@camunda/e2e-test-suite 0.0.1242 → 0.0.1244

package/dist/tests/api/v2/system/clock-api-tests.spec.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * Cluster clock endpoints.
+ *
+ * In its own file because it is its own Playwright project: pinning the clock
+ * moves time for **every** caller on the cluster, so these tests cannot share
+ * the parallel window with the rest of the suite. See the `clock` project in
+ * `playwright.api.config.ts` for why a project is what isolates them and what
+ * that costs.
+ *
+ * `mode: 'serial'` is still needed, but only for the reason it can deliver:
+ * ordering the tests *within this file* so two of them do not pin and reset
+ * against each other.
+ *
+ * The shell suite ran these from inside its EXIT trap, after the process exit
+ * code had already been computed — so a clock assertion could not fail the
+ * run, and a crash before the trap left the cluster clock pinned for whatever
+ * ran next.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const assertions_1 = require("../../../../utils/api/assertions");
+const PINNED = Date.parse('2029-01-01T00:00:00Z');
+api_1.test.describe('Clock', () => {
+    api_1.test.describe.configure({ mode: 'serial' });
+    // Asserted, not fire-and-forget: a reset that answers 4xx/5xx leaves the
+    // cluster pinned for everything that follows, and an unchecked response
+    // would let the run continue and fail somewhere with no connection to the
+    // clock.
+    api_1.test.afterEach(async ({ api }) => {
+        const response = await api.post('/clock/reset', {
+            body: {},
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNoContent)(response);
+    });
+    (0, api_1.test)('pins the cluster clock to a timestamp', async ({ api }) => {
+        const response = await api.put('/clock', {
+            body: { timestamp: PINNED },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNoContent)(response);
+    });
+    (0, api_1.test)('resets the cluster clock', async ({ api }) => {
+        await api.put('/clock', {
+            body: { timestamp: PINNED },
+            tenant: 'none',
+        });
+        const response = await api.post('/clock/reset', {
+            body: {},
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNoContent)(response);
+    });
+    (0, api_1.test)('rejects a malformed timestamp', async ({ api }) => {
+        const response = await api.put('/clock', {
+            body: { timestamp: 'not-a-timestamp' },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+});

package/dist/tests/api/v2/system/system-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/system/system-api-tests.spec.js

@@ -0,0 +1,183 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const keys_1 = require("../../../../utils/api/keys");
+const config_1 = require("../../../../utils/api/config");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+api_1.test.describe('Usage metrics', () => {
+    const startTime = '2020-01-01T00:00:00.000Z';
+    const endTime = '2030-01-01T00:00:00.000Z';
+    (0, api_1.test)('reports usage metrics for a time range', async ({ api }) => {
+        const response = await api.get('/system/usage-metrics', {
+            tenant: 'none',
+            query: { startTime, endTime },
+        });
+        const json = (await (0, assertions_1.assertOk)(response));
+        (0, assertions_1.assertRequiredFields)(json, ['processInstances', 'decisionInstances']);
+    });
+    (0, api_1.test)('rejects a request with no time range', async ({ api }) => {
+        const response = await api.get('/system/usage-metrics', { tenant: 'none' });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects a malformed timestamp', async ({ api }) => {
+        const response = await api.get('/system/usage-metrics', {
+            tenant: 'none',
+            query: { startTime: 'not-a-date', endTime },
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects a range whose end precedes its start', async ({ api }) => {
+        const response = await api.get('/system/usage-metrics', {
+            tenant: 'none',
+            query: { startTime: endTime, endTime: startTime },
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+});
+// The Clock tests used to live here. They moved to `clock-api-tests.spec.ts`
+// because they pin cluster-wide state and need their own Playwright project to
+// stay out of the parallel window — `mode: 'serial'` here only ordered them
+// against each other, never against the other files.
+api_1.test.describe('Identity read models', () => {
+    (0, api_1.test)('lists tenants', async ({ api }) => {
+        const response = await api.post('/tenants/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertPaginated)(response);
+    });
+    (0, api_1.test)('lists roles', async ({ api }) => {
+        const response = await api.post('/roles/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertPaginated)(response);
+    });
+    (0, api_1.test)('lists groups', async ({ api }) => {
+        const response = await api.post('/groups/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertPaginated)(response);
+    });
+    (0, api_1.test)('lists mapping rules', async ({ api }) => {
+        const response = await api.post('/mapping-rules/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertPaginated)(response);
+    });
+    (0, api_1.test)('lists users', async ({ api }) => {
+        api_1.test.skip(capabilities_1.usersApiUnavailable !== false, capabilities_1.usersApiUnavailable === false ? '' : capabilities_1.usersApiUnavailable);
+        const response = await api.post('/users/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertPaginated)(response);
+    });
+});
+/**
+ * Holds the capability gate used across the identity specs to its word.
+ *
+ * Whichever way the cluster is configured, exactly one of these two runs and
+ * asserts what that configuration means for `/v2/users/**`. If the gate were
+ * ever wrong — a cluster that does serve the API but is read as OIDC — the
+ * matching test here fails, so a mis-set gate costs a red run rather than
+ * silently removing the user coverage it controls.
+ */
+api_1.test.describe('Users API availability', () => {
+    (0, api_1.test)('is closed with a stated reason when the cluster is in OIDC mode', async ({ api, }) => {
+        api_1.test.skip(capabilities_1.usersApiUnavailable === false, 'the cluster serves the Users API');
+        const response = await api.post('/users/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertForbidden)(response, /users api is disabled/i);
+    });
+    (0, api_1.test)('is served when the cluster manages users locally', async ({ api }) => {
+        api_1.test.skip(capabilities_1.usersApiUnavailable !== false, 'the cluster is in OIDC mode');
+        const response = await api.post('/users/search', {
+            body: { filter: {}, page: { limit: 10 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertPaginated)(response);
+    });
+});
+/**
+ * Reports whether this cluster enforces authorization.
+ *
+ * The authorization *enforcement* spec needs two things: a second principal
+ * that holds no roles, and a cluster that actually checks permissions. It
+ * gates on the first. This records the second, because the SM QA clusters do
+ * not enforce — `test`, the client this suite authenticates as, is not one of
+ * the three admin mappings the chart values initialise, yet nothing refuses
+ * it. Without this test that fact lives only in a comment, and a cluster that
+ * silently started or stopped enforcing would look identical.
+ */
+api_1.test.describe('Authorization enforcement', () => {
+    (0, api_1.test)('reports whether the cluster enforces authorization', async ({ api, }, testInfo) => {
+        const enabled = await (0, capabilities_1.readAuthorizationsEnabled)(api);
+        // `enabled` comes back undefined for two unrelated reasons, and naming
+        // the wrong one sends the reader somewhere there is nothing to find.
+        // Before 8.10 the endpoint is not published at all. From 8.10 it is, but
+        // it answers for the *calling principal*, so a cluster that serves /v2
+        // without credentials has no principal for it to answer for: on c8Run
+        // `/v2/authentication/me` refuses an anonymous caller even though the
+        // rest of the tree does not. Either way enforcement being unreadable is
+        // not the same as enforcement being off.
+        api_1.test.skip(enabled === undefined, (0, config_1.atLeastVersion)('8.10')
+            ? 'this cluster does not authenticate the caller, so ' +
+                '/v2/authentication/me/authorizations/search has no principal to ' +
+                'report for — the enforcement state cannot be read here, which ' +
+                'leaves this deployment without the safety net this test is (see ' +
+                'tests/api/README.md)'
+            : 'the cluster does not publish ' +
+                '/v2/authentication/me/authorizations/search (pre-8.10)');
+        testInfo.annotations.push({
+            type: 'authorization enforcement',
+            description: enabled
+                ? 'enabled — an unprivileged principal would be refused, so the ' +
+                    'enforcement spec is meaningful once one is configured'
+                : 'DISABLED — every principal is permitted, so authorization ' +
+                    'enforcement cannot be observed on this cluster no matter what ' +
+                    'second principal is supplied (see tests/api/README.md)',
+        });
+        if (!enabled) {
+            console.warn('Authorization enforcement is DISABLED on this cluster: every ' +
+                'principal is permitted, so the enforcement spec could not observe ' +
+                'a refusal even with SECONDARY_CLIENT_ID set. See ' +
+                'tests/api/README.md for what closing that gap requires.');
+        }
+        // Belt and braces: `readAuthorizationsEnabled` already throws on a 200
+        // whose `authorizationsEnabled` is not a boolean, and on any status that
+        // is neither the answer nor one of the two that mean the cluster cannot
+        // give it. This keeps the contract visible in the test that depends on it.
+        (0, test_1.expect)(typeof enabled).toBe('boolean');
+    });
+});
+api_1.test.describe('Ad-hoc sub-process activities', () => {
+    (0, api_1.test)('rejects activating activities on an absent sub-process', async ({ api, }) => {
+        const response = await api.post('/element-instances/ad-hoc-activities/{adHocSubProcessInstanceKey}/activation', {
+            params: { adHocSubProcessInstanceKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: { elements: [{ elementId: (0, bpmn_1.uniqueId)('activity') }] },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [404], 'an absent ad-hoc sub-process instance is reported as not found');
+    });
+    (0, api_1.test)('rejects an activation request carrying no elements', async ({ api }) => {
+        const response = await api.post('/element-instances/ad-hoc-activities/{adHocSubProcessInstanceKey}/activation', {
+            params: { adHocSubProcessInstanceKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: {},
+            tenant: 'none',
+        });
+        // Validation precedes the existence check, so this is a 400 rather than
+        // the 404 above.
+        (0, test_1.expect)([400, 404]).toContain(response.status());
+        if (response.status() === 400) {
+            await (0, assertions_1.assertBadRequest)(response);
+        }
+    });
+});

package/dist/tests/api/v2/user-task/user-task-api-tests.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/api/v2/user-task/user-task-api-tests.spec.js

@@ -0,0 +1,258 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("../../../../fixtures/api");
+const test_1 = require("@playwright/test");
+const assertions_1 = require("../../../../utils/api/assertions");
+const deployments_1 = require("../../../../utils/api/deployments");
+const bpmn_1 = require("../../../../utils/api/bpmn");
+const eventually_1 = require("../../../../utils/api/eventually");
+const capabilities_1 = require("../../../../utils/api/capabilities");
+const keys_1 = require("../../../../utils/api/keys");
+/** Starts a process holding one Zeebe user task and returns that task's key. */
+async function startUserTask(api, resources) {
+    const processId = (0, bpmn_1.uniqueId)('user-task-api');
+    await (0, deployments_1.deployProcess)(api, resources, processId, (0, bpmn_1.linearProcess)(processId, bpmn_1.element.userTask()));
+    const start = await api.post('/process-instances', {
+        body: { processDefinitionId: processId },
+        tenant: 'root',
+    });
+    await (0, assertions_1.assertStatusIn)(start, [200], 'instance creation is synchronous');
+    const instance = (await start.json());
+    const processInstanceKey = String(instance.processInstanceKey);
+    let tasks;
+    try {
+        tasks = await (0, eventually_1.eventuallyGet)(async () => {
+            const response = await api.post('/user-tasks/search', {
+                body: { filter: { processInstanceKey }, page: { limit: 10 } },
+            });
+            const page = await (0, assertions_1.assertPaginated)(response);
+            return page.items;
+        }, (items) => items.length > 0, { description: `user tasks for instance ${processInstanceKey}` });
+    }
+    catch (error) {
+        // An empty result cannot say *why* it is empty, and that is the whole
+        // question when this fails: did the engine never create the task (our
+        // model is wrong), or did it create one that was never exported (the
+        // cluster is wrong)? The element instances answer it — they come from a
+        // different index, so a `task` element sitting in the instance while the
+        // user-task search stays empty means the record exists and only its
+        // export is missing.
+        throw new Error(`${error instanceof Error ? error.message : String(error)}\n` +
+            (await describeInstance(api, processInstanceKey, processId)));
+    }
+    return { userTaskKey: String(tasks[0].userTaskKey), processInstanceKey };
+}
+/** Where the instance actually got to, for the failure message above. */
+async function describeInstance(api, processInstanceKey, processId) {
+    try {
+        const instances = await api.post('/process-instances/search', {
+            body: { filter: { processInstanceKey } },
+        });
+        const elements = await api.post('/element-instances/search', {
+            body: { filter: { processInstanceKey }, page: { limit: 20 } },
+        });
+        // The definition was deployed moments before the instance started, so it
+        // is the control: both travel the same exporter to the same secondary
+        // storage. A definition that arrived while its instance did not is a
+        // fault specific to this instance; neither arriving means export was
+        // behind or stopped for everything, which is a cluster fault rather than
+        // anything these tests can assert around. Run 35696766504 failed 12 tests
+        // without recording which of the two it was.
+        const definitions = await api.post('/process-definitions/search', {
+            body: { filter: { processDefinitionId: processId }, page: { limit: 1 } },
+        });
+        const instanceJson = (await instances.json());
+        const elementJson = (await elements.json());
+        const definitionJson = (await definitions.json());
+        const state = instanceJson.items?.[0]?.state ?? '<no instance found>';
+        const active = (elementJson.items ?? []).map((item) => `${item.elementId}:${item.type}=${item.state}`);
+        const exported = (definitionJson.items ?? []).length > 0;
+        return (`Instance ${processInstanceKey} state=${state}; ` +
+            `element instances: ${active.length > 0 ? active.join(', ') : '<none>'}; ` +
+            `its definition ${processId} ` +
+            `${exported
+                ? 'DID reach secondary storage (export is live, so this instance is the fault)'
+                : 'did NOT reach secondary storage either (export is behind or stopped cluster-wide)'}`);
+    }
+    catch (error) {
+        return `Could not describe instance ${processInstanceKey}: ${error instanceof Error ? error.message : String(error)}`;
+    }
+}
+api_1.test.describe('User tasks', () => {
+    (0, api_1.test)('finds the task created by a running instance', async ({ api, resources, }) => {
+        const { userTaskKey, processInstanceKey } = await startUserTask(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const response = await api.post('/user-tasks/search', {
+            body: { filter: { processInstanceKey } },
+        });
+        const page = await (0, assertions_1.assertPaginated)(response, { exactItems: 1 });
+        const task = page.items[0];
+        (0, test_1.expect)(String(task.userTaskKey)).toBe(userTaskKey);
+        (0, test_1.expect)(task.state).toBe('CREATED');
+    });
+    (0, api_1.test)('returns a task by key', async ({ api, resources }) => {
+        const { userTaskKey, processInstanceKey } = await startUserTask(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const response = await api.get('/user-tasks/{userTaskKey}', {
+            params: { userTaskKey },
+        });
+        const task = (await (0, assertions_1.assertOk)(response));
+        (0, assertions_1.assertRequiredFields)(task, ['userTaskKey', 'state', 'elementId']);
+        (0, test_1.expect)(task.elementId).toBe('task');
+        (0, test_1.expect)(task.state).toBe('CREATED');
+    });
+    (0, api_1.test)('assigns a task to a user', async ({ api, resources }) => {
+        const { userTaskKey, processInstanceKey } = await startUserTask(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const response = await api.post('/user-tasks/{userTaskKey}/assignment', {
+            params: { userTaskKey },
+            body: { assignee: 'demo', allowOverride: true },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'assignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/user-tasks/{userTaskKey}', {
+                params: { userTaskKey },
+            });
+            const task = (await (0, assertions_1.assertOk)(lookup));
+            // The shell suite asserted the 204 and moved on, so an assignment that
+            // was accepted but never applied counted as a pass.
+            (0, test_1.expect)(task.assignee).toBe('demo');
+        });
+    });
+    (0, api_1.test)('unassigns an assigned task', async ({ api, resources }) => {
+        const { userTaskKey, processInstanceKey } = await startUserTask(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        await api.post('/user-tasks/{userTaskKey}/assignment', {
+            params: { userTaskKey },
+            body: { assignee: 'demo', allowOverride: true },
+            tenant: 'none',
+        });
+        const response = await api.delete('/user-tasks/{userTaskKey}/assignee', {
+            params: { userTaskKey },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'unassignment is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/user-tasks/{userTaskKey}', {
+                params: { userTaskKey },
+            });
+            const task = (await (0, assertions_1.assertOk)(lookup));
+            (0, test_1.expect)(task.assignee ?? null).toBeNull();
+        });
+    });
+    (0, api_1.test)('updates a task through a patch', async ({ api, resources }) => {
+        const { userTaskKey, processInstanceKey } = await startUserTask(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const response = await api.patch('/user-tasks/{userTaskKey}', {
+            params: { userTaskKey },
+            body: { changeset: { priority: 75 } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'the patch is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const lookup = await api.get('/user-tasks/{userTaskKey}', {
+                params: { userTaskKey },
+            });
+            const task = (await (0, assertions_1.assertOk)(lookup));
+            (0, test_1.expect)(task.priority).toBe(75);
+        });
+    });
+    (0, api_1.test)('completes a task and finishes the instance', async ({ api, resources, }) => {
+        const { userTaskKey, processInstanceKey } = await startUserTask(api, resources);
+        const response = await api.post('/user-tasks/{userTaskKey}/completion', {
+            params: { userTaskKey },
+            body: { variables: { approved: true } },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204], 'completion is acknowledged');
+        await (0, eventually_1.eventually)(async () => {
+            const search = await api.post('/process-instances/search', {
+                body: { filter: { processInstanceKey } },
+            });
+            const page = await (0, assertions_1.assertPaginated)(search, { exactItems: 1 });
+            (0, test_1.expect)(page.items[0].state).toBe('COMPLETED');
+        });
+    });
+    (0, api_1.test)('searches the variables visible to a task', async ({ api, resources }) => {
+        const { userTaskKey, processInstanceKey } = await startUserTask(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const response = await api.post('/user-tasks/{userTaskKey}/variables/search', { params: { userTaskKey }, body: { filter: {} } });
+        await (0, assertions_1.assertPaginated)(response);
+    });
+    (0, api_1.test)('reports no linked form for a task without one', async ({ api, resources, }) => {
+        const { userTaskKey, processInstanceKey } = await startUserTask(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const response = await api.get('/user-tasks/{userTaskKey}/form', {
+            params: { userTaskKey },
+        });
+        await (0, assertions_1.assertStatusIn)(response, [204, 404], 'a task with no linked form reports 204 on 8.8+ and 404 on earlier minors');
+    });
+    (0, api_1.test)('rejects assigning a completed task', async ({ api, resources }) => {
+        const { userTaskKey } = await startUserTask(api, resources);
+        await api.post('/user-tasks/{userTaskKey}/completion', {
+            params: { userTaskKey },
+            body: { variables: {} },
+            tenant: 'none',
+        });
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/user-tasks/{userTaskKey}/assignment', {
+                params: { userTaskKey },
+                body: { assignee: 'demo', allowOverride: true },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertStatusIn)(response, [404, 409], 'a completed task is either gone or in an invalid state, depending on minor version');
+        });
+    });
+    (0, api_1.test)('rejects a lookup for an absent task key', async ({ api }) => {
+        const response = await api.get('/user-tasks/{userTaskKey}', {
+            params: { userTaskKey: keys_1.ABSENT_KEY },
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects completing an absent task', async ({ api }) => {
+        const response = await api.post('/user-tasks/{userTaskKey}/completion', {
+            params: { userTaskKey: keys_1.ABSENT_ROUTABLE_KEY },
+            body: { variables: {} },
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertNotFound)(response);
+    });
+    (0, api_1.test)('rejects a patch carrying no changeset', async ({ api, resources }) => {
+        const { userTaskKey, processInstanceKey } = await startUserTask(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        const response = await api.patch('/user-tasks/{userTaskKey}', {
+            params: { userTaskKey },
+            body: {},
+            tenant: 'none',
+        });
+        await (0, assertions_1.assertBadRequest)(response);
+    });
+    (0, api_1.test)('rejects an unauthenticated task search', async ({ api }) => {
+        api_1.test.skip(capabilities_1.unauthenticatedAccessAllowed !== false, capabilities_1.unauthenticatedAccessAllowed === false
+            ? ''
+            : capabilities_1.unauthenticatedAccessAllowed);
+        const response = await api.post('/user-tasks/search', {
+            body: { filter: {} },
+            authorization: null,
+        });
+        await (0, assertions_1.assertUnauthorized)(response);
+    });
+    (0, api_1.test)('rejects assigning a task that is already assigned without override', async ({ api, resources, }) => {
+        const { userTaskKey, processInstanceKey } = await startUserTask(api, resources);
+        resources.track('processInstance', processInstanceKey);
+        await api.post('/user-tasks/{userTaskKey}/assignment', {
+            params: { userTaskKey },
+            body: { assignee: 'demo', allowOverride: true },
+            tenant: 'none',
+        });
+        await (0, eventually_1.eventually)(async () => {
+            const response = await api.post('/user-tasks/{userTaskKey}/assignment', {
+                params: { userTaskKey },
+                body: { assignee: 'someone-else', allowOverride: false },
+                tenant: 'none',
+            });
+            await (0, assertions_1.assertConflict)(response);
+        });
+    });
+});

package/dist/utils/api/assertions.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Assertion vocabulary for REST v2 responses.
+ *
+ * Each helper asserts the status *and* the problem body the API documents for
+ * it, so a response that is right by accident fails. The legacy shell suite
+ * asserted status codes only, and accepted lists such as `200 201 403` that
+ * passed whether the call succeeded or was rejected outright.
+ *
+ * Where a status genuinely varies — across versions, or because an operation is
+ * synchronous on one path and accepted-for-later on another — use
+ * `assertStatusIn`, which requires the reason in writing at the call site.
+ */
+import { type APIResponse } from '@playwright/test';
+/** Fields every paginated search response carries. */
+export declare const PAGINATED_FIELDS: readonly ["items", "page"];
+export declare function assertStatus(response: APIResponse, expected: number): Promise<void>;
+/**
+ * Accepts any of `expected`. `reason` documents why the endpoint may answer
+ * with more than one status and is printed on failure — it is required so that
+ * widening an assertion is a deliberate, reviewable act.
+ */
+export declare function assertStatusIn(response: APIResponse, expected: readonly number[], reason: string): Promise<void>;
+export declare function assertRequiredFields(payload: unknown, required: readonly string[]): void;
+export declare function assertEqualsForKeys(payload: unknown, expected: Record<string, unknown>, keys: readonly string[]): void;
+export declare function assertOk(response: APIResponse): Promise<unknown>;
+export declare function assertCreated(response: APIResponse): Promise<unknown>;
+export declare function assertNoContent(response: APIResponse): Promise<void>;
+export declare function assertUnauthorized(response: APIResponse): Promise<void>;
+/**
+ * A 403 does not carry one fixed problem title. The authorization layer sends
+ * `FORBIDDEN`, while the filter that closes `/v2/users/**` on an OIDC cluster
+ * sends `Access issue` — both are the API refusing the call. The status and
+ * the detail carry the meaning, so the title is matched loosely and the
+ * caller pins the specific refusal through `detail`.
+ */
+export declare function assertForbidden(response: APIResponse, detail?: string | RegExp): Promise<void>;
+export declare function assertNotFound(response: APIResponse, detail?: string | RegExp): Promise<void>;
+export declare function assertConflict(response: APIResponse, detail?: string | RegExp): Promise<void>;
+export declare function assertBadRequest(response: APIResponse, detail?: string | RegExp, title?: string | RegExp): Promise<void>;
+export declare function assertPaginated(response: APIResponse, options?: {
+    minItems?: number;
+    exactItems?: number;
+    minTotalItems?: number;
+    exactTotalItems?: number;
+}): Promise<{
+    items: unknown[];
+    page: {
+        totalItems: number;
+    };
+}>;