@camunda/e2e-test-suite 0.0.1241 → 0.0.1243

package/dist/tests/api/v2/runtime/variable-incident-api-tests.spec.js

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const deployments_1 = require("../../../../utils/api/deployments");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const eventually_1 = require("../../../../utils/api/eventually");
+const keys_1 = require("../../../../utils/api/keys");
+async function startWithVariables(api, resources, variables) {
+    const processId = (0, bpmn_1.uniqueId)('variable-api');
+    await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask((0, bpmn_1.uniqueId)('job'))));
+    const start = await api.post('/process-instances', {
+        body: { processDefinitionId: processId, variables },
+        tenant: 'root',
+    });
+    await (0, assertions_1.assertStatusIn)(start, [200], 'instance creation is synchronous');
+    const instance = (await start.json());
+    return String(instance.processInstanceKey);
+}
+api_1.test.describe('Variables', () => {
+    (0, api_1.test)('finds a variable set at instance start', async ({ api, resources }) => {
+        const processInstanceKey = await startWithVariables(api, resources, {
+            customerId: 'cust-1',
+        });
+        resources.track('processInstance', processInstanceKey);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/variables/search', {
+                body: {
+                    filter: { processInstanceKey, name: 'customerId' },
+                    page: { limit: 10 },
+                },
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { exactItems: 1 });
+            const item = page.items[0];
+            (0, test_1.expect)(item.name).toBe('customerId');
+            (0, test_1.expect)(item.value).toBe('"cust-1"');
+        });
+    });
+    (0, api_1.test)('returns a variable by key', async ({ api, resources }) => {
+        const processInstanceKey = await startWithVariables(api, resources, {
+            total: 17,
+        });
+        resources.track('processInstance', processInstanceKey);
+        const items = await (0, eventually_1.eventuallyGet)(async () => {
+            const response = await api.post('/variables/search', {
+                body: {
+                    filter: { processInstanceKey, name: 'total' },
+                    page: { limit: 10 },
+                },
+            });
+            return (await (0, assertions_1.assertPaginated)(response)).items;
+        }, (found) => found.length > 0, { description: 'variables' });
+        const response = await api.get('/variables/{variableKey}', {
+            params: { variableKey: String(items[0].variableKey) },
+        });
+        const json = (await (0, assertions_1.assertOk)(response));
+        (0, assertions_1.assertRequiredFields)(json, ['variableKey', 'name', 'value', 'scopeKey']);
+        (0, test_1.expect)(json.name).toBe('total');
+    });
+    (0, api_1.test)('rejects a lookup for an absent variable key', async ({ api }) => {
+        const response = await api.get('/variables/{variableKey}', {
+            params: { variableKey: keys_1.ABSENT_KEY },
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+});
+api_1.test.describe('Incidents', () => {
+    /**
+     * Drives a service task job to zero retries, which is how the engine is made
+     * to raise an incident deterministically. The shell suite instead searched
+     * the cluster for whatever incident happened to exist, so its incident tests
+     * asserted against unrelated runs and passed with `exactItems: 0`.
+     */
+    async function raiseIncident(api, resources) {
+        const processId = (0, bpmn_1.uniqueId)('incident-api');
+        const jobType = (0, bpmn_1.uniqueId)('incident-job');
+        await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask(jobType)));
+        const start = await api.post('/process-instances', {
+            body: { processDefinitionId: processId },
+            tenant: 'root',
+        });
+        await (0, assertions_1.assertStatusIn)(start, [200], 'instance creation is synchronous');
+        const instance = (await start.json());
+        const processInstanceKey = String(instance.processInstanceKey);
+        const jobs = await (0, eventually_1.eventuallyGet)(async () => {
+            const response = await api.post('/jobs/activation', {
+                body: {
+                    type: jobType,
+                    worker: 'api-v2-suite',
+                    maxJobsToActivate: 1,
+                    timeout: 60000,
+                },
+                tenant: 'tenantIds',
+            });
+            const json = (await response.json());
+            return json.jobs ?? [];
+        }, (found) => found.length > 0, { description: 'activated job' });
+        await api.post('/jobs/{jobKey}/failure', {
+            params: { jobKey: String(jobs[0].jobKey) },
+            body: { errorMessage: 'no retries left', retries: 0, retryBackOff: 0 },
+            tenant: 'none',
+        });
+        const incidents = await (0, eventually_1.eventuallyGet)(async () => {
+            const response = await api.post('/incidents/search', {
+                body: { filter: { processInstanceKey }, page: { limit: 10 } },
+            });
+            return (await (0, assertions_1.assertPaginated)(response)).items;
+        }, (found) => found.length > 0, { description: 'incidents' });
+        return { processInstanceKey, incidentKey: String(incidents[0].incidentKey) };
+    }
+    (0, api_1.test)('raises an incident for a job with no retries left', async ({ api, resources, }) => {
+        const { processInstanceKey, incidentKey } = await raiseIncident(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        // `PENDING` is a real state in `IncidentStateEnum`, not an error: an
+        // incident is exported as PENDING and becomes ACTIVE once the engine has
+        // finished raising it. Reading once caught the earlier state.
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/incidents/{incidentKey}', {
+                params: { incidentKey },
+            });
+            const incident = (await (0, assertions_1.assertOk)(response));
+            (0, assertions_1.assertRequiredFields)(incident, [
+                'incidentKey',
+                'processInstanceKey',
+                'errorType',
+                'state',
+            ]);
+            (0, test_1.expect)(incident.state).toBe('ACTIVE');
+            (0, test_1.expect)(String(incident.processInstanceKey)).toBe(processInstanceKey);
+        });
+    });
+    (0, api_1.test)('resolves an incident once its job has retries again', async ({ api, resources, }) => {
+        const { processInstanceKey, incidentKey } = await raiseIncident(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const incident = (await (await api.get('/incidents/{incidentKey}', { params: { incidentKey } })).json());
+        // Resolution retries the element, so the job needs retries first —
+        // otherwise the engine immediately raises the incident again.
+        await api.patch('/jobs/{jobKey}', {
+            params: { jobKey: String(incident.jobKey) },
+            body: { changeset: { retries: 3 } },
+            tenant: 'none',
+        });
+        const response = await api.post('/incidents/{incidentKey}/resolution', {
+            params: { incidentKey },
+            body: {},
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'resolution is acknowledged once the command is written');
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/incidents/search', {
+                body: {
+                    filter: { processInstanceKey, state: 'ACTIVE' },
+                    page: { limit: 10 },
+                },
+            });
+            await (0, assertions_1.assertPaginated)(search, { exactItems: 0 });
+        });
+    });
+    (0, api_1.test)('rejects a lookup for an absent incident key', async ({ api }) => {
+        const response = await api.get('/incidents/{incidentKey}', {
+            params: { incidentKey: keys_1.ABSENT_KEY },
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects resolving an absent incident', async ({ api }) => {
+        const response = await api.post('/incidents/{incidentKey}/resolution', {
+            params: { incidentKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: {},
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+});

package/dist/tests/api/v2/system/clock-api-tests.spec.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Cluster clock endpoints.
+ *
+ * In its own file because it is its own Playwright project: pinning the clock
+ * moves time for **every** caller on the cluster, so these tests cannot share
+ * the parallel window with the rest of the suite. See the `clock` project in
+ * `playwright.api.config.ts` for why a project is what isolates them and what
+ * that costs.
+ *
+ * `mode: 'serial'` is still needed, but only for the reason it can deliver:
+ * ordering the tests *within this file* so two of them do not pin and reset
+ * against each other.
+ *
+ * The shell suite ran these from inside its EXIT trap, after the process exit
+ * code had already been computed — so a clock assertion could not fail the
+ * run, and a crash before the trap left the cluster clock pinned for whatever
+ * ran next.
+ */
+export {};

package/dist/tests/api/v2/system/clock-api-tests.spec.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * Cluster clock endpoints.
+ *
+ * In its own file because it is its own Playwright project: pinning the clock
+ * moves time for **every** caller on the cluster, so these tests cannot share
+ * the parallel window with the rest of the suite. See the `clock` project in
+ * `playwright.api.config.ts` for why a project is what isolates them and what
+ * that costs.
+ *
+ * `mode: 'serial'` is still needed, but only for the reason it can deliver:
+ * ordering the tests *within this file* so two of them do not pin and reset
+ * against each other.
+ *
+ * The shell suite ran these from inside its EXIT trap, after the process exit
+ * code had already been computed — so a clock assertion could not fail the
+ * run, and a crash before the trap left the cluster clock pinned for whatever
+ * ran next.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const assertions_1 = require("../../../../utils/api/assertions");
+const PINNED = Date.parse('2029-01-01T00:00:00Z');
+api_1.test.describe('Clock', () => {
+    api_1.test.describe.configure({ mode: 'serial' });
+    // Asserted, not fire-and-forget: a reset that answers 4xx/5xx leaves the
+    // cluster pinned for everything that follows, and an unchecked response
+    // would let the run continue and fail somewhere with no connection to the
+    // clock.
+    api_1.test.afterEach(async ({ api }) => {
+        const response = await api.post('/clock/reset', {
+            body: {},
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNoContent)(response);
+    });
+    (0, api_1.test)('pins the cluster clock to a timestamp', async ({ api }) => {
+        const response = await api.put('/clock', {
+            body: { timestamp: PINNED },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNoContent)(response);
+    });
+    (0, api_1.test)('resets the cluster clock', async ({ api }) => {
+        await api.put('/clock', {
+            body: { timestamp: PINNED },
+            tenant: 'none',
+        });
+        const response = await api.post('/clock/reset', {
+            body: {},
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNoContent)(response);
+    });
+    (0, api_1.test)('rejects a malformed timestamp', async ({ api }) => {
+        const response = await api.put('/clock', {
+            body: { timestamp: 'not-a-timestamp' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+});

package/dist/tests/api/v2/system/system-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/system/system-api-tests.spec.js

@@ -0,0 +1,183 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const keys_1 = require("../../../../utils/api/keys");
+const config_1 = require("../../../../utils/api/config");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+api_1.test.describe('Usage metrics', () => {
+    const startTime = '2020-01-01T00:00:00.000Z';
+    const endTime = '2030-01-01T00:00:00.000Z';
+    (0, api_1.test)('reports usage metrics for a time range', async ({ api }) => {
+        const response = await api.get('/system/usage-metrics', {
+            tenant: 'none',
+            query: { startTime, endTime },
+        });
+        const json = (await (0, assertions_1.assertOk)(response));
+        (0, assertions_1.assertRequiredFields)(json, ['processInstances', 'decisionInstances']);
+    });
+    (0, api_1.test)('rejects a request with no time range', async ({ api }) => {
+        const response = await api.get('/system/usage-metrics', { tenant: 'none' });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects a malformed timestamp', async ({ api }) => {
+        const response = await api.get('/system/usage-metrics', {
+            tenant: 'none',
+            query: { startTime: 'not-a-date', endTime },
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects a range whose end precedes its start', async ({ api }) => {
+        const response = await api.get('/system/usage-metrics', {
+            tenant: 'none',
+            query: { startTime: endTime, endTime: startTime },
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+});
+// The Clock tests used to live here. They moved to `clock-api-tests.spec.ts`
+// because they pin cluster-wide state and need their own Playwright project to
+// stay out of the parallel window — `mode: 'serial'` here only ordered them
+// against each other, never against the other files.
+api_1.test.describe('Identity read models', () => {
+    (0, api_1.test)('lists tenants', async ({ api }) => {
+        const response = await api.post('/tenants/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertPaginated)(response);
+    });
+    (0, api_1.test)('lists roles', async ({ api }) => {
+        const response = await api.post('/roles/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertPaginated)(response);
+    });
+    (0, api_1.test)('lists groups', async ({ api }) => {
+        const response = await api.post('/groups/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertPaginated)(response);
+    });
+    (0, api_1.test)('lists mapping rules', async ({ api }) => {
+        const response = await api.post('/mapping-rules/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertPaginated)(response);
+    });
+    (0, api_1.test)('lists users', async ({ api }) => {
+        api_1.test.skip(capabilities_1.usersApiUnavailable !== false, capabilities_1.usersApiUnavailable === false ? '' : capabilities_1.usersApiUnavailable);
+        const response = await api.post('/users/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertPaginated)(response);
+    });
+});
+/**
+ * Holds the capability gate used across the identity specs to its word.
+ *
+ * Whichever way the cluster is configured, exactly one of these two runs and
+ * asserts what that configuration means for `/v2/users/**`. If the gate were
+ * ever wrong — a cluster that does serve the API but is read as OIDC — the
+ * matching test here fails, so a mis-set gate costs a red run rather than
+ * silently removing the user coverage it controls.
+ */
+api_1.test.describe('Users API availability', () => {
+    (0, api_1.test)('is closed with a stated reason when the cluster is in OIDC mode', async ({ api, }) => {
+        api_1.test.skip(capabilities_1.usersApiUnavailable === false, 'the cluster serves the Users API');
+        const response = await api.post('/users/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertForbidden)(response, /users api is disabled/i);
+    });
+    (0, api_1.test)('is served when the cluster manages users locally', async ({ api }) => {
+        api_1.test.skip(capabilities_1.usersApiUnavailable !== false, 'the cluster is in OIDC mode');
+        const response = await api.post('/users/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertPaginated)(response);
+    });
+});
+/**
+ * Reports whether this cluster enforces authorization.
+ *
+ * The authorization *enforcement* spec needs two things: a second principal
+ * that holds no roles, and a cluster that actually checks permissions. It
+ * gates on the first. This records the second, because the SM QA clusters do
+ * not enforce — `test`, the client this suite authenticates as, is not one of
+ * the three admin mappings the chart values initialise, yet nothing refuses
+ * it. Without this test that fact lives only in a comment, and a cluster that
+ * silently started or stopped enforcing would look identical.
+ */
+api_1.test.describe('Authorization enforcement', () => {
+    (0, api_1.test)('reports whether the cluster enforces authorization', async ({ api, }, testInfo) => {
+        const enabled = await (0, capabilities_1.readAuthorizationsEnabled)(api);
+        // `enabled` comes back undefined for two unrelated reasons, and naming
+        // the wrong one sends the reader somewhere there is nothing to find.
+        // Before 8.10 the endpoint is not published at all. From 8.10 it is, but
+        // it answers for the *calling principal*, so a cluster that serves /v2
+        // without credentials has no principal for it to answer for: on c8Run
+        // `/v2/authentication/me` refuses an anonymous caller even though the
+        // rest of the tree does not. Either way enforcement being unreadable is
+        // not the same as enforcement being off.
+        api_1.test.skip(enabled === undefined, (0, config_1.atLeastVersion)('8.10')
+            ? 'this cluster does not authenticate the caller, so ' +
+                '/v2/authentication/me/authorizations/search has no principal to ' +
+                'report for — the enforcement state cannot be read here, which ' +
+                'leaves this deployment without the safety net this test is (see ' +
+                'tests/api/README.md)'
+            : 'the cluster does not publish ' +
+                '/v2/authentication/me/authorizations/search (pre-8.10)');
+        testInfo.annotations.push({
+            type: 'authorization enforcement',
+            description: enabled
+                ? 'enabled — an unprivileged principal would be refused, so the ' +
+                    'enforcement spec is meaningful once one is configured'
+                : 'DISABLED — every principal is permitted, so authorization ' +
+                    'enforcement cannot be observed on this cluster no matter what ' +
+                    'second principal is supplied (see tests/api/README.md)',
+        });
+        if (!enabled) {
+            console.warn('Authorization enforcement is DISABLED on this cluster: every ' +
+                'principal is permitted, so the enforcement spec could not observe ' +
+                'a refusal even with SECONDARY_CLIENT_ID set. See ' +
+                'tests/api/README.md for what closing that gap requires.');
+        }
+        // Belt and braces: `readAuthorizationsEnabled` already throws on a 200
+        // whose `authorizationsEnabled` is not a boolean, and on any status that
+        // is neither the answer nor one of the two that mean the cluster cannot
+        // give it. This keeps the contract visible in the test that depends on it.
+        (0, test_1.expect)(typeof enabled).toBe('boolean');
+    });
+});
+api_1.test.describe('Ad-hoc sub-process activities', () => {
+    (0, api_1.test)('rejects activating activities on an absent sub-process', async ({ api, }) => {
+        const response = await api.post('/element-instances/ad-hoc-activities/{adHocSubProcessInstanceKey}/activation', {
+            params: { adHocSubProcessInstanceKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: { elements: [{ elementId: (0, bpmn_1.uniqueId)('activity') }] },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [404], 'an absent ad-hoc sub-process instance is reported as not found');
+    });
+    (0, api_1.test)('rejects an activation request carrying no elements', async ({ api }) => {
+        const response = await api.post('/element-instances/ad-hoc-activities/{adHocSubProcessInstanceKey}/activation', {
+            params: { adHocSubProcessInstanceKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: {},
+            tenant: 'none',
+        });
+        // Validation precedes the existence check, so this is a 400 rather than
+        // the 404 above.
+        (0, test_1.expect)([400, 404]).toContain(response.status());
+        if (response.status() === 400) {
+            await (0, assertions_1.assertBadRequest)(response);
+        }
+    });
+});

package/dist/tests/api/v2/user-task/user-task-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};