEach((key) => resources.track('processInstance', key));
+        const response = await api.post('/jobs/{jobKey}/failure', {
+            params: { jobKey: jobs[0].jobKey },
+            body: { errorMessage: 'deliberate failure', retries: 1, retryBackOff: 0 },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'failure is acknowledged once the command is written');
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/jobs/search', {
+                body: { filter: { jobKey: jobs[0].jobKey }, page: { limit: 10 } },
+            });
+            const page = await (0, assertions_1.assertPaginated)(search, { minItems: 1 });
+            (0, test_1.expect)(page.items[0].retries).toBe(1);
+        });
+    });
+    (0, api_1.test)('raises an incident when a job fails with no retries left', async ({ api, resources, }) => {
+        const { jobs, instanceKeys } = await activateJobs(api, resources, 1);
+        instanceKeys.forEach((key) => resources.track('processInstance', key));
+        const response = await api.post('/jobs/{jobKey}/failure', {
+            params: { jobKey: jobs[0].jobKey },
+            body: { errorMessage: 'exhausted', retries: 0, retryBackOff: 0 },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'failure is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/incidents/search', {
+                body: {
+                    filter: { processInstanceKey: instanceKeys[0] },
+                    page: { limit: 10 },
+                },
+            });
+            const page = await (0, assertions_1.assertPaginated)(search, { minItems: 1 });
+            (0, test_1.expect)(page.items[0].state).toBe('ACTIVE');
+        });
+    });
+    (0, api_1.test)('updates job retries through a patch', async ({ api, resources }) => {
+        const { jobs, instanceKeys } = await activateJobs(api, resources, 1);
+        instanceKeys.forEach((key) => resources.track('processInstance', key));
+        const response = await api.patch('/jobs/{jobKey}', {
+            params: { jobKey: jobs[0].jobKey },
+            body: { changeset: { retries: 5 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'the patch is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/jobs/search', {
+                body: { filter: { jobKey: jobs[0].jobKey }, page: { limit: 10 } },
+            });
+            const page = await (0, assertions_1.assertPaginated)(search, { minItems: 1 });
+            (0, test_1.expect)(page.items[0].retries).toBe(5);
+        });
+    });
+    (0, api_1.test)('throws a business error for an activated job', async ({ api, resources, }) => {
+        const { jobs, instanceKeys } = await activateJobs(api, resources, 1);
+        instanceKeys.forEach((key) => resources.track('processInstance', key));
+        const response = await api.post('/jobs/{jobKey}/error', {
+            params: { jobKey: jobs[0].jobKey },
+            body: { errorCode: 'E_TEST', errorMessage: 'thrown by the API suite' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'the error is acknowledged');
+        // No boundary event catches E_TEST, so the engine raises an incident.
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/incidents/search', {
+                body: {
+                    filter: { processInstanceKey: instanceKeys[0] },
+                    page: { limit: 10 },
+                },
+            });
+            await (0, assertions_1.assertPaginated)(search, { minItems: 1 });
+        });
+    });
+    (0, api_1.test)('filters a job search by type', async ({ api, resources }) => {
+        const { jobType, instanceKeys } = await activateJobs(api, resources, 1);
+        instanceKeys.forEach((key) => resources.track('processInstance', key));
+        // `/jobs/search` is `x-eventually-consistent: true`: activation is a
+        // command against the engine, while the search reads the exported index,
+        // so a job is activatable before it is searchable.
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/jobs/search', {
+                body: { filter: { type: jobType }, page: { limit: 20 } },
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            for (const item of page.items) {
+                (0, test_1.expect)(item.type).toBe(jobType);
+            }
+        });
+    });
+    (0, api_1.test)('honours the page size on a job search', async ({ api, resources }) => {
+        const { jobType, instanceKeys } = await activateJobs(api, resources, 2);
+        instanceKeys.forEach((key) => resources.track('processInstance', key));
+        // Wait for both jobs to be indexed before asserting the page size, or a
+        // limit of 1 over an index holding 0 rows passes for the wrong reason.
+        await (0, eventually_1.eventually)(async () => {
+            const all = await api.post('/jobs/search', {
+                body: { filter: { type: jobType }, page: { limit: 20 } },
+            });
+            await (0, assertions_1.assertPaginated)(all, { minItems: 2 });
+        });
+        const response = await api.post('/jobs/search', {
+            body: { filter: { type: jobType }, page: { limit: 1 } },
+        });
+        await (0, assertions_1.assertPaginated)(response, { exactItems: 1 });
+    });
+    (0, api_1.test)('returns no jobs for an unknown job type', async ({ api }) => {
+        const response = await api.post('/jobs/activation', {
+            body: {
+                type: (0, bpmn_1.uniqueId)('never-deployed'),
+                worker: 'api-v2-suite',
+                maxJobsToActivate: 5,
+                timeout: 10000,
+            },
+            tenant: 'tenantIds',
+        });
+        const json = (await (0, assertions_1.assertOk)(response));
+        // The shell suite asserted only the 200 here, which a response carrying
+        // somebody else's jobs would also satisfy.
+        (0, test_1.expect)(json.jobs).toEqual([]);
+    });
+    (0, api_1.test)('rejects an activation request with no job type', async ({ api }) => {
+        const response = await api.post('/jobs/activation', {
+            body: { worker: 'api-v2-suite', maxJobsToActivate: 1, timeout: 10000 },
+            tenant: 'tenantIds',
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects completing an absent job', async ({ api }) => {
+        const response = await api.post('/jobs/{jobKey}/completion', {
+            params: { jobKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: { variables: {} },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects failing an absent job', async ({ api }) => {
+        const response = await api.post('/jobs/{jobKey}/failure', {
+            params: { jobKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: { errorMessage: 'nope', retries: 1 },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects throwing an error for an absent job', async ({ api }) => {
+        const response = await api.post('/jobs/{jobKey}/error', {
+            params: { jobKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: { errorCode: 'E_TEST' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects patching an absent job', async ({ api }) => {
+        const response = await api.patch('/jobs/{jobKey}', {
+            params: { jobKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: { changeset: { retries: 3 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects an unauthenticated activation', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.post('/jobs/activation', {
+            body: {
+                type: (0, bpmn_1.uniqueId)('job'),
+                worker: 'api-v2-suite',
+                maxJobsToActivate: 1,
+                timeout: 10000,
+            },
+            tenant: 'tenantIds',
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+});

package/dist/tests/api/v2/message/message-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/message/message-api-tests.spec.js

@@ -0,0 +1,219 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const deployments_1 = require("../../../../utils/api/deployments");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const eventually_1 = require("../../../../utils/api/eventually");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+/** Deploys a process that waits on a correlated message and starts it. */
+async function startWaitingInstance(api, resources) {
+    const processId = (0, bpmn_1.uniqueId)('message-api');
+    const messageName = (0, bpmn_1.uniqueId)('message');
+    const correlationKey = (0, bpmn_1.uniqueId)('correlation');
+    await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.messageCatch(messageName)));
+    const start = await api.post('/process-instances', {
+        body: {
+            processDefinitionId: processId,
+            variables: { msgCorrelationKey: correlationKey },
+        },
+        tenant: 'root',
+    });
+    await (0, assertions_1.assertStatusIn)(start, [200], 'instance creation is synchronous');
+    const instance = (await start.json());
+    return {
+        messageName,
+        correlationKey,
+        processInstanceKey: String(instance.processInstanceKey),
+    };
+}
+api_1.test.describe('Messages', () => {
+    (0, api_1.test)('publishes a message', async ({ api }) => {
+        const response = await api.post('/messages/publication', {
+            body: {
+                name: (0, bpmn_1.uniqueId)('publish'),
+                correlationKey: (0, bpmn_1.uniqueId)('key'),
+                timeToLive: 10000,
+            },
+            tenant: 'root',
+        });
+        const json = (await (0, assertions_1.assertOk)(response));
+        (0, assertions_1.assertRequiredFields)(json, ['messageKey']);
+    });
+    (0, api_1.test)('publishes a message carrying variables', async ({ api }) => {
+        const response = await api.post('/messages/publication', {
+            body: {
+                name: (0, bpmn_1.uniqueId)('publish-vars'),
+                correlationKey: (0, bpmn_1.uniqueId)('key'),
+                timeToLive: 10000,
+                variables: { orderId: 'order-7' },
+            },
+            tenant: 'root',
+        });
+        await (0, assertions_1.assertOk)(response);
+    });
+    (0, api_1.test)('correlates a message to a waiting instance', async ({ api, resources, }) => {
+        const { messageName, correlationKey, processInstanceKey } = await startWaitingInstance(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        // The subscription must exist before correlation, otherwise the API
+        // correctly reports that nothing is waiting.
+        await (0, eventually_1.eventually)(async () => {
+            const subscriptions = await api.post('/message-subscriptions/search', {
+                body: { filter: { processInstanceKey }, page: { limit: 10 } },
+            });
+            await (0, assertions_1.assertPaginated)(subscriptions, { minItems: 1 });
+        });
+        const response = await api.post('/messages/correlation', {
+            body: { name: messageName, correlationKey, variables: { answer: 42 } },
+            tenant: 'root',
+        });
+        const json = (await (0, assertions_1.assertOk)(response));
+        (0, assertions_1.assertRequiredFields)(json, ['messageKey', 'processInstanceKey']);
+        (0, test_1.expect)(String(json.processInstanceKey)).toBe(processInstanceKey);
+        // Correlation releases the catch event, so the instance runs to its end.
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/process-instances/search', {
+                body: { filter: { processInstanceKey } },
+            });
+            const page = await (0, assertions_1.assertPaginated)(search, { exactItems: 1 });
+            (0, test_1.expect)(page.items[0].state).toBe('COMPLETED');
+        });
+    });
+    (0, api_1.test)('reports that no instance awaits an uncorrelatable message', async ({ api, }) => {
+        const response = await api.post('/messages/correlation', {
+            body: {
+                name: (0, bpmn_1.uniqueId)('nobody-waiting'),
+                correlationKey: (0, bpmn_1.uniqueId)('key'),
+            },
+            tenant: 'root',
+        });
+        // The shell suite accepted `200 404` here, which passes whether or not
+        // anything correlated.
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects publishing a message with no name', async ({ api }) => {
+        const response = await api.post('/messages/publication', {
+            body: { correlationKey: (0, bpmn_1.uniqueId)('key') },
+            tenant: 'root',
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects correlating a message with no name', async ({ api }) => {
+        const response = await api.post('/messages/correlation', {
+            body: { correlationKey: (0, bpmn_1.uniqueId)('key') },
+            tenant: 'root',
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects an unauthenticated publication', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.post('/messages/publication', {
+            body: { name: (0, bpmn_1.uniqueId)('unauth'), correlationKey: (0, bpmn_1.uniqueId)('key') },
+            tenant: 'root',
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+    (0, api_1.test)('rejects an unauthenticated correlation', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.post('/messages/correlation', {
+            body: { name: (0, bpmn_1.uniqueId)('unauth'), correlationKey: (0, bpmn_1.uniqueId)('key') },
+            tenant: 'root',
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+});
+api_1.test.describe('Message subscriptions', () => {
+    (0, api_1.test)('lists the subscription opened by a waiting instance', async ({ api, resources, }) => {
+        const { messageName, processInstanceKey } = await startWaitingInstance(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/message-subscriptions/search', {
+                body: { filter: { processInstanceKey }, page: { limit: 10 } },
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            const item = page.items[0];
+            (0, test_1.expect)(item.messageName).toBe(messageName);
+        });
+    });
+    (0, api_1.test)('filters subscriptions by message name', async ({ api, resources }) => {
+        const { messageName, processInstanceKey } = await startWaitingInstance(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/message-subscriptions/search', {
+                body: { filter: { messageName }, page: { limit: 10 } },
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            for (const item of page.items) {
+                (0, test_1.expect)(item.messageName).toBe(messageName);
+            }
+        });
+    });
+    (0, api_1.test)('records a correlated subscription after correlation', async ({ api, resources, }) => {
+        const { messageName, correlationKey, processInstanceKey } = await startWaitingInstance(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        await (0, eventually_1.eventually)(async () => {
+            const subscriptions = await api.post('/message-subscriptions/search', {
+                body: { filter: { processInstanceKey }, page: { limit: 10 } },
+            });
+            await (0, assertions_1.assertPaginated)(subscriptions, { minItems: 1 });
+        });
+        await api.post('/messages/correlation', {
+            body: { name: messageName, correlationKey },
+            tenant: 'root',
+        });
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/correlated-message-subscriptions/search', { body: { filter: { processInstanceKey }, page: { limit: 10 } } });
+            await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+        });
+    });
+});
+api_1.test.describe('Signals', () => {
+    (0, api_1.test)('broadcasts a signal', async ({ api }) => {
+        const response = await api.post('/signals/broadcast', {
+            body: { signalName: (0, bpmn_1.uniqueId)('signal') },
+            tenant: 'root',
+        });
+        const json = (await (0, assertions_1.assertOk)(response));
+        (0, assertions_1.assertRequiredFields)(json, ['signalKey']);
+    });
+    (0, api_1.test)('broadcasts a signal carrying variables', async ({ api }) => {
+        const response = await api.post('/signals/broadcast', {
+            body: { signalName: (0, bpmn_1.uniqueId)('signal'), variables: { source: 'api-suite' } },
+            tenant: 'root',
+        });
+        await (0, assertions_1.assertOk)(response);
+    });
+    (0, api_1.test)('rejects a broadcast with no signal name', async ({ api }) => {
+        // `signalName` is `required` in the request schema, so omitting it is a
+        // contract violation and a documented 400.
+        //
+        // An *empty* name is not: the schema sets no `minLength` and the server
+        // adds no check, so `{signalName: ''}` is accepted and returns a signal
+        // key. That is arguably wrong — no catch event can ever match it — but it
+        // is what the API currently promises, and a test asserting otherwise
+        // would be asserting an inference rather than the contract.
+        const response = await api.post('/signals/broadcast', {
+            body: {},
+            tenant: 'root',
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects an unauthenticated broadcast', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.post('/signals/broadcast', {
+            body: { signalName: (0, bpmn_1.uniqueId)('signal') },
+            tenant: 'root',
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+});

package/dist/tests/api/v2/process-definition/process-definition-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};