@camunda/e2e-test-suite 0.0.1242 → 0.0.1244

package/dist/tests/api/v2/identity/tenant-api-tests.spec.js

@@ -0,0 +1,319 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const beans_1 = require("../../../../utils/api/beans");
+const identity_1 = require("../../../../utils/api/identity");
+const eventually_1 = require("../../../../utils/api/eventually");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+async function createTenant(api, resources) {
+    const tenant = (0, beans_1.newTenant)();
+    await (0, assertions_1.assertCreated)(await api.post('/tenants', { body: tenant, tenant: 'none' }));
+    resources.track('tenant', tenant.tenantId);
+    return tenant;
+}
+api_1.test.describe('Tenants', () => {
+    (0, api_1.test)('creates a tenant', async ({ api, resources }) => {
+        const tenant = (0, beans_1.newTenant)();
+        const response = await api.post('/tenants', {
+            body: tenant,
+            tenant: 'none',
+        });
+        // The shell suite expected `200 201 403 404 405` — five statuses, three of
+        // which mean the request never took effect.
+        const created = (await (0, assertions_1.assertCreated)(response));
+        (0, assertions_1.assertRequiredFields)(created, beans_1.tenantRequiredFields);
+        (0, test_1.expect)(created.tenantId).toBe(tenant.tenantId);
+        resources.track('tenant', tenant.tenantId);
+    });
+    (0, api_1.test)('returns a created tenant by id', async ({ api, resources }) => {
+        const tenant = await createTenant(api, resources);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/tenants/{tenantId}', {
+                params: { tenantId: tenant.tenantId },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(response));
+            (0, test_1.expect)(json.tenantId).toBe(tenant.tenantId);
+            (0, test_1.expect)(json.name).toBe(tenant.name);
+        });
+    });
+    (0, api_1.test)('updates a tenant', async ({ api, resources }) => {
+        const tenant = await createTenant(api, resources);
+        const updatedName = `Updated ${tenant.name}`;
+        const response = await api.put('/tenants/{tenantId}', {
+            params: { tenantId: tenant.tenantId },
+            body: { name: updatedName, description: 'updated by the API suite' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [200, 204], 'the update returns the tenant on 8.8+ and an empty body on earlier minors');
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/tenants/{tenantId}', {
+                params: { tenantId: tenant.tenantId },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(lookup));
+            (0, test_1.expect)(json.name).toBe(updatedName);
+        });
+    });
+    (0, api_1.test)('finds a created tenant through search', async ({ api, resources }) => {
+        const tenant = await createTenant(api, resources);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/tenants/search', {
+                body: { filter: { tenantId: tenant.tenantId }, page: { limit: 10 } },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertPaginated)(response, { exactItems: 1 });
+        });
+    });
+    (0, api_1.test)('deletes a tenant', async ({ api, resources }) => {
+        const tenant = await createTenant(api, resources);
+        const response = await api.delete('/tenants/{tenantId}', {
+            params: { tenantId: tenant.tenantId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'deletion is acknowledged');
+        resources.forget('tenant', tenant.tenantId);
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/tenants/{tenantId}', {
+                params: { tenantId: tenant.tenantId },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertNotFound)(lookup);
+        });
+    });
+    (0, api_1.test)('rejects a tenant whose id already exists', async ({ api, resources }) => {
+        const tenant = await createTenant(api, resources);
+        const response = await api.post('/tenants', {
+            body: (0, beans_1.newTenant)({ tenantId: tenant.tenantId }),
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertConflict)(response);
+    });
+    (0, api_1.test)('rejects an over-long tenant id', async ({ api }) => {
+        const response = await api.post('/tenants', {
+            body: (0, beans_1.newTenant)({ tenantId: 'a'.repeat(300) }),
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects a lookup for an absent tenant', async ({ api }) => {
+        const response = await api.get('/tenants/{tenantId}', {
+            params: { tenantId: (0, bpmn_1.uniqueId)('absent-tenant') },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects an unauthenticated tenant creation', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.post('/tenants', {
+            body: (0, beans_1.newTenant)(),
+            tenant: 'none',
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+});
+api_1.test.describe('Tenant membership', () => {
+    (0, api_1.test)('assigns and removes a user', async ({ api, resources }) => {
+        const tenant = await createTenant(api, resources);
+        const username = await (0, identity_1.provisionUsername)(api, resources);
+        const assign = await api.put('/tenants/{tenantId}/users/{username}', {
+            params: { tenantId: tenant.tenantId, username },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(assign, [204], 'assignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/tenants/{tenantId}/users/search', {
+                params: { tenantId: tenant.tenantId },
+                body: { page: { limit: 20 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            const usernames = page.items.map((item) => item.username);
+            (0, test_1.expect)(usernames).toContain(username);
+        });
+        const remove = await api.delete('/tenants/{tenantId}/users/{username}', {
+            params: { tenantId: tenant.tenantId, username },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(remove, [204], 'removal is acknowledged');
+    });
+    (0, api_1.test)('assigns and removes a group', async ({ api, resources }) => {
+        const tenant = await createTenant(api, resources);
+        const group = (0, beans_1.newGroup)();
+        await (0, assertions_1.assertCreated)(await api.post('/groups', { body: group, tenant: 'none' }));
+        resources.track('group', group.groupId);
+        const assign = await api.put('/tenants/{tenantId}/groups/{groupId}', {
+            params: { tenantId: tenant.tenantId, groupId: group.groupId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(assign, [204], 'assignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/tenants/{tenantId}/groups/search', {
+                params: { tenantId: tenant.tenantId },
+                body: { page: { limit: 20 } },
+                tenant: 'none',
+            });
+            const page = await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+            const groupIds = page.items.map((item) => item.groupId);
+            (0, test_1.expect)(groupIds).toContain(group.groupId);
+        });
+        const remove = await api.delete('/tenants/{tenantId}/groups/{groupId}', {
+            params: { tenantId: tenant.tenantId, groupId: group.groupId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(remove, [204], 'removal is acknowledged');
+    });
+    (0, api_1.test)('assigns and removes a role', async ({ api, resources }) => {
+        const tenant = await createTenant(api, resources);
+        const role = (0, beans_1.newRole)();
+        await (0, assertions_1.assertCreated)(await api.post('/roles', { body: role, tenant: 'none' }));
+        resources.track('role', role.roleId);
+        const assign = await api.put('/tenants/{tenantId}/roles/{roleId}', {
+            params: { tenantId: tenant.tenantId, roleId: role.roleId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(assign, [204], 'assignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/tenants/{tenantId}/roles/search', {
+                params: { tenantId: tenant.tenantId },
+                body: { page: { limit: 20 } },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+        });
+        const remove = await api.delete('/tenants/{tenantId}/roles/{roleId}', {
+            params: { tenantId: tenant.tenantId, roleId: role.roleId },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(remove, [204], 'removal is acknowledged');
+    });
+    (0, api_1.test)('assigns and removes a mapping rule', async ({ api, resources }) => {
+        const tenant = await createTenant(api, resources);
+        const rule = (0, beans_1.newMappingRule)();
+        await (0, assertions_1.assertCreated)(await api.post('/mapping-rules', { body: rule, tenant: 'none' }));
+        resources.track('mappingRule', rule.mappingRuleId);
+        const assign = await api.put('/tenants/{tenantId}/mapping-rules/{mappingRuleId}', {
+            params: {
+                tenantId: tenant.tenantId,
+                mappingRuleId: rule.mappingRuleId,
+            },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(assign, [204], 'assignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/tenants/{tenantId}/mapping-rules/search', {
+                params: { tenantId: tenant.tenantId },
+                body: { page: { limit: 20 } },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertPaginated)(response, { minItems: 1 });
+        });
+        const remove = await api.delete('/tenants/{tenantId}/mapping-rules/{mappingRuleId}', {
+            params: {
+                tenantId: tenant.tenantId,
+                mappingRuleId: rule.mappingRuleId,
+            },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(remove, [204], 'removal is acknowledged');
+    });
+    (0, api_1.test)('rejects assigning a user to an absent tenant', async ({ api, resources, }) => {
+        const username = await (0, identity_1.provisionUsername)(api, resources);
+        const response = await api.put('/tenants/{tenantId}/users/{username}', {
+            params: {
+                tenantId: (0, bpmn_1.uniqueId)('absent-tenant'),
+                username,
+            },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects assigning an absent user to a tenant', async ({ api, resources, }) => {
+        const tenant = await createTenant(api, resources);
+        const response = await api.put('/tenants/{tenantId}/users/{username}', {
+            params: {
+                tenantId: tenant.tenantId,
+                username: (0, bpmn_1.uniqueId)('absent-user'),
+            },
+            tenant: 'none',
+        });
+        // The shell suite called this case "idempotent" and asserted
+        // `200 204 403 404` — i.e. it passed whether the API accepted or refused.
+        // The real answer depends on the cluster's identity mode; the expectation
+        // follows it and states why.
+        await (0, assertions_1.assertStatusIn)(response, [capabilities_1.absentUserMembership.status], capabilities_1.absentUserMembership.reason);
+    });
+});
+api_1.test.describe('Mapping rules', () => {
+    (0, api_1.test)('creates a mapping rule', async ({ api, resources }) => {
+        const rule = (0, beans_1.newMappingRule)();
+        const response = await api.post('/mapping-rules', {
+            body: rule,
+            tenant: 'none',
+        });
+        const created = (await (0, assertions_1.assertCreated)(response));
+        (0, assertions_1.assertRequiredFields)(created, ['mappingRuleId', 'claimName', 'claimValue']);
+        (0, test_1.expect)(created.mappingRuleId).toBe(rule.mappingRuleId);
+        resources.track('mappingRule', rule.mappingRuleId);
+    });
+    (0, api_1.test)('returns a created mapping rule by id', async ({ api, resources }) => {
+        const rule = (0, beans_1.newMappingRule)();
+        await (0, assertions_1.assertCreated)(await api.post('/mapping-rules', { body: rule, tenant: 'none' }));
+        resources.track('mappingRule', rule.mappingRuleId);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/mapping-rules/{mappingRuleId}', {
+                params: { mappingRuleId: rule.mappingRuleId },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(response));
+            (0, test_1.expect)(json.claimName).toBe(rule.claimName);
+            (0, test_1.expect)(json.claimValue).toBe(rule.claimValue);
+        });
+    });
+    (0, api_1.test)('updates a mapping rule', async ({ api, resources }) => {
+        const rule = (0, beans_1.newMappingRule)();
+        await (0, assertions_1.assertCreated)(await api.post('/mapping-rules', { body: rule, tenant: 'none' }));
+        resources.track('mappingRule', rule.mappingRuleId);
+        const response = await api.put('/mapping-rules/{mappingRuleId}', {
+            params: { mappingRuleId: rule.mappingRuleId },
+            body: {
+                claimName: rule.claimName,
+                claimValue: rule.claimValue,
+                name: `Updated ${rule.name}`,
+            },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [200, 204], 'the update returns the rule on 8.8+ and an empty body on earlier minors');
+    });
+    (0, api_1.test)('rejects a mapping rule whose id already exists', async ({ api, resources, }) => {
+        const rule = (0, beans_1.newMappingRule)();
+        await (0, assertions_1.assertCreated)(await api.post('/mapping-rules', { body: rule, tenant: 'none' }));
+        resources.track('mappingRule', rule.mappingRuleId);
+        const response = await api.post('/mapping-rules', {
+            body: (0, beans_1.newMappingRule)({ mappingRuleId: rule.mappingRuleId }),
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertConflict)(response);
+    });
+    (0, api_1.test)('rejects updating an absent mapping rule', async ({ api }) => {
+        const response = await api.put('/mapping-rules/{mappingRuleId}', {
+            params: { mappingRuleId: (0, bpmn_1.uniqueId)('absent-rule') },
+            body: { claimName: 'c', claimValue: 'v', name: 'absent' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects deleting an absent mapping rule', async ({ api }) => {
+        const response = await api.delete('/mapping-rules/{mappingRuleId}', {
+            params: { mappingRuleId: (0, bpmn_1.uniqueId)('absent-rule') },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+});

package/dist/tests/api/v2/identity/user-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/identity/user-api-tests.spec.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const beans_1 = require("../../../../utils/api/beans");
+const eventually_1 = require("../../../../utils/api/eventually");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+async function createUser(api, resources, overrides = {}) {
+    const user = (0, beans_1.newUser)(overrides);
+    await (0, assertions_1.assertCreated)(await api.post('/users', { body: user, tenant: 'none' }));
+    resources.track('user', user.username);
+    return user;
+}
+api_1.test.describe('Users', () => {
+    // Every test below creates or reads a local user. On an OIDC cluster the
+    // whole /v2/users/** tree is turned off, so none of them has a subject.
+    // `system-api-tests.spec.ts` asserts that the tree really is closed there,
+    // so this gate cannot quietly drop coverage if the mode is misread.
+    api_1.test.skip(capabilities_1.usersApiUnavailable !== false, capabilities_1.usersApiUnavailable === false ? '' : capabilities_1.usersApiUnavailable);
+    (0, api_1.test)('creates a user', async ({ api, resources }) => {
+        const user = (0, beans_1.newUser)();
+        const response = await api.post('/users', { body: user, tenant: 'none' });
+        const created = (await (0, assertions_1.assertCreated)(response));
+        (0, assertions_1.assertRequiredFields)(created, beans_1.userRequiredFields);
+        (0, test_1.expect)(created.username).toBe(user.username);
+        (0, test_1.expect)(created.email).toBe(user.email);
+        // A password must never be echoed back by the API.
+        (0, test_1.expect)(created.password).toBeUndefined();
+        resources.track('user', user.username);
+    });
+    (0, api_1.test)('returns a created user by username', async ({ api, resources }) => {
+        const user = await createUser(api, resources);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.get('/users/{username}', {
+                params: { username: user.username },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(response));
+            (0, test_1.expect)(json.username).toBe(user.username);
+            (0, test_1.expect)(json.email).toBe(user.email);
+        });
+    });
+    (0, api_1.test)('updates a user profile', async ({ api, resources }) => {
+        const user = await createUser(api, resources);
+        const updatedName = `Updated ${user.name}`;
+        const response = await api.put('/users/{username}', {
+            params: { username: user.username },
+            body: { name: updatedName, email: user.email },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [200, 204], 'the update returns the user on 8.8+ and an empty body on earlier minors');
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/users/{username}', {
+                params: { username: user.username },
+                tenant: 'none',
+            });
+            const json = (await (0, assertions_1.assertOk)(lookup));
+            (0, test_1.expect)(json.name).toBe(updatedName);
+        });
+    });
+    (0, api_1.test)('finds a created user through search', async ({ api, resources }) => {
+        const user = await createUser(api, resources);
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/users/search', {
+                body: { filter: { username: user.username }, page: { limit: 10 } },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertPaginated)(response, { exactItems: 1 });
+        });
+    });
+    (0, api_1.test)('deletes a user', async ({ api, resources }) => {
+        const user = await createUser(api, resources);
+        const response = await api.delete('/users/{username}', {
+            params: { username: user.username },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'deletion is acknowledged');
+        resources.forget('user', user.username);
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/users/{username}', {
+                params: { username: user.username },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertNotFound)(lookup);
+        });
+    });
+    // There is no /users/{username}/roles|groups|tenants sub-search on any
+    // supported version — membership is only queryable from the owning side.
+    // The two tests that stood here asserted `exactItems: 0` against a 404 from
+    // an unrouted path, so neither could report anything. Role, group and
+    // tenant membership is asserted in role-api-tests, group-api-tests and
+    // tenant-api-tests, each through the endpoint that exists.
+    (0, api_1.test)('rejects a username that already exists', async ({ api, resources }) => {
+        const user = await createUser(api, resources);
+        const response = await api.post('/users', {
+            body: (0, beans_1.newUser)({ username: user.username }),
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertConflict)(response);
+    });
+    (0, api_1.test)('rejects a malformed email address', async ({ api }) => {
+        const response = await api.post('/users', {
+            body: (0, beans_1.newUser)({ email: 'not-an-email' }),
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response, /email/i);
+    });
+    (0, api_1.test)('rejects a user with no password', async ({ api }) => {
+        const user = (0, beans_1.newUser)();
+        delete user.password;
+        const response = await api.post('/users', { body: user, tenant: 'none' });
+        await (0, assertions_1.assertBadRequest)(response, /password/i);
+    });
+    (0, api_1.test)('rejects updating an absent user', async ({ api }) => {
+        const response = await api.put('/users/{username}', {
+            params: { username: (0, bpmn_1.uniqueId)('absent-user') },
+            body: { name: 'does not exist', email: 'nobody@example.com' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects a lookup for an absent user', async ({ api }) => {
+        const response = await api.get('/users/{username}', {
+            params: { username: (0, bpmn_1.uniqueId)('absent-user') },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+});
+// Outside the capability gate above: the security filter chain answers before
+// the OIDC endpoint filter does, so an unauthenticated call is rejected with
+// 401 whether or not the cluster serves the Users API. That holds in both
+// modes and is worth asserting in both.
+api_1.test.describe('Users, unauthenticated', () => {
+    (0, api_1.test)('rejects an unauthenticated user creation', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.post('/users', {
+            body: (0, beans_1.newUser)(),
+            tenant: 'none',
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+});

package/dist/tests/api/v2/job/job-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};