@camunda/e2e-test-suite 0.0.1288 → 0.0.1289

package/dist/pages/8.8/AppsPage.d.ts

@@ -19,11 +19,13 @@ declare class AppsPage {
     readonly camundaComponentsButton: Locator;
     readonly camundaAppsButton: Locator;
     readonly hubSidebar: Locator;
+    private hubReturnUrl?;
     constructor(page: Page);
     clickCluster(component: Locator, name: string): Promise<void>;
     private expandHubClusterGroup;
     private showAllWorkspaces;
     private clickHubClusterApp;
+    goBackToHub(): Promise<void>;
     private isOnHub;
     clickModeler(): Promise<void>;
     private clickHubModelerHome;
@@ -54,8 +56,10 @@ declare class AppsPage {
     clickCamundaApps(maxRetries?: number): Promise<void>;
     private dismissBlockingModal;
     clickConsoleLink(): Promise<void>;
-    assertOperatePresent(shouldBeVisible?: boolean): Promise<void>;
-    assertTasklistPresent(shouldBeVisible?: boolean): Promise<void>;
-    assertOptimizePresent(shouldBeVisible?: boolean): Promise<void>;
+    private hubClusterAppLink;
+    private assertHubClusterAppPresent;
+    assertOperatePresent(clusterName: string, shouldBeVisible?: boolean): Promise<void>;
+    assertTasklistPresent(clusterName: string, shouldBeVisible?: boolean): Promise<void>;
+    assertOptimizePresent(clusterName: string, shouldBeVisible?: boolean): Promise<void>;
 }
 export { AppsPage };

package/dist/pages/8.8/AppsPage.js

@@ -27,9 +27,19 @@ class AppsPage {
     camundaComponentsButton;
     camundaAppsButton;
     hubSidebar;
+    hubReturnUrl;
     constructor(page) {
         this.page = page;
-        this.modelerLink = page.getByRole('link', { name: 'Modeler', exact: true });
+        // Hub has no "Modeler" switcher entry; Modeler is Hub's home, reached
+        // through the header logo link clickHubModelerHome() uses
+        // (NavShellDs.common.tsx). The final .first() keeps this strict-safe on a
+        // page that carries both.
+        this.modelerLink = page
+            .getByRole('link', { name: 'Modeler', exact: true })
+            .or(page
+            .locator('header[data-slot="app-header"]')
+            .getByRole('link', { name: /^Camunda (Modeler|Hub) home$/ }))
+            .first();
         this.appSwitcherButton = page.getByLabel('App Switcher');
         this.tasklistLink = page.getByRole('link', { name: 'Tasklist', exact: true });
         this.identityLink = page.getByRole('link', { name: /^(Admin|Identity)$/ });
@@ -253,14 +263,8 @@ class AppsPage {
         // cluster name and portalled OUTSIDE the "Main navigation" <nav> -- so a
         // sidebar-scoped lookup finds nothing there. Look in that popover first;
         // keep the sidebar-scoped lookup for the expanded-sidebar layout, where
-        // the links render inline. Not exact: the rendered accessible name
-        // carries more than the bare app name (e.g. "Operate in <cluster>
-        // (opens in a new tab)").
-        const appLink = this.page
-            .getByRole('dialog', { name: clusterName, exact: true })
-            .getByRole('link', { name: appName })
-            .or(this.hubSidebar.getByRole('link', { name: appName }))
-            .first();
+        // the links render inline.
+        const appLink = this.hubClusterAppLink(clusterName, appName);
         // Decide whether to expand from clusterName's OWN toggle state, not from
         // whether "some" appLink is already visible sidebar-wide: in a
         // multi-cluster org another cluster's group can already be expanded with
@@ -279,11 +283,22 @@ class AppsPage {
         // navigation the Console app switcher gave these callers.
         const href = await appLink.getAttribute('href');
         if (href) {
+            this.hubReturnUrl = this.page.url();
             await this.page.goto(new URL(href, this.page.url()).toString());
             return;
         }
         await appLink.click({ timeout: 10000 });
     }
+    // Returns from an app that clickHubClusterApp opened. page.goBack() alone
+    // can stop on one of the app's own login-redirect history entries, and the
+    // next Hub sidebar lookup then runs against the app instead of Hub.
+    async goBackToHub() {
+        await this.page.goBack();
+        if (this.hubReturnUrl &&
+            !new URL(this.page.url()).hostname.startsWith('hub.')) {
+            await this.page.goto(this.hubReturnUrl);
+        }
+    }
     // True once the tab is on a Camunda Hub host, where Modeler home is Hub's
     // own home rather than a modeler.* hostname.
     isOnHub() {
@@ -459,10 +474,7 @@ class AppsPage {
     }
     async clickIdentity(clusterName) {
         if (new URL(this.page.url()).hostname.startsWith('hub.')) {
-            // Non-anchored, matching the substring lookup clickHubClusterApp uses
-            // for Operate/Tasklist/Optimize -- an anchored pattern fails the same
-            // way an exact-string match did for those apps if the rendered link's
-            // accessible name carries any extra content (icon/badge).
+            // Identity should be removed once camunda/camunda#46447 is fixed.
             await this.clickHubClusterApp(clusterName, /Admin|Identity/);
             return;
         }
@@ -716,17 +728,26 @@ class AppsPage {
             .catch(() => { });
     }
     async clickConsoleLink() {
-        // Camunda Hub replaced Console on SaaS: there is no "Console" entry in a
-        // switcher, and the org-scoped Console area is the sidebar's
-        // Clusters/Environments section. Going there is what callers assert on
-        // (HomePage.consoleBanner resolves to Hub's authenticated header).
+        // Camunda Hub folded Console into the same persistent shell as
+        // Modeler/home: Console's Dashboard/Clusters/Organization links are just
+        // another section of the same "Main navigation" sidebar, not a separate
+        // app to switch into. Its header banner (homePage.consoleBanner, via
+        // hubHeader) is already visible from any Hub page, so there is no
+        // navigation action needed here -- mirrors the same hostname guard in
+        // clickModeler(). Clicking the sidebar's Clusters/Environments link is
+        // not just unnecessary but wrong: Hub shows that section only to org
+        // admins, so requiring it broke every RBA step that reaches here as a
+        // handed-off non-admin test user. Callers that do need the Clusters page
+        // call clickClusters() themselves; the rest assert consoleBanner.
+        //
+        // The diagram editor is the exception: it has no "Main navigation"
+        // sidebar at all, so a caller arriving from "Deploy & run" would find
+        // nothing here. Go home first there.
         if (new URL(this.page.url()).hostname.startsWith('hub.')) {
-            const consoleArea = this.hubSidebar
-                .locator('a[href$="/clusters"]')
-                .or(this.hubSidebar.locator('a[href$="/environments"]'))
-                .first();
-            await (0, test_1.expect)(consoleArea).toBeVisible({ timeout: 30000 });
-            await consoleArea.click({ timeout: 30000 });
+            if (!(await this.hubSidebar.isVisible().catch(() => false))) {
+                await this.clickModeler();
+                await (0, test_1.expect)(this.hubSidebar).toBeVisible({ timeout: 30000 });
+            }
             return;
         }
         const maxRetries = 3;
@@ -750,7 +771,46 @@ class AppsPage {
         }
         throw new Error(`Failed to click the console link after ${maxRetries} attempts.`);
     }
-    async assertOperatePresent(shouldBeVisible = true) {
+    // Hub's replacement for the app switcher: a cluster's apps are the child
+    // links of its own sidebar group. Hub names every app link "<app> in
+    // <environment>", plus " (opens in a new tab)" when it leads to the live app
+    // (camunda-hub environment-sidebar-rows.ts) -- the nightly traces carry both
+    // shapes ("Operate in Third RBA V2 Cluster", "Admin in Admin Role Cluster
+    // (opens in a new tab)"). Anchor both halves rather than matching the bare
+    // app name: the flyout's first link is "Details of <environment>", so for
+    // "Admin Role Cluster" a bare /Admin|Identity/ resolved to that link, and
+    // inline it resolved to "Operate in Admin Role Cluster (opens in a new
+    // tab)", which precedes the Admin link. Anchoring on the environment also
+    // stops "Test Cluster" matching "UI Test Cluster".
+    hubClusterAppLink(clusterName, appName) {
+        const appPattern = typeof appName === 'string' ? escapeRegExp(appName) : appName.source;
+        const cluster = escapeRegExp(clusterName);
+        const appLinkName = new RegExp(`^(?:${appPattern}) in ${cluster}(?: \\(opens in a new tab\\))?$`);
+        return this.page
+            .getByRole('dialog', { name: clusterName, exact: true })
+            .getByRole('link', { name: appLinkName })
+            .or(this.hubSidebar.getByRole('link', { name: appLinkName }))
+            .first();
+    }
+    async assertHubClusterAppPresent(clusterName, appName, shouldBeVisible) {
+        const appLink = this.hubClusterAppLink(clusterName, appName);
+        // Not expanded for an absence check: expandHubClusterGroup throws when
+        // the user cannot see the environment at all, which is a pass here.
+        if (!shouldBeVisible) {
+            await (0, test_1.expect)(appLink).toBeHidden({ timeout: 30000 });
+            return;
+        }
+        await this.expandHubClusterGroup(clusterName);
+        await (0, test_1.expect)(appLink).toBeVisible({ timeout: 30000 });
+    }
+    // On Hub the cluster name is what scopes the lookup: there is no app
+    // switcher panel listing apps org-wide, only each cluster's own sidebar
+    // group.
+    async assertOperatePresent(clusterName, shouldBeVisible = true) {
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            await this.assertHubClusterAppPresent(clusterName, 'Operate', shouldBeVisible);
+            return;
+        }
         const maxRetries = 3;
         for (let retries = 0; retries < maxRetries; retries++) {
             try {
@@ -779,7 +839,12 @@ class AppsPage {
         }
         throw new Error(`Failed to assert the operate link visibility after ${maxRetries} attempts.`);
     }
-    async assertTasklistPresent(shouldBeVisible = true) {
+    // See assertOperatePresent for the clusterName/Hub note.
+    async assertTasklistPresent(clusterName, shouldBeVisible = true) {
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            await this.assertHubClusterAppPresent(clusterName, 'Tasklist', shouldBeVisible);
+            return;
+        }
         const maxRetries = 3;
         for (let retries = 0; retries < maxRetries; retries++) {
             try {
@@ -808,7 +873,12 @@ class AppsPage {
         }
         throw new Error(`Failed to assert the tasklist link visibility after ${maxRetries} attempts.`);
     }
-    async assertOptimizePresent(shouldBeVisible = true) {
+    // See assertOperatePresent for the clusterName/Hub note.
+    async assertOptimizePresent(clusterName, shouldBeVisible = true) {
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            await this.assertHubClusterAppPresent(clusterName, 'Optimize', shouldBeVisible);
+            return;
+        }
         const maxRetries = 3;
         for (let retries = 0; retries < maxRetries; retries++) {
             try {

package/dist/pages/8.8/ModelerCreatePage.d.ts

@@ -103,6 +103,8 @@ declare class ModelerCreatePage {
     readonly timerValue: Locator;
     readonly eighthPlacedElement: Locator;
     readonly deployAndRunMainButton: Locator;
+    readonly deployRunActions: Locator;
+    readonly deployAndRunMenuItem: Locator;
     readonly deployAndRunSubButton: Locator;
     readonly dialog: Locator;
     readonly backupDeployButton: Locator;
@@ -141,6 +143,7 @@ declare class ModelerCreatePage {
     clickAdditionalActionsButton(): Promise<void>;
     clickDeployMenuItem(): Promise<void>;
     deployDiagram(clusterName: string): Promise<void>;
+    assertDeployAndRunNotPermitted(): Promise<void>;
     clickStartInstanceMainButton(): Promise<void>;
     clickStartInstanceSubButton(): Promise<void>;
     runProcessInstance(clusterName: string, variables?: string, formVariables?: {

package/dist/pages/8.8/ModelerCreatePage.js

@@ -115,6 +115,8 @@ class ModelerCreatePage {
     timerValue;
     eighthPlacedElement;
     deployAndRunMainButton;
+    deployRunActions;
+    deployAndRunMenuItem;
     deployAndRunSubButton;
     dialog;
     backupDeployButton;
@@ -160,6 +162,13 @@ class ModelerCreatePage {
             name: 'Deploy & run',
             exact: true,
         });
+        // camunda-hub deploy-run-combo-action: both the Carbon ComboButton and
+        // the design-system SplitButton carry this test id.
+        this.deployRunActions = page.getByTestId('deploy-run-actions');
+        this.deployAndRunMenuItem = page.getByRole('menuitem', {
+            name: 'Deploy & run',
+            exact: true,
+        });
         this.deployAndRunSubButton = this.dialog.getByRole('button', {
             name: 'Deploy & run',
             exact: true,
@@ -674,6 +683,22 @@ class ModelerCreatePage {
         await (0, test_1.expect)(this.viewProcessLink).toBeVisible({ timeout: 30000 });
         await (0, test_1.expect)(this.viewProcessLink).toBeHidden({ timeout: 30000 });
     }
+    // For a user whose org role lacks instance/workflow create permissions,
+    // Hub's checkIfAllowedToRun is false: the split button's primary action
+    // becomes "Deploy" and "Deploy & run" moves into its menu, disabled
+    // (camunda-hub BPMNDeployAndRunButtonsDs.tsx, deploy-run-permission.saas.ts).
+    // The Console-era expectation of a deploy that is attempted and then fails
+    // cannot happen, so assert the gate itself.
+    async assertDeployAndRunNotPermitted() {
+        await (0, test_1.expect)(this.deployRunActions.getByRole('button', { name: 'Deploy', exact: true })).toBeVisible({ timeout: 60000 });
+        await (0, test_1.expect)(this.deployAndRunMainButton).toHaveCount(0);
+        await this.deployRunActions
+            .getByRole('button', { name: 'Additional actions' })
+            .click({ timeout: 30000 });
+        await (0, test_1.expect)(this.deployAndRunMenuItem).toBeVisible({ timeout: 30000 });
+        await (0, test_1.expect)(this.deployAndRunMenuItem).toBeDisabled();
+        await this.page.keyboard.press('Escape');
+    }
     async clickStartInstanceMainButton() {
         // ensureStageCluster runs immediately before this on every runProcessInstance
         // attempt and navigates twice, so the diagram's action bar may belong to a

package/dist/pages/8.8/UtilitiesPage.js

@@ -83,8 +83,13 @@ async function loginWithRetry(page, loginPage, testUser, timeout, maxRetries = 5
             // for the tab's whole lifetime; without clearing it here alongside
             // cookies/storage, a flow that logs a different user into the same
             // page could have getUserToken() return the PREVIOUS user's token.
-            (0, consoleApiHelpers_1.resetHubBearerToken)(page);
+            // Listen from before Hub loads: an API helper called later on an idle
+            // Hub page would otherwise find no request carrying the token.
+            (0, consoleApiHelpers_1.observeBearerTokens)(page);
             await page.goto('about:blank');
+            // After about:blank: until then the previous user's Hub page can still
+            // send a request, and its token must not count for the new session.
+            (0, consoleApiHelpers_1.resetHubBearerToken)(page);
             await page
                 .evaluate(() => {
                 try {
@@ -409,24 +414,36 @@ async function enableAuthorizations(clusterName, homePage, clusterPage, clusterD
 }
 exports.enableAuthorizations = enableAuthorizations;
 async function assertLatestAlertEmail(id, mailSlurp, processName, alertText) {
-    const maxRetries = 3;
-    for (let retries = 0; retries < maxRetries; retries++) {
-        try {
-            const email = await mailSlurp.waitForLatestEmail(id, 120000);
-            if (email && email.body) {
-                (0, test_1.expect)(email.body).toContain(processName);
-                (0, test_1.expect)(email.body).toContain(alertText);
-                return email.body;
-            }
-            else {
-                throw new Error('Email or email body is null or undefined.');
+    // Search the whole inbox for an email carrying alertText rather than asking
+    // for the "latest" one. waitForLatestEmail is documented as returning the
+    // last received email immediately when the inbox is NOT empty ("If you need
+    // to wait for an email for a non-empty inbox see the other receive methods"
+    // -- mailslurp-client's own JSDoc), and the alert flow calls this twice on
+    // the same inbox: the second call kept resolving to the first alert's mail
+    // ("New Incidents: 1") and failed its "New Incidents: 2" assertion on every
+    // retry, since retrying re-read the same already-delivered email. Matching
+    // on content also tolerates the alert sending more mails than the two this
+    // flow asserts on, and ordering between them.
+    let body;
+    await (0, test_1.expect)(async () => {
+        // minCount/retryTimeout make the server itself hold the request open until
+        // the inbox has grown, so this does not busy-poll between attempts.
+        const previews = await mailSlurp.getEmails(id, {
+            minCount: 1,
+            retryTimeout: 60000,
+        });
+        for (const preview of previews) {
+            const email = await mailSlurp.getEmail(preview.id);
+            if (email?.body?.includes(processName) &&
+                email.body.includes(alertText)) {
+                body = email.body;
+                return;
             }
         }
-        catch (error) {
-            console.warn(`Click attempt ${retries + 1} failed: ${error}`);
-        }
-    }
-    throw new Error(`Failed to get latest alert (${processName}) email for ${id} after ${maxRetries} attempts.`);
+        throw new Error(`No alert email for "${processName}" containing "${alertText}" in ` +
+            `inbox ${id} yet (${previews.length} mail(s) present)`);
+    }).toPass({ timeout: 360000, intervals: [5000, 10000, 20000] });
+    return body;
 }
 exports.assertLatestAlertEmail = assertLatestAlertEmail;
 async function clickInvitationLinkInEmail(page, id, mailSlurp) {

package/dist/pages/8.8/WorkspaceMembersPage.d.ts

@@ -10,6 +10,7 @@ declare class WorkspaceMembersPage {
     constructor(page: Page);
     showAllWorkspaces(): Promise<void>;
     openManageMembers(workspaceName: string): Promise<void>;
+    workspaceId(): string;
     private memberRow;
     isMember(email: string): Promise<boolean>;
     addMember(email: string, role: WorkspaceRole): Promise<void>;

package/dist/pages/8.8/WorkspaceMembersPage.js

@@ -106,6 +106,14 @@ class WorkspaceMembersPage {
             await this.membersTab.click({ timeout: 30000 });
         }
     }
+    // Valid once openManageMembers has landed on /workspaces/<id>/manage.
+    workspaceId() {
+        const id = this.page.url().match(/\/workspaces\/([^/?#]+)\/manage/)?.[1];
+        if (!id) {
+            throw new Error(`Not on a workspace Manage page, cannot read its id: ${this.page.url()}`);
+        }
+        return decodeURIComponent(id);
+    }
     memberRow(email) {
         return this.page.getByRole('row').filter({ hasText: email }).first();
     }
@@ -229,12 +237,11 @@ class WorkspaceMembersPage {
             return;
         }
         const row = this.memberRow(email);
-        // The destructive action lives behind the row's own overflow menu; its
-        // trigger is an icon button, so it is matched on its accessible name
-        // rather than on text.
+        // camunda-hub MembersTable.tsx: the row's icon trigger is
+        // aria-label="Actions for <name>", data-test="member-actions-trigger".
         await row
-            .getByRole('button', { name: /(more|actions|options|menu)/i })
-            .or(row.locator('[data-test="member-row-actions"]'))
+            .locator('[data-test="member-actions-trigger"]')
+            .or(row.getByRole('button', { name: /^Actions for / }))
             .first()
             .click({ timeout: 30000 });
         await this.page
@@ -242,11 +249,15 @@ class WorkspaceMembersPage {
             .or(this.page.getByRole('option', { name: /^Remove( member)?$/i }))
             .first()
             .click({ timeout: 30000 });
-        // Removal is confirmed in a dialog. Scoped to it so the match cannot
-        // resolve back to the menu item that opened it.
-        const dialog = this.page.getByRole('dialog').first();
-        await dialog
-            .getByRole('button', { name: /^(Remove|Confirm|Delete)$/i })
+        // RemoveMemberDialog.tsx is a Radix AlertDialog, i.e. role="alertdialog",
+        // which getByRole('dialog') does NOT match -- the confirm button was
+        // unreachable. Prefer its own test id and keep the role lookup as a
+        // fallback.
+        await this.page
+            .locator('[data-test="remove-member-confirm"]')
+            .or(this.page
+            .getByRole('alertdialog', { name: 'Remove member' })
+            .getByRole('button', { name: 'Remove', exact: true }))
             .first()
             .click({ timeout: 30000 });
         await (0, test_1.expect)(row).toBeHidden({ timeout: 60000 });

package/dist/tests/8.8/access-user-role-management.spec.js

@@ -7,6 +7,7 @@ const sleep_1 = require("../../utils/sleep");
 const resetSession_1 = require("../../utils/resetSession");
 const LoginPage_1 = require("../../pages/8.8/LoginPage");
 const WorkspaceMembersPage_1 = require("../../pages/8.8/WorkspaceMembersPage");
+const consoleApiHelpers_1 = require("../../utils/consoleApiHelpers");
 const test_1 = require("@playwright/test");
 const users_1 = require("../../utils/users");
 const testUser = (0, users_1.getTestUser)('mainUser');
@@ -47,18 +48,20 @@ _8_8_1.test.describe('User Roles User Flow', () => {
     // Editor and its own "not reachable without workspace access" assertion
     // would fail on the second attempt; the grant would also leak into every
     // later nightly run against the same org.
-    _8_8_1.test.afterEach(async ({ page, browser }, testInfo) => {
+    _8_8_1.test.afterEach(async ({ page, loginPage }, testInfo) => {
         if (!testInfo.title.startsWith('Analyst Role User Flow')) {
             return;
         }
         if (!analystWorkspaceGrantMade) {
             return;
         }
-        await (0, resetSession_1.resetSession)(browser, page);
-        await new LoginPage_1.LoginPage(page).loginWithTestUser({
-            username: process.env.C8_USERNAME,
-            password: process.env.C8_PASSWORD,
-        });
+        // Leave Hub before the analyst's session is dropped. A Hub deep link
+        // reloaded signed out is persisted as the next login's destination
+        // (camunda-hub auth-service.saas.ts persistReturnTo), so the admin landed
+        // on the analyst's diagram, whose sidebar has no org link for
+        // assertTestUsesCorrectOrganization to find.
+        await page.goto('about:blank');
+        await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, testUser, (testInfo.workerIndex + 1) * 1000);
         const workspaceMembersPage = new WorkspaceMembersPage_1.WorkspaceMembersPage(page);
         await workspaceMembersPage.openManageMembers(analystWorkspaceName);
         await workspaceMembersPage.removeMember(process.env.C8_USERNAME_TEST_9);
@@ -98,9 +101,9 @@ _8_8_1.test.describe('User Roles User Flow', () => {
                 timeout: 60000,
             });
             await appsPage.clickCamundaApps();
-            await appsPage.assertOptimizePresent();
-            await appsPage.assertOperatePresent();
-            await appsPage.assertTasklistPresent();
+            await appsPage.assertOptimizePresent(clusterName);
+            await appsPage.assertOperatePresent(clusterName);
+            await appsPage.assertTasklistPresent(clusterName);
             await (0, test_1.expect)(appsPage.modelerLink).toBeVisible();
             await appsPage.clickCamundaApps();
         });
@@ -112,7 +115,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Tasklist and Ensure Tasklist is not Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await (0, UtilitiesPage_1.waitForLoadingToFinish)(page);
             await appsPage.clickCamundaApps();
             await appsPage.clickTasklist(clusterName);
@@ -121,7 +124,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Identity and Ensure Identity is not Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await (0, UtilitiesPage_1.waitForLoadingToFinish)(page);
             await appsPage.clickCamundaApps();
             await appsPage.clickIdentity(clusterName);
@@ -130,7 +133,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Optimize and Ensure Optimize is Not Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await (0, UtilitiesPage_1.waitForLoadingToFinish)(page);
             await appsPage.clickCamundaApps();
             await appsPage.clickOptimize(clusterName);
@@ -139,7 +142,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Modeler and Ensure Diagram Failed To Deploy', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await (0, UtilitiesPage_1.waitForLoadingToFinish)(page);
             await appsPage.clickCamundaApps();
             await appsPage.clickModeler();
@@ -166,6 +169,19 @@ _8_8_1.test.describe('User Roles User Flow', () => {
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'User Roles User Flow' + randomString;
         const clusterName = clusterNames['Analyst Role User Flow'];
+        // A retry runs in a fresh worker, where analystWorkspaceGrantMade starts
+        // false even when the previous attempt's teardown failed to hand the grant
+        // back -- which is exactly what happens when that teardown dies on its
+        // admin re-login. The "not reachable without workspace access" step below
+        // would then always fail, because the analyst is still an Editor.
+        if (_8_8_1.test.info().retry > 0) {
+            await _8_8_1.test.step('Hand back a workspace grant left by the previous attempt', async () => {
+                await appsPage.clickModeler();
+                const workspaceMembersPage = new WorkspaceMembersPage_1.WorkspaceMembersPage(page);
+                await workspaceMembersPage.openManageMembers(analystWorkspaceName);
+                await workspaceMembersPage.removeMember(process.env.C8_USERNAME_TEST_9);
+            });
+        }
         await _8_8_1.test.step('Navigate to Console and Enable RBA', async () => {
             await (0, UtilitiesPage_1.enableAuthorizations)(clusterName, homePage, clusterPage, clusterDetailsPage, appsPage);
             await (0, sleep_1.sleep)(15000);
@@ -225,6 +241,9 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             const hubSidebar = page.getByRole('navigation', {
                 name: 'Main navigation',
             });
+            // The negative counts below mean nothing before the shell has rendered:
+            // toHaveCount(0) passes vacuously on a page that has not painted yet.
+            await (0, test_1.expect)(hubSidebar).toBeVisible({ timeout: 30000 });
             await (0, test_1.expect)(hubSidebar.getByRole('button', { name: clusterName })).toHaveCount(0, { timeout: 30000 });
             await (0, test_1.expect)(hubSidebar.getByRole('link', { name: /Optimize/ })).toHaveCount(0, { timeout: 30000 });
             await (0, test_1.expect)(optimizeHomePage.optimizeBanner).not.toBeVisible({
@@ -247,6 +266,14 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             // clean that up too.
             analystWorkspaceGrantMade = true;
             await workspaceMembersPage.setMemberRole(process.env.C8_USERNAME_TEST_9, 'Editor');
+            // Editorship alone surfaces nothing: an environment is reachable only
+            // when it is assigned to a workspace the user is Editor or Workspace
+            // Admin on, and nothing else in this flow assigns this cluster's
+            // environment to the shared workspace. Without it the analyst holds the
+            // membership but the sidebar still renders no group for the cluster,
+            // which is where the nightly timed out (expandHubClusterGroup waiting on
+            // button "Analyst Role Cluster").
+            await (0, consoleApiHelpers_1.linkClusterToWorkspaceViaApi)(page, workspaceMembersPage.workspaceId(), clusterName);
             await (0, resetSession_1.resetSession)(browser, page);
             await new LoginPage_1.LoginPage(page).loginWithTestUser({
                 username: process.env.C8_USERNAME_TEST_9,
@@ -287,9 +314,9 @@ _8_8_1.test.describe('User Roles User Flow', () => {
                 timeout: 60000,
             });
             await appsPage.clickCamundaApps();
-            await appsPage.assertOptimizePresent();
-            await appsPage.assertOperatePresent();
-            await appsPage.assertTasklistPresent();
+            await appsPage.assertOptimizePresent(clusterName);
+            await appsPage.assertOperatePresent(clusterName);
+            await appsPage.assertTasklistPresent(clusterName);
             await (0, test_1.expect)(appsPage.modelerLink).toBeVisible();
             await appsPage.clickCamundaApps();
         });
@@ -299,7 +326,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             await (0, UtilitiesPage_1.assertLocatorVisibleWithRetry)(page, operateHomePage.noPermissionsMessage, 'Operate No Permission message');
         });
         await _8_8_1.test.step('Navigate to Tasklist and Ensure Tasklist is not Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await appsPage.clickCamundaApps();
             await appsPage.clickTasklist(clusterName);
             await (0, test_1.expect)(taskPanelPage.noPermissionsMessage).toBeVisible({
@@ -307,7 +334,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Identity and Ensure Identity is not Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await appsPage.clickCamundaApps();
             await appsPage.clickIdentity(clusterName);
             await (0, test_1.expect)(ocIdentityHomePage.noPermissionsMessage).toBeVisible({
@@ -315,14 +342,14 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Optimize and Ensure Optimize is Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await appsPage.clickCamundaApps();
             await appsPage.clickOptimize(clusterName);
             await (0, test_1.expect)(optimizeHomePage.optimizeBanner).toBeVisible({
                 timeout: 60000,
             });
         });
-        await _8_8_1.test.step('Navigate to Modeler and Ensure Diagram Failed To Deploy', async () => {
+        await _8_8_1.test.step('Navigate to Modeler and Ensure Diagram Cannot Be Deployed & Run', async () => {
             await appsPage.clickCamundaApps();
             await appsPage.clickModeler();
             await homePage.clickSkipCustomization();
@@ -339,9 +366,10 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             await modelerCreatePage.clickAppendElementButton();
             await modelerCreatePage.clickAppendEndEventButton();
             await (0, sleep_1.sleep)(20000);
-            await modelerCreatePage.runProcessInstance(clusterName, '', {}, '', true);
-            await (0, test_1.expect)(page.getByText(/The (diagram|application) failed to deploy & run/)).toBeVisible({ timeout: 60000 });
-            await modelerCreatePage.clickCloseButton();
+            // Hub gates this in the UI: an Analyst holds no instance or workflow
+            // create permission, so "Deploy & run" is offered only disabled, where
+            // Console let the attempt through and reported a failed deployment.
+            await modelerCreatePage.assertDeployAndRunNotPermitted();
         });
     });
     (0, _8_8_1.test)('Admin Role User Flow', async ({ page, modelerHomePage, appsPage, homePage, clusterPage, clusterDetailsPage, browser, consoleOrganizationsPage, settingsPage, operateHomePage, ocIdentityHomePage, taskPanelPage, optimizeHomePage, modelerCreatePage, }) => {
@@ -403,9 +431,9 @@ _8_8_1.test.describe('User Roles User Flow', () => {
                 timeout: 60000,
             });
             await appsPage.clickCamundaApps();
-            await appsPage.assertOptimizePresent();
-            await appsPage.assertOperatePresent();
-            await appsPage.assertTasklistPresent();
+            await appsPage.assertOptimizePresent(clusterName);
+            await appsPage.assertOperatePresent(clusterName);
+            await appsPage.assertTasklistPresent(clusterName);
             await (0, test_1.expect)(appsPage.modelerLink).toBeVisible();
             await appsPage.clickCamundaApps();
         });
@@ -417,7 +445,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Tasklist and Ensure Tasklist is Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await appsPage.clickCamundaApps();
             await appsPage.clickTasklist(clusterName);
             await (0, test_1.expect)(taskPanelPage.taskListPageBanner).toBeVisible({
@@ -425,7 +453,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Identity and Ensure Identity is Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await appsPage.clickCamundaApps();
             await appsPage.clickIdentity(clusterName);
             await (0, test_1.expect)(ocIdentityHomePage.identityBanner).toBeVisible({
@@ -436,7 +464,7 @@ _8_8_1.test.describe('User Roles User Flow', () => {
             });
         });
         await _8_8_1.test.step('Navigate to Optimize and Ensure Optimize is Accessible', async () => {
-            await page.goBack();
+            await appsPage.goBackToHub();
             await appsPage.clickCamundaApps();
             await appsPage.clickOptimize(clusterName);
             await (0, test_1.expect)(optimizeHomePage.optimizeBanner).toBeVisible({

package/dist/tests/8.8/console-user-flows.spec.js

@@ -192,7 +192,28 @@ _8_8_1.test.describe('Console User Flow Tests @tasklistV2', () => {
             await modelerHomePage.clickCrossComponentProjectFolder();
             await modelerHomePage.clickProcessDiagram(processName);
             await modelerCreatePage.runProcessInstance(alertFlowClusterName);
-            await (0, sleep_1.sleep)(10000);
+            // Straight into the next run, no wait. The email assertion below expects
+            // ONE mail reporting "New Incidents: 2", which only happens when both
+            // incidents fall inside the same alert evaluation cycle; the 10s sleep
+            // that used to be here pushed them into separate cycles and Console sent
+            // a "New Incidents: 1" mail for each (observed live: three mails at
+            // 15:09:20, 15:11:51 and 15:13:02, all reporting 1).
+            //
+            // Close the first run's toast before clicking again: camunda-hub 6813a7e
+            // made the "Instance started!" toast persistent whenever it carries the
+            // Operate action, so it stays up and its action button covers
+            // "Deploy & run", swallowing the second click ("<button
+            // data-action=\"true\"> ... intercepts pointer events", observed live
+            // once the sleep was gone).
+            const instanceStartedToast = page
+                .locator('[data-sonner-toast]')
+                .filter({ has: modelerCreatePage.viewProcessInstanceLink });
+            await instanceStartedToast
+                .locator('[data-close-button="true"]')
+                .click({ timeout: 30000 });
+            await (0, test_1.expect)(modelerCreatePage.viewProcessInstanceLink).toBeHidden({
+                timeout: 30000,
+            });
             await modelerCreatePage.runProcessInstance(alertFlowClusterName);
         });
         await _8_8_1.test.step('Navigate to Cluster Details', async () => {

package/dist/tests/8.8/rba-enabled-v1-user-flows.spec.js

@@ -9,6 +9,7 @@ const roleAuthorizations_1 = require("../../utils/roleAuthorizations");
 const expectTextWithRetry_1 = require("../../utils/assertionHelpers/expectTextWithRetry");
 const expectTextWithPagination_1 = require("../../utils/assertionHelpers/expectTextWithPagination");
 const users_1 = require("../../utils/users");
+const consoleApiHelpers_1 = require("../../utils/consoleApiHelpers");
 const expectLocatorWithRetry_1 = require("../../utils/assertionHelpers/expectLocatorWithRetry");
 const mainUser = (0, users_1.getTestUser)('twentyFifthUser');
 _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV1', () => {
@@ -19,19 +20,30 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV1', () => {
         'RBA On User Flow - Permission for Selected Processes Only': 'Fourth RBA V1 Cluster',
     };
     _8_8_1.test.beforeEach(async ({ page, homePage, clusterPage, loginPage, clusterDetailsPage, appsPage }, testInfo) => {
+        // Claimed here, not in each body: creating the cluster and waiting for
+        // it to come back Healthy after the authorizations toggle can outlast
+        // the default per-test timeout before the body starts.
+        _8_8_1.test.slow();
         await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, mainUser, (testInfo.workerIndex + 1) * 1000);
         await homePage.clickClusters();
         const clusterName = clusterNames[testInfo.title];
         (0, test_1.expect)(clusterName, `No cluster mapping for test title: "${testInfo.title}")`).toBeTruthy();
         await clusterPage.createClusterIfNotExists(clusterName);
         await (0, UtilitiesPage_1.disableRBA)(clusterName, homePage, clusterPage, clusterDetailsPage, appsPage);
+        // The flows below hand off to test users with no elevated or DevOps org
+        // role, and Hub only lets those roles assign an environment to a
+        // workspace (camunda-hub#28955). Without this, the test user's deploy
+        // dialog never offers this cluster and every runProcessInstance retry
+        // fails until the test times out. Assign it now, while the elevated
+        // main user's session is active. test-setup creates the test users'
+        // workspaces up front so that they exist at this point.
+        await (0, consoleApiHelpers_1.linkClusterToWorkspacesNamedViaApi)(page, clusterName);
     });
     _8_8_1.test.afterEach(async ({ page }, testInfo) => {
         await (0, _setup_1.captureScreenshot)(page, testInfo);
         await (0, _setup_1.captureFailureVideo)(page, testInfo);
     });
     (0, _8_8_1.test)('RBA On User Flow - No User Permission', async ({ page, homePage, modelerHomePage, appsPage, modelerCreatePage, clusterPage, clusterDetailsPage, taskPanelPage, taskProcessesPage, operateHomePage, ocIdentityHomePage, ocIdentityAuthorizationsPage, ocIdentityRolesPage, loginPage, settingsPage, }, testInfo) => {
-        _8_8_1.test.slow();
         const clusterName = clusterNames[testInfo.title];
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'RBA_NO_PERM' + randomString;
@@ -153,7 +165,6 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV1', () => {
         });
     });
     (0, _8_8_1.test)('RBA On User Flow - Permission for One Process', async ({ page, homePage, modelerHomePage, appsPage, modelerCreatePage, clusterPage, clusterDetailsPage, taskPanelPage, taskProcessesPage, operateHomePage, loginPage, ocIdentityHomePage, ocIdentityAuthorizationsPage, ocIdentityRolesPage, settingsPage, }, testInfo) => {
-        _8_8_1.test.slow();
         const clusterName = clusterNames[testInfo.title];
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'RBA_ONE_PERM' + randomString;
@@ -305,7 +316,6 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV1', () => {
         });
     });
     (0, _8_8_1.test)('RBA On User Flow - Permission for All Processes with Full Permissions', async ({ page, homePage, modelerHomePage, appsPage, modelerCreatePage, clusterPage, clusterDetailsPage, taskPanelPage, taskProcessesPage, operateHomePage, ocIdentityHomePage, ocIdentityAuthorizationsPage, }, testInfo) => {
-        _8_8_1.test.slow();
         const clusterName = clusterNames[testInfo.title];
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'AFTER_RBA' + randomString;
@@ -375,7 +385,6 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV1', () => {
         });
     });
     (0, _8_8_1.test)('RBA On User Flow - Permission for Selected Processes Only', async ({ page, homePage, modelerHomePage, appsPage, modelerCreatePage, clusterPage, clusterDetailsPage, taskPanelPage, taskProcessesPage, operateHomePage, ocIdentityHomePage, ocIdentityAuthorizationsPage, ocIdentityRolesPage, loginPage, settingsPage, }, testInfo) => {
-        _8_8_1.test.slow();
         const clusterName = clusterNames[testInfo.title];
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'RBA_SELECTED_PERM' + randomString;

package/dist/tests/8.8/rba-enabled-v2-user-flows.spec.js

@@ -9,6 +9,7 @@ const roleAuthorizations_1 = require("../../utils/roleAuthorizations");
 const expectTextWithRetry_1 = require("../../utils/assertionHelpers/expectTextWithRetry");
 const expectTextWithPagination_1 = require("../../utils/assertionHelpers/expectTextWithPagination");
 const users_1 = require("../../utils/users");
+const consoleApiHelpers_1 = require("../../utils/consoleApiHelpers");
 const mainUser = (0, users_1.getTestUser)('twentySixthUser');
 _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV2', () => {
     const clusterNames = {
@@ -18,6 +19,10 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV2', () => {
         'RBA On User Flow - Permission for Selected Processes Only': 'Fourth RBA V2 Cluster',
     };
     _8_8_1.test.beforeEach(async ({ page, homePage, clusterPage, loginPage, clusterDetailsPage, appsPage }, testInfo) => {
+        // Claimed here, not in each body: creating the cluster and waiting for
+        // it to come back Healthy after the authorizations toggle can outlast
+        // the default per-test timeout before the body starts.
+        _8_8_1.test.slow();
         await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, mainUser, (testInfo.workerIndex + 1) * 1000);
         await (0, test_1.expect)(homePage.clusterTab).toBeVisible({ timeout: 120000 });
         await homePage.clickClusters();
@@ -25,13 +30,20 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV2', () => {
         (0, test_1.expect)(clusterName, `No cluster mapping for test title: "${testInfo.title}")`).toBeTruthy();
         await clusterPage.createClusterIfNotExists(clusterName);
         await (0, UtilitiesPage_1.disableRBA)(clusterName, homePage, clusterPage, clusterDetailsPage, appsPage);
+        // The flows below hand off to test users with no elevated or DevOps org
+        // role, and Hub only lets those roles assign an environment to a
+        // workspace (camunda-hub#28955). Without this, the test user's deploy
+        // dialog never offers this cluster and every runProcessInstance retry
+        // fails until the test times out. Assign it now, while the elevated
+        // main user's session is active. test-setup creates the test users'
+        // workspaces up front so that they exist at this point.
+        await (0, consoleApiHelpers_1.linkClusterToWorkspacesNamedViaApi)(page, clusterName);
     });
     _8_8_1.test.afterEach(async ({ page }, testInfo) => {
         await (0, _setup_1.captureScreenshot)(page, testInfo);
         await (0, _setup_1.captureFailureVideo)(page, testInfo);
     });
     (0, _8_8_1.test)('RBA On User Flow - No User Permission', async ({ page, homePage, modelerHomePage, appsPage, modelerCreatePage, clusterPage, clusterDetailsPage, taskPanelPage, taskProcessesPage, operateHomePage, ocIdentityHomePage, ocIdentityAuthorizationsPage, ocIdentityRolesPage, loginPage, settingsPage, }, testInfo) => {
-        _8_8_1.test.slow();
         const clusterName = clusterNames[testInfo.title];
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'RBA_NO_PERM' + randomString;
@@ -68,10 +80,19 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV2', () => {
             await ocIdentityAuthorizationsPage.createAuthorization((0, roleAuthorizations_1.authorizationAllPermissions)(role));
         });
         await _8_8_1.test.step('Clear cookies and reset session', async () => {
+            // Reset the session directly rather than driving Hub's user-menu
+            // logout: that menu is not reachable from every page this step can be
+            // reached from, and clickOpenSettingsButton then burns all three of its
+            // retries (nightly: "Failed to click button after 3 retries"). Clearing
+            // cookies and storage is what the step is actually for, and is what
+            // pages/8.9's copy of this spec does.
+            await page.context().clearCookies();
+            await page.evaluate(() => {
+                localStorage.clear();
+                sessionStorage.clear();
+            });
             await page.goto('/');
-            await settingsPage.clickOpenSettingsButton();
-            await settingsPage.clickLogoutButton();
-            await loginPage.loginWithTestUser(testUser);
+            await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, testUser, 1000);
         });
         await _8_8_1.test.step('Navigate to Web Modeler', async () => {
             await appsPage.clickCamundaApps();
@@ -131,7 +152,6 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV2', () => {
         });
     });
     (0, _8_8_1.test)('RBA On User Flow - Permission for One Process', async ({ page, homePage, modelerHomePage, appsPage, modelerCreatePage, clusterPage, clusterDetailsPage, taskPanelPage, taskProcessesPage, operateHomePage, loginPage, ocIdentityHomePage, ocIdentityAuthorizationsPage, ocIdentityRolesPage, settingsPage, }, testInfo) => {
-        _8_8_1.test.slow();
         const clusterName = clusterNames[testInfo.title];
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'RBA_ONE_PERM' + randomString;
@@ -175,12 +195,21 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV2', () => {
             await ocIdentityAuthorizationsPage.createAuthorization((0, roleAuthorizations_1.roleAllAuthorization)(role1));
         });
         await _8_8_1.test.step('Clear cookies and reset session', async () => {
+            // Reset the session directly rather than driving Hub's user-menu
+            // logout: that menu is not reachable from every page this step can be
+            // reached from, and clickOpenSettingsButton then burns all three of its
+            // retries (nightly: "Failed to click button after 3 retries"). Clearing
+            // cookies and storage is what the step is actually for, and is what
+            // pages/8.9's copy of this spec does.
+            await page.context().clearCookies();
+            await page.evaluate(() => {
+                localStorage.clear();
+                sessionStorage.clear();
+            });
             await page.goto('/');
-            await settingsPage.clickOpenSettingsButton();
-            await settingsPage.clickLogoutButton();
         });
         await _8_8_1.test.step('Login as Test User', async () => {
-            await loginPage.loginWithTestUser(testUser);
+            await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, testUser, 1000);
         });
         await _8_8_1.test.step('Navigate to Web Modeler', async () => {
             await appsPage.clickCamundaApps();
@@ -280,7 +309,6 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV2', () => {
         });
     });
     (0, _8_8_1.test)('RBA On User Flow - Permission for All Processes with Full Permissions', async ({ page, homePage, modelerHomePage, appsPage, modelerCreatePage, clusterPage, clusterDetailsPage, taskPanelPage, taskProcessesPage, operateHomePage, ocIdentityHomePage, ocIdentityAuthorizationsPage, }, testInfo) => {
-        _8_8_1.test.slow();
         const clusterName = clusterNames[testInfo.title];
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'AFTER_RBA' + randomString;
@@ -352,8 +380,7 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV2', () => {
             await (0, expectTextWithRetry_1.expectTextWithRetry)(page, process2);
         });
     });
-    (0, _8_8_1.test)('RBA On User Flow - Permission for Selected Processes Only', async ({ page, homePage, modelerHomePage, appsPage, modelerCreatePage, clusterPage, clusterDetailsPage, taskPanelPage, taskProcessesPage, operateHomePage, ocIdentityHomePage, ocIdentityAuthorizationsPage, ocIdentityRolesPage, loginPage, settingsPage, }, testInfo) => {
-        _8_8_1.test.slow();
+    (0, _8_8_1.test)('RBA On User Flow - Permission for Selected Processes Only', async ({ page, homePage, modelerHomePage, appsPage, modelerCreatePage, clusterPage, clusterDetailsPage, taskPanelPage, taskProcessesPage, operateHomePage, ocIdentityHomePage, ocIdentityAuthorizationsPage, ocIdentityRolesPage, loginPage, }, testInfo) => {
         const clusterName = clusterNames[testInfo.title];
         const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
         const processName = 'RBA_SELECTED_PERM' + randomString;
@@ -392,10 +419,19 @@ _8_8_1.test.describe.parallel('RBA Enabled User Flows Test @tasklistV2', () => {
             await (0, sleep_1.sleep)(20000);
         });
         await _8_8_1.test.step('Clear cookies and reset session', async () => {
+            // Reset the session directly rather than driving Hub's user-menu
+            // logout: that menu is not reachable from every page this step can be
+            // reached from, and clickOpenSettingsButton then burns all three of its
+            // retries (nightly: "Failed to click button after 3 retries"). Clearing
+            // cookies and storage is what the step is actually for, and is what
+            // pages/8.9's copy of this spec does.
+            await page.context().clearCookies();
+            await page.evaluate(() => {
+                localStorage.clear();
+                sessionStorage.clear();
+            });
             await page.goto('/');
-            await settingsPage.clickOpenSettingsButton();
-            await settingsPage.clickLogoutButton();
-            await loginPage.loginWithTestUser(testUser);
+            await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, testUser, 1000);
         });
         await _8_8_1.test.step('Navigate to Web Modeler', async () => {
             await appsPage.clickCamundaApps();

package/dist/tests/8.8/test-setup.spec.js

@@ -118,11 +118,56 @@ _8_8_1.test.describe('Cluster Setup Tests', () => {
             await clusterSecretsPage.createSetOfSecrets(clusterName, connectorSecrets_1.connectorSecretsValues);
         }
     });
-    for (const [index, user] of (0, users_1.getTestUsers)().entries()) {
-        (0, _8_8_1.test)(`Create Project Folder for User ${index + 1}`, async ({ page, loginPage, homePage, appsPage, modelerHomePage, }, testInfo) => {
-            await _8_8_1.test.step('Log in', async () => {
-                await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, user, (testInfo.workerIndex + 1) * 1000);
+    // The RBA specs hand off to these developer-role users, who cannot assign an
+    // environment to a workspace (camunda-hub#28955). Their workspaces must exist
+    // before the RBA beforeEach links its cluster to them as the admin main user.
+    const rbaHandoffUsers = process.env.IS_AG === 'true' && process.env.RUN_FULL_SUITE !== 'true'
+        ? []
+        : ['4', '5', '6']
+            .map((n) => ({
+            username: process.env[`C8_USERNAME_TEST_${n}`] ?? '',
+            password: process.env[`C8_PASSWORD_TEST_${n}`] ?? '',
+            title: `Create Project Folder for RBA hand-off user TEST_${n}`,
+        }))
+            .filter((user) => user.username !== '' && user.password !== '');
+    for (const [index, user] of [
+        ...(0, users_1.getTestUsers)().map((u, i) => ({
+            ...u,
+            title: `Create Project Folder for User ${i + 1}`,
+        })),
+        ...rbaHandoffUsers,
+    ].entries()) {
+        const isRbaHandoffUser = index >= (0, users_1.getTestUsers)().length;
+        (0, _8_8_1.test)(user.title, async ({ page, loginPage, homePage, appsPage, modelerHomePage }, testInfo) => {
+            const loggedIn = await _8_8_1.test.step('Log in', async () => {
+                try {
+                    await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, user, (testInfo.workerIndex + 1) * 1000);
+                    return true;
+                }
+                catch (error) {
+                    // Every spec in the project depends on this setup project, so a
+                    // hand-off slot the org did not provision must not block the whole
+                    // suite (an 8.9 PR run lost 162 tests to exactly that). Nothing but
+                    // the RBA specs reads these three workspaces, and each of those logs
+                    // in as its own user, so it fails on its own login instead.
+                    //
+                    // Any failure, not just a credential rejection: unlike 8.9/8.10,
+                    // this version's LoginPage does not run classifyLoginRejection, so
+                    // no AUTH0_INVALID_CREDENTIALS marker ever reaches here to match on.
+                    if (!isRbaHandoffUser) {
+                        throw error;
+                    }
+                    console.warn(`${user.title}: ${String(error)}`);
+                    testInfo.annotations.push({
+                        type: 'warning',
+                        description: 'Could not log in as this hand-off user; no workspace',
+                    });
+                    return false;
+                }
             });
+            if (!loggedIn) {
+                return;
+            }
             await _8_8_1.test.step('Navigate to Web Modeler', async () => {
                 // Camunda Hub replaced Console + Web Modeler on SaaS: it lands on the
                 // Modeler home directly and has no app switcher to wait for.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/e2e-test-suite",
-  "version": "0.0.1288",
+  "version": "0.0.1289",
   "description": "End-to-end test helpers for Camunda 8",
   "repository": {
     "type": "git",