@camunda/e2e-test-suite 0.0.1242 → 0.0.1243

package/dist/tests/api/v2/form/form-api-tests.spec.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const deployments_1 = require("../../../../utils/api/deployments");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const config_1 = require("../../../../utils/api/config");
+const eventually_1 = require("../../../../utils/api/eventually");
+const keys_1 = require("../../../../utils/api/keys");
+async function deployForm(api, resources, formId) {
+    const response = await (0, deployments_1.deployResources)(api, resources, [
+        {
+            name: `${formId}.form`,
+            content: (0, bpmn_1.simpleForm)(formId),
+            mimeType: 'application/json',
+        },
+    ]);
+    await (0, assertions_1.assertStatusIn)(response, [200], 'deployment is synchronous');
+    const json = (await response.json());
+    const deployment = json.deployments.find((entry) => entry.form !== undefined);
+    (0, test_1.expect)(deployment, `deployment response carried no form: ${JSON.stringify(json)}`).toBeTruthy();
+    const form = deployment.form;
+    return { formKey: String(form.formKey), version: Number(form.version) };
+}
+api_1.test.describe('Forms', () => {
+    (0, api_1.test)('deploys a form', async ({ api, resources }) => {
+        const formId = (0, bpmn_1.uniqueId)('form-api');
+        const { formKey, version } = await deployForm(api, resources, formId);
+        (0, test_1.expect)(formKey).toBeTruthy();
+        (0, test_1.expect)(version).toBe(1);
+    });
+    // `GET /v2/forms/{formKey}` is published from 8.10; before that the whole
+    // /v2/forms prefix is unrouted. Registered conditionally rather than run
+    // everywhere, because on 8.8 and 8.9 the absent-key case would answer 404
+    // for the wrong reason and pass without exercising anything.
+    if ((0, config_1.atLeastVersion)('8.10')) {
+        (0, api_1.test)('returns a deployed form by key', async ({ api, resources }) => {
+            const formId = (0, bpmn_1.uniqueId)('form-lookup');
+            const { formKey } = await deployForm(api, resources, formId);
+            await (0, eventually_1.eventually)(async () => {
+                const response = await api.get('/forms/{formKey}', { params: { formKey } });
+                const form = (await (0, assertions_1.assertOk)(response));
+                (0, assertions_1.assertRequiredFields)(form, ['formKey', 'formId', 'version', 'schema']);
+                (0, test_1.expect)(form.formId).toBe(formId);
+            });
+        });
+        (0, api_1.test)('rejects a lookup for an absent form key', async ({ api }) => {
+            const response = await api.get('/forms/{formKey}', {
+                params: { formKey: keys_1.ABSENT_KEY },
+            });
+            await (0, assertions_1.assertNotFound)(response);
+        });
+    }
+    // Covered on every minor: a start form reached through the definition,
+    // which is the only form endpoint 8.8 and 8.9 serve.
+    (0, api_1.test)('returns the start form linked to a process definition', async ({ api, resources, }) => {
+        const formId = (0, bpmn_1.uniqueId)('form-linked');
+        const processId = (0, bpmn_1.uniqueId)('form-linked-process');
+        await deployForm(api, resources, formId);
+        const deployed = await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.startFormProcess)(processId, formId));
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/process-definitions/{processDefinitionKey}/form', { params: { processDefinitionKey: deployed.processDefinitionKey } });
+            const form = (await (0, assertions_1.assertOk)(response));
+            (0, test_1.expect)(form.formId).toBe(formId);
+            (0, test_1.expect)(String(form.schema)).toContain('fieldOne');
+        });
+    });
+});
+api_1.test.describe('Setup', () => {
+    (0, api_1.test)('refuses to bootstrap a first user on a configured cluster', async ({ api, }) => {
+        const username = (0, bpmn_1.uniqueId)('setup-user');
+        const response = await api.post('/setup/user', {
+            body: {
+                username,
+                password: 'SetupPass123!',
+                email: `${username}@example.com`,
+                name: 'Setup test user',
+            },
+            tenant: 'none',
+        });
+        // This endpoint bootstraps the first administrator. Every cluster this
+        // suite runs against is already configured, so the correct answer is a
+        // refusal. The shell suite expected `200 201 400 403 409` — every possible
+        // outcome, including quietly creating an unmanaged admin account.
+        await (0, assertions_1.assertStatusIn)(response, [403], 'initial setup is closed once a cluster has an administrator');
+    });
+});

package/dist/tests/api/v2/identity/group-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/identity/group-api-tests.spec.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const beans_1 = require("../../../../utils/api/beans");
+const identity_1 = require("../../../../utils/api/identity");
+const eventually_1 = require("../../../../utils/api/eventually");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+async function createGroup(api, resources) {
+    const group = (0, beans_1.newGroup)();
+    await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+    resources.track('group', group.groupId);
+    return group;
+}
+api_1.test.describe('Groups', () => {
+    (0, api_1.test)('creates a group', async ({ api, resources }) => {
+        const group = (0, beans_1.newGroup)();
+        const response = await api.post('/groups', {
+            body: group,
+            tenant: 'none',
+        });
+        const created = (await (0, assertions_1.assertCreated)(response));
+        (0, assertions_1.assertRequiredFields)(created, beans_1.groupRequiredFields);
+        (0, test_1.expect)(created.groupId).toBe(group.groupId);
+        resources.track('group', group.groupId);
+    });
+    (0, api_1.test)('returns a created group by id', async ({ api, resources }) => {
+        const group = await createGroup(api, resources);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/groups/{groupId}', {
+                params: { groupId: group.groupId },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(response));
+            (0, test_1.expect)(json.groupId).toBe(group.groupId);
+            (0, test_1.expect)(json.name).toBe(group.name);
+        });
+    });
+    (0, api_1.test)('updates a group', async ({ api, resources }) => {
+        const group = await createGroup(api, resources);
+        const updatedName = `Updated ${group.name}`;
+        const response = await api.put('/groups/{groupId}', {
+            params: { groupId: group.groupId },
+            body: { name: updatedName, description: 'updated by the API suite' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [200, 204], 'the update returns the group on 8.8+ and an empty body on earlier minors');
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/groups/{groupId}', {
+                params: { groupId: group.groupId },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(lookup));
+            (0, test_1.expect)(json.name).toBe(updatedName);
+        });
+    });
+    (0, api_1.test)('finds a created group through search', async ({ api, resources }) => {
+        const group = await createGroup(api, resources);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/groups/search', {
+                body: { filter: { groupId: group.groupId }, page: { limit: 10 } },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertPaginated)(response, { exactItems: 1 });
+        });
+    });
+    (0, api_1.test)('deletes a group', async ({ api, resources }) => {
+        const group = await createGroup(api, resources);
+        const response = await api.delete('/groups/{groupId}', {
+            params: { groupId: group.groupId },
+            tenant: 'none',
+        });
+        // The shell suite accepted `204 404 500` for group deletion, so a server
+        // fault on delete was a pass.
+        await (0, assertions_1.assertStatusIn)(response, [204], 'deletion is acknowledged');
+        resources.forget('group', group.groupId);
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/groups/{groupId}', {
+                params: { groupId: group.groupId },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertNotFound)(lookup);
+        });
+    });
+    (0, api_1.test)('assigns and removes a user', async ({ api, resources }) => {
+        const group = await createGroup(api, resources);
+        const username = await (0, identity_1.provisionUsername)(api, resources);
+        const assign = await api.put('/groups/{groupId}/users/{username}', {
+            params: { groupId: group.groupId, username },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(assign, [204], 'assignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/groups/{groupId}/users/search', {
+                params: { groupId: group.groupId },
+                body: { page: { limit: 20 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            const usernames = page.items.map((item) => item.username);
+            (0, test_1.expect)(usernames).toContain(username);
+        });
+        const remove = await api.delete('/groups/{groupId}/users/{username}', {
+            params: { groupId: group.groupId, username },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(remove, [204], 'removal is acknowledged');
+    });
+    (0, api_1.test)('lists the roles a group holds', async ({ api, resources }) => {
+        const group = await createGroup(api, resources);
+        const response = await api.post('/groups/{groupId}/roles/search', {
+            params: { groupId: group.groupId },
+            body: { page: { limit: 20 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertPaginated)(response, { exactItems: 0 });
+    });
+    (0, api_1.test)('rejects a group whose id already exists', async ({ api, resources }) => {
+        const group = await createGroup(api, resources);
+        const response = await api.post('/groups', {
+            body: (0, beans_1.newGroup)({ groupId: group.groupId }),
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertConflict)(response);
+    });
+    (0, api_1.test)('rejects a group with no name', async ({ api }) => {
+        const response = await api.post('/groups', {
+            body: { groupId: (0, bpmn_1.uniqueId)('group') },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response, /name/i);
+    });
+    (0, api_1.test)('rejects updating an absent group', async ({ api }) => {
+        const response = await api.put('/groups/{groupId}', {
+            params: { groupId: (0, bpmn_1.uniqueId)('absent-group') },
+            body: { name: 'does not exist' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects a lookup for an absent group', async ({ api }) => {
+        const response = await api.get('/groups/{groupId}', {
+            params: { groupId: (0, bpmn_1.uniqueId)('absent-group') },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects assigning a user to an absent group', async ({ api, resources, }) => {
+        const username = await (0, identity_1.provisionUsername)(api, resources);
+        const response = await api.put('/groups/{groupId}/users/{username}', {
+            params: {
+                groupId: (0, bpmn_1.uniqueId)('absent-group'),
+                username,
+            },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects an unauthenticated group creation', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.post('/groups', {
+            body: (0, beans_1.newGroup)(),
+            tenant: 'none',
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+});

package/dist/tests/api/v2/identity/membership-api-tests.spec.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Client and mapping-rule membership across roles, groups and tenants.
+ *
+ * Clients are not created through this API on an OIDC cluster — they come from
+ * the identity provider — so these tests assert the membership endpoints
+ * against a client id that need not resolve to a real client. That matches what
+ * the endpoints do: they record an association, and the association is what is
+ * read back.
+ */
+export {};

package/dist/tests/api/v2/identity/membership-api-tests.spec.js

@@ -0,0 +1,164 @@
+"use strict";
+/**
+ * Client and mapping-rule membership across roles, groups and tenants.
+ *
+ * Clients are not created through this API on an OIDC cluster — they come from
+ * the identity provider — so these tests assert the membership endpoints
+ * against a client id that need not resolve to a real client. That matches what
+ * the endpoints do: they record an association, and the association is what is
+ * read back.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const beans_1 = require("../../../../utils/api/beans");
+const eventually_1 = require("../../../../utils/api/eventually");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+api_1.test.describe('Role membership for clients and mapping rules', () => {
+    (0, api_1.test)('assigns and removes a client', async ({ api, resources }) => {
+        const role = (0, beans_1.newRole)();
+        await (0, assertions_1.assertCreated)(await api.post('/roles', { body: role, tenant: 'none' }));
+        resources.track('role', role.roleId);
+        const clientId = (0, bpmn_1.uniqueId)('client');
+        const assign = await api.put('/roles/{roleId}/clients/{clientId}', {
+            params: { roleId: role.roleId, clientId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(assign, [204], 'assignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/roles/{roleId}/clients/search', {
+                params: { roleId: role.roleId },
+                body: { page: { limit: 20 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            const clientIds = page.items.map((item) => item.clientId);
+            (0, test_1.expect)(clientIds).toContain(clientId);
+        });
+        const remove = await api.delete('/roles/{roleId}/clients/{clientId}', {
+            params: { roleId: role.roleId, clientId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(remove, [204], 'removal is acknowledged');
+    });
+    (0, api_1.test)('assigns and removes a mapping rule', async ({ api, resources }) => {
+        const role = (0, beans_1.newRole)();
+        await (0, assertions_1.assertCreated)(await api.post('/roles', { body: role, tenant: 'none' }));
+        resources.track('role', role.roleId);
+        const rule = (0, beans_1.newMappingRule)();
+        await (0, assertions_1.assertCreated)(await api.post('/mapping-rules', { body: rule, tenant: 'none' }));
+        resources.track('mappingRule', rule.mappingRuleId);
+        const assign = await api.put('/roles/{roleId}/mapping-rules/{mappingRuleId}', {
+            params: { roleId: role.roleId, mappingRuleId: rule.mappingRuleId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(assign, [204], 'assignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/roles/{roleId}/mapping-rules/search', {
+                params: { roleId: role.roleId },
+                body: { page: { limit: 20 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            const ruleIds = page.items.map((item) => item.mappingRuleId);
+            (0, test_1.expect)(ruleIds).toContain(rule.mappingRuleId);
+        });
+        const remove = await api.delete('/roles/{roleId}/mapping-rules/{mappingRuleId}', {
+            params: { roleId: role.roleId, mappingRuleId: rule.mappingRuleId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(remove, [204], 'removal is acknowledged');
+    });
+    (0, api_1.test)('rejects assigning a client to an absent role', async ({ api }) => {
+        const response = await api.put('/roles/{roleId}/clients/{clientId}', {
+            params: { roleId: (0, bpmn_1.uniqueId)('absent-role'), clientId: (0, bpmn_1.uniqueId)('client') },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+});
+api_1.test.describe('Group membership for clients and mapping rules', () => {
+    (0, api_1.test)('assigns and removes a client', async ({ api, resources }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const clientId = (0, bpmn_1.uniqueId)('client');
+        const assign = await api.put('/groups/{groupId}/clients/{clientId}', {
+            params: { groupId: group.groupId, clientId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(assign, [204], 'assignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/groups/{groupId}/clients/search', {
+                params: { groupId: group.groupId },
+                body: { page: { limit: 20 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            const clientIds = page.items.map((item) => item.clientId);
+            (0, test_1.expect)(clientIds).toContain(clientId);
+        });
+        const remove = await api.delete('/groups/{groupId}/clients/{clientId}', {
+            params: { groupId: group.groupId, clientId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(remove, [204], 'removal is acknowledged');
+    });
+    (0, api_1.test)('assigns and removes a mapping rule', async ({ api, resources }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const rule = (0, beans_1.newMappingRule)();
+        await (0, assertions_1.assertCreated)(await api.post('/mapping-rules', { body: rule, tenant: 'none' }));
+        resources.track('mappingRule', rule.mappingRuleId);
+        const assign = await api.put('/groups/{groupId}/mapping-rules/{mappingRuleId}', {
+            params: { groupId: group.groupId, mappingRuleId: rule.mappingRuleId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(assign, [204], 'assignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/groups/{groupId}/mapping-rules/search', {
+                params: { groupId: group.groupId },
+                body: { page: { limit: 20 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            const ruleIds = page.items.map((item) => item.mappingRuleId);
+            (0, test_1.expect)(ruleIds).toContain(rule.mappingRuleId);
+        });
+        const remove = await api.delete('/groups/{groupId}/mapping-rules/{mappingRuleId}', {
+            params: { groupId: group.groupId, mappingRuleId: rule.mappingRuleId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(remove, [204], 'removal is acknowledged');
+    });
+});
+api_1.test.describe('Tenant membership for clients', () => {
+    (0, api_1.test)('assigns and removes a client', async ({ api, resources }) => {
+        const tenant = (0, beans_1.newTenant)();
+        await (0, assertions_1.assertCreated)(await api.post('/tenants', { body: tenant, tenant: 'none' }));
+        resources.track('tenant', tenant.tenantId);
+        const clientId = (0, bpmn_1.uniqueId)('client');
+        const assign = await api.put('/tenants/{tenantId}/clients/{clientId}', {
+            params: { tenantId: tenant.tenantId, clientId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(assign, [204], 'assignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/tenants/{tenantId}/clients/search', {
+                params: { tenantId: tenant.tenantId },
+                body: { page: { limit: 20 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            const clientIds = page.items.map((item) => item.clientId);
+            (0, test_1.expect)(clientIds).toContain(clientId);
+        });
+        const remove = await api.delete('/tenants/{tenantId}/clients/{clientId}', {
+            params: { tenantId: tenant.tenantId, clientId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(remove, [204], 'removal is acknowledged');
+    });
+});

package/dist/tests/api/v2/identity/role-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/identity/role-api-tests.spec.js

@@ -0,0 +1,212 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const beans_1 = require("../../../../utils/api/beans");
+const identity_1 = require("../../../../utils/api/identity");
+const eventually_1 = require("../../../../utils/api/eventually");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+async function createRole(api, resources) {
+    const role = (0, beans_1.newRole)();
+    const response = await api.post('/roles', { body: role, tenant: 'none' });
+    await (0, assertions_1.assertCreated)(response);
+    resources.track('role', role.roleId);
+    return role;
+}
+api_1.test.describe('Roles', () => {
+    (0, api_1.test)('creates a role', async ({ api, resources }) => {
+        const role = (0, beans_1.newRole)();
+        const response = await api.post('/roles', { body: role, tenant: 'none' });
+        // The shell suite expected `200 201 403` here, so a cluster rejecting
+        // every role creation reported this as a pass.
+        const created = (await (0, assertions_1.assertCreated)(response));
+        (0, assertions_1.assertRequiredFields)(created, beans_1.roleRequiredFields);
+        (0, test_1.expect)(created.roleId).toBe(role.roleId);
+        (0, test_1.expect)(created.name).toBe(role.name);
+        resources.track('role', role.roleId);
+    });
+    (0, api_1.test)('returns a created role by id', async ({ api, resources }) => {
+        const role = await createRole(api, resources);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/roles/{roleId}', {
+                params: { roleId: role.roleId },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(response));
+            (0, test_1.expect)(json.roleId).toBe(role.roleId);
+            (0, test_1.expect)(json.name).toBe(role.name);
+        });
+    });
+    (0, api_1.test)('updates a role', async ({ api, resources }) => {
+        const role = await createRole(api, resources);
+        const updatedName = `Updated ${role.name}`;
+        const response = await api.put('/roles/{roleId}', {
+            params: { roleId: role.roleId },
+            body: { name: updatedName, description: 'updated by the API suite' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [200, 204], 'the update returns the role on 8.8+ and an empty body on earlier minors');
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/roles/{roleId}', {
+                params: { roleId: role.roleId },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(lookup));
+            (0, test_1.expect)(json.name).toBe(updatedName);
+        });
+    });
+    (0, api_1.test)('finds a created role through search', async ({ api, resources }) => {
+        const role = await createRole(api, resources);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/roles/search', {
+                body: { filter: { roleId: role.roleId }, page: { limit: 10 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { exactItems: 1 });
+            (0, test_1.expect)(page.items[0].roleId).toBe(role.roleId);
+        });
+    });
+    (0, api_1.test)('deletes a role', async ({ api, resources }) => {
+        const role = await createRole(api, resources);
+        const response = await api.delete('/roles/{roleId}', {
+            params: { roleId: role.roleId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'deletion is acknowledged');
+        resources.forget('role', role.roleId);
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/roles/{roleId}', {
+                params: { roleId: role.roleId },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertNotFound)(lookup);
+        });
+    });
+    (0, api_1.test)('rejects a role whose id already exists', async ({ api, resources }) => {
+        const role = await createRole(api, resources);
+        const response = await api.post('/roles', {
+            body: (0, beans_1.newRole)({ roleId: role.roleId }),
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertConflict)(response);
+    });
+    (0, api_1.test)('rejects a role with no name', async ({ api }) => {
+        const response = await api.post('/roles', {
+            body: { roleId: (0, bpmn_1.uniqueId)('role'), description: 'no name' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response, /name/i);
+    });
+    (0, api_1.test)('rejects a role with no id', async ({ api }) => {
+        const response = await api.post('/roles', {
+            body: { name: 'nameless role' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response, /roleId/i);
+    });
+    (0, api_1.test)('rejects a lookup for an absent role', async ({ api }) => {
+        const response = await api.get('/roles/{roleId}', {
+            params: { roleId: (0, bpmn_1.uniqueId)('absent-role') },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects an unauthenticated role creation', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.post('/roles', {
+            body: (0, beans_1.newRole)(),
+            tenant: 'none',
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+});
+api_1.test.describe('Role membership', () => {
+    (0, api_1.test)('assigns and removes a user', async ({ api, resources }) => {
+        const role = await createRole(api, resources);
+        const username = await (0, identity_1.provisionUsername)(api, resources);
+        const assign = await api.put('/roles/{roleId}/users/{username}', {
+            params: { roleId: role.roleId, username },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(assign, [204], 'assignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/roles/{roleId}/users/search', {
+                params: { roleId: role.roleId },
+                body: { page: { limit: 20 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            const usernames = page.items.map((item) => item.username);
+            (0, test_1.expect)(usernames).toContain(username);
+        });
+        const remove = await api.delete('/roles/{roleId}/users/{username}', {
+            params: { roleId: role.roleId, username },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(remove, [204], 'removal is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/roles/{roleId}/users/search', {
+                params: { roleId: role.roleId },
+                body: { page: { limit: 20 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response);
+            const usernames = page.items.map((item) => item.username);
+            (0, test_1.expect)(usernames).not.toContain(username);
+        });
+    });
+    (0, api_1.test)('assigns and removes a group', async ({ api, resources }) => {
+        const role = await createRole(api, resources);
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const assign = await api.put('/roles/{roleId}/groups/{groupId}', {
+            params: { roleId: role.roleId, groupId: group.groupId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(assign, [204], 'assignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/roles/{roleId}/groups/search', {
+                params: { roleId: role.roleId },
+                body: { page: { limit: 20 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            const groupIds = page.items.map((item) => item.groupId);
+            (0, test_1.expect)(groupIds).toContain(group.groupId);
+        });
+        const remove = await api.delete('/roles/{roleId}/groups/{groupId}', {
+            params: { roleId: role.roleId, groupId: group.groupId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(remove, [204], 'removal is acknowledged');
+    });
+    (0, api_1.test)('rejects assigning a user to an absent role', async ({ api, resources, }) => {
+        const username = await (0, identity_1.provisionUsername)(api, resources);
+        const response = await api.put('/roles/{roleId}/users/{username}', {
+            params: { roleId: (0, bpmn_1.uniqueId)('absent-role'), username },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects assigning an absent user to a role', async ({ api, resources, }) => {
+        const role = await createRole(api, resources);
+        const response = await api.put('/roles/{roleId}/users/{username}', {
+            params: {
+                roleId: role.roleId,
+                username: (0, bpmn_1.uniqueId)('absent-user'),
+            },
+            tenant: 'none',
+        });
+        // The shell suite asserted `200 204` here — that is, it asserted the
+        // assignment SUCCEEDS for a user that does not exist. Whether it should
+        // depends on the cluster's identity mode, so the expectation follows the
+        // mode and states why.
+        await (0, assertions_1.assertStatusIn)(response, [capabilities_1.absentUserMembership.status], capabilities_1.absentUserMembership.reason);
+    });
+});

package/dist/tests/api/v2/identity/tenant-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};