@camunda/e2e-test-suite 0.0.1247 → 0.0.1249

package/dist/utils/consoleApiHelpers.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.waitForAiFeaturesEnabledViaApi = exports.areAiFeaturesEnabledViaApi = exports.waitForClusterRestartHealthyViaApi = exports.waitForClusterHealthyViaApi = exports.ensureClientAuditLoggingViaApi = exports.ensureTasklistV2Enabled = exports.ensureClusterViaApi = exports.createClusterViaApi = exports.deleteClusterViaApi = void 0;
+exports.waitForAiFeaturesEnabledViaApi = exports.areAiFeaturesEnabledViaApi = exports.waitForClusterRestartHealthyViaApi = exports.waitForClusterHealthyViaApi = exports.ensureClientAuditLoggingViaApi = exports.ensureTasklistV2Enabled = exports.ensureClusterViaApi = exports.createClusterViaApi = exports.deleteClusterViaApi = exports.resetHubBearerToken = void 0;
 const test_1 = require("@playwright/test");
 const sleep_1 = require("./sleep");
 const PLAN_TYPE_ID = '574cde5f-54ae-43c1-851a-e6fb4f03423a';
@@ -31,10 +31,103 @@ function getOrgId() {
         throw new Error('ORG_ID env var is not set');
     return orgId;
 }
+// Camunda Hub, which replaced the Console frontend on SaaS, keeps its Auth0
+// token out of localStorage but sends it as a Bearer header on its own calls
+// to the Console/Accounts APIs (it polls console.cloud.*/external/events), so
+// remember the latest one seen per page.
+const observedBearerTokens = new WeakMap();
+const tokenObservedPages = new WeakSet();
+// Bumped by resetHubBearerToken() on every session reset. Both the listener
+// below and getHubBearerToken()'s waitForRequest fallback read this
+// synchronously right before their async header/token extraction and
+// re-check it after: a request that started under the previous session but
+// resolves after the epoch moved on is discarded instead of being cached or
+// returned as if it belonged to the new session.
+const sessionEpoch = new WeakMap();
+const CLOUD_API_HOST = /^https:\/\/(console|accounts)\.cloud\./;
+const BEARER_WAIT_TIMEOUT_MS = 60000;
+function bearerTokenOf(url, authorization) {
+    if (!CLOUD_API_HOST.test(url) || !authorization?.startsWith('Bearer ')) {
+        return null;
+    }
+    return authorization.slice('Bearer '.length);
+}
+function observeBearerTokens(page) {
+    if (tokenObservedPages.has(page)) {
+        return;
+    }
+    tokenObservedPages.add(page);
+    // allHeaders(): headers() only exposes the provisional request headers,
+    // which do not carry Authorization.
+    page.on('request', async (request) => {
+        if (!CLOUD_API_HOST.test(request.url())) {
+            return;
+        }
+        const epochAtRequestTime = sessionEpoch.get(page) ?? 0;
+        const headers = await request.allHeaders().catch(() => undefined);
+        const token = bearerTokenOf(request.url(), headers?.authorization);
+        if (token && sessionEpoch.get(page) === epochAtRequestTime) {
+            observedBearerTokens.set(page, token);
+        }
+    });
+}
+// Exported so LoginPage can call this before a new login begins. Without it,
+// a page that signs in as a second user keeps answering getHubBearerToken()
+// with the first user's cached token until some later console.cloud/
+// accounts.cloud request happens to fire -- API calls made in between (e.g.
+// role-change verification right after switching users) would silently run
+// as the wrong user instead of failing loudly.
+//
+// Only the cached VALUE is cleared -- tokenObservedPages (and the listener it
+// guards) is deliberately left alone; the listener doesn't care which user's
+// token it's writing, so removing its registration marker here would attach
+// a second page.on('request') listener on top of the still-attached first
+// one on the next observeBearerTokens() call, and a third after the next
+// reset, and so on. Bumping sessionEpoch guards against an in-flight request
+// from the PREVIOUS session resolving its allHeaders() after this clear
+// runs, which would otherwise repopulate the cache with the stale token.
+function resetHubBearerToken(page) {
+    observedBearerTokens.delete(page);
+    sessionEpoch.set(page, (sessionEpoch.get(page) ?? 0) + 1);
+}
+exports.resetHubBearerToken = resetHubBearerToken;
+async function getHubBearerToken(page) {
+    observeBearerTokens(page);
+    const deadline = Date.now() + BEARER_WAIT_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+        const cached = observedBearerTokens.get(page);
+        if (cached) {
+            return cached;
+        }
+        // This waitForRequest -- unlike the page.on('request') listener above --
+        // resolves and extracts a token directly, bypassing the cache entirely.
+        // Capture the epoch before waiting so a session reset that lands while
+        // this await is pending (letting an in-flight request from the OLD
+        // session satisfy the host-only predicate below) is caught: such a
+        // request's token is discarded instead of being returned as if it were
+        // the new session's.
+        const epochBeforeWait = sessionEpoch.get(page) ?? 0;
+        const request = await page
+            .waitForRequest((r) => CLOUD_API_HOST.test(r.url()), {
+            timeout: Math.max(deadline - Date.now(), 1),
+        })
+            .catch(() => null);
+        if (!request) {
+            break;
+        }
+        const headers = await request.allHeaders().catch(() => undefined);
+        const token = bearerTokenOf(request.url(), headers?.authorization);
+        if (token && sessionEpoch.get(page) === epochBeforeWait) {
+            return token;
+        }
+    }
+    return observedBearerTokens.get(page) ?? null;
+}
 // Auth0 SPA JS stores tokens in localStorage under keys starting with @@auth0spajs@@
 // cacheLocation: 'localstorage' is configured in the Console frontend auth store
 async function getUserToken(page) {
-    const token = await page.evaluate(() => {
+    observeBearerTokens(page);
+    const storedToken = await page.evaluate(() => {
         for (const key of Object.keys(localStorage)) {
             if (key.startsWith('@@auth0spajs@@')) {
                 try {
@@ -49,9 +142,11 @@ async function getUserToken(page) {
         }
         return null;
     });
+    const token = storedToken ?? (await getHubBearerToken(page));
     if (!token) {
-        throw new Error('Could not extract access token from browser localStorage — ' +
-            'ensure loginWithRetry has been called before any cluster API operations');
+        throw new Error('Could not extract an access token from either browser localStorage ' +
+            'or an observed Hub Bearer header — ensure loginWithRetry has been ' +
+            'called before any cluster API operations');
     }
     return token;
 }
@@ -263,6 +358,27 @@ function pickGenerationByName(channels, generationName) {
     throw new Error(`Source generation "${generationName}" not found in any channel's ` +
         `allowed generations`);
 }
+// Resolve the version-keyed snapshot generation live by name. The snapshot is
+// named "<minor> Cross Component Test Suite" (see .github/c8_versions.json) and
+// is periodically recreated in Console INT with a fresh UUID -- and can move
+// channels -- which invalidates the hardcoded GENERATION_MAP/CHANNEL_ID pairing.
+// Matching is whitespace-normalised and case-insensitive so a cosmetic rename
+// does not miss it; the recreated-and-renamed predecessor ("Old - <minor> ...")
+// no longer normalises to the wanted name and is also dropped from
+// allowedGenerations, so it is never picked.
+function pickSnapshotGeneration(channels, minorVersion) {
+    const normalise = (value) => value.replace(/\s+/g, ' ').trim().toLowerCase();
+    const wanted = normalise(`${minorVersion} Cross Component Test Suite`);
+    for (const channel of channels) {
+        const match = (channel.allowedGenerations ?? []).find((generation) => normalise(generation.name) === wanted);
+        if (match) {
+            console.log(`Resolved snapshot generation "${match.name}" for Camunda ` +
+                `${minorVersion} from channel "${channel.name}" (${match.uuid})`);
+            return { channelId: channel.uuid, generationId: match.uuid };
+        }
+    }
+    return undefined;
+}
 // Migration source cluster target: honor an explicit Source Generation (passed
 // via CLUSTER_VERSION) when set; otherwise auto-select the latest stable
 // generation for the source minor version.
@@ -341,6 +457,11 @@ async function createClusterViaApi(page, clusterName, region = 'GCP', tasklistV2
     // operator's chosen generation is used instead of the version-keyed snapshot.
     let channelId = CHANNEL_ID;
     let generationId;
+    // Only the default (snapshot) path uses the hardcoded GENERATION_MAP/CHANNEL_ID
+    // pairing that a Console generation rotation can invalidate; the explicit
+    // paths already resolve live (or carry a real per-run UUID), so their 400s
+    // are genuine and must not be retried.
+    let usedSnapshotDefault = false;
     const requestedGeneration = requestedGenerationName();
     if (process.env.CLUSTER_GENERATION_ID) {
         generationId = process.env.CLUSTER_GENERATION_ID;
@@ -357,34 +478,15 @@ async function createClusterViaApi(page, clusterName, region = 'GCP', tasklistV2
     }
     else {
         generationId = resolveGenerationId();
+        usedSnapshotDefault = true;
     }
     const k8sContextId = region.toUpperCase() === 'AWS' ? AWS_REGION_ID : GCP_REGION_ID;
-    let createResponse;
-    try {
-        createResponse = await clusterApiRequest(page, 'POST', `${getConsoleBaseUrl()}/api/orgs/${orgId}/clusters`, {
-            name: clusterName,
-            planTypeId: PLAN_TYPE_ID,
-            channelId,
-            generationId,
-            k8sContextId,
-            autoUpdate: true,
-            stageLabel: 'dev',
-            // Always sent explicitly rather than omitted: Console defaults an unset
-            // field to v2-enabled for any generation >= 8.8, and the switch to v2 is
-            // one-way -- a cluster that ends up v2-enabled can never be brought back
-            // to v1 for the rest of its life. v2 cannot run job-worker-based user
-            // tasks, draft variables, or public start forms, so the v1 leg
-            // (@tasklistV1-tagged suites) depends on this being false, and the v2 leg
-            // equally depends on it being true.
-            tasklistV2Enabled,
-        });
-    }
-    catch (error) {
-        // Console does not cancel the create when the client stops waiting: it
-        // answers /clusters slower than the request timeout while still creating
-        // the cluster. Adopt what the timed-out POST made instead of re-POSTing,
-        // which would leave two clusters under the same name and break
-        // clickClusterLink in strict mode.
+    // Console does not cancel the create when the client stops waiting: it
+    // answers /clusters slower than the request timeout while still creating the
+    // cluster. Adopt what the timed-out POST made instead of re-POSTing, which
+    // would leave two clusters under the same name and break clickClusterLink in
+    // strict mode.
+    const recoverTimedOutCreate = async (error) => {
         const recovered = await findClusterByNameWithRetry(page, clusterName);
         if (!recovered)
             throw error;
@@ -392,6 +494,57 @@ async function createClusterViaApi(page, clusterName, region = 'GCP', tasklistV2
             `clusterId=${recovered.uuid} namespace=${recovered.uuid}-zeebe ` +
             `orgId=${orgId} tasklistMode=${tasklistV2Enabled ? 'v2' : 'v1'}`);
         return recovered.uuid;
+    };
+    const attemptCreate = (chId, genId) => clusterApiRequest(page, 'POST', `${getConsoleBaseUrl()}/api/orgs/${orgId}/clusters`, {
+        name: clusterName,
+        planTypeId: PLAN_TYPE_ID,
+        channelId: chId,
+        generationId: genId,
+        k8sContextId,
+        autoUpdate: true,
+        stageLabel: 'dev',
+        // Always sent explicitly rather than omitted: Console defaults an unset
+        // field to v2-enabled for any generation >= 8.8, and the switch to v2 is
+        // one-way -- a cluster that ends up v2-enabled can never be brought back
+        // to v1 for the rest of its life. v2 cannot run job-worker-based user
+        // tasks, draft variables, or public start forms, so the v1 leg
+        // (@tasklistV1-tagged suites) depends on this being false, and the v2 leg
+        // equally depends on it being true.
+        tasklistV2Enabled,
+    });
+    let createResponse;
+    try {
+        createResponse = await attemptCreate(channelId, generationId);
+    }
+    catch (error) {
+        return recoverTimedOutCreate(error);
+    }
+    // The version-keyed snapshot generation is periodically recreated in Console
+    // INT with a fresh UUID (and can change channel), which invalidates the
+    // hardcoded GENERATION_MAP/CHANNEL_ID pairing and rejects the create with
+    // HTTP 400 "Generation is not part of allowed generations of selected
+    // channel". On the default (snapshot) path, re-resolve the generation live by
+    // name and retry once so a rotation self-heals instead of failing every setup
+    // until the UUID is hand-updated. A missing live match falls through to the
+    // error below, so the outcome is never worse than before.
+    if (usedSnapshotDefault &&
+        createResponse.status() === 400 &&
+        (await createResponse.text()).includes('allowed generations')) {
+        const minorVersion = resolveMinorVersion();
+        const snapshot = pickSnapshotGeneration(await fetchClusterChannels(page), minorVersion);
+        if (snapshot &&
+            (snapshot.channelId !== channelId ||
+                snapshot.generationId !== generationId)) {
+            console.log(`Snapshot generation for Camunda ${minorVersion} was rotated; ` +
+                `retrying cluster create with live-resolved generation ` +
+                `${snapshot.generationId} on channel ${snapshot.channelId}`);
+            try {
+                createResponse = await attemptCreate(snapshot.channelId, snapshot.generationId);
+            }
+            catch (error) {
+                return recoverTimedOutCreate(error);
+            }
+        }
     }
     if (createResponse.status() !== 200 && createResponse.status() !== 201) {
         throw new Error(`Failed to create cluster "${clusterName}": ` +

package/dist/utils/resetSession.js

@@ -1,9 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resetSessionAll = exports.resetSession = void 0;
+const consoleApiHelpers_1 = require("./consoleApiHelpers");
 async function resetSession(browser, page) {
     const context = browser.contexts()[0];
     await context.clearCookies();
+    // See loginWithRetry in UtilitiesPage.ts: the Hub bearer-token cache in
+    // consoleApiHelpers.ts is keyed by Page for the tab's whole lifetime, so a
+    // session reset that re-authenticates as a different user must clear it
+    // too, or getUserToken() can return the previous user's cached token.
+    (0, consoleApiHelpers_1.resetHubBearerToken)(page);
     await page.reload();
     await page.waitForLoadState('domcontentloaded');
     await page.goto('/');
@@ -17,6 +23,7 @@ async function resetSessionAll(context, page) {
             localStorage.clear();
             sessionStorage.clear();
         });
+        (0, consoleApiHelpers_1.resetHubBearerToken)(page);
     }
     await page.reload();
     await page.goto('/');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/e2e-test-suite",
-  "version": "0.0.1247",
+  "version": "0.0.1249",
   "description": "End-to-end test helpers for Camunda 8",
   "repository": {
     "type": "git",