@camunda/e2e-test-suite 0.0.1248 → 0.0.1249

package/dist/pages/8.9/LoginPage.js

@@ -5,6 +5,7 @@ const test_1 = require("@playwright/test");
 const authErrorClassification_1 = require("../../utils/authErrorClassification");
 const UtilitiesPage_1 = require("./UtilitiesPage");
 const sessionRecovery_1 = require("../../utils/sessionRecovery");
+const consoleApiHelpers_1 = require("../../utils/consoleApiHelpers");
 const userNameInputValidInputSchema = {
     _schema: {
         maxlength: 254,
@@ -66,9 +67,23 @@ class LoginPage {
     async clickLoginButton() {
         await this.loginButton.click({ timeout: 60000 });
     }
+    // Auth0 responds to a rejected password by re-rendering the same password
+    // step with an error message rather than navigating anywhere, so success
+    // and failure aren't told apart by a URL or element one side has and the
+    // other doesn't. Without this check, a permanently wrong password falls
+    // through into assertTestUsesCorrectOrganization's generic ~120s wait for a
+    // Console/Hub shell that is never coming, and loginWithRetry then spends
+    // its remaining attempts resubmitting the exact same doomed credentials.
+    async throwIfCredentialsRejected(username) {
+        const message = await (0, authErrorClassification_1.classifyLoginRejection)(this.page, username);
+        if (message) {
+            throw new Error(message);
+        }
+    }
     async login(credentials = {}) {
         const { username = process.env.C8_USERNAME, password = process.env.C8_PASSWORD, } = credentials;
         (0, sessionRecovery_1.trackSignedInUser)(this.page, username);
+        (0, consoleApiHelpers_1.resetHubBearerToken)(this.page);
         await (0, test_1.expect)(this.loginMessage).toBeVisible({ timeout: 120000 });
         await (0, test_1.expect)(this.usernameInput.locator).toBeVisible({ timeout: 30000 });
         await this.fillUsername(username);
@@ -76,11 +91,13 @@ class LoginPage {
         await this.fillPassword(password);
         await (0, test_1.expect)(this.loginButton).toBeVisible({ timeout: 120000 });
         await this.clickLoginButton();
+        await this.throwIfCredentialsRejected(username);
         await (0, UtilitiesPage_1.assertTestUsesCorrectOrganization)(this.page);
     }
     async loginWithTestUser(credentials = {}) {
         const { username = process.env.C8_USERNAME_TEST, password = process.env.C8_PASSWORD_TEST, } = credentials;
         (0, sessionRecovery_1.trackSignedInUser)(this.page, username);
+        (0, consoleApiHelpers_1.resetHubBearerToken)(this.page);
         // Navigate to app root to trigger auth redirect. The Console app (at
         // console.* hostnames) embeds a hidden invite-user email input also labeled
         // "Email address" that would otherwise satisfy the locator below before the
@@ -157,6 +174,7 @@ class LoginPage {
         await this.fillPassword(password);
         await (0, test_1.expect)(this.loginButton).toBeVisible({ timeout: 120000 });
         await this.clickLoginButton();
+        await this.throwIfCredentialsRejected(username);
         await (0, UtilitiesPage_1.assertTestUsesCorrectOrganization)(this.page);
     }
     async loginFailAssertion() {
@@ -170,6 +188,7 @@ class LoginPage {
     async loginWithoutOrgAssertion(credentials = {}) {
         const { username = process.env.C8_USERNAME, password = process.env.C8_PASSWORD, } = credentials;
         (0, sessionRecovery_1.trackSignedInUser)(this.page, username);
+        (0, consoleApiHelpers_1.resetHubBearerToken)(this.page);
         await (0, test_1.expect)(this.usernameInput.locator).toBeVisible({ timeout: 180000 });
         await this.fillUsername(username);
         await this.clickContinueButton();

package/dist/pages/8.9/ModelerHomePage.d.ts

@@ -1,12 +1,18 @@
 import { Page, Locator } from '@playwright/test';
 declare class ModelerHomePage {
     private defaultFolderName;
+    private defaultClusterName;
     private page;
     private processApplicationPage;
     private processApplicationUrl?;
     private processApplicationName?;
     readonly modelerPageBanner: Locator;
     readonly createNewProjectButton: Locator;
+    readonly createWorkspaceButton: Locator;
+    readonly workspaceWizardNameInput: Locator;
+    readonly workspaceWizardSubmitButton: Locator;
+    readonly workspaceWizardMembersStep: Locator;
+    readonly workspaceWizardEnvironmentsHeading: Locator;
     readonly projectNameInput: Locator;
     readonly formNameInput: Locator;
     readonly chooseBpmnTemplateButton: Locator;
@@ -57,6 +63,7 @@ declare class ModelerHomePage {
     returnToResourceContainer(): Promise<void>;
     startBlankBpmnDiagram(): Promise<void>;
     private becameVisible;
+    private createWorkspaceViaWizard;
     clickHomeBreadcrumb(): Promise<void>;
     clickOpenOrganizationsButton(): Promise<void>;
     createForm(formName: string): Promise<void>;

package/dist/pages/8.9/ModelerHomePage.js

@@ -9,6 +9,11 @@ const ProcessApplicationPage_1 = require("./ProcessApplicationPage");
 const sessionRecovery_1 = require("../../utils/sessionRecovery");
 class ModelerHomePage {
     defaultFolderName = 'Cross Component Test Project';
+    // The default cluster test-setup.spec.ts's "Create Default Cluster" test
+    // provisions for the whole suite -- assigned to the shared workspace's
+    // Environments step so downstream specs can deploy to it without a manual
+    // assignment step first.
+    defaultClusterName = 'Test Cluster';
     page;
     // Since camunda/camunda-hub#25831 files and folders cannot sit at a
     // workspace ("project" in today's UI) root -- only process applications and
@@ -25,6 +30,11 @@ class ModelerHomePage {
     processApplicationName;
     modelerPageBanner;
     createNewProjectButton;
+    createWorkspaceButton;
+    workspaceWizardNameInput;
+    workspaceWizardSubmitButton;
+    workspaceWizardMembersStep;
+    workspaceWizardEnvironmentsHeading;
     projectNameInput;
     formNameInput;
     chooseBpmnTemplateButton;
@@ -53,9 +63,24 @@ class ModelerHomePage {
     constructor(page) {
         this.page = page;
         this.processApplicationPage = new ProcessApplicationPage_1.ProcessApplicationPage(page);
-        this.modelerPageBanner = page.getByRole('banner', {
+        // Hub's design-system shell renders the app header as a role=banner with no
+        // accessible name after the Camunda Hub rebrand, so the classic
+        // name-matched banner no longer resolves; the Modeler logo link inside it
+        // carries "Camunda Hub home" when the org has workspacesEnabled, else
+        // "Camunda Modeler home" (camunda-hub NavShellDs.common.tsx) -- match
+        // either. Keep the legacy named-banner branch for shells where the rename
+        // has not shipped yet.
+        this.modelerPageBanner = page
+            .getByRole('banner', {
             name: 'Camunda Modeler',
-        });
+        })
+            .or(page
+            .getByRole('link', { name: 'Camunda Hub home' })
+            .and(page.locator(':not([href$="/login"])')))
+            .or(page
+            .getByRole('link', { name: 'Camunda Modeler home' })
+            .and(page.locator(':not([href$="/login"])')))
+            .first();
         // Hub renamed this button to "Create project" on both the classic and the
         // design-system shell. The legacy label is kept so the flow still works
         // against Modeler builds where the rename has not shipped yet. exact:true
@@ -68,6 +93,24 @@ class ModelerHomePage {
             name: 'Create project',
             exact: true,
         }));
+        // Camunda Hub, which replaced Console + Web Modeler on SaaS, tops the
+        // hierarchy with a Workspaces overview whose "Create workspace" CTA opens a
+        // two-step wizard (General -> Members) that names the workspace up front.
+        // Same hooks as pages/SM-8.10/ModelerHomePage.ts. exact:true keeps the
+        // split button's options chevron out of the match.
+        this.createWorkspaceButton = page.getByRole('button', {
+            name: 'Create workspace',
+            exact: true,
+        });
+        this.workspaceWizardNameInput = page.locator('#workspace-name');
+        this.workspaceWizardSubmitButton = page.locator('[data-test="workspace-wizard-submit"]');
+        this.workspaceWizardMembersStep = page.locator('[data-test="step-members"]');
+        // When the org has environments enabled, an "Assign environments" step is
+        // inserted after Members -- camunda-hub's own
+        // e2e-playwright/pages/CreateWorkspacePage.ts detects it the same way.
+        this.workspaceWizardEnvironmentsHeading = page.getByRole('heading', {
+            name: 'Assign environments',
+        });
         this.projectNameInput = page.locator('[data-test="editable-input"]');
         this.formNameInput = page.locator('[data-test="editable-input"]');
         this.idpApplicationNameInput = page.getByPlaceholder('New IDP Application');
@@ -105,8 +148,11 @@ class ModelerHomePage {
         this.homeBreadcrumb = page.locator('[data-test="breadcrumb-home"]');
         this.openOrganizationsButton = page.getByLabel('Open Organizations');
         this.manageButton = page.getByRole('menuitem', { name: 'Manage' });
+        // On the Camunda Hub Workspaces overview the folder is a workspace tile
+        // whose "Open workspace <name>" button navigates into it.
         this.crossComponentProjectFolder = page
-            .getByTitle(this.defaultFolderName, { exact: true })
+            .getByRole('button', { name: `Open workspace ${this.defaultFolderName}` })
+            .or(page.getByTitle(this.defaultFolderName, { exact: true }))
             .first();
         this.rows = page.getByRole('row');
         this.uploadFilesButton = page.getByRole('menuitem', { name: 'Upload files' });
@@ -444,7 +490,76 @@ class ModelerHomePage {
             .then(() => true)
             .catch(() => false);
     }
+    // Drives Camunda Hub's workspace-creation wizard. The name is entered on
+    // the General step, which enables "Next"; the same submit button then
+    // relabels itself through the remaining steps and finally reads "Create
+    // workspace" once it creates the workspace and routes the creator into its
+    // projects listing. Gate the Members-step click on that step becoming
+    // active so the shared submit button is not clicked twice while still on
+    // General.
+    async createWorkspaceViaWizard(name) {
+        await this.dismissOverlays();
+        await this.createWorkspaceButton.click({ timeout: 60000 });
+        await this.workspaceWizardNameInput.fill(name, { timeout: 60000 });
+        await this.workspaceWizardSubmitButton.click({ timeout: 60000 });
+        await (0, test_1.expect)(this.workspaceWizardMembersStep).toHaveAttribute('data-state', 'active', { timeout: 30000 });
+        await this.workspaceWizardSubmitButton.click({ timeout: 60000 });
+        // When the org has environments enabled, this only advances the wizard
+        // into an "Assign environments" step instead of submitting. Assign the
+        // suite's default cluster here rather than submitting with an empty
+        // selection -- otherwise this shared workspace starts with no
+        // environments and every downstream spec that deploys to it needs its
+        // own manual assignment first. Each card's accessible name is
+        // "Select <cluster name>" before it is picked (camunda-hub's own
+        // create-workspace-environments.spec.tsx asserts the same pattern).
+        // Sampled immediately (isVisible() doesn't wait) since the step change
+        // is a synchronous client-side re-render.
+        if (await this.workspaceWizardEnvironmentsHeading
+            .isVisible()
+            .catch(() => false)) {
+            // "Create Default Cluster" runs in parallel with this flow
+            // (test-setup.spec.ts's mode: 'parallel'), so the cluster this picker
+            // lists may still be provisioning -- wait for it a generous 90s rather
+            // than sampling once. Hub itself treats submitting unassigned as a
+            // supported, recoverable path for a real user ("Could not load
+            // environments. You can finish creating the workspace and assign them
+            // later."), but this shared workspace is relied on by every downstream
+            // spec that deploys to it -- silently submitting without the default
+            // environment turns a real setup problem here into confusing failures
+            // scattered across unrelated specs later. Fail loudly here instead.
+            const clusterOption = this.page.getByRole('button', {
+                name: new RegExp(`^Select ${this.defaultClusterName}`),
+            });
+            if (await this.becameVisible(clusterOption, 90000)) {
+                await clusterOption.click({ timeout: 10000 });
+            }
+            else {
+                throw new Error(`"${this.defaultClusterName}" was not selectable on the Environments step within 90s -- refusing to create the shared workspace without its default environment assigned, since every downstream spec that deploys to it depends on that assignment.`);
+            }
+            await this.workspaceWizardSubmitButton.click({ timeout: 60000 });
+        }
+        await this.page.waitForURL(/\/workspaces?\/[^/]+\/projects/, {
+            timeout: 120000,
+        });
+    }
     async clickHomeBreadcrumb() {
+        // Camunda Hub has no Modeler home breadcrumb: its home is the Workspaces
+        // overview, reached through the header logo link so the SPA keeps its
+        // in-memory session (a full navigation re-runs the whole Auth0 hand-off).
+        // The link's accessible name is "Camunda Hub home" when the org has
+        // workspacesEnabled, else "Camunda Modeler home" (camunda-hub
+        // NavShellDs.common.tsx) -- match either.
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            await this.page
+                .locator('header[data-slot="app-header"]')
+                .getByRole('link', { name: 'Camunda Hub home' })
+                .or(this.page
+                .locator('header[data-slot="app-header"]')
+                .getByRole('link', { name: 'Camunda Modeler home' }))
+                .first()
+                .click({ timeout: 30000 });
+            return;
+        }
         try {
             await this.homeBreadcrumb.click();
         }
@@ -537,6 +652,10 @@ class ModelerHomePage {
                 return;
             }
             try {
+                if (await this.becameVisible(this.createWorkspaceButton, 5000)) {
+                    await this.createWorkspaceViaWizard(this.defaultFolderName);
+                    return;
+                }
                 await this.clickCreateNewProjectButton();
                 await this.enterNewProjectName(this.defaultFolderName);
                 return;

package/dist/pages/8.9/UtilitiesPage.js

@@ -9,11 +9,34 @@ const sleep_1 = require("../../utils/sleep");
 const randomSleep_1 = require("../../utils/randomSleep");
 const fileUpload_1 = require("../../utils/fileUpload");
 const mailSlurpClient_1 = require("../../utils/mailSlurpClient");
+const consoleApiHelpers_1 = require("../../utils/consoleApiHelpers");
 // Tracks which worker-derived `timeout` values have already paid the
 // stagger sleep below, so a worker only pays it once per process lifetime
 // rather than on every call -- see the comment at the call site.
 const staggeredWorkerTimeouts = new Set();
+const onboardingTourSuppressed = new WeakSet();
+// Mirrors camunda-hub@452978f: pre-seed the onboarding tour's "seen" localStorage flag
+// (SEEN_KEY_PREFIX in .../tour-dialog/use-onboarding-seen.ts) so it never auto-opens. The
+// "Welcome to Camunda Hub" tour mounts app-wide -- Console included, not just Modeler -- and
+// hides the post-login banner link from the accessibility tree until dismissed, which times
+// out assertTestUsesCorrectOrganization's banner check. addInitScript runs before any page
+// script on every navigation/reload, so there's no login-response race to lose; the flag is
+// matched by prefix since the user id isn't known ahead of login.
+async function suppressOnboardingTour(page) {
+    if (onboardingTourSuppressed.has(page)) {
+        return;
+    }
+    onboardingTourSuppressed.add(page);
+    await page.addInitScript((prefixPattern) => {
+        const pattern = new RegExp(prefixPattern);
+        const originalGetItem = Storage.prototype.getItem;
+        Storage.prototype.getItem = function (key) {
+            return pattern.test(key) ? 'true' : originalGetItem.call(this, key);
+        };
+    }, '^hub\\.onboarding\\..*\\.seen\\.');
+}
 async function loginWithRetry(page, loginPage, testUser, timeout, maxRetries = 5) {
+    await suppressOnboardingTour(page);
     let lastError;
     // `timeout` is a stable per-worker identifier (derived from workerIndex),
     // and a worker is a long-lived process across every test/repeat it runs, so
@@ -25,6 +48,11 @@ async function loginWithRetry(page, loginPage, testUser, timeout, maxRetries = 5
     for (let attempt = 0; attempt < maxRetries; attempt++) {
         try {
             await page.context().clearCookies();
+            // The Hub bearer-token cache in consoleApiHelpers.ts is keyed by Page
+            // for the tab's whole lifetime; without clearing it here alongside
+            // cookies/storage, a flow that logs a different user into the same
+            // page could have getUserToken() return the PREVIOUS user's token.
+            (0, consoleApiHelpers_1.resetHubBearerToken)(page);
             await page.goto('about:blank');
             await page
                 .evaluate(() => {
@@ -61,6 +89,17 @@ async function loginWithRetry(page, loginPage, testUser, timeout, maxRetries = 5
         }
         catch (error) {
             lastError = error;
+            // A rejected password or a blocked account is a credential/
+            // provisioning-level failure, not a transient one: every attempt
+            // resubmits the same env-supplied credentials, so retrying just
+            // reproduces the same rejection up to maxRetries times (observed:
+            // ~6 minutes burned across 5 identical "Wrong email or password"
+            // cycles for one seeded user). Fail on the first rejection instead.
+            if (String(error).includes(authErrorClassification_1.AUTH0_INVALID_CREDENTIALS) ||
+                String(error).includes(authErrorClassification_1.AUTH0_ACCOUNT_BLOCKED)) {
+                console.error(lastError);
+                throw lastError;
+            }
             if (attempt < maxRetries - 1) {
                 const rateLimited = String(error).includes(authErrorClassification_1.AUTH0_RATE_LIMIT);
                 console.warn(`Attempt ${attempt + 1} failed for logging in. Retrying with clean session...`, error);
@@ -368,8 +407,14 @@ async function assertTestUsesCorrectOrganization(page) {
     const homePage = new HomePage_1.HomePage(page);
     if (page.url().includes('?code=') || page.url().includes('&state=')) {
         console.log('OAuth callback detected, waiting for redirect...');
+        // Camunda Hub (which replaced Console on SaaS) only exchanges the code
+        // once its SPA has booted, and on CI runners that boot alone was measured
+        // at ~45s past /login-callback -- a 30s wait aborted the exchange on every
+        // attempt. Ported from 8.10's already-verified fix (same run, confirmed
+        // via CI run 36003828752: "Create Project Folder for User 7" exhausted
+        // all 5 login retries on this exact 30s timeout).
         await page.waitForURL((url) => !url.toString().includes('?code='), {
-            timeout: 30000,
+            timeout: 120000,
         });
         await (0, sleep_1.sleep)(5000);
     }
@@ -379,7 +424,20 @@ async function assertTestUsesCorrectOrganization(page) {
         await (0, test_1.expect)(homePage.modelerBanner).toBeVisible({ timeout: 30000 });
     }
     else {
-        await (0, test_1.expect)(homePage.consoleBanner).toBeVisible({ timeout: 60000 });
+        await (0, test_1.expect)(homePage.consoleBanner.or(homePage.hubHeader)).toBeVisible({
+            timeout: 60000,
+        });
+    }
+    // Camunda Hub replaces Console on SaaS (8.10 release notes), and the Hub
+    // shell has neither the "Camunda logo Console" link nor the "Open
+    // Organizations" switcher, and lands on /workspaces without the org id in
+    // the URL. Its sidebar scopes the Clusters/Organization links to the active
+    // org, so assert the expected org id there instead.
+    if (await homePage.hubHeader.isVisible()) {
+        await (0, test_1.expect)(homePage.hubSidebar
+            .locator(`a[href*="/org/${process.env.ORG_ID}/"]`)
+            .first()).toBeVisible({ timeout: 180000 });
+        return;
     }
     await (0, test_1.expect)(homePage.openOrganizationButton).toBeVisible({ timeout: 180000 });
     try {

package/dist/tests/8.9/test-setup.spec.js

@@ -18,7 +18,8 @@ _8_9_1.test.describe('Cluster Setup Tests', () => {
         await (0, _setup_1.captureScreenshot)(page, testInfo);
         await (0, _setup_1.captureFailureVideo)(page, testInfo);
     });
-    (0, _8_9_1.test)('Enable Alpha Features', async ({ page, loginPage, consoleOrganizationsPage, homePage, }, testInfo) => {
+    // Skipped due to bug #29346: https://github.com/camunda/camunda-hub/issues/29346
+    _8_9_1.test.skip('Enable Alpha Features', async ({ page, loginPage, consoleOrganizationsPage, homePage, }, testInfo) => {
         _8_9_1.test.skip(process.env.IS_PROD === 'true', 'Skipping test because not required on PROD test org');
         _8_9_1.test.skip(process.env.IS_AG === 'true', 'Skipping test because not required when IS_AG is true');
         await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, users_1.testUsers.mainUser, (testInfo.workerIndex + 1) * 1000);
@@ -128,11 +129,17 @@ _8_9_1.test.describe('Cluster Setup Tests', () => {
                 await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, user, (testInfo.workerIndex + 1) * 1000);
             });
             await _8_9_1.test.step('Navigate to Web Modeler', async () => {
-                await (0, test_1.expect)(homePage.camundaComponentsButton).toBeVisible({
+                // Camunda Hub replaced Console + Web Modeler on SaaS: it lands on the
+                // Modeler home directly and has no app switcher to wait for.
+                await (0, test_1.expect)(homePage.camundaComponentsButton.or(homePage.hubHeader)).toBeVisible({
                     timeout: 120000,
                 });
-                await appsPage.clickCamundaApps();
-                await appsPage.clickModeler();
+                // Camunda Hub (hub.*) replaced Console + Web Modeler on SaaS and has no
+                // app switcher: its home already is the Modeler home.
+                if (!new URL(page.url()).hostname.startsWith('hub.')) {
+                    await appsPage.clickCamundaApps();
+                    await appsPage.clickModeler();
+                }
                 await (0, test_1.expect)(modelerHomePage.modelerPageBanner).toBeVisible({
                     timeout: 180000,
                 });

package/dist/utils/authErrorClassification.d.ts

@@ -6,3 +6,8 @@ export declare const AUTH0_QUOTA_TEXT: RegExp;
 export declare const AUTH0_GENERIC_ERROR_TEXT: RegExp;
 export declare function classifyAuthErrorPage(page: Page): Promise<string | null>;
 export declare function throwIfAuthErrorPage(page: Page): Promise<void>;
+export declare const AUTH0_INVALID_CREDENTIALS = "AUTH0_INVALID_CREDENTIALS";
+export declare const AUTH0_ACCOUNT_BLOCKED = "AUTH0_ACCOUNT_BLOCKED";
+export declare const AUTH0_INVALID_CREDENTIALS_TEXT: RegExp;
+export declare const AUTH0_ACCOUNT_BLOCKED_TEXT: RegExp;
+export declare function classifyLoginRejection(page: Page, username: string): Promise<string | null>;

package/dist/utils/authErrorClassification.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.throwIfAuthErrorPage = exports.classifyAuthErrorPage = exports.AUTH0_GENERIC_ERROR_TEXT = exports.AUTH0_QUOTA_TEXT = exports.AUTH0_RATE_LIMIT_GENERIC = exports.AUTH0_RATE_LIMIT_QUOTA = exports.AUTH0_RATE_LIMIT = void 0;
+exports.classifyLoginRejection = exports.AUTH0_ACCOUNT_BLOCKED_TEXT = exports.AUTH0_INVALID_CREDENTIALS_TEXT = exports.AUTH0_ACCOUNT_BLOCKED = exports.AUTH0_INVALID_CREDENTIALS = exports.throwIfAuthErrorPage = exports.classifyAuthErrorPage = exports.AUTH0_GENERIC_ERROR_TEXT = exports.AUTH0_QUOTA_TEXT = exports.AUTH0_RATE_LIMIT_GENERIC = exports.AUTH0_RATE_LIMIT_QUOTA = exports.AUTH0_RATE_LIMIT = void 0;
 // Auth0 renders an error page for two structurally different failures, and
 // until now both were counted as one signal. They need different responses:
 //
@@ -93,3 +93,51 @@ async function throwIfAuthErrorPage(page) {
     }
 }
 exports.throwIfAuthErrorPage = throwIfAuthErrorPage;
+// Auth0 rejects a submitted password by re-rendering the same password step
+// with one of these two messages, rather than serving a distinct error page
+// -- so this needs its own probe after a password submission, unlike
+// classifyAuthErrorPage above which covers the interstitial pages Auth0
+// serves before any credentials are entered.
+//
+// Both are credential/provisioning-level rejections: the password Auth0 has
+// on file for this account does not match what the runner was given, or the
+// account is locked. Neither self-heals, so loginWithRetry treats this
+// marker as fail-fast rather than the default retry-with-backoff -- retrying
+// with the same env-supplied credentials 5 times only reproduces the same
+// 400 response 5 times (see docs/saas-login-investigation.md).
+exports.AUTH0_INVALID_CREDENTIALS = 'AUTH0_INVALID_CREDENTIALS';
+exports.AUTH0_ACCOUNT_BLOCKED = 'AUTH0_ACCOUNT_BLOCKED';
+exports.AUTH0_INVALID_CREDENTIALS_TEXT = /Wrong email or password/i;
+exports.AUTH0_ACCOUNT_BLOCKED_TEXT = /account has been blocked after multiple consecutive login attempts/i;
+// Auth0 re-renders the password step with the rejection copy right after the
+// POST, but not necessarily by the moment the caller checks -- a zero-wait
+// isVisible() can run before that paint completes and miss it, which would
+// silently fall through to the generic ~120s shell wait instead of failing
+// fast. Give each marker a short window to render.
+const REJECTION_RENDER_TIMEOUT = 3000;
+async function classifyLoginRejection(page, username) {
+    const [invalid, blocked] = await Promise.all([
+        page
+            .getByText(exports.AUTH0_INVALID_CREDENTIALS_TEXT)
+            .first()
+            .waitFor({ state: 'visible', timeout: REJECTION_RENDER_TIMEOUT })
+            .then(() => true)
+            .catch(() => false),
+        page
+            .getByText(exports.AUTH0_ACCOUNT_BLOCKED_TEXT)
+            .first()
+            .waitFor({ state: 'visible', timeout: REJECTION_RENDER_TIMEOUT })
+            .then(() => true)
+            .catch(() => false),
+    ]);
+    if (!invalid && !blocked) {
+        return null;
+    }
+    const marker = blocked ? exports.AUTH0_ACCOUNT_BLOCKED : exports.AUTH0_INVALID_CREDENTIALS;
+    const reason = blocked
+        ? 'account has been blocked after multiple consecutive login attempts'
+        : 'wrong email or password';
+    return (`${marker}: Auth0 rejected the credentials for ${username} (${reason}) ` +
+        '-- this is a credential/provisioning issue, not something a retry fixes');
+}
+exports.classifyLoginRejection = classifyLoginRejection;

package/dist/utils/consoleApiHelpers.d.ts

@@ -1,4 +1,5 @@
 import { Page } from '@playwright/test';
+export declare function resetHubBearerToken(page: Page): void;
 export declare function deleteClusterViaApi(page: Page, clusterName: string): Promise<void>;
 export declare function createClusterViaApi(page: Page, clusterName: string, region?: string, tasklistV2Enabled?: boolean): Promise<string>;
 export declare function ensureClusterViaApi(page: Page, clusterName: string, region?: string, tasklistV2Enabled?: boolean): Promise<string>;