@camunda/e2e-test-suite 0.0.1435 → 0.0.1436

package/dist/pages/8.8/AppsPage.js

@@ -204,10 +204,19 @@ class AppsPage {
         // current cluster's own toggle name is not exactly clusterName either,
         // and an exact-equality exclusion would wrongly treat it as "other" and
         // immediately re-collapse the group this method just expanded.
-        const otherExpandedToggles = this.hubSidebar.getByRole('button', {
+        // The sidebar's own rail toggle is also a button inside "Main navigation"
+        // with aria-expanded="true" once the rail is open ("Collapse sidebar").
+        // Without excluding it this loop clicked it right after the group was
+        // expanded, collapsing the rail and taking the app links with it -- the
+        // 8.8 nightly trace shows exactly that sequence (expand "Test Cluster",
+        // count 1, click "Collapse sidebar", app link never appears). Same
+        // exclusion as pages/8.9/AppsPage.ts.
+        const otherExpandedToggles = this.hubSidebar
+            .getByRole('button', {
             expanded: true,
             name: new RegExp(`^(?!.*${escapeRegExp(clusterName)}).+$`),
-        });
+        })
+            .and(this.page.locator(':not([data-slot="app-sidebar-collapse-toggle"])'));
         for (let i = 0; i < 5 && (await otherExpandedToggles.count()) > 0; i++) {
             // Let a failed collapse throw rather than swallowing it: the app link
             // is intentionally sidebar-wide, so a group left expanded here produces

package/dist/pages/8.8/ClusterDetailsPage.d.ts

@@ -71,8 +71,8 @@ declare class ClusterDetailsPage {
     clickSettingsTab(): Promise<void>;
     private waitForAuthorizationsSection;
     private setAuthorizationsViaSwitch;
-    enableAuthorizations(): Promise<void>;
-    disableAuthorizations(): Promise<void>;
+    enableAuthorizations(): Promise<boolean>;
+    disableAuthorizations(): Promise<boolean>;
     searchAndClickClientCredentialsLink(name: string): Promise<ClientCredentialsDetailsPage>;
     deleteAPIClientsIfExist(name?: string): Promise<void>;
     clickAlertsTab(): Promise<void>;

package/dist/pages/8.8/ClusterDetailsPage.js

@@ -326,11 +326,11 @@ class ClusterDetailsPage {
     // Carbon toggle.
     async setAuthorizationsViaSwitch(enabled) {
         if (!(await this.authorizationsSwitch.isVisible().catch(() => false))) {
-            return false;
+            return 'absent';
         }
         const isOn = (await this.authorizationsSwitch.getAttribute('aria-checked')) === 'true';
         if (isOn === enabled) {
-            return true;
+            return 'unchanged';
         }
         await this.authorizationsSwitch.click({ timeout: 30000 });
         if (await this.dialog.isVisible({ timeout: 15000 }).catch(() => false)) {
@@ -341,13 +341,14 @@ class ClusterDetailsPage {
             await (0, test_1.expect)(this.page.getByText(enabled ? 'Enabling...' : 'Disabling...')).not.toBeVisible({ timeout: 60000 });
         }
         await (0, test_1.expect)(this.authorizationsSwitch).toHaveAttribute('aria-checked', String(enabled), { timeout: 120000 });
-        return true;
+        return 'changed';
     }
     async enableAuthorizations() {
         await (0, sleep_1.sleep)(5000);
         await this.waitForAuthorizationsSection();
-        if (await this.setAuthorizationsViaSwitch(true)) {
-            return;
+        const viaSwitch = await this.setAuthorizationsViaSwitch(true);
+        if (viaSwitch !== 'absent') {
+            return viaSwitch === 'changed';
         }
         // Locate all elements with class .cds--toggle__text
         const toggleTextElements = await this.page.$$('.cds--toggle__text');
@@ -372,13 +373,16 @@ class ClusterDetailsPage {
                     }
                     await (0, sleep_1.sleep)(10000);
                     console.log('Second toggle switch clicked.');
+                    return true;
                 }
                 else {
                     console.log('Second toggle switch not found or less than 2.');
+                    return false;
                 }
             }
             else {
                 console.log("Second toggle text does not contain 'Disabled'.");
+                return false;
             }
         }
         else {
@@ -395,8 +399,9 @@ class ClusterDetailsPage {
     }
     async disableAuthorizations() {
         await this.waitForAuthorizationsSection();
-        if (await this.setAuthorizationsViaSwitch(false)) {
-            return;
+        const viaSwitch = await this.setAuthorizationsViaSwitch(false);
+        if (viaSwitch !== 'absent') {
+            return viaSwitch === 'changed';
         }
         // Locate all elements with class .cds--toggle__text
         const toggleTextElements = await this.page.$$('.cds--toggle__text');
@@ -421,13 +426,16 @@ class ClusterDetailsPage {
                     }
                     console.log('Second toggle switch clicked.');
                     await (0, sleep_1.sleep)(10000);
+                    return true;
                 }
                 else {
                     console.log('Second toggle switch not found or less than 2.');
+                    return false;
                 }
             }
             else {
                 console.log("Second toggle text does not contain 'Enabled'.");
+                return false;
             }
         }
         else {

package/dist/pages/8.8/ClusterPage.d.ts

@@ -58,6 +58,7 @@ declare class ClusterPage {
     clickLatestStableForMinorVersion(): Promise<void>;
     clickClusterOption(version: string): Promise<void>;
     createClusterIfNotExists(clusterName: string, region?: string): Promise<void>;
+    waitForClusterRestartToStart(name: string, timeout?: number): Promise<void>;
     assertClusterHealthyStatusWithRetry(name: string, visibilityTimeout?: number, totalTimeout?: number, isUpgradeScenario?: boolean): Promise<void>;
     clickAlphaTab(): Promise<void>;
     clickDevTab(): Promise<void>;

package/dist/pages/8.8/ClusterPage.js

@@ -362,20 +362,18 @@ class ClusterPage {
         await this.createClusterButton.click();
     }
     async clickClustersBreadcrumb(clusterName) {
-        const clusterRow = this.cluster(clusterName);
-        const clusterRowVisible = clusterRow
-            .getByText(CREATING_STATUS)
-            .or(clusterRow.getByText('Healthy', { exact: true }));
+        // Wait for the new cluster's row, not for a status: Hub can list a
+        // just-created cluster as "unknown" for longer than this wait before it
+        // switches to "Creating…". Every caller asserts Healthy afterwards.
+        const clusterRow = this.clusterLink(clusterName);
         try {
             await (0, test_1.expect)(this.clustersBreadcrumb).toBeVisible({ timeout: 60000 });
             await this.clustersBreadcrumb.click({ timeout: 60000 });
-            await (0, test_1.expect)(clusterRow.getByText(CREATING_STATUS)).toBeVisible({
-                timeout: 30000,
-            });
+            await (0, test_1.expect)(clusterRow).toBeVisible({ timeout: 30000 });
         }
         catch (error) {
             await this.clickClusterBanner();
-            await (0, test_1.expect)(clusterRowVisible).toBeVisible({ timeout: 30000 });
+            await (0, test_1.expect)(clusterRow).toBeVisible({ timeout: 30000 });
         }
     }
     async clickClusterLink(name) {
@@ -465,14 +463,51 @@ class ClusterPage {
     }
     async createClusterIfNotExists(clusterName, region = 'GCP') {
         await (0, sleep_1.sleep)(15000);
-        if ((await this.cluster(clusterName).isVisible({ timeout: 20000 })) &&
-            (await this.clusterHealthiness(clusterName).isVisible({ timeout: 20000 }))) {
+        // isVisible() does not wait, so a table that was still loading read as
+        // "no cluster" and a retry recreated the cluster its first attempt had
+        // already created. Give the row time to render before trusting a miss.
+        const exists = await this.cluster(clusterName)
+            .waitFor({ state: 'visible', timeout: 30000 })
+            .then(() => true)
+            .catch(() => false);
+        if (!exists) {
+            await this.createCluster(clusterName, region);
+        }
+        else if (await this.clusterHealthiness(clusterName).isVisible()) {
             console.log(`${clusterName} exists and is healthy.`);
+            return;
         }
         else {
-            await this.createCluster(clusterName, region);
-            await this.assertClusterHealthyStatusWithRetry(clusterName, 120000, 600000);
+            // Still provisioning, typically from the attempt this retry replaces.
+            // Recreating it adds a second cluster of the same name, because the
+            // pre-clean in createCluster does not delete it, and every exact-name
+            // locator then fails on strict mode.
+            console.log(`${clusterName} exists but is not Healthy yet; waiting for it to come up.`);
         }
+        await this.assertClusterHealthyStatusWithRetry(clusterName, 120000, 600000);
+    }
+    // A settings change that restarts the cluster, such as the authorizations
+    // toggle, leaves the status on "Healthy" until the operator reconciles the
+    // new spec. A Healthy check made straight after the change can therefore
+    // pass before the restart has begun, and the test then runs against a
+    // cluster that is about to restart. Wait for the status to leave Healthy
+    // first. The list updates over SSE, so no reload is needed while waiting.
+    async waitForClusterRestartToStart(name, timeout = 120000) {
+        const rowShown = await this.cluster(name)
+            .waitFor({ state: 'visible', timeout: 60000 })
+            .then(() => true)
+            .catch(() => false);
+        if (!rowShown) {
+            console.warn(`${name}: cluster row not shown, so the restart cannot be watched.`);
+            return;
+        }
+        const leftHealthy = await this.clusterHealthiness(name)
+            .waitFor({ state: 'hidden', timeout })
+            .then(() => true)
+            .catch(() => false);
+        console.log(leftHealthy
+            ? `${name}: restart started, status left Healthy.`
+            : `${name}: status stayed Healthy for ${timeout / 1000}s after the change.`);
     }
     async assertClusterHealthyStatusWithRetry(name, visibilityTimeout = 100000, totalTimeout = 420000, isUpgradeScenario = false) {
         // For upgrade scenarios, use much longer timeouts and more retries instead of fixed waits.

package/dist/pages/8.8/UtilitiesPage.js

@@ -387,8 +387,11 @@ async function disableRBA(clusterName, homePage, clusterPage, clusterDetailsPage
         timeout: 90000,
     });
     await clusterDetailsPage.clickSettingsTab();
-    await clusterDetailsPage.disableAuthorizations();
+    const changed = await clusterDetailsPage.disableAuthorizations();
     await homePage.clickClusters();
+    if (changed) {
+        await clusterPage.waitForClusterRestartToStart(clusterName);
+    }
     await clusterPage.assertClusterHealthyStatusWithRetry(clusterName);
     await clusterPage.clickClusterLink(clusterName);
     await (0, test_1.expect)(clusterDetailsPage.rbaEnabledMessage.first()).not.toBeVisible({
@@ -407,8 +410,11 @@ async function enableAuthorizations(clusterName, homePage, clusterPage, clusterD
         timeout: 90000,
     });
     await clusterDetailsPage.clickSettingsTab();
-    await clusterDetailsPage.enableAuthorizations();
+    const changed = await clusterDetailsPage.enableAuthorizations();
     await homePage.clickClusters();
+    if (changed) {
+        await clusterPage.waitForClusterRestartToStart(clusterName);
+    }
     await clusterPage.assertClusterHealthyStatusWithRetry(clusterName);
     await clusterPage.clickClusterLink(clusterName);
     await clusterDetailsPage.assertComponentsHealth();

package/dist/pages/8.9/ClusterDetailsPage.d.ts

@@ -78,8 +78,8 @@ declare class ClusterDetailsPage {
     clickSettingsTab(): Promise<void>;
     private waitForAuthorizationsSection;
     private setAuthorizationsViaSwitch;
-    enableAuthorizations(): Promise<void>;
-    disableAuthorizations(): Promise<void>;
+    enableAuthorizations(): Promise<boolean>;
+    disableAuthorizations(): Promise<boolean>;
     searchAndClickClientCredentialsLink(name: string): Promise<ClientCredentialsDetailsPage>;
     deleteAPIClientsIfExist(name?: string): Promise<void>;
     clickAlertsTab(): Promise<void>;

package/dist/pages/8.9/ClusterDetailsPage.js

@@ -401,20 +401,21 @@ class ClusterDetailsPage {
             },
         });
     }
-    // Drives the design-system Authorizations switch. Returns false when this
+    // Drives the design-system Authorizations switch. Returns 'absent' when this
     // shell does not render one, so the caller falls through to the legacy
-    // Carbon toggle.
+    // Carbon toggle, and 'changed' only when it flipped the setting, which
+    // restarts the cluster.
     async setAuthorizationsViaSwitch(enabled) {
         const hasSwitch = await this.authorizationsSwitch
             .waitFor({ state: 'visible', timeout: 10000 })
             .then(() => true)
             .catch(() => false);
         if (!hasSwitch) {
-            return false;
+            return 'absent';
         }
         const isOn = (await this.authorizationsSwitch.getAttribute('aria-checked')) === 'true';
         if (isOn === enabled) {
-            return true;
+            return 'unchanged';
         }
         await this.authorizationsSwitch.click({ timeout: 30000 });
         const confirmOpened = await this.dialog
@@ -427,13 +428,14 @@ class ClusterDetailsPage {
             await (0, test_1.expect)(this.page.getByText(enabled ? 'Enabling...' : 'Disabling...')).not.toBeVisible({ timeout: 60000 });
         }
         await (0, test_1.expect)(this.authorizationsSwitch).toHaveAttribute('aria-checked', String(enabled), { timeout: 120000 });
-        return true;
+        return 'changed';
     }
     async enableAuthorizations() {
         await (0, sleep_1.sleep)(5000);
         await this.waitForAuthorizationsSection();
-        if (await this.setAuthorizationsViaSwitch(true)) {
-            return;
+        const viaSwitch = await this.setAuthorizationsViaSwitch(true);
+        if (viaSwitch !== 'absent') {
+            return viaSwitch === 'changed';
         }
         // Locate all elements with class .cds--toggle__text
         const toggleTextElements = await this.page.$$('.cds--toggle__text');
@@ -458,13 +460,16 @@ class ClusterDetailsPage {
                     }
                     await (0, sleep_1.sleep)(10000);
                     console.log('Second toggle switch clicked.');
+                    return true;
                 }
                 else {
                     console.log('Second toggle switch not found or less than 2.');
+                    return false;
                 }
             }
             else {
                 console.log("Second toggle text does not contain 'Disabled'.");
+                return false;
             }
         }
         else {
@@ -477,8 +482,9 @@ class ClusterDetailsPage {
     }
     async disableAuthorizations() {
         await this.waitForAuthorizationsSection();
-        if (await this.setAuthorizationsViaSwitch(false)) {
-            return;
+        const viaSwitch = await this.setAuthorizationsViaSwitch(false);
+        if (viaSwitch !== 'absent') {
+            return viaSwitch === 'changed';
         }
         // Locate all elements with class .cds--toggle__text
         const toggleTextElements = await this.page.$$('.cds--toggle__text');
@@ -504,13 +510,16 @@ class ClusterDetailsPage {
                     }
                     console.log('Second toggle switch clicked.');
                     await (0, sleep_1.sleep)(10000);
+                    return true;
                 }
                 else {
                     console.log('Second toggle switch not found or less than 2.');
+                    return false;
                 }
             }
             else {
                 console.log("Second toggle text does not contain 'Enabled'.");
+                return false;
             }
         }
         else {

package/dist/pages/8.9/ClusterPage.d.ts

@@ -56,6 +56,7 @@ declare class ClusterPage {
     clickLatestStableForMinorVersion(): Promise<void>;
     clickClusterOption(): Promise<void>;
     createClusterIfNotExists(clusterName: string, region?: string): Promise<void>;
+    waitForClusterRestartToStart(name: string, timeout?: number): Promise<void>;
     assertClusterHealthyStatusWithRetry(name: string, visibilityTimeout?: number, totalTimeout?: number, maxRetries?: number): Promise<void>;
     clickAlphaTab(): Promise<void>;
     clickDevTab(): Promise<void>;

package/dist/pages/8.9/ClusterPage.js

@@ -314,17 +314,18 @@ class ClusterPage {
         await this.createClusterButton.click();
     }
     async clickClustersBreadcrumb(clusterName) {
-        const clusterRow = this.cluster(clusterName);
-        const creatingRow = clusterRow.getByText(CLUSTER_CREATING_STATUS);
-        const clusterRowVisible = creatingRow.or(clusterRow.getByText('Healthy', { exact: true }));
+        // Wait for the new cluster's row, not for a status: Hub can list a
+        // just-created cluster as "unknown" for longer than this wait before it
+        // switches to "Creating…". Every caller asserts Healthy afterwards.
+        const clusterRow = this.clusterLink(clusterName);
         try {
             await (0, test_1.expect)(this.clustersBreadcrumb).toBeVisible({ timeout: 60000 });
             await this.clustersBreadcrumb.click({ timeout: 60000 });
-            await (0, test_1.expect)(creatingRow).toBeVisible({ timeout: 30000 });
+            await (0, test_1.expect)(clusterRow).toBeVisible({ timeout: 30000 });
         }
         catch (error) {
             await this.clickClusterBanner();
-            await (0, test_1.expect)(clusterRowVisible).toBeVisible({ timeout: 30000 });
+            await (0, test_1.expect)(clusterRow).toBeVisible({ timeout: 30000 });
         }
     }
     async clickClusterLink(name) {
@@ -432,22 +433,60 @@ class ClusterPage {
     }
     async createClusterIfNotExists(clusterName, region = 'GCP') {
         await (0, sleep_1.sleep)(15000);
-        if ((await this.cluster(clusterName).isVisible({ timeout: 20000 })) &&
-            (await this.clusterHealthiness(clusterName).isVisible({ timeout: 20000 }))) {
+        // isVisible() does not wait, so a table that was still loading read as
+        // "no cluster" and a retry recreated the cluster its first attempt had
+        // already created. Give the row time to render before trusting a miss.
+        const exists = await this.cluster(clusterName)
+            .waitFor({ state: 'visible', timeout: 30000 })
+            .then(() => true)
+            .catch(() => false);
+        if (!exists) {
+            await this.createCluster(clusterName, region);
+        }
+        else if (await this.clusterHealthiness(clusterName).isVisible()) {
             console.log(`${clusterName} exists and is healthy.`);
+            return;
         }
         else {
-            await this.createCluster(clusterName, region);
-            // The Healthy badge is only re-read after a reload, and
-            // expectLocatorWithRetry reloads once per attempt -- so `maxRetries` is
-            // what sets the polling resolution, not `totalTimeout`. With the old
-            // 120s/600s/5 the loop reloaded 5 times and gave up after ~570s, short
-            // of its own 600s budget. Polling every 15s instead reloads ~45 times,
-            // and 900s gives a cluster provisioning alongside the other parallel
-            // workers' clusters the room it actually needs (still well inside the
-            // 36-minute test.slow() budget).
-            await this.assertClusterHealthyStatusWithRetry(clusterName, 15000, 900000, 60);
+            // Still provisioning, typically from the attempt this retry replaces.
+            // Recreating it is not an option: createCluster's pre-clean finds no
+            // per-row Delete button in Hub's table (only "Row actions"), so it
+            // leaves this cluster in place and adds a second one of the same name,
+            // which the apps menu can then no longer tell apart.
+            console.log(`${clusterName} exists but is not Healthy yet; waiting for it to come up.`);
+        }
+        // The Healthy badge is only re-read after a reload, and
+        // expectLocatorWithRetry reloads once per attempt -- so `maxRetries` is
+        // what sets the polling resolution, not `totalTimeout`. With the old
+        // 120s/600s/5 the loop reloaded 5 times and gave up after ~570s, short
+        // of its own 600s budget. Polling every 15s instead reloads ~45 times,
+        // and 900s gives a cluster provisioning alongside the other parallel
+        // workers' clusters the room it actually needs (still well inside the
+        // 36-minute test.slow() budget).
+        await this.assertClusterHealthyStatusWithRetry(clusterName, 15000, 900000, 60);
+    }
+    // A settings change that restarts the cluster, such as the authorizations
+    // toggle, leaves the status on "Healthy" until the operator reconciles the
+    // new spec. A Healthy check made straight after the change can therefore
+    // pass before the restart has begun, and the test then runs against a
+    // cluster that is about to restart. Wait for the status to leave Healthy
+    // first. The list updates over SSE, so no reload is needed while waiting.
+    async waitForClusterRestartToStart(name, timeout = 120000) {
+        const rowShown = await this.cluster(name)
+            .waitFor({ state: 'visible', timeout: 60000 })
+            .then(() => true)
+            .catch(() => false);
+        if (!rowShown) {
+            console.warn(`${name}: cluster row not shown, so the restart cannot be watched.`);
+            return;
         }
+        const leftHealthy = await this.clusterHealthiness(name)
+            .waitFor({ state: 'hidden', timeout })
+            .then(() => true)
+            .catch(() => false);
+        console.log(leftHealthy
+            ? `${name}: restart started, status left Healthy.`
+            : `${name}: status stayed Healthy for ${timeout / 1000}s after the change.`);
     }
     async assertClusterHealthyStatusWithRetry(name, visibilityTimeout = 100000, totalTimeout = 500000, maxRetries) {
         await (0, expectLocatorWithRetry_1.expectLocatorWithRetry)(this.page, this.clusterHealthiness(name), {

package/dist/pages/8.9/UtilitiesPage.js

@@ -422,10 +422,13 @@ async function disableRBA(clusterName, homePage, clusterPage, clusterDetailsPage
         timeout: 90000,
     });
     await clusterDetailsPage.clickSettingsTab();
-    await clusterDetailsPage.disableAuthorizations();
+    const changed = await clusterDetailsPage.disableAuthorizations();
     // The toggle restarts the cluster; Console can crash out of the settings
     // route while it does, taking the Clusters nav link with it.
     await homePage.clickClustersWithReloadRecovery();
+    if (changed) {
+        await clusterPage.waitForClusterRestartToStart(clusterName);
+    }
     await clusterPage.assertClusterHealthyStatusWithRetry(clusterName);
     await clusterPage.clickClusterLink(clusterName);
     await (0, test_1.expect)(clusterDetailsPage.rbaEnabledMessage.first()).not.toBeVisible({
@@ -444,10 +447,13 @@ async function enableAuthorizations(clusterName, homePage, clusterPage, clusterD
         timeout: 90000,
     });
     await clusterDetailsPage.clickSettingsTab();
-    await clusterDetailsPage.enableAuthorizations();
+    const changed = await clusterDetailsPage.enableAuthorizations();
     // The toggle restarts the cluster; Console can crash out of the settings
     // route while it does, taking the Clusters nav link with it.
     await homePage.clickClustersWithReloadRecovery();
+    if (changed) {
+        await clusterPage.waitForClusterRestartToStart(clusterName);
+    }
     await clusterPage.assertClusterHealthyStatusWithRetry(clusterName);
     await clusterPage.clickClusterLink(clusterName);
     await clusterDetailsPage.assertComponentsHealth();

package/dist/tests/8.8/access-user-role-management.spec.js

@@ -44,10 +44,8 @@ _8_8_1.test.describe('User Roles User Flow', () => {
     });
     // Workspace membership is durable organization state, so the Editor rights
     // the Analyst flow grants must be handed back whether the test passed or
-    // failed. Left behind, a retry would start with the analyst already an
-    // Editor and its own "not reachable without workspace access" assertion
-    // would fail on the second attempt; the grant would also leak into every
-    // later nightly run against the same org.
+    // failed. Left behind, the grant would leak into every later nightly run
+    // against the same org.
     _8_8_1.test.afterEach(async ({ page, loginPage }, testInfo) => {
         if (!testInfo.title.startsWith('Analyst Role User Flow')) {
             return;
@@ -169,10 +167,9 @@ _8_8_1.test.describe('User Roles User Flow', () => {
         const processName = 'User Roles User Flow' + randomString;
         const clusterName = clusterNames['Analyst Role User Flow'];
         // A retry runs in a fresh worker, where analystWorkspaceGrantMade starts
-        // false even when the previous attempt's teardown failed to hand the grant
-        // back -- which is exactly what happens when that teardown dies on its
-        // admin re-login. The "not reachable without workspace access" step below
-        // would then always fail, because the analyst is still an Editor.
+        // false even when the previous attempt's teardown failed to hand the
+        // grant back. Remove a leftover grant so the membership does not leak
+        // into later runs against the same org.
         if (_8_8_1.test.info().retry > 0) {
             await _8_8_1.test.step('Hand back a workspace grant left by the previous attempt', async () => {
                 await appsPage.clickModeler();
@@ -201,52 +198,23 @@ _8_8_1.test.describe('User Roles User Flow', () => {
                 password: process.env.C8_PASSWORD_TEST_9,
             }, 1000);
         });
-        // An organization role no longer decides on its own what a non-admin can
-        // reach. Since camunda-hub's environments work (pdp-3443, pdp-3715), a
-        // cluster's apps are surfaced through an ENVIRONMENT, and an environment
-        // is visible only to users who are Editor or Workspace Admin on a
-        // workspace it is assigned to -- organization admins and owners excepted,
-        // who see every environment unconditionally. An Analyst with no workspace
-        // membership therefore reaches nothing, which is the decided design
-        // rather than a defect: "Clusters are shown only to org admins.
-        // Non-admins do not have cluster visibility (they operate with
-        // environments instead)."
-        //
-        // Assert that gate before granting the membership the rest of this test
-        // depends on, so both halves are covered: the role alone grants no
-        // access, and the role plus workspace editorship does.
-        await _8_8_1.test.step('Ensure Optimize is not reachable without workspace access', async () => {
-            // Assert the cause, not just the consequence. Hub shows the analyst an
-            // empty Workspaces overview -- "You don't have explicit membership in
-            // any workspace in this organization" before the scope is widened, and
-            // "Your organization has no workspaces yet" after -- because the
-            // workspace belongs to whoever created it. With no workspace there is
-            // no environment, and with no environment no cluster app, so checking
-            // the Optimize banner alone would pass for unrelated reasons too.
+        // Every SaaS organization member sees every environment in the
+        // organization, whether or not they belong to a workspace. Hub decided
+        // this in camunda-hub#30270 and shipped it in camunda-hub#30271; the bug
+        // that challenged it, camunda-hub#30300, was closed as works-as-intended.
+        // Assert it, so a revert to the stricter "assigned only" rule is caught.
+        // What the analyst may do inside each app stays gated by the cluster's
+        // authorizations, which the steps below assert.
+        await _8_8_1.test.step('Ensure the cluster is listed without workspace access', async () => {
             await appsPage.clickCamundaApps();
             await (0, test_1.expect)(page
                 .getByText('Your organization has no workspaces yet')
                 .or(page.getByText("You don't have explicit membership in any workspace"))
                 .first()).toBeVisible({ timeout: 60000 });
-            // Assert the absence of THIS cluster's Optimize target directly rather
-            // than calling clickOptimize() and swallowing whatever it throws: a
-            // swallowed error would let this step pass because the hand-off helper
-            // itself broke and the page simply stayed on Hub, where the Optimize
-            // banner is absent for reasons that have nothing to do with the gate.
-            // On Hub a cluster's apps hang off the sidebar group named for the
-            // cluster, so with no environment neither the group nor the Optimize
-            // link inside it is ever rendered.
             const hubSidebar = page.getByRole('navigation', {
                 name: 'Main navigation',
             });
-            // The negative counts below mean nothing before the shell has rendered:
-            // toHaveCount(0) passes vacuously on a page that has not painted yet.
-            await (0, test_1.expect)(hubSidebar).toBeVisible({ timeout: 30000 });
-            await (0, test_1.expect)(hubSidebar.getByRole('button', { name: clusterName })).toHaveCount(0, { timeout: 30000 });
-            await (0, test_1.expect)(hubSidebar.getByRole('link', { name: /Optimize/ })).toHaveCount(0, { timeout: 30000 });
-            await (0, test_1.expect)(optimizeHomePage.optimizeBanner).not.toBeVisible({
-                timeout: 30000,
-            });
+            await (0, test_1.expect)(hubSidebar.getByRole('button', { name: clusterName })).toBeVisible({ timeout: 30000 });
         });
         await _8_8_1.test.step('Grant the analyst Editor rights on the shared workspace', async () => {
             // Only an organization admin may change workspace membership, so this

package/dist/tests/8.9/access-user-role-management.spec.js

@@ -40,9 +40,10 @@ _8_9_1.test.describe('User Roles User Flow', () => {
         await (0, _setup_1.captureScreenshot)(page, testInfo);
         await (0, _setup_1.captureFailureVideo)(page, testInfo);
     });
-    // Workspace membership is durable org state: left behind, a retry starts
-    // with the analyst already an Editor and its "not reachable without
-    // workspace access" step fails. Hand it back whether the test passed or not.
+    // Workspace membership is durable organization state, so the Editor rights
+    // the Analyst flow grants must be handed back whether the test passed or
+    // failed. Left behind, the grant would leak into every later nightly run
+    // against the same org.
     _8_9_1.test.afterEach(async ({ page, loginPage }, testInfo) => {
         if (!testInfo.title.startsWith('Analyst Role User Flow')) {
             return;
@@ -166,7 +167,8 @@ _8_9_1.test.describe('User Roles User Flow', () => {
         const clusterName = clusterNames['Analyst Role User Flow'];
         // A retry runs in a fresh worker, where analystWorkspaceGrantMade starts
         // false even when the previous attempt's teardown failed to hand the
-        // grant back. The "not reachable" step below would then always fail.
+        // grant back. Remove a leftover grant so the membership does not leak
+        // into later runs against the same org.
         if (_8_9_1.test.info().retry > 0) {
             await _8_9_1.test.step('Hand back a workspace grant left by the previous attempt', async () => {
                 await appsPage.clickModeler();
@@ -196,11 +198,14 @@ _8_9_1.test.describe('User Roles User Flow', () => {
                 password: process.env.C8_PASSWORD_TEST_9,
             });
         });
-        // Hub no longer lets an organization role alone reach a cluster's apps: a
-        // non-admin sees only environments assigned to a workspace they are Editor
-        // or Workspace Admin on (camunda-hub EnvironmentVisibilityResolver,
-        // ProjectOperation.VIEW_ENVIRONMENTS). Assert that gate, then grant it.
-        await _8_9_1.test.step('Ensure Optimize is not reachable without workspace access', async () => {
+        // Every SaaS organization member sees every environment in the
+        // organization, whether or not they belong to a workspace. Hub decided
+        // this in camunda-hub#30270 and shipped it in camunda-hub#30271; the bug
+        // that challenged it, camunda-hub#30300, was closed as works-as-intended.
+        // Assert it, so a revert to the stricter "assigned only" rule is caught.
+        // What the analyst may do inside each app stays gated by the cluster's
+        // authorizations, which the steps below assert.
+        await _8_9_1.test.step('Ensure the cluster is listed without workspace access', async () => {
             await appsPage.clickCamundaApps();
             await (0, test_1.expect)(page
                 .getByText('Your organization has no workspaces yet')
@@ -209,13 +214,7 @@ _8_9_1.test.describe('User Roles User Flow', () => {
             const hubSidebar = page.getByRole('navigation', {
                 name: 'Main navigation',
             });
-            // The negative counts below mean nothing before the shell has rendered.
-            await (0, test_1.expect)(hubSidebar).toBeVisible({ timeout: 30000 });
-            await (0, test_1.expect)(hubSidebar.getByRole('button', { name: clusterName })).toHaveCount(0, { timeout: 30000 });
-            await (0, test_1.expect)(hubSidebar.getByRole('link', { name: /Optimize/ })).toHaveCount(0, { timeout: 30000 });
-            await (0, test_1.expect)(optimizeHomePage.optimizeBanner).not.toBeVisible({
-                timeout: 30000,
-            });
+            await (0, test_1.expect)(hubSidebar.getByRole('button', { name: clusterName })).toBeVisible({ timeout: 30000 });
         });
         await _8_9_1.test.step('Grant the analyst Editor rights on the shared workspace', async () => {
             // Membership and environment assignment are org-admin actions, so this

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/e2e-test-suite",
-  "version": "0.0.1435",
+  "version": "0.0.1436",
   "description": "End-to-end test helpers for Camunda 8",
   "repository": {
     "type": "git",