@camunda/e2e-test-suite 0.0.1242 → 0.0.1244

package/dist/utils/api/assertions.js

@@ -0,0 +1,142 @@
+"use strict";
+/**
+ * Assertion vocabulary for REST v2 responses.
+ *
+ * Each helper asserts the status *and* the problem body the API documents for
+ * it, so a response that is right by accident fails. The legacy shell suite
+ * asserted status codes only, and accepted lists such as `200 201 403` that
+ * passed whether the call succeeded or was rejected outright.
+ *
+ * Where a status genuinely varies — across versions, or because an operation is
+ * synchronous on one path and accepted-for-later on another — use
+ * `assertStatusIn`, which requires the reason in writing at the call site.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertPaginated = exports.assertBadRequest = exports.assertConflict = exports.assertNotFound = exports.assertForbidden = exports.assertUnauthorized = exports.assertNoContent = exports.assertCreated = exports.assertOk = exports.assertEqualsForKeys = exports.assertRequiredFields = exports.assertStatusIn = exports.assertStatus = exports.PAGINATED_FIELDS = void 0;
+const test_1 = require("@playwright/test");
+/** Fields every RFC 7807 problem body from the API carries. */
+const PROBLEM_FIELDS = ['title', 'detail'];
+/** Fields every paginated search response carries. */
+exports.PAGINATED_FIELDS = ['items', 'page'];
+async function describe(response) {
+    const body = await response.text().catch(() => '<unreadable body>');
+    return `${response.url()} -> ${response.status()}\n${body}`;
+}
+async function assertStatus(response, expected) {
+    if (response.status() !== expected) {
+        throw new Error(`Expected status ${expected}, got ${response.status()}.\n${await describe(response)}`);
+    }
+}
+exports.assertStatus = assertStatus;
+/**
+ * Accepts any of `expected`. `reason` documents why the endpoint may answer
+ * with more than one status and is printed on failure — it is required so that
+ * widening an assertion is a deliberate, reviewable act.
+ */
+async function assertStatusIn(response, expected, reason) {
+    if (!expected.includes(response.status())) {
+        throw new Error(`Expected one of [${expected.join(', ')}] (${reason}), got ${response.status()}.\n${await describe(response)}`);
+    }
+}
+exports.assertStatusIn = assertStatusIn;
+function assertRequiredFields(payload, required) {
+    (0, test_1.expect)(payload, 'response body should be an object').toBeTruthy();
+    const record = payload;
+    const missing = required.filter((field) => !Object.prototype.hasOwnProperty.call(record, field) ||
+        record[field] === undefined);
+    if (missing.length > 0) {
+        throw new Error(`Response is missing required field(s): ${missing.join(', ')}\n` +
+            `Body: ${JSON.stringify(payload, null, 2)}`);
+    }
+}
+exports.assertRequiredFields = assertRequiredFields;
+function assertEqualsForKeys(payload, expected, keys) {
+    const record = payload;
+    for (const key of keys) {
+        (0, test_1.expect)(record?.[key], `field "${key}"`).toEqual(expected[key]);
+    }
+}
+exports.assertEqualsForKeys = assertEqualsForKeys;
+async function assertProblem(response, status, title, detail) {
+    await assertStatus(response, status);
+    const json = await response.json();
+    assertRequiredFields(json, PROBLEM_FIELDS);
+    if (typeof title === 'string') {
+        (0, test_1.expect)(json.title, `problem title for ${response.url()}`).toBe(title);
+    }
+    else {
+        (0, test_1.expect)(String(json.title)).toMatch(title);
+    }
+    if (detail !== undefined) {
+        (0, test_1.expect)(String(json.detail)).toMatch(typeof detail === 'string'
+            ? new RegExp(detail.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'i')
+            : detail);
+    }
+}
+async function assertOk(response) {
+    await assertStatus(response, 200);
+    return response.json();
+}
+exports.assertOk = assertOk;
+async function assertCreated(response) {
+    await assertStatus(response, 201);
+    return response.json();
+}
+exports.assertCreated = assertCreated;
+async function assertNoContent(response) {
+    await assertStatus(response, 204);
+}
+exports.assertNoContent = assertNoContent;
+async function assertUnauthorized(response) {
+    await assertStatus(response, 401);
+    const json = await response.json().catch(() => undefined);
+    // 401 may be produced by the ingress or the security filter chain before the
+    // API's problem-body writer runs, so only assert the body when there is one.
+    if (json) {
+        (0, test_1.expect)(String(json.title)).toMatch(/unauthorized/i);
+    }
+}
+exports.assertUnauthorized = assertUnauthorized;
+/**
+ * A 403 does not carry one fixed problem title. The authorization layer sends
+ * `FORBIDDEN`, while the filter that closes `/v2/users/**` on an OIDC cluster
+ * sends `Access issue` — both are the API refusing the call. The status and
+ * the detail carry the meaning, so the title is matched loosely and the
+ * caller pins the specific refusal through `detail`.
+ */
+async function assertForbidden(response, detail) {
+    await assertProblem(response, 403, /forbidden|access issue/i, detail);
+}
+exports.assertForbidden = assertForbidden;
+async function assertNotFound(response, detail) {
+    await assertProblem(response, 404, /not[_ ]?found/i, detail);
+}
+exports.assertNotFound = assertNotFound;
+async function assertConflict(response, detail) {
+    await assertProblem(response, 409, /already[_ ]exists|invalid[_ ]state/i, detail);
+}
+exports.assertConflict = assertConflict;
+async function assertBadRequest(response, detail, title = /invalid[_ ]argument|bad request/i) {
+    await assertProblem(response, 400, title, detail);
+}
+exports.assertBadRequest = assertBadRequest;
+async function assertPaginated(response, options = {}) {
+    await assertStatus(response, 200);
+    const json = await response.json();
+    assertRequiredFields(json, exports.PAGINATED_FIELDS);
+    (0, test_1.expect)(Array.isArray(json.items), 'items should be an array').toBe(true);
+    if (options.minItems !== undefined) {
+        (0, test_1.expect)(json.items.length).toBeGreaterThanOrEqual(options.minItems);
+    }
+    if (options.exactItems !== undefined) {
+        (0, test_1.expect)(json.items.length).toBe(options.exactItems);
+    }
+    if (options.minTotalItems !== undefined) {
+        (0, test_1.expect)(json.page.totalItems).toBeGreaterThanOrEqual(options.minTotalItems);
+    }
+    if (options.exactTotalItems !== undefined) {
+        (0, test_1.expect)(json.page.totalItems).toBe(options.exactTotalItems);
+    }
+    return json;
+}
+exports.assertPaginated = assertPaginated;

package/dist/utils/api/auth.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Authentication strategies for the Orchestration Cluster REST v2 API.
+ *
+ * The orchestration-cluster suite in `camunda/camunda` hardcodes Basic auth, so
+ * it cannot drive an OIDC-secured cluster. Helm-upgrade runs are OIDC, which is
+ * why this layer exists: it resolves an `Authorization` header from whichever
+ * strategy the environment selects, and refreshes bearer tokens before they
+ * expire so a long suite does not start 401-ing part way through.
+ */
+import type { APIRequestContext } from '@playwright/test';
+import { type ApiConfig } from './config';
+/**
+ * The `Authorization` header for the suite's principal, refreshed when stale.
+ * Throws rather than returning an unauthenticated header, so a broken token
+ * endpoint surfaces as a setup error instead of 300 misleading 401 assertions.
+ */
+export declare function authHeader(request: APIRequestContext, config?: ApiConfig): Promise<string>;
+/**
+ * A bearer header for a different OAuth2 client, used by the authorization
+ * enforcement tests to act as an under-privileged principal. Returns undefined
+ * when the client cannot authenticate, which those tests assert on directly.
+ */
+export declare function clientAuthHeader(request: APIRequestContext, clientId: string, clientSecret: string, config?: ApiConfig): Promise<string | undefined>;
+/** A bearer header obtained via the password grant, for per-user assertions. */
+export declare function userAuthHeader(request: APIRequestContext, username: string, password: string, config?: ApiConfig): Promise<string | undefined>;
+/** Drops cached tokens. Used by tests that deliberately invalidate a principal. */
+export declare function clearTokenCache(): void;

package/dist/utils/api/auth.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * Authentication strategies for the Orchestration Cluster REST v2 API.
+ *
+ * The orchestration-cluster suite in `camunda/camunda` hardcodes Basic auth, so
+ * it cannot drive an OIDC-secured cluster. Helm-upgrade runs are OIDC, which is
+ * why this layer exists: it resolves an `Authorization` header from whichever
+ * strategy the environment selects, and refreshes bearer tokens before they
+ * expire so a long suite does not start 401-ing part way through.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearTokenCache = exports.userAuthHeader = exports.clientAuthHeader = exports.authHeader = void 0;
+const config_1 = require("./config");
+/**
+ * Re-fetch this long before the server-stated expiry. A request issued at the
+ * very edge of a token's lifetime can still arrive expired, and the suite runs
+ * long enough for that to be a routine occurrence rather than a rare race.
+ */
+const EXPIRY_MARGIN_MS = 60000;
+/** Fallback lifetime when the token endpoint omits `expires_in`. */
+const DEFAULT_TOKEN_TTL_MS = 300000;
+const tokenCache = new Map();
+function cacheKey(clientId, subject = '') {
+    return `${clientId}::${subject}`;
+}
+function basicHeader(username, password) {
+    return `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`;
+}
+async function fetchToken(request, tokenUrl, form) {
+    let response;
+    try {
+        response = await request.post(tokenUrl, {
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            form,
+        });
+    }
+    catch (error) {
+        // An unreachable token endpoint is the single most likely reason a whole
+        // run fails: on a Helm cluster the identity provider may not be serving
+        // yet. Reported raw, it surfaces as a Playwright stack inside auth.ts on
+        // every one of the suite's tests, which says nothing about the cause.
+        console.error(`Token endpoint ${tokenUrl} is unreachable: ${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+    if (!response.ok()) {
+        const body = await response.text().catch(() => '<no-body>');
+        console.error(`Token request to ${tokenUrl} failed with ${response.status()}: ${body}`);
+        return undefined;
+    }
+    const json = (await response.json());
+    if (!json.access_token) {
+        console.error(`Token response from ${tokenUrl} carried no access_token`);
+        return undefined;
+    }
+    const ttl = json.expires_in ? json.expires_in * 1000 : DEFAULT_TOKEN_TTL_MS;
+    return {
+        header: `Bearer ${json.access_token}`,
+        expiresAt: Date.now() + Math.max(ttl - EXPIRY_MARGIN_MS, 0),
+    };
+}
+function clientCredentialsForm(oauth, clientId, clientSecret) {
+    const form = {
+        grant_type: 'client_credentials',
+        client_id: clientId,
+        client_secret: clientSecret,
+    };
+    if (oauth.audience)
+        form.audience = oauth.audience;
+    if (oauth.scope)
+        form.scope = oauth.scope;
+    return form;
+}
+/**
+ * The `Authorization` header for the suite's principal, refreshed when stale.
+ * Throws rather than returning an unauthenticated header, so a broken token
+ * endpoint surfaces as a setup error instead of 300 misleading 401 assertions.
+ */
+async function authHeader(request, config = config_1.apiConfig) {
+    if (config.authMethod === 'basic') {
+        return basicHeader(config.basic.username, config.basic.password);
+    }
+    const key = cacheKey(config.oauth.clientId);
+    const cached = tokenCache.get(key);
+    if (cached && cached.expiresAt > Date.now()) {
+        return cached.header;
+    }
+    const token = await fetchToken(request, config.oauth.tokenUrl, clientCredentialsForm(config.oauth, config.oauth.clientId, config.oauth.clientSecret));
+    if (!token) {
+        throw new Error(`Could not obtain an OAuth2 token for client "${config.oauth.clientId}" from ${config.oauth.tokenUrl}`);
+    }
+    tokenCache.set(key, token);
+    return token.header;
+}
+exports.authHeader = authHeader;
+/**
+ * A bearer header for a different OAuth2 client, used by the authorization
+ * enforcement tests to act as an under-privileged principal. Returns undefined
+ * when the client cannot authenticate, which those tests assert on directly.
+ */
+async function clientAuthHeader(request, clientId, clientSecret, config = config_1.apiConfig) {
+    const key = cacheKey(clientId);
+    const cached = tokenCache.get(key);
+    if (cached && cached.expiresAt > Date.now()) {
+        return cached.header;
+    }
+    const token = await fetchToken(request, config.oauth.tokenUrl, clientCredentialsForm(config.oauth, clientId, clientSecret));
+    if (!token)
+        return undefined;
+    tokenCache.set(key, token);
+    return token.header;
+}
+exports.clientAuthHeader = clientAuthHeader;
+/** A bearer header obtained via the password grant, for per-user assertions. */
+async function userAuthHeader(request, username, password, config = config_1.apiConfig) {
+    const key = cacheKey(config.oauth.clientId, username);
+    const cached = tokenCache.get(key);
+    if (cached && cached.expiresAt > Date.now()) {
+        return cached.header;
+    }
+    const token = await fetchToken(request, config.oauth.tokenUrl, {
+        grant_type: 'password',
+        client_id: config.oauth.clientId,
+        client_secret: config.oauth.clientSecret,
+        username,
+        password,
+    });
+    if (!token)
+        return undefined;
+    tokenCache.set(key, token);
+    return token.header;
+}
+exports.userAuthHeader = userAuthHeader;
+/** Drops cached tokens. Used by tests that deliberately invalidate a principal. */
+function clearTokenCache() {
+    tokenCache.clear();
+}
+exports.clearTokenCache = clearTokenCache;

package/dist/utils/api/beans.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Request bodies for identity resources.
+ *
+ * Every factory randomises its identifier. The shell suite seeded ids from
+ * `$(date +%s)-$$`, which collides between workers started in the same second
+ * and left tests fighting over the same role or group.
+ */
+export declare const roleRequiredFields: readonly ["roleId", "name", "description"];
+export declare const groupRequiredFields: readonly ["groupId", "name"];
+export declare const tenantRequiredFields: readonly ["tenantId", "name"];
+export declare const userRequiredFields: readonly ["username", "name", "email"];
+export declare const mappingRuleRequiredFields: readonly ["mappingRuleId", "claimName", "claimValue", "name"];
+export declare function newRole(overrides?: Record<string, unknown>): {
+    roleId: string;
+    name: string;
+    description: string;
+};
+export declare function newGroup(overrides?: Record<string, unknown>): {
+    groupId: string;
+    name: string;
+    description: string;
+};
+export declare function newTenant(overrides?: Record<string, unknown>): {
+    tenantId: string;
+    name: string;
+    description: string;
+};
+export declare function newUser(overrides?: Record<string, unknown>): {
+    username: string;
+    name: string;
+    email: string;
+    password: string;
+};
+export declare function newMappingRule(overrides?: Record<string, unknown>): {
+    mappingRuleId: string;
+    claimName: string;
+    claimValue: string;
+    name: string;
+};
+export declare function newAuthorization(overrides?: Record<string, unknown>): {
+    ownerId: string;
+    ownerType: string;
+    resourceId: string;
+    resourceType: string;
+    permissionTypes: string[];
+};

package/dist/utils/api/beans.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * Request bodies for identity resources.
+ *
+ * Every factory randomises its identifier. The shell suite seeded ids from
+ * `$(date +%s)-$$`, which collides between workers started in the same second
+ * and left tests fighting over the same role or group.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.newAuthorization = exports.newMappingRule = exports.newUser = exports.newTenant = exports.newGroup = exports.newRole = exports.mappingRuleRequiredFields = exports.userRequiredFields = exports.tenantRequiredFields = exports.groupRequiredFields = exports.roleRequiredFields = void 0;
+const node_crypto_1 = require("node:crypto");
+function suffix() {
+    return (0, node_crypto_1.randomUUID)().slice(0, 8);
+}
+exports.roleRequiredFields = ['roleId', 'name', 'description'];
+exports.groupRequiredFields = ['groupId', 'name'];
+exports.tenantRequiredFields = ['tenantId', 'name'];
+exports.userRequiredFields = ['username', 'name', 'email'];
+exports.mappingRuleRequiredFields = [
+    'mappingRuleId',
+    'claimName',
+    'claimValue',
+    'name',
+];
+function newRole(overrides = {}) {
+    const id = `role-${suffix()}`;
+    return {
+        roleId: id,
+        name: `Role ${id}`,
+        description: `Created by the REST v2 API suite`,
+        ...overrides,
+    };
+}
+exports.newRole = newRole;
+function newGroup(overrides = {}) {
+    const id = `group-${suffix()}`;
+    return {
+        groupId: id,
+        name: `Group ${id}`,
+        description: `Created by the REST v2 API suite`,
+        ...overrides,
+    };
+}
+exports.newGroup = newGroup;
+function newTenant(overrides = {}) {
+    const id = `tenant-${suffix()}`;
+    return {
+        tenantId: id,
+        name: `Tenant ${id}`,
+        description: `Created by the REST v2 API suite`,
+        ...overrides,
+    };
+}
+exports.newTenant = newTenant;
+function newUser(overrides = {}) {
+    const id = `user-${suffix()}`;
+    return {
+        username: id,
+        name: `User ${id}`,
+        email: `${id}@example.com`,
+        password: 'SecurePass123!',
+        ...overrides,
+    };
+}
+exports.newUser = newUser;
+function newMappingRule(overrides = {}) {
+    const id = `rule-${suffix()}`;
+    return {
+        mappingRuleId: id,
+        claimName: `claim-${suffix()}`,
+        claimValue: `value-${suffix()}`,
+        name: `Mapping rule ${id}`,
+        ...overrides,
+    };
+}
+exports.newMappingRule = newMappingRule;
+function newAuthorization(overrides = {}) {
+    return {
+        ownerId: `owner-${suffix()}`,
+        ownerType: 'GROUP',
+        resourceId: '*',
+        resourceType: 'PROCESS_DEFINITION',
+        permissionTypes: ['READ_PROCESS_DEFINITION'],
+        ...overrides,
+    };
+}
+exports.newAuthorization = newAuthorization;

package/dist/utils/api/bpmn.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Minimal BPMN/DMN builders for API-level tests.
+ *
+ * The legacy shell suite pasted 18 near-identical BPMN documents inline as
+ * heredocs, several of them interpolating a process id. Building the XML gives
+ * every test a unique process id without a new file per shape, which is what
+ * the suite's isolation rules require — reused ids collide across parallel
+ * workers and produce cross-test flakiness.
+ *
+ * Only the shapes the API tests need are modelled. Anything requiring real
+ * diagram semantics belongs in `resources/` as a checked-in file.
+ */
+export interface ProcessElement {
+    xml: string;
+    id: string;
+    /**
+     * Fragments that must sit beside `<bpmn:process>` rather than inside it —
+     * `<bpmn:message>` is the only one the API tests need.
+     */
+    definitionsFragment?: string;
+}
+/** A process/decision id that cannot collide with another worker's. */
+export declare function uniqueId(prefix: string): string;
+export declare const element: {
+    serviceTask(jobType: string, id?: string): ProcessElement;
+    userTask(id?: string, formId?: string): ProcessElement;
+    messageCatch(messageName: string, correlationKey?: string, id?: string): ProcessElement;
+    businessRuleTask(decisionId: string, id?: string): ProcessElement;
+    callActivity(calledProcessId: string, id?: string): ProcessElement;
+};
+/**
+ * A single-path process: start event -> the given element -> end event.
+ * No DI is emitted; the engine does not require it and no test reads it.
+ */
+export declare function linearProcess(processId: string, body: ProcessElement, options?: {
+    name?: string;
+}): string;
+/** A process whose only content is a start and end event. */
+export declare function emptyProcess(processId: string): string;
+/**
+ * A process whose start event links a deployed form, so that
+ * `GET /v2/process-definitions/{key}/form` has something to return. The form
+ * must already be deployed (or ride in the same deployment), otherwise the
+ * broker rejects the reference.
+ */
+export declare function startFormProcess(processId: string, formId: string): string;
+/** A one-rule DMN decision that echoes its input, for evaluation tests. */
+export declare function simpleDecision(decisionId: string, definitionsId?: string): string;
+/** A minimal Camunda form with two text fields, for form submission tests. */
+export declare function simpleForm(formId: string): string;