@camunda/e2e-test-suite 0.0.1287 → 0.0.1289

package/dist/pages/8.9/WorkspaceMembersPage.js

@@ -0,0 +1,264 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkspaceMembersPage = void 0;
+const test_1 = require("@playwright/test");
+// Camunda Hub's workspace "Manage members" view: Members / Environments /
+// General tabs over a member table of Name | Email | Workspace role | Joined,
+// an "Add members" panel, and a role cell that becomes a select once clicked.
+//
+// This page matters to the role flows because an organization role alone no
+// longer decides what a non-admin can reach. Since camunda-hub's environments
+// work, an environment -- and so the cluster app behind it -- is visible only
+// to a user who is Editor or Workspace Admin on a workspace it is assigned to
+// (pdp-3715); organization admins and owners see every environment.
+class WorkspaceMembersPage {
+    page;
+    membersTab;
+    manageMembersHeading;
+    addMembersButton;
+    addMemberSearchbox;
+    addMemberSubmitButton;
+    constructor(page) {
+        this.page = page;
+        this.membersTab = page.getByRole('tab', { name: 'Members' });
+        this.manageMembersHeading = page.getByRole('heading', {
+            name: 'Manage members',
+        });
+        this.addMembersButton = page
+            .locator('[data-test="add-members-button"]')
+            .or(page.getByRole('button', { name: 'Add members' }))
+            .first();
+        // A cmdk combobox: <input cmdk-input role="combobox"
+        // aria-label="Search members" placeholder="Search members or enter an
+        // email to invite">. Prefer the accessible name over the placeholder,
+        // which is the longer and more churn-prone of the two.
+        this.addMemberSearchbox = page
+            .getByRole('combobox', { name: 'Search members' })
+            .or(page.getByPlaceholder('Search members or enter an email to invite'))
+            .first();
+        // `exact` matters: the panel's own trigger is "Add members", which a
+        // substring match on "Add" would also resolve.
+        this.addMemberSubmitButton = page.getByRole('button', {
+            name: 'Add',
+            exact: true,
+        });
+    }
+    // Hub's Workspaces overview defaults to "My workspaces" -- only the ones the
+    // current user is an explicit member of -- and resets to it on every load,
+    // so a workspace created by another user is invisible until the scope is
+    // widened. The empty state offers an explicit button; the populated view
+    // offers the filter instead. A no-op where neither is rendered.
+    async showAllWorkspaces() {
+        const switchButton = this.page.getByRole('button', {
+            name: 'Switch to All workspaces',
+        });
+        const scopeFilter = this.page.getByRole('combobox', {
+            name: 'Filter workspaces',
+        });
+        const appeared = await switchButton
+            .or(scopeFilter)
+            .first()
+            .waitFor({ state: 'visible', timeout: 15000 })
+            .then(() => true)
+            .catch(() => false);
+        if (!appeared) {
+            return;
+        }
+        if (await switchButton.isVisible().catch(() => false)) {
+            await switchButton.click({ timeout: 10000 });
+            await (0, test_1.expect)(switchButton).toBeHidden({ timeout: 10000 });
+            return;
+        }
+        if ((await scopeFilter.innerText()).includes('All workspaces')) {
+            return;
+        }
+        await scopeFilter.click({ timeout: 10000 });
+        await this.page
+            .getByRole('option', { name: 'All workspaces' })
+            .click({ timeout: 10000 });
+        await (0, test_1.expect)(scopeFilter).toContainText('All workspaces', {
+            timeout: 10000,
+        });
+    }
+    async openManageMembers(workspaceName) {
+        // `.first()`: an org can hold several workspaces sharing a name -- the
+        // nightly's environments card lists "Cross Component Test Project" twice
+        // -- and an unqualified match is then a strict-mode violation.
+        const manageButton = this.page
+            .getByRole('button', { name: `Manage workspace ${workspaceName}` })
+            .first();
+        // Keep Hub's default "My workspaces" scope, which is what a real user
+        // sees, and widen only when the target is not in it -- e.g. it was
+        // created by another user and this one holds no explicit membership.
+        const visibleUnderDefaultScope = await manageButton
+            .waitFor({ state: 'visible', timeout: 15000 })
+            .then(() => true)
+            .catch(() => false);
+        if (!visibleUnderDefaultScope) {
+            await this.showAllWorkspaces();
+        }
+        await (0, test_1.expect)(manageButton).toBeVisible({ timeout: 60000 });
+        await manageButton.click({ timeout: 30000 });
+        await (0, test_1.expect)(this.manageMembersHeading).toBeVisible({ timeout: 60000 });
+        if ((await this.membersTab
+            .getAttribute('aria-selected')
+            .catch(() => null)) !== 'true') {
+            await this.membersTab.click({ timeout: 30000 });
+        }
+    }
+    // Valid once openManageMembers has landed on /workspaces/<id>/manage.
+    workspaceId() {
+        const id = this.page.url().match(/\/workspaces\/([^/?#]+)\/manage/)?.[1];
+        if (!id) {
+            throw new Error(`Not on a workspace Manage page, cannot read its id: ${this.page.url()}`);
+        }
+        return decodeURIComponent(id);
+    }
+    memberRow(email) {
+        return this.page.getByRole('row').filter({ hasText: email }).first();
+    }
+    async isMember(email) {
+        return this.memberRow(email)
+            .waitFor({ state: 'visible', timeout: 15000 })
+            .then(() => true)
+            .catch(() => false);
+    }
+    // Adds a user who is not on the member list yet. The panel is collapsed
+    // until its trigger is clicked, and its own "Workspace role" select already
+    // defaults to Editor, so it is only driven when a different role is wanted.
+    async addMember(email, role) {
+        await this.addMembersButton.click({ timeout: 30000 });
+        await (0, test_1.expect)(this.addMemberSearchbox).toBeVisible({ timeout: 30000 });
+        await this.addMemberSearchbox.click({ timeout: 30000 });
+        await this.addMemberSearchbox.fill(email);
+        // An org member shows up as a pickable result; picking it is what enables
+        // the submit. Typing alone leaves an invite-by-email candidate that some
+        // builds require to be committed the same way.
+        // cmdk renders its results as [cmdk-item] nodes with role="option",
+        // filtered live against what was typed.
+        const result = this.page
+            .getByRole('option', { name: new RegExp(escapeRegExp(email), 'i') })
+            .or(this.page.locator('[cmdk-item]').filter({ hasText: email }))
+            .first();
+        // The result list is a multi-select, and its checkbox is NOT a checkbox:
+        // a trace of the live DOM shows each row as
+        //   <div cmdk-item role="option" data-staged="false" aria-selected="true">
+        //     <svg aria-hidden="true"><rect .../></svg> <div>name / email</div>
+        // so getByRole('checkbox') matches nothing, and clicking the row only
+        // sets cmdk's highlight -- aria-selected and data-selected both read
+        // "true" while data-staged stays "false" and "Add" stays disabled.
+        // Click the leading svg, which is the box itself, and gate on the one
+        // attribute that actually tracks the pick.
+        await (0, test_1.expect)(result).toBeVisible({ timeout: 30000 });
+        // Neither the row nor its box can be clicked into a staged state: the box
+        // is a decorative svg the design system gives `pointer-events: none`, so
+        // that click lands on the row, and a row click only moves cmdk's
+        // highlight -- across three live runs `data-staged` never left "false"
+        // while `aria-selected` read "true" and "Add" stayed disabled. The
+        // list's "Select all" control is what actually stages. It is a
+        // <button data-test="members-picker-select-all">, not a cmdk item, and
+        // its label is split across text nodes ("Select all (", "1", ")"), so it
+        // is addressed by its test id. The search box above has already been
+        // filled with this one address, so the guard below holds it to exactly
+        // the intended user rather than trusting the label's count.
+        const candidates = this.page
+            .locator('[cmdk-item]')
+            .filter({ hasText: email });
+        await (0, test_1.expect)(candidates).toHaveCount(1, { timeout: 15000 });
+        await this.page
+            .locator('[data-test="members-picker-select-all"]')
+            .click({ timeout: 15000 });
+        await (0, test_1.expect)(result).toHaveAttribute('data-staged', 'true', {
+            timeout: 15000,
+        });
+        if (role !== 'Editor') {
+            await this.selectRoleIn(this.page.getByRole('combobox', { name: 'Workspace role' }).first(), role);
+        }
+        await (0, test_1.expect)(this.addMemberSubmitButton).toBeEnabled({ timeout: 30000 });
+        await this.addMemberSubmitButton.click({ timeout: 30000 });
+        await (0, test_1.expect)(this.memberRow(email)).toBeVisible({ timeout: 60000 });
+    }
+    async selectRoleIn(control, role) {
+        await control.click({ timeout: 30000 });
+        await this.page
+            .getByRole('option', { name: role, exact: true })
+            .or(this.page.getByRole('menuitem', { name: role, exact: true }))
+            .first()
+            .click({ timeout: 30000 });
+    }
+    // Ensures the user holds `role` on this workspace, adding them first when
+    // they are not a member at all -- which is the usual case for a role flow,
+    // since the shared workspace is created by whichever setup user won the
+    // race and nobody else is added to it.
+    async setMemberRole(email, role) {
+        if (!(await this.isMember(email))) {
+            await this.addMember(email, role);
+            return;
+        }
+        const row = this.memberRow(email);
+        if ((await row.getByText(role, { exact: true }).count()) > 0) {
+            return;
+        }
+        // The role cell renders as a static pill until clicked, then becomes a
+        // select with its own confirm control; leaving it unconfirmed silently
+        // reverts the row to its previous role.
+        const roleControl = row
+            .getByRole('combobox')
+            .or(row.getByRole('button', {
+            name: /^(Workspace Admin|Editor|Commenter|Viewer)$/,
+        }))
+            .first();
+        await roleControl.click({ timeout: 30000 });
+        await this.selectRoleIn(roleControl, role);
+        // Clicked unconditionally, not behind an `isVisible()` probe: the
+        // confirmation is what persists the change, and the control can render a
+        // beat after the select. A probe would read `false` in that window, skip
+        // the click, and let the assertion below match the still-uncommitted
+        // value in the open editor just before the row reverts. Clicking outright
+        // makes Playwright wait for the control and fail here when it never
+        // arrives, rather than passing on an edit that was never saved.
+        await row
+            .getByRole('button', { name: /^(Confirm|Save|Apply|Update)$/i })
+            .or(row.locator('button[type="submit"]'))
+            .first()
+            .click({ timeout: 30000 });
+        await (0, test_1.expect)(row.getByText(role, { exact: true })).toBeVisible({
+            timeout: 60000,
+        });
+    }
+    // Undoes `setMemberRole`/`addMember`. Workspace membership is durable org
+    // state: left behind, it survives the test that granted it, so a Playwright
+    // retry starts with the user already an Editor and any assertion about the
+    // un-granted state fails on the second attempt. A no-op when the user is
+    // not on the list, so it is safe to call from teardown after a failure at
+    // any point in the flow.
+    async removeMember(email) {
+        if (!(await this.isMember(email))) {
+            return;
+        }
+        const row = this.memberRow(email);
+        // camunda-hub MembersTable.tsx: the row's icon trigger is
+        // aria-label="Actions for <name>", data-test="member-actions-trigger".
+        await row
+            .locator('[data-test="member-actions-trigger"]')
+            .or(row.getByRole('button', { name: /^Actions for / }))
+            .first()
+            .click({ timeout: 30000 });
+        await this.page
+            .getByRole('menuitem', { name: /^Remove( member)?$/i })
+            .or(this.page.getByRole('option', { name: /^Remove( member)?$/i }))
+            .first()
+            .click({ timeout: 30000 });
+        // RemoveMemberDialog.tsx is a Radix AlertDialog, i.e. role="alertdialog",
+        // which getByRole('dialog') does not match.
+        await this.page
+            .getByRole('alertdialog', { name: 'Remove member' })
+            .getByRole('button', { name: 'Remove', exact: true })
+            .click({ timeout: 30000 });
+        await (0, test_1.expect)(row).toBeHidden({ timeout: 60000 });
+    }
+}
+exports.WorkspaceMembersPage = WorkspaceMembersPage;
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}

package/dist/tests/8.8/access-user-role-management.spec.js

@@ -7,6 +7,7 @@ const sleep_1 = require("../../utils/sleep");
 const resetSession_1 = require("../../utils/resetSession");
 const LoginPage_1 = require("../../pages/8.8/LoginPage");
 const WorkspaceMembersPage_1 = require("../../pages/8.8/WorkspaceMembersPage");
+const consoleApiHelpers_1 = require("../../utils/consoleApiHelpers");
 const test_1 = require("@playwright/test");
 const users_1 = require("../../utils/users");
 const testUser = (0, users_1.getTestUser)('mainUser');
@@ -47,18 +48,20 @@ _8_8_1.test.describe('User Roles User Flow', () => {
     // Editor and its own "not reachable without workspace access" assertion
     // would fail on the second attempt; the grant would also leak into every
     // later nightly run against the same org.
-    _8_8_1.test.afterEach(async ({ page, browser }, testInfo) => {
+    _8_8_1.test.afterEach(async ({ page, loginPage }, testInfo) => {
         if (!testInfo.title.startsWith('Analyst Role User Flow')) {
             return;
         }
         if (!analystWorkspaceGrantMade) {
             return;
         }
-        await (0, resetSession_1.resetSession)(browser, page);
-        await new LoginPage_1.LoginPage(page).loginWithTestUser({
-            username: process.env.C8_USERNAME,
-            password: process.env.C8_PASSWORD,
-        });
+        // Leave Hub before the analyst's session is dropped. A Hub deep link
+        // reloaded signed out is persisted as the next login's destination
+        // (camunda-hub auth-service.saas.ts persistReturnTo), so the admin landed
+        // on the analyst's diagram, whose sidebar has no org link for
+        // assertTestUsesCorrectOrganization to find.
+        await page.goto('about:blank');
+        await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, testUser, (testInfo.workerIndex + 1) * 1000);
         const workspaceMembersPage = new WorkspaceMembersPage_1.WorkspaceMembersPage(page);
         await workspaceMembersPage.openManageMembers(analystWorkspaceName);
         await workspaceMembersPage.removeMember(process.env.C8_USERNAME_TEST_9);
@@ -98,9 +101,9 @@ _8_8_1.test.describe('User Roles User Flow', () => {
                 timeout: 60000,
             });
             await appsPage.clickCamundaApps();
-            await appsPage.assertOptimizePresent();
-            await appsPage.assertOperatePresent();
-            await appsPage.assertTasklistPresent();
+            await appsPage.assertOptimizePresent(clusterName);
+            await appsPage.assertOperatePresent(clusterName);
+            await appsPage.assertTasklistPresent(clusterName);
             await (0, test_1.expect)(appsPage.modelerLink).toBeVisible();
             await appsPage.clickCamundaApps();
         });
@@ -112,7 +115,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Tasklist and Ensure Tasklist is not Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await (0, UtilitiesPage_1.waitForLoadingToFinish)(page);
             await appsPage.clickCamundaApps();
             await appsPage.clickTasklist(clusterName);
@@ -121,7 +124,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Identity and Ensure Identity is not Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await (0, UtilitiesPage_1.waitForLoadingToFinish)(page);
             await appsPage.clickCamundaApps();
             await appsPage.clickIdentity(clusterName);
@@ -130,7 +133,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Optimize and Ensure Optimize is Not Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await (0, UtilitiesPage_1.waitForLoadingToFinish)(page);
             await appsPage.clickCamundaApps();
             await appsPage.clickOptimize(clusterName);
@@ -139,7 +142,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Modeler and Ensure Diagram Failed To Deploy', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await (0, UtilitiesPage_1.waitForLoadingToFinish)(page);
             await appsPage.clickCamundaApps();
             await appsPage.clickModeler();
@@ -166,6 +169,19 @@ _8_8_1.test.describe('User Roles User Flow', () => {
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'User Roles User Flow' + randomString;
         const clusterName = clusterNames['Analyst Role User Flow'];
+        // A retry runs in a fresh worker, where analystWorkspaceGrantMade starts
+        // false even when the previous attempt's teardown failed to hand the grant
+        // back -- which is exactly what happens when that teardown dies on its
+        // admin re-login. The "not reachable without workspace access" step below
+        // would then always fail, because the analyst is still an Editor.
+        if (_8_8_1.test.info().retry > 0) {
+            await _8_8_1.test.step('Hand back a workspace grant left by the previous attempt', async () => {
+                await appsPage.clickModeler();
+                const workspaceMembersPage = new WorkspaceMembersPage_1.WorkspaceMembersPage(page);
+                await workspaceMembersPage.openManageMembers(analystWorkspaceName);
+                await workspaceMembersPage.removeMember(process.env.C8_USERNAME_TEST_9);
+            });
+        }
         await _8_8_1.test.step('Navigate to Console and Enable RBA', async () => {
             await (0, UtilitiesPage_1.enableAuthorizations)(clusterName, homePage, clusterPage, clusterDetailsPage, appsPage);
             await (0, sleep_1.sleep)(15000);
@@ -225,6 +241,9 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             const hubSidebar = page.getByRole('navigation', {
                 name: 'Main navigation',
             });
+            // The negative counts below mean nothing before the shell has rendered:
+            // toHaveCount(0) passes vacuously on a page that has not painted yet.
+            await (0, test_1.expect)(hubSidebar).toBeVisible({ timeout: 30000 });
             await (0, test_1.expect)(hubSidebar.getByRole('button', { name: clusterName })).toHaveCount(0, { timeout: 30000 });
             await (0, test_1.expect)(hubSidebar.getByRole('link', { name: /Optimize/ })).toHaveCount(0, { timeout: 30000 });
             await (0, test_1.expect)(optimizeHomePage.optimizeBanner).not.toBeVisible({
@@ -247,6 +266,14 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             // clean that up too.
             analystWorkspaceGrantMade = true;
             await workspaceMembersPage.setMemberRole(process.env.C8_USERNAME_TEST_9, 'Editor');
+            // Editorship alone surfaces nothing: an environment is reachable only
+            // when it is assigned to a workspace the user is Editor or Workspace
+            // Admin on, and nothing else in this flow assigns this cluster's
+            // environment to the shared workspace. Without it the analyst holds the
+            // membership but the sidebar still renders no group for the cluster,
+            // which is where the nightly timed out (expandHubClusterGroup waiting on
+            // button "Analyst Role Cluster").
+            await (0, consoleApiHelpers_1.linkClusterToWorkspaceViaApi)(page, workspaceMembersPage.workspaceId(), clusterName);
             await (0, resetSession_1.resetSession)(browser, page);
             await new LoginPage_1.LoginPage(page).loginWithTestUser({
                 username: process.env.C8_USERNAME_TEST_9,
@@ -287,9 +314,9 @@ _8_8_1.test.describe('User Roles User Flow', () => {
                 timeout: 60000,
             });
             await appsPage.clickCamundaApps();
-            await appsPage.assertOptimizePresent();
-            await appsPage.assertOperatePresent();
-            await appsPage.assertTasklistPresent();
+            await appsPage.assertOptimizePresent(clusterName);
+            await appsPage.assertOperatePresent(clusterName);
+            await appsPage.assertTasklistPresent(clusterName);
             await (0, test_1.expect)(appsPage.modelerLink).toBeVisible();
             await appsPage.clickCamundaApps();
         });
@@ -299,7 +326,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             await (0, UtilitiesPage_1.assertLocatorVisibleWithRetry)(page, operateHomePage.noPermissionsMessage, 'Operate No Permission message');
         });
         await _8_8_1.test.step('Navigate to Tasklist and Ensure Tasklist is not Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await appsPage.clickCamundaApps();
             await appsPage.clickTasklist(clusterName);
             await (0, test_1.expect)(taskPanelPage.noPermissionsMessage).toBeVisible({
@@ -307,7 +334,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Identity and Ensure Identity is not Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await appsPage.clickCamundaApps();
             await appsPage.clickIdentity(clusterName);
             await (0, test_1.expect)(ocIdentityHomePage.noPermissionsMessage).toBeVisible({
@@ -315,14 +342,14 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Optimize and Ensure Optimize is Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await appsPage.clickCamundaApps();
             await appsPage.clickOptimize(clusterName);
             await (0, test_1.expect)(optimizeHomePage.optimizeBanner).toBeVisible({
                 timeout: 60000,
             });
         });
-        await _8_8_1.test.step('Navigate to Modeler and Ensure Diagram Failed To Deploy', async () => {
+        await _8_8_1.test.step('Navigate to Modeler and Ensure Diagram Cannot Be Deployed & Run', async () => {
             await appsPage.clickCamundaApps();
             await appsPage.clickModeler();
             await homePage.clickSkipCustomization();
@@ -339,9 +366,10 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             await modelerCreatePage.clickAppendElementButton();
             await modelerCreatePage.clickAppendEndEventButton();
             await (0, sleep_1.sleep)(20000);
-            await modelerCreatePage.runProcessInstance(clusterName, '', {}, '', true);
-            await (0, test_1.expect)(page.getByText(/The (diagram|application) failed to deploy & run/)).toBeVisible({ timeout: 60000 });
-            await modelerCreatePage.clickCloseButton();
+            // Hub gates this in the UI: an Analyst holds no instance or workflow
+            // create permission, so "Deploy & run" is offered only disabled, where
+            // Console let the attempt through and reported a failed deployment.
+            await modelerCreatePage.assertDeployAndRunNotPermitted();
         });
     });
     (0, _8_8_1.test)('Admin Role User Flow', async ({ page, modelerHomePage, appsPage, homePage, clusterPage, clusterDetailsPage, browser, consoleOrganizationsPage, settingsPage, operateHomePage, ocIdentityHomePage, taskPanelPage, optimizeHomePage, modelerCreatePage, }) => {
@@ -403,9 +431,9 @@ _8_8_1.test.describe('User Roles User Flow', () => {
                 timeout: 60000,
             });
             await appsPage.clickCamundaApps();
-            await appsPage.assertOptimizePresent();
-            await appsPage.assertOperatePresent();
-            await appsPage.assertTasklistPresent();
+            await appsPage.assertOptimizePresent(clusterName);
+            await appsPage.assertOperatePresent(clusterName);
+            await appsPage.assertTasklistPresent(clusterName);
             await (0, test_1.expect)(appsPage.modelerLink).toBeVisible();
             await appsPage.clickCamundaApps();
         });
@@ -417,7 +445,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Tasklist and Ensure Tasklist is Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await appsPage.clickCamundaApps();
             await appsPage.clickTasklist(clusterName);
             await (0, test_1.expect)(taskPanelPage.taskListPageBanner).toBeVisible({
@@ -425,7 +453,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Identity and Ensure Identity is Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await appsPage.clickCamundaApps();
             await appsPage.clickIdentity(clusterName);
             await (0, test_1.expect)(ocIdentityHomePage.identityBanner).toBeVisible({
@@ -436,7 +464,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Optimize and Ensure Optimize is Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await appsPage.clickCamundaApps();
             await appsPage.clickOptimize(clusterName);
             await (0, test_1.expect)(optimizeHomePage.optimizeBanner).toBeVisible({

package/dist/tests/8.8/console-user-flows.spec.js

@@ -192,7 +192,28 @@ _8_8_1.test.describe('Console User Flow Tests @tasklistV2', () => {
             await modelerHomePage.clickCrossComponentProjectFolder();
             await modelerHomePage.clickProcessDiagram(processName);
             await modelerCreatePage.runProcessInstance(alertFlowClusterName);
-            await (0, sleep_1.sleep)(10000);
+            // Straight into the next run, no wait. The email assertion below expects
+            // ONE mail reporting "New Incidents: 2", which only happens when both
+            // incidents fall inside the same alert evaluation cycle; the 10s sleep
+            // that used to be here pushed them into separate cycles and Console sent
+            // a "New Incidents: 1" mail for each (observed live: three mails at
+            // 15:09:20, 15:11:51 and 15:13:02, all reporting 1).
+            //
+            // Close the first run's toast before clicking again: camunda-hub 6813a7e
+            // made the "Instance started!" toast persistent whenever it carries the
+            // Operate action, so it stays up and its action button covers
+            // "Deploy & run", swallowing the second click ("<button
+            // data-action=\"true\"> ... intercepts pointer events", observed live
+            // once the sleep was gone).
+            const instanceStartedToast = page
+                .locator('[data-sonner-toast]')
+                .filter({ has: modelerCreatePage.viewProcessInstanceLink });
+            await instanceStartedToast
+                .locator('[data-close-button="true"]')
+                .click({ timeout: 30000 });
+            await (0, test_1.expect)(modelerCreatePage.viewProcessInstanceLink).toBeHidden({
+                timeout: 30000,
+            });
             await modelerCreatePage.runProcessInstance(alertFlowClusterName);
         });
         await _8_8_1.test.step('Navigate to Cluster Details', async () => {

package/dist/tests/8.8/rba-enabled-v1-user-flows.spec.js

@@ -9,6 +9,7 @@ const roleAuthorizations_1 = require("../../utils/roleAuthorizations");
 const expectTextWithRetry_1 = require("../../utils/assertionHelpers/expectTextWithRetry");
 const expectTextWithPagination_1 = require("../../utils/assertionHelpers/expectTextWithPagination");
 const users_1 = require("../../utils/users");
+const consoleApiHelpers_1 = require("../../utils/consoleApiHelpers");
 const expectLocatorWithRetry_1 = require("../../utils/assertionHelpers/expectLocatorWithRetry");
 const mainUser = (0, users_1.getTestUser)('twentyFifthUser');
 _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV1', () => {
@@ -19,19 +20,30 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV1', () => {
         'RBA On User Flow - Permission for Selected Processes Only': 'Fourth RBA V1 Cluster',
     };
     _8_8_1.test.beforeEach(async ({ page, homePage, clusterPage, loginPage, clusterDetailsPage, appsPage }, testInfo) => {
+        // Claimed here, not in each body: creating the cluster and waiting for
+        // it to come back Healthy after the authorizations toggle can outlast
+        // the default per-test timeout before the body starts.
+        _8_8_1.test.slow();
         await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, mainUser, (testInfo.workerIndex + 1) * 1000);
         await homePage.clickClusters();
         const clusterName = clusterNames[testInfo.title];
         (0, test_1.expect)(clusterName, `No cluster mapping for test title: "${testInfo.title}")`).toBeTruthy();
         await clusterPage.createClusterIfNotExists(clusterName);
         await (0, UtilitiesPage_1.disableRBA)(clusterName, homePage, clusterPage, clusterDetailsPage, appsPage);
+        // The flows below hand off to test users with no elevated or DevOps org
+        // role, and Hub only lets those roles assign an environment to a
+        // workspace (camunda-hub#28955). Without this, the test user's deploy
+        // dialog never offers this cluster and every runProcessInstance retry
+        // fails until the test times out. Assign it now, while the elevated
+        // main user's session is active. test-setup creates the test users'
+        // workspaces up front so that they exist at this point.
+        await (0, consoleApiHelpers_1.linkClusterToWorkspacesNamedViaApi)(page, clusterName);
     });
     _8_8_1.test.afterEach(async ({ page }, testInfo) => {
         await (0, _setup_1.captureScreenshot)(page, testInfo);
         await (0, _setup_1.captureFailureVideo)(page, testInfo);
     });
     (0, _8_8_1.test)('RBA On User Flow - No User Permission', async ({ page, homePage, modelerHomePage, appsPage, modelerCreatePage, clusterPage, clusterDetailsPage, taskPanelPage, taskProcessesPage, operateHomePage, ocIdentityHomePage, ocIdentityAuthorizationsPage, ocIdentityRolesPage, loginPage, settingsPage, }, testInfo) => {
-        _8_8_1.test.slow();
         const clusterName = clusterNames[testInfo.title];
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'RBA_NO_PERM' + randomString;
@@ -153,7 +165,6 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV1', () => {
         });
     });
     (0, _8_8_1.test)('RBA On User Flow - Permission for One Process', async ({ page, homePage, modelerHomePage, appsPage, modelerCreatePage, clusterPage, clusterDetailsPage, taskPanelPage, taskProcessesPage, operateHomePage, loginPage, ocIdentityHomePage, ocIdentityAuthorizationsPage, ocIdentityRolesPage, settingsPage, }, testInfo) => {
-        _8_8_1.test.slow();
         const clusterName = clusterNames[testInfo.title];
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'RBA_ONE_PERM' + randomString;
@@ -305,7 +316,6 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV1', () => {
         });
     });
     (0, _8_8_1.test)('RBA On User Flow - Permission for All Processes with Full Permissions', async ({ page, homePage, modelerHomePage, appsPage, modelerCreatePage, clusterPage, clusterDetailsPage, taskPanelPage, taskProcessesPage, operateHomePage, ocIdentityHomePage, ocIdentityAuthorizationsPage, }, testInfo) => {
-        _8_8_1.test.slow();
         const clusterName = clusterNames[testInfo.title];
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'AFTER_RBA' + randomString;
@@ -375,7 +385,6 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV1', () => {
         });
     });
     (0, _8_8_1.test)('RBA On User Flow - Permission for Selected Processes Only', async ({ page, homePage, modelerHomePage, appsPage, modelerCreatePage, clusterPage, clusterDetailsPage, taskPanelPage, taskProcessesPage, operateHomePage, ocIdentityHomePage, ocIdentityAuthorizationsPage, ocIdentityRolesPage, loginPage, settingsPage, }, testInfo) => {
-        _8_8_1.test.slow();
         const clusterName = clusterNames[testInfo.title];
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'RBA_SELECTED_PERM' + randomString;