@camunda/e2e-test-suite 0.0.1242 → 0.0.1244

package/dist/fixtures/api.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Playwright fixture for the Orchestration Cluster REST v2 API suite.
+ *
+ * Provides an authenticated `api` client and a `resources` tracker whose
+ * contents are deleted after the worker finishes, so a spec never has to write
+ * its own teardown loop.
+ */
+import { ApiClient } from '../utils/api/http';
+import { ResourceTracker } from '../utils/api/cleanup';
+interface ApiFixtures {
+    api: ApiClient;
+    resources: ResourceTracker;
+}
+export declare const test: import("@playwright/test").TestType<import("@playwright/test").PlaywrightTestArgs & import("@playwright/test").PlaywrightTestOptions & ApiFixtures, import("@playwright/test").PlaywrightWorkerArgs & import("@playwright/test").PlaywrightWorkerOptions>;
+export { expect } from '@playwright/test';

package/dist/fixtures/api.js

@@ -0,0 +1,27 @@
+"use strict";
+/**
+ * Playwright fixture for the Orchestration Cluster REST v2 API suite.
+ *
+ * Provides an authenticated `api` client and a `resources` tracker whose
+ * contents are deleted after the worker finishes, so a spec never has to write
+ * its own teardown loop.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.expect = exports.test = void 0;
+const test_1 = require("@playwright/test");
+const http_1 = require("../utils/api/http");
+const cleanup_1 = require("../utils/api/cleanup");
+// Configuration is read once at module load, so specs that need it import
+// `apiConfig` directly rather than taking it as a fixture.
+exports.test = test_1.test.extend({
+    api: async ({ request }, use) => {
+        await use(new http_1.ApiClient(request));
+    },
+    resources: async ({ api }, use) => {
+        const tracker = new cleanup_1.ResourceTracker();
+        await use(tracker);
+        await tracker.cleanup(api);
+    },
+});
+var test_2 = require("@playwright/test");
+Object.defineProperty(exports, "expect", { enumerable: true, get: function () { return test_2.expect; } });

package/dist/pages/SM-8.10/ModelerCreatePage.js

@@ -341,10 +341,11 @@ class ModelerCreatePage {
         // substring match is case-insensitive -- hence the strict-mode violation.
         // Key on the sidebar toggle's data-test plus its state-dependent title so
         // the locator stays unambiguous and still distinguishes collapse from
-        // expand; both attributes are rendered by the legacy and the
-        // design-system toggle alike.
-        this.closeDetailsPanel = page.locator('[data-test="details-panel-toggle"][title="Close Details Panel"]');
-        this.openDetailsPanel = page.locator('[data-test="details-panel-toggle"][title="Open Details Panel"]');
+        // expand. The title is matched case-insensitively (`i`) because the
+        // design-system toggle renders "Close details panel" while the legacy one
+        // renders "Close Details Panel".
+        this.closeDetailsPanel = page.locator('[data-test="details-panel-toggle"][title="Close Details Panel" i]');
+        this.openDetailsPanel = page.locator('[data-test="details-panel-toggle"][title="Open Details Panel" i]');
     }
     async deployProcessInstance(tenant = '') {
         await this.clickDeployButton();

package/dist/tests/api/v2/authorization/authorization-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/authorization/authorization-api-tests.spec.js

@@ -0,0 +1,247 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const beans_1 = require("../../../../utils/api/beans");
+const eventually_1 = require("../../../../utils/api/eventually");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const deployments_1 = require("../../../../utils/api/deployments");
+const identity_1 = require("../../../../utils/api/identity");
+const keys_1 = require("../../../../utils/api/keys");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+async function createAuthorization(api, resources, body) {
+    const response = await api.post('/authorizations', { body, tenant: 'none' });
+    // The shell suite expected `201 409` throughout this section, so a run
+    // where every authorization already existed — or where creation kept
+    // conflicting — was indistinguishable from one where it worked.
+    const created = (await (0, assertions_1.assertCreated)(response));
+    const key = String(created.authorizationKey);
+    resources.track('authorization', key);
+    return key;
+}
+api_1.test.describe('Authorizations', () => {
+    (0, api_1.test)('creates an authorization for a group owner', async ({ api, resources, }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const processId = (0, bpmn_1.uniqueId)('authz-process');
+        const deployed = await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask((0, bpmn_1.uniqueId)('job'))));
+        const key = await createAuthorization(api, resources, {
+            ownerType: 'GROUP',
+            ownerId: group.groupId,
+            resourceType: 'PROCESS_DEFINITION',
+            resourceId: deployed.processDefinitionId,
+            permissionTypes: ['READ_PROCESS_INSTANCE'],
+        });
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/authorizations/{authorizationKey}', {
+                params: { authorizationKey: key },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(response));
+            (0, assertions_1.assertRequiredFields)(json, [
+                'authorizationKey',
+                'ownerId',
+                'ownerType',
+                'resourceType',
+                'permissionTypes',
+            ]);
+            (0, test_1.expect)(json.ownerId).toBe(group.groupId);
+            (0, test_1.expect)(json.permissionTypes).toEqual(['READ_PROCESS_INSTANCE']);
+        });
+    });
+    (0, api_1.test)('creates an authorization carrying several permissions', async ({ api, resources, }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const key = await createAuthorization(api, resources, {
+            ownerType: 'GROUP',
+            ownerId: group.groupId,
+            resourceType: 'PROCESS_DEFINITION',
+            resourceId: '*',
+            permissionTypes: ['READ_PROCESS_DEFINITION', 'READ_PROCESS_INSTANCE'],
+        });
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/authorizations/{authorizationKey}', {
+                params: { authorizationKey: key },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(response));
+            (0, test_1.expect)(json.permissionTypes).toEqual(test_1.expect.arrayContaining([
+                'READ_PROCESS_DEFINITION',
+                'READ_PROCESS_INSTANCE',
+            ]));
+        });
+    });
+    (0, api_1.test)('creates an authorization for a user owner', async ({ api, resources, }) => {
+        const username = await (0, identity_1.provisionUsername)(api, resources);
+        const key = await createAuthorization(api, resources, {
+            ownerType: 'USER',
+            ownerId: username,
+            resourceType: 'DECISION_DEFINITION',
+            resourceId: '*',
+            permissionTypes: ['READ_DECISION_DEFINITION'],
+        });
+        (0, test_1.expect)(key).toBeTruthy();
+    });
+    (0, api_1.test)('finds an authorization by owner', async ({ api, resources }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        await createAuthorization(api, resources, {
+            ownerType: 'GROUP',
+            ownerId: group.groupId,
+            resourceType: 'PROCESS_DEFINITION',
+            resourceId: '*',
+            permissionTypes: ['READ_PROCESS_DEFINITION'],
+        });
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/authorizations/search', {
+                body: { filter: { ownerId: group.groupId }, page: { limit: 10 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            for (const item of page.items) {
+                (0, test_1.expect)(item.ownerId).toBe(group.groupId);
+            }
+        });
+    });
+    (0, api_1.test)('filters an authorization search by owner type', async ({ api, resources, }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        await createAuthorization(api, resources, {
+            ownerType: 'GROUP',
+            ownerId: group.groupId,
+            resourceType: 'PROCESS_DEFINITION',
+            resourceId: '*',
+            permissionTypes: ['READ_PROCESS_DEFINITION'],
+        });
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/authorizations/search', {
+                body: { filter: { ownerType: 'GROUP' }, page: { limit: 50 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            for (const item of page.items) {
+                (0, test_1.expect)(item.ownerType).toBe('GROUP');
+            }
+        });
+    });
+    (0, api_1.test)('updates the permissions on an authorization', async ({ api, resources, }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const key = await createAuthorization(api, resources, {
+            ownerType: 'GROUP',
+            ownerId: group.groupId,
+            resourceType: 'PROCESS_DEFINITION',
+            resourceId: '*',
+            permissionTypes: ['READ_PROCESS_DEFINITION'],
+        });
+        const response = await api.put('/authorizations/{authorizationKey}', {
+            params: { authorizationKey: key },
+            body: {
+                ownerType: 'GROUP',
+                ownerId: group.groupId,
+                resourceType: 'PROCESS_DEFINITION',
+                resourceId: '*',
+                permissionTypes: ['READ_PROCESS_DEFINITION', 'UPDATE_PROCESS_INSTANCE'],
+            },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'the update is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/authorizations/{authorizationKey}', {
+                params: { authorizationKey: key },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(lookup));
+            (0, test_1.expect)(json.permissionTypes).toEqual(test_1.expect.arrayContaining(['UPDATE_PROCESS_INSTANCE']));
+        });
+    });
+    (0, api_1.test)('deletes an authorization', async ({ api, resources }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const key = await createAuthorization(api, resources, {
+            ownerType: 'GROUP',
+            ownerId: group.groupId,
+            resourceType: 'PROCESS_DEFINITION',
+            resourceId: '*',
+            permissionTypes: ['READ_PROCESS_DEFINITION'],
+        });
+        const response = await api.delete('/authorizations/{authorizationKey}', {
+            params: { authorizationKey: key },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'deletion is acknowledged');
+        resources.forget('authorization', key);
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/authorizations/{authorizationKey}', {
+                params: { authorizationKey: key },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertNotFound)(lookup);
+        });
+    });
+    (0, api_1.test)('rejects an authorization with no permission types', async ({ api, resources, }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const response = await api.post('/authorizations', {
+            body: {
+                ownerType: 'GROUP',
+                ownerId: group.groupId,
+                resourceType: 'PROCESS_DEFINITION',
+                resourceId: '*',
+                permissionTypes: [],
+            },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects an authorization with an unknown resource type', async ({ api, resources, }) => {
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const response = await api.post('/authorizations', {
+            body: {
+                ownerType: 'GROUP',
+                ownerId: group.groupId,
+                resourceType: 'NOT_A_RESOURCE_TYPE',
+                resourceId: '*',
+                permissionTypes: ['READ_PROCESS_DEFINITION'],
+            },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects a lookup for an absent authorization', async ({ api }) => {
+        const response = await api.get('/authorizations/{authorizationKey}', {
+            params: { authorizationKey: keys_1.ABSENT_KEY },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects an unauthenticated authorization search', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.post('/authorizations/search', {
+            body: { filter: {} },
+            tenant: 'none',
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+    (0, api_1.test)('honours the page size on an authorization search', async ({ api }) => {
+        const response = await api.post('/authorizations/search', {
+            body: { filter: {}, page: { limit: 1 } },
+            tenant: 'none',
+        });
+        const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+        (0, test_1.expect)(page.items.length).toBe(1);
+    });
+});

package/dist/tests/api/v2/authorization/authorization-enforcement-api-tests.spec.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Authorization *enforcement* — that the cluster actually refuses an
+ * unprivileged principal, not merely that the authorization API accepts writes.
+ *
+ * This is the coverage a Helm-upgrade run most needs, because role bindings are
+ * what an upgrade is most likely to lose. In the shell suite it was 2,700 lines
+ * (9506-12224) inside a single `if [[ "$TEST_CLIENT_TOKEN_VALID" ]]` block: if
+ * the token fetch failed, the entire section silently did not run and the script
+ * still exited 0.
+ *
+ * Two things change here. The gate is a hard failure rather than a silent skip,
+ * so "enforcement was never checked" can no longer look like success. And the
+ * unprivileged principal is a user this spec creates, rather than the suite's own
+ * admin client with its permissions temporarily stripped and restored — that
+ * approach mutated cluster-wide admin state mid-run, so a failure between the
+ * strip and the restore left the rest of the suite running without permissions.
+ */
+export {};

package/dist/tests/api/v2/authorization/authorization-enforcement-api-tests.spec.js

@@ -0,0 +1,208 @@
+"use strict";
+/**
+ * Authorization *enforcement* — that the cluster actually refuses an
+ * unprivileged principal, not merely that the authorization API accepts writes.
+ *
+ * This is the coverage a Helm-upgrade run most needs, because role bindings are
+ * what an upgrade is most likely to lose. In the shell suite it was 2,700 lines
+ * (9506-12224) inside a single `if [[ "$TEST_CLIENT_TOKEN_VALID" ]]` block: if
+ * the token fetch failed, the entire section silently did not run and the script
+ * still exited 0.
+ *
+ * Two things change here. The gate is a hard failure rather than a silent skip,
+ * so "enforcement was never checked" can no longer look like success. And the
+ * unprivileged principal is a user this spec creates, rather than the suite's own
+ * admin client with its permissions temporarily stripped and restored — that
+ * approach mutated cluster-wide admin state mid-run, so a failure between the
+ * strip and the restore left the rest of the suite running without permissions.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const beans_1 = require("../../../../utils/api/beans");
+const config_1 = require("../../../../utils/api/config");
+const auth_1 = require("../../../../utils/api/auth");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+const eventually_1 = require("../../../../utils/api/eventually");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const deployments_1 = require("../../../../utils/api/deployments");
+/**
+ * Obtains a principal that holds no roles, by whichever route the cluster
+ * allows.
+ *
+ * Throws when neither route works. That is deliberate: without a second
+ * principal there is no way to observe enforcement, and a suite that quietly
+ * reports success in that state is worse than one that fails. The tests are
+ * gated on `enforcementPrincipalUnavailable` before they get here, so a throw
+ * means a configured route broke rather than that none was configured.
+ */
+async function unprivilegedPrincipal(api, request, resources) {
+    // OIDC cluster: act as a second identity-provider client. It must hold no
+    // roles for the assertions below to mean anything, which is a property of
+    // how it was provisioned rather than something this suite can enforce.
+    if (!config_1.apiConfig.usersApiEnabled) {
+        const { clientId, clientSecret } = config_1.apiConfig.secondaryClient;
+        const header = await (0, auth_1.clientAuthHeader)(request, clientId, clientSecret);
+        if (!header) {
+            throw new Error(`Could not obtain a token for the secondary client "${clientId}" from ` +
+                `${config_1.apiConfig.oauth.tokenUrl}. Enforcement cannot be observed without a ` +
+                `second principal, so this is a failure rather than a skip. Check that ` +
+                `SECONDARY_CLIENT_SECRET matches the client and that client credentials ` +
+                `are enabled for it.`);
+        }
+        return { ownerId: clientId, ownerType: 'CLIENT', authorization: header };
+    }
+    const user = (0, beans_1.newUser)();
+    await (0, assertions_1.assertCreated)(await api.post('/users', { body: user, tenant: 'none' }));
+    resources.track('user', user.username);
+    if (config_1.apiConfig.authMethod === 'basic') {
+        const encoded = Buffer.from(`${user.username}:${user.password}`).toString('base64');
+        return {
+            ownerId: user.username,
+            ownerType: 'USER',
+            authorization: `Basic ${encoded}`,
+        };
+    }
+    const header = await (0, auth_1.userAuthHeader)(request, user.username, user.password);
+    if (!header) {
+        throw new Error(`Could not obtain a token for the freshly created user "${user.username}" ` +
+            `from ${config_1.apiConfig.oauth.tokenUrl}. Enforcement cannot be observed without a ` +
+            `second principal, so this is a failure rather than a skip. Check that the ` +
+            `"${config_1.apiConfig.oauth.clientId}" client has direct access grants enabled and that ` +
+            `users created through /v2/users are resolvable by the identity provider.`);
+    }
+    return { ownerId: user.username, ownerType: 'USER', authorization: header };
+}
+api_1.test.describe('Authorization enforcement', () => {
+    // Without a second, unprivileged principal there is nothing to enforce
+    // against. The reason names what to configure so this reads as a gap to
+    // close rather than a test that mysteriously does not run.
+    api_1.test.skip(capabilities_1.enforcementPrincipalUnavailable !== false, capabilities_1.enforcementPrincipalUnavailable === false
+        ? ''
+        : capabilities_1.enforcementPrincipalUnavailable);
+    (0, api_1.test)('refuses a process-definition search to an unprivileged user', async ({ api, request, resources, }) => {
+        const principal = await unprivilegedPrincipal(api, request, resources);
+        const response = await api.post('/process-definitions/search', {
+            body: { filter: {} },
+            authorization: principal.authorization,
+        });
+        // A cluster that has lost its authorization wiring answers 200 here.
+        await (0, assertions_1.assertStatusIn)(response, [200, 403], 'an unprivileged principal is refused outright, or served an empty result set');
+        if (response.status() === 200) {
+            // Where the API filters rather than refuses, the result must be empty —
+            // seeing another principal's definitions is the same defect as a 200 on
+            // a forbidden call.
+            await (0, assertions_1.assertPaginated)(response, { exactItems: 0 });
+        }
+    });
+    (0, api_1.test)('refuses a user list to an unprivileged user', async ({ api, request, resources, }) => {
+        // In OIDC mode /v2/users/** is closed to everyone, so a 403 here would
+        // come from the endpoint filter rather than from the authorization check
+        // this test is about — it would pass without enforcement working at all.
+        api_1.test.skip(capabilities_1.usersApiUnavailable !== false, capabilities_1.usersApiUnavailable === false ? '' : capabilities_1.usersApiUnavailable);
+        const principal = await unprivilegedPrincipal(api, request, resources);
+        const response = await api.post('/users/search', {
+            body: { filter: {} },
+            tenant: 'none',
+            authorization: principal.authorization,
+        });
+        await (0, assertions_1.assertStatusIn)(response, [200, 403], 'an unprivileged principal is refused outright, or served an empty result set');
+        if (response.status() === 200) {
+            await (0, assertions_1.assertPaginated)(response, { exactItems: 0 });
+        }
+    });
+    (0, api_1.test)('refuses a deployment to an unprivileged user', async ({ api, request, resources, }) => {
+        const principal = await unprivilegedPrincipal(api, request, resources);
+        const processId = (0, bpmn_1.uniqueId)('enforcement-deploy');
+        const response = await api.post('/deployments', {
+            tenant: 'none',
+            authorization: principal.authorization,
+            multipart: {
+                resources: {
+                    name: `${processId}.bpmn`,
+                    mimeType: 'application/xml',
+                    buffer: Buffer.from((0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask((0, bpmn_1.uniqueId)('job'))), 'utf-8'),
+                },
+            },
+        });
+        await (0, assertions_1.assertForbidden)(response);
+        // Backcheck: the refusal must also mean nothing was created. The shell
+        // suite called this step "BACKCHECK" and it is the part worth keeping.
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/process-definitions/search', {
+                body: { filter: { processDefinitionId: processId } },
+            });
+            await (0, assertions_1.assertPaginated)(search, { exactItems: 0 });
+        });
+    });
+    (0, api_1.test)('refuses role creation to an unprivileged user', async ({ api, request, resources, }) => {
+        const principal = await unprivilegedPrincipal(api, request, resources);
+        const roleId = (0, bpmn_1.uniqueId)('enforcement-role');
+        const response = await api.post('/roles', {
+            body: { roleId, name: 'should not be created' },
+            tenant: 'none',
+            authorization: principal.authorization,
+        });
+        await (0, assertions_1.assertForbidden)(response);
+        const lookup = await api.get('/roles/{roleId}', {
+            params: { roleId },
+            tenant: 'none',
+        });
+        (0, test_1.expect)(lookup.status(), 'a refused role creation must leave no role behind').toBe(404);
+    });
+    (0, api_1.test)('refuses starting a process instance to an unprivileged user', async ({ api, request, resources, }) => {
+        const principal = await unprivilegedPrincipal(api, request, resources);
+        const processId = (0, bpmn_1.uniqueId)('enforcement-start');
+        await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask((0, bpmn_1.uniqueId)('job'))));
+        const response = await api.post('/process-instances', {
+            body: { processDefinitionId: processId },
+            tenant: 'root',
+            authorization: principal.authorization,
+        });
+        await (0, assertions_1.assertForbidden)(response);
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/process-instances/search', {
+                body: { filter: { processDefinitionId: processId } },
+            });
+            await (0, assertions_1.assertPaginated)(search, { exactItems: 0 });
+        });
+    });
+    (0, api_1.test)('admits a user once granted the matching authorization', async ({ api, request, resources, }) => {
+        const principal = await unprivilegedPrincipal(api, request, resources);
+        const processId = (0, bpmn_1.uniqueId)('enforcement-grant');
+        await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.serviceTask((0, bpmn_1.uniqueId)('job'))));
+        // Refused before the grant.
+        const before = await api.post('/process-definitions/search', {
+            body: { filter: { processDefinitionId: processId } },
+            authorization: principal.authorization,
+        });
+        if (before.status() === 200) {
+            await (0, assertions_1.assertPaginated)(before, { exactItems: 0 });
+        }
+        else {
+            await (0, assertions_1.assertForbidden)(before);
+        }
+        const grant = await api.post('/authorizations', {
+            body: {
+                ownerType: principal.ownerType,
+                ownerId: principal.ownerId,
+                resourceType: 'PROCESS_DEFINITION',
+                resourceId: processId,
+                permissionTypes: ['READ_PROCESS_DEFINITION'],
+            },
+            tenant: 'none',
+        });
+        const created = (await (0, assertions_1.assertCreated)(grant));
+        resources.track('authorization', String(created.authorizationKey));
+        // Admitted after it. This direction is what proves the refusal above came
+        // from the authorization check rather than from the resource being absent.
+        await (0, eventually_1.eventually)(async () => {
+            const after = await api.post('/process-definitions/search', {
+                body: { filter: { processDefinitionId: processId } },
+                authorization: principal.authorization,
+            });
+            await (0, assertions_1.assertPaginated)(after, { exactItems: 1 });
+        });
+    });
+});

package/dist/tests/api/v2/batch-operation/batch-operation-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};