@camunda/e2e-test-suite 0.0.1443 → 0.0.1444

package/dist/pages/SM-8.11/NavigationPage.d.ts

@@ -0,0 +1,58 @@
+import { Locator, Page } from '@playwright/test';
+declare class NavigationPage {
+    private page;
+    readonly modelerPageBanner: Locator;
+    readonly operatePageBanner: Locator;
+    readonly tasklistPageBanner: Locator;
+    readonly optimizePageBanner: Locator;
+    readonly identityPageBanner: Locator;
+    readonly keyboardPageBanner: Locator;
+    readonly managementIdentityPageBanner: Locator;
+    private onboardingTourSuppressed;
+    constructor(page: Page);
+    private isGatewayErrorPage;
+    private waitForBanner;
+    goTo(url: string, banner: Locator, sleepTimeout?: number, { username, password, }?: {
+        username?: string;
+        password?: string;
+    }, maxRetries?: number): Promise<void>;
+    goToModeler(sleepTimeout?: number, credentials?: {
+        username: string;
+        password: string;
+    }): Promise<void>;
+    private suppressOnboardingTour;
+    goToTasklist(sleepTimeout?: number, credentials?: {
+        username: string;
+        password: string;
+    }): Promise<void>;
+    goToOperate(sleepTimeout?: number, credentials?: {
+        username: string;
+        password: string;
+    }): Promise<void>;
+    goToOptimize(sleepTimeout?: number, credentials?: {
+        username: string;
+        password: string;
+    }): Promise<void>;
+    goToOptimizeWithoutAccess({ username, password, }?: {
+        username?: string;
+        password?: string;
+    }): Promise<void>;
+    goToModelerWithoutAccess({ username, password, }?: {
+        username?: string;
+        password?: string;
+    }): Promise<void>;
+    goToKeycloak(maxRetries?: number): Promise<void>;
+    goToOCAdmin(sleepTimeout?: number, credentials?: {
+        username: string;
+        password: string;
+    }, maxRetries?: number): Promise<void>;
+    goToClusters(sleepTimeout?: number, credentials?: {
+        username: string;
+        password: string;
+    }): Promise<void>;
+    goToManagementIdentity(sleepTimeout?: number, credentials?: {
+        username: string;
+        password: string;
+    }): Promise<void>;
+}
+export { NavigationPage };

package/dist/pages/SM-8.11/NavigationPage.js

@@ -0,0 +1,389 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NavigationPage = void 0;
+const test_1 = require("@playwright/test");
+const LoginPage_1 = require("./LoginPage");
+const sleep_1 = require("../../utils/sleep");
+const constants_1 = require("../../utils/constants");
+const env_1 = require("../../utils/env");
+// Context paths use `||`, not `??`: an env var set to the empty string must fall back to the
+// default. CI wiring that always exports a variable (set to "" when the leg has no override)
+// otherwise defeats the default — `page.goto('')` resolves to Playwright's baseURL, so the app
+// under test is never reached and the failure surfaces as an unrelated navigation timeout.
+const ORCHESTRATION_CONTEXT_PATH = process.env.ORCHESTRATION_CONTEXT_PATH || '/orchestration';
+const NORMALIZED_ORCHESTRATION_CONTEXT_PATH = ORCHESTRATION_CONTEXT_PATH.startsWith('/')
+    ? ORCHESTRATION_CONTEXT_PATH
+    : `/${ORCHESTRATION_CONTEXT_PATH}`;
+const MODELER_CONTEXT_PATH = process.env.MODELER_CONTEXT_PATH || '/modeler';
+const OPTIMIZE_CONTEXT_PATH = process.env.OPTIMIZE_CONTEXT_PATH || '/optimize';
+const MANAGEMENT_IDENTITY_CONTEXT_PATH = process.env.MANAGEMENT_IDENTITY_CONTEXT_PATH || '/identity';
+const IDENTITY_FIRSTUSER_USERNAME = process.env.DISTRO_QA_E2E_TESTS_IDENTITY_FIRSTUSER_USERNAME || 'demo';
+const IDENTITY_FIRSTUSER_PASSWORD = process.env.DISTRO_QA_E2E_TESTS_IDENTITY_FIRSTUSER_PASSWORD || 'demo';
+class NavigationPage {
+    page;
+    modelerPageBanner;
+    operatePageBanner;
+    tasklistPageBanner;
+    optimizePageBanner;
+    identityPageBanner;
+    keyboardPageBanner;
+    managementIdentityPageBanner;
+    onboardingTourSuppressed = false;
+    constructor(page) {
+        this.page = page;
+        // Operate renders the Design System header (AppHeaderV2) whenever the
+        // `navV2Enabled` client config is on -- its home link is
+        // aria-label="Camunda Operate" instead of the legacy shell's
+        // "Camunda logo Operate" text. Match either so the banner resolves with
+        // the flag on or off.
+        this.operatePageBanner = page
+            .getByRole('link', { name: 'Camunda logo Operate' })
+            .or(page.getByRole('link', { name: 'Camunda Operate', exact: true }))
+            .first();
+        // Web Modeler renders the Design System nav shell (NavShellDs) whenever
+        // `design-system-enabled` is on. Its home link was
+        // aria-label="Camunda Modeler home"; the Camunda Hub rebrand renamed it to
+        // aria-label="Camunda Hub home" (still an aria-hidden logo, href .../modeler/),
+        // so the legacy shell's "Camunda logoModeler" text no longer exists. The
+        // unauthenticated shell reuses the same aria-label pointing at /login, and
+        // waitForBanner() gates only on visibility, so exclude that href here:
+        // callers use this banner as the logged-in gate.
+        // Match every shell so the banner resolves flag on or off, pre- or post-rebrand.
+        this.modelerPageBanner = page
+            .getByRole('link', { name: 'Camunda Hub home' })
+            .or(page.getByRole('link', { name: 'Camunda Modeler home' }))
+            .and(page.locator(':not([href$="/login"])'))
+            .or(page.locator('a').filter({ hasText: 'Camunda logoModeler' }))
+            .first();
+        // Tasklist renders the Design System header since the Carbon shell was
+        // deleted -- the logo is its own anchor (aria-label="Camunda logo", with
+        // an aria-hidden svg) and "Tasklist" moved into the breadcrumb nav, so
+        // the legacy shell's combined "Camunda logo Tasklist" name no longer
+        // exists. Match either shell so the banner resolves on both, and scope
+        // the generic logo-link fallback to Tasklist's orchestration href so it
+        // stays aligned with overridden context paths too.
+        this.tasklistPageBanner = page
+            .getByRole('navigation', { name: 'Camunda context' })
+            .getByRole('link', { name: 'Tasklist', exact: true })
+            .or(page
+            .getByRole('link', { name: 'Camunda logo', exact: true })
+            .and(page.locator(`[href$="${NORMALIZED_ORCHESTRATION_CONTEXT_PATH}/tasklist"]`)))
+            .or(page.getByRole('link', { name: 'Camunda logo Tasklist' }))
+            .first();
+        // Optimize renders the Design System header (HeaderV2) whenever the nav
+        // V2 client config is on -- its home link is aria-label="Camunda
+        // Optimize" wrapping an aria-hidden logo svg, so the legacy shell's
+        // "Camunda logo Optimize" text no longer exists. Match either so the
+        // banner resolves with the flag on or off (mirrors operatePageBanner and
+        // pages/8.10/OptimizeHomePage.optimizeBanner).
+        this.optimizePageBanner = page
+            .getByRole('link', { name: 'Camunda logo Optimize' })
+            .or(page.getByRole('link', { name: 'Camunda Optimize', exact: true }))
+            .first();
+        // TODO: Drop support for Identity once we fully rename it to Admin
+        this.identityPageBanner = page
+            .getByRole('link', { name: 'Camunda Admin', exact: true })
+            .or(page
+            .locator('a')
+            .filter({ hasText: /^Camunda logo\s*(Identity|Admin)$/ }))
+            .first();
+        this.managementIdentityPageBanner = page
+            .locator('a')
+            .filter({ hasText: /^Camunda logo\s*Management Identity$/ })
+            .first();
+        this.keyboardPageBanner = page.locator('#keycloak-bg');
+    }
+    async isGatewayErrorPage() {
+        return this.page
+            .getByRole('heading', {
+            name: /50[234]\s+(Bad Gateway|Service Temporarily Unavailable|Gateway Time-?out)/i,
+        })
+            .first()
+            .isVisible()
+            .catch(() => false);
+    }
+    // Waits for the app shell's banner, but treats the two states that cannot
+    // resolve on their own as a reason to act rather than to keep waiting.
+    //
+    // The passive `expect(banner).toBeVisible({timeout: 60000})` this replaces
+    // could not tell a shell that is merely slow (worth waiting for) from one
+    // where nothing is coming at all: `login` swallowed a missing form and
+    // submitted nothing, so no transition is pending, or the ingress served a
+    // 50x page for the OAuth callback, which never becomes the app shell. Both
+    // spend the whole 60s and lose the attempt, and the only surviving evidence
+    // is "toBeVisible ... <element(s) not found>" -- repeated once per attempt,
+    // that is exactly the reported "Login (/modeler) failed after 8 attempts".
+    // The 60s budget is unchanged: a genuinely slow shell still gets all of it,
+    // and a sustained outage still fails.
+    async waitForBanner(url, banner, submitted) {
+        const totalTimeout = constants_1._1_SECOND_IN_MS * 60;
+        const deadline = Date.now() + totalTimeout;
+        let lastState = 'no banner';
+        while (Date.now() < deadline) {
+            const round = Math.min(constants_1._1_SECOND_IN_MS * 20, deadline - Date.now());
+            try {
+                await (0, test_1.expect)(banner).toBeVisible({ timeout: round });
+                return;
+            }
+            catch {
+                lastState = `no banner on ${this.page.url()}`;
+            }
+            if (!submitted) {
+                // Nothing was submitted and no banner rendered, so there is no pending
+                // transition for the rest of the budget to wait on. Hand back to the
+                // caller's retry loop now — it re-navigates and logs in again, which
+                // is the only thing that can change this state.
+                throw new Error(`${url} rendered no banner and no credentials were submitted: ${lastState}`);
+            }
+            if (await this.isGatewayErrorPage()) {
+                lastState = `a 50x gateway page on ${this.page.url()}`;
+                if (Date.now() >= deadline) {
+                    break;
+                }
+                await this.page.goto(url, {
+                    timeout: 60000,
+                    waitUntil: 'domcontentloaded',
+                });
+            }
+        }
+        throw new Error(`${url} did not render its banner within ${totalTimeout}ms: ${lastState}`);
+    }
+    async goTo(url, banner, sleepTimeout, { username = IDENTITY_FIRSTUSER_USERNAME, password = IDENTITY_FIRSTUSER_PASSWORD, } = {}, maxRetries = 8) {
+        const startTime = Date.now();
+        let timeout = constants_1._1_SECOND_IN_MS * 10;
+        if (url === '/modeler') {
+            timeout = constants_1._1_SECOND_IN_MS * 20;
+        }
+        for (let attempt = 0; attempt < maxRetries; attempt++) {
+            try {
+                if (sleepTimeout) {
+                    await (0, sleep_1.sleep)(sleepTimeout);
+                }
+                await this.page.goto(url, {
+                    timeout: 60000,
+                    waitUntil: 'domcontentloaded',
+                });
+                // A transient ingress or pod-reschedule blip on the shared cluster
+                // serves an nginx 50x gateway page in place of the app. Reload with a
+                // bounded budget so a short blip self-heals; a sustained outage
+                // exhausts the budget and still surfaces as a failed navigation.
+                // The bound is wall clock as well as count: 8 reloads that each wait
+                // out the 60s goto budget are ~520s of the 720s test timeout inside a
+                // single attempt, which starves the retry loop below of the attempts
+                // it needs to ride the outage out.
+                const gatewayDeadline = Date.now() + constants_1._1_SECOND_IN_MS * 60;
+                let gatewayReloads = 0;
+                while (gatewayReloads < 8 &&
+                    Date.now() < gatewayDeadline &&
+                    (await this.isGatewayErrorPage())) {
+                    await (0, sleep_1.sleep)(constants_1._1_SECOND_IN_MS * 5);
+                    await this.page.goto(url, {
+                        timeout: 60000,
+                        waitUntil: 'domcontentloaded',
+                    });
+                    gatewayReloads++;
+                }
+                const loginPage = new LoginPage_1.LoginPage(this.page);
+                const loginEntryPoint = banner
+                    .or(loginPage.usernameInput)
+                    .or(loginPage.coreUsernameInput)
+                    .or(loginPage.keycloakBanner)
+                    .first();
+                await (0, test_1.expect)(loginEntryPoint).toBeVisible({ timeout: 60000 });
+                const isBannerVisible = await banner.isVisible().catch(() => false);
+                // Guard against the Modeler SPA rendering its header on the login
+                // page before the OAuth redirect fires. If the banner is visible
+                // but the URL is still a login/auth path, the user is NOT actually
+                // authenticated — wait for the real login form to appear.
+                const currentUrl = this.page.url();
+                const onLoginPath = currentUrl.includes('/login') || currentUrl.includes('/auth/');
+                let submitted = false;
+                if (isBannerVisible && !onLoginPath) {
+                    // Probe with the same #username signal detectLoginForm uses: the
+                    // KC26 default theme does not expose the 'Username or email' label,
+                    // so the old locator reported "no form" on a rendered Keycloak login
+                    // page and left the attempt unauthenticated.
+                    const loginVisible = await this.page
+                        .locator('#username')
+                        .or(loginPage.usernameInput)
+                        .first()
+                        .isVisible()
+                        .catch(() => false);
+                    if (loginVisible) {
+                        submitted = await loginPage.login(username, password);
+                    }
+                    // If login selector not visible, banner is real - navigation succeeded
+                }
+                else {
+                    submitted = await loginPage.login(username, password);
+                }
+                await this.waitForBanner(url, banner, submitted);
+                return;
+            }
+            catch (error) {
+                const now = new Date();
+                const elapsed = Date.now() - startTime;
+                if (attempt < maxRetries - 1) {
+                    // Progressive backoff: a transient Keycloak 5xx during the OAuth
+                    // login (the "We are sorry... internal server error" /
+                    // "Unexpected error when handling authentication request to
+                    // identity provider" pages) can persist for several seconds.
+                    // Widening the gap between attempts (2s, 4s, 6s, ...) lets the
+                    // auth server recover instead of burning every retry inside one
+                    // short outage window. Bumped from 5 to 8 retries after run
+                    // 30080472743's "Basic Login" failed all 5 attempts against a
+                    // freshly-installed cluster, each with a genuine 400/500 from
+                    // Keycloak's own login-actions/authenticate endpoint -- the prior
+                    // budget (~20s of backoff) wasn't consistently enough to outlast
+                    // Keycloak's post-install warm-up window.
+                    await (0, sleep_1.sleep)(2000 * (attempt + 1));
+                    if (!this.page.isClosed()) {
+                        try {
+                            await this.page.waitForLoadState('load', { timeout: timeout });
+                        }
+                        catch (error) {
+                            const now2 = new Date();
+                            const elapsed2 = Date.now() - startTime;
+                            console.warn(`[${now2.toISOString()}] (+${elapsed2}ms) [NavigationPage] Load state timeout or error: ${error}`);
+                        }
+                    }
+                }
+                else {
+                    console.error(`[${now.toISOString()}] (+${elapsed}ms) [NavigationPage] Login (${url}) failed after ${maxRetries} attempts: ${error}`);
+                    // Carry the final attempt's error into the thrown message. Without
+                    // it the only surviving signal is the attempt count, which says
+                    // nothing about WHY all 8 attempts failed -- a Keycloak 5xx, a
+                    // gateway page, a missing banner and a closed page all collapse to
+                    // the same string, so triage of this signature has to guess. Every
+                    // sibling helper already does this (goToKeycloak below rethrows
+                    // lastError; KeycloakUtils and pages/8.10/UtilitiesPage interpolate
+                    // the cause).
+                    throw new Error(`Login (${url}) failed after ${maxRetries} attempts: ${error}`);
+                }
+            }
+        }
+    }
+    async goToModeler(sleepTimeout, credentials) {
+        await this.suppressOnboardingTour();
+        await this.goTo(MODELER_CONTEXT_PATH, this.modelerPageBanner, sleepTimeout, credentials, 8);
+    }
+    // Mirrors camunda-hub@452978f: pre-seed the onboarding tour's "seen" localStorage flag
+    // (SEEN_KEY_PREFIX in .../tour-dialog/use-onboarding-seen.ts) so it never auto-opens, rather
+    // than dismissing it reactively (the two prior fixes here -- both raced the dialog's mount
+    // and lost, since the user id needed for the real key isn't known until after that same
+    // race). addInitScript avoids the race by running before any page script, matching the
+    // flag by prefix since the user id isn't known up front.
+    async suppressOnboardingTour() {
+        if (this.onboardingTourSuppressed) {
+            return;
+        }
+        this.onboardingTourSuppressed = true;
+        await this.page.addInitScript((prefixPattern) => {
+            const pattern = new RegExp(prefixPattern);
+            const originalGetItem = Storage.prototype.getItem;
+            Storage.prototype.getItem = function (key) {
+                return pattern.test(key) ? 'true' : originalGetItem.call(this, key);
+            };
+        }, '^hub\\.onboarding\\..*\\.seen\\.');
+    }
+    async goToTasklist(sleepTimeout, credentials) {
+        await this.goTo(`${NORMALIZED_ORCHESTRATION_CONTEXT_PATH}/tasklist`, this.tasklistPageBanner, sleepTimeout, credentials);
+    }
+    async goToOperate(sleepTimeout, credentials) {
+        await this.goTo(`${NORMALIZED_ORCHESTRATION_CONTEXT_PATH}/operate`, this.operatePageBanner, sleepTimeout, credentials);
+    }
+    async goToOptimize(sleepTimeout, credentials) {
+        await this.goTo(OPTIMIZE_CONTEXT_PATH, this.optimizePageBanner, sleepTimeout, credentials);
+    }
+    // `goTo` ends by asserting the app banner, so it cannot be used to reach
+    // Optimize as a user without the Optimize role: that request ends on a
+    // `text/plain` 403 page carrying neither the banner nor a login form, and
+    // every retry burns a full 60s timeout. Navigate and log in only; the
+    // caller asserts what the denied page shows.
+    async goToOptimizeWithoutAccess({ username = IDENTITY_FIRSTUSER_USERNAME, password = IDENTITY_FIRSTUSER_PASSWORD, } = {}) {
+        await this.page.goto(OPTIMIZE_CONTEXT_PATH, {
+            timeout: 60000,
+            waitUntil: 'domcontentloaded',
+        });
+        // On a fresh install Optimize can sit behind an nginx 503 for minutes
+        // after the other apps are up. `goTo` rides that out across its retry
+        // attempts; this helper has no retry loop, so it waits on the wall clock
+        // instead. If the gateway page outlasts the budget, fail on it here: the
+        // caller's denial assertion would otherwise time out with a "not found"
+        // that hides the outage.
+        const gatewayBudgetMs = constants_1._1_SECOND_IN_MS * 180;
+        const gatewayDeadline = Date.now() + gatewayBudgetMs;
+        while (Date.now() < gatewayDeadline && (await this.isGatewayErrorPage())) {
+            await (0, sleep_1.sleep)(constants_1._1_SECOND_IN_MS * 5);
+            await this.page.goto(OPTIMIZE_CONTEXT_PATH, {
+                timeout: 60000,
+                waitUntil: 'domcontentloaded',
+            });
+        }
+        if (await this.isGatewayErrorPage()) {
+            throw new Error(`${OPTIMIZE_CONTEXT_PATH} still served a 50x gateway page after ${gatewayBudgetMs}ms`);
+        }
+        await new LoginPage_1.LoginPage(this.page).login(username, password);
+    }
+    // Same reason as `goToOptimizeWithoutAccess`: a user whose Web Modeler role
+    // was removed never reaches a page carrying the Modeler banner — the OAuth
+    // round trip ends back on the Keycloak authorize URL — so `goTo` burns all 8
+    // attempts (~570s) and throws instead of letting the caller assert the denial.
+    // Navigate and log in only; the caller asserts what the denied page shows.
+    async goToModelerWithoutAccess({ username = IDENTITY_FIRSTUSER_USERNAME, password = IDENTITY_FIRSTUSER_PASSWORD, } = {}) {
+        await this.page.goto(MODELER_CONTEXT_PATH, {
+            timeout: 60000,
+            waitUntil: 'domcontentloaded',
+        });
+        let gatewayReloads = 0;
+        while (gatewayReloads < 8 && (await this.isGatewayErrorPage())) {
+            await (0, sleep_1.sleep)(constants_1._1_SECOND_IN_MS * 5);
+            await this.page.goto(MODELER_CONTEXT_PATH, {
+                timeout: 60000,
+                waitUntil: 'domcontentloaded',
+            });
+            gatewayReloads++;
+        }
+        await new LoginPage_1.LoginPage(this.page).login(username, password);
+    }
+    async goToKeycloak(maxRetries = 5) {
+        const keycloakUrl = process.env.KEYCLOAK_URL
+            ? `${process.env.KEYCLOAK_URL}/auth`
+            : '/auth';
+        let lastError;
+        for (let attempt = 0; attempt < maxRetries; attempt++) {
+            try {
+                await this.page.goto(keycloakUrl);
+                await (0, test_1.expect)(this.keyboardPageBanner).toBeVisible({ timeout: 60000 });
+                return;
+            }
+            catch (error) {
+                lastError = error;
+                if (attempt < maxRetries - 1) {
+                    await (0, sleep_1.sleep)(5000);
+                }
+            }
+        }
+        throw lastError instanceof Error
+            ? lastError
+            : new Error(`goToKeycloak failed after ${maxRetries} attempts`);
+    }
+    async goToOCAdmin(sleepTimeout, credentials, maxRetries) {
+        await this.goTo(`${NORMALIZED_ORCHESTRATION_CONTEXT_PATH}/admin`, this.identityPageBanner, sleepTimeout, credentials, 
+        // 8, not 5, to match goTo's own default: the comment there records that
+        // ~20s of backoff (all 5 attempts buy) was not consistently enough to
+        // outlast Keycloak's warm-up, and /admin additionally serves a
+        // forbidden redirect while the user's admin authorization propagates.
+        // Call sites that wrap goToOCAdmin in their own toPass loop still pass
+        // maxRetries explicitly (see document-handling-user-flows).
+        maxRetries ?? (env_1.isOpenSearch ? 10 : 8));
+    }
+    async goToClusters(sleepTimeout, credentials) {
+        await this.suppressOnboardingTour();
+        await this.goTo(`${MODELER_CONTEXT_PATH}/clusters`, this.modelerPageBanner, sleepTimeout, credentials);
+    }
+    async goToManagementIdentity(sleepTimeout, credentials) {
+        await this.goTo(MANAGEMENT_IDENTITY_CONTEXT_PATH, this.managementIdentityPageBanner, sleepTimeout, credentials);
+    }
+}
+exports.NavigationPage = NavigationPage;

package/dist/pages/SM-8.11/OCIdentityAuthorizationsPage.d.ts

@@ -0,0 +1,10 @@
+import { Authorization } from '../SM-8.11/Authorization';
+import { Page } from '@playwright/test';
+declare class OCIdentityAuthorizationsPage extends Authorization {
+    constructor(page: Page);
+    clickProcessDefinitionTab(): Promise<void>;
+    clickAuthorizationTab(): Promise<void>;
+    clickComponentTab(): Promise<void>;
+    clickResourceTab(): Promise<void>;
+}
+export { OCIdentityAuthorizationsPage };

package/dist/pages/SM-8.11/OCIdentityAuthorizationsPage.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OCIdentityAuthorizationsPage = void 0;
+const Authorization_1 = require("../SM-8.11/Authorization");
+class OCIdentityAuthorizationsPage extends Authorization_1.Authorization {
+    constructor(page) {
+        super(page);
+    }
+    async clickProcessDefinitionTab() {
+        await this.selectResourceType('PROCESS_DEFINITION');
+    }
+    async clickAuthorizationTab() {
+        await this.selectResourceType('AUTHORIZATION');
+    }
+    async clickComponentTab() {
+        await this.selectResourceType('COMPONENT');
+    }
+    async clickResourceTab() {
+        await this.selectResourceType('RESOURCE');
+    }
+}
+exports.OCIdentityAuthorizationsPage = OCIdentityAuthorizationsPage;

package/dist/pages/SM-8.11/OCIdentityClusterVariablesPage.d.ts

@@ -0,0 +1,22 @@
+import { Page, Locator } from '@playwright/test';
+export declare class OCIdentityClusterVariablesPage {
+    private page;
+    readonly variablesList: Locator;
+    readonly editVariableButton: (variableName: string) => Locator;
+    readonly editVariableModal: Locator;
+    readonly variableValueField: Locator;
+    readonly saveVariableButton: Locator;
+    readonly closeEditVariableModal: Locator;
+    readonly cancelButton: Locator;
+    readonly variableRow: (variableName: string) => Locator;
+    readonly monacoEditor: Locator;
+    readonly monacoEditorTextArea: Locator;
+    readonly monacoSuggestWidget: Locator;
+    readonly successMessage: Locator;
+    readonly editMenuItem: Locator;
+    readonly editModalHeading: Locator;
+    constructor(page: Page);
+    editVariable(variableName: string, newValue: string): Promise<void>;
+    assertVariableExists(variableName: string): Promise<void>;
+    assertVariableValue(variableName: string, expectedValue: string): Promise<void>;
+}

package/dist/pages/SM-8.11/OCIdentityClusterVariablesPage.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OCIdentityClusterVariablesPage = void 0;
+const test_1 = require("@playwright/test");
+const sleep_1 = require("../../utils/sleep");
+class OCIdentityClusterVariablesPage {
+    page;
+    variablesList;
+    editVariableButton;
+    editVariableModal;
+    variableValueField;
+    saveVariableButton;
+    closeEditVariableModal;
+    cancelButton;
+    variableRow;
+    monacoEditor;
+    monacoEditorTextArea;
+    monacoSuggestWidget;
+    successMessage;
+    editMenuItem;
+    editModalHeading;
+    constructor(page) {
+        this.page = page;
+        // The Admin UI is migrating off Carbon onto the Camunda design system:
+        // `identity/client/src/pages/cluster-variables/index.tsx` renders ListV2
+        // (design-system `DataTable`, Radix dialog/menu) when the
+        // `isNewDesignSystemEnabled` client config is on, which the orchestration
+        // server defaults to for Self-Managed. Released 8.10 alpha images predate
+        // ListV2 and still render Carbon, so the locators that differ between the
+        // two DOMs accept either.
+        this.variablesList = page.locator('table.cds--data-table, table[data-slot="table"]');
+        this.variableRow = (variableName) => this.variablesList
+            .locator('tbody')
+            .getByRole('row')
+            .filter({ hasText: variableName });
+        // Carbon's OverflowMenu labels its trigger "Options"; the design-system
+        // DataTable labels it "Row actions".
+        this.editVariableButton = (variableName) => this.variableRow(variableName).getByRole('button', {
+            name: /^(Options|Row actions)$/,
+        });
+        this.editVariableModal = page.getByRole('dialog', {
+            name: /Edit.*variable/i,
+        });
+        this.variableValueField = this.editVariableModal.getByRole('textbox', {
+            name: 'Editor content',
+        });
+        // Both modals pass `confirmLabel={t("save")}`, so the accessible name is
+        // stable across the two footers.
+        this.saveVariableButton = this.editVariableModal.getByRole('button', {
+            name: 'Save',
+        });
+        this.closeEditVariableModal = this.editVariableModal.getByRole('button', {
+            name: 'Close',
+        });
+        this.cancelButton = this.editVariableModal.getByRole('button', {
+            name: 'Cancel',
+        });
+        this.monacoEditor = this.editVariableModal.locator('.monaco-editor');
+        this.monacoEditorTextArea = this.monacoEditor.locator('textarea.inputarea');
+        this.monacoSuggestWidget = this.monacoEditor.locator('.editor-widget.suggest-widget');
+        this.successMessage = this.page.getByText('Cluster variable updated');
+        // Carbon renders the modal title as an h3, the design-system dialog as an
+        // h2; the heading role covers both.
+        this.editModalHeading = this.editVariableModal.getByRole('heading').first();
+        // Carbon menu items are buttons, Radix menu items are divs — match on the
+        // role instead of the tag.
+        this.editMenuItem = this.page.getByRole('menuitem', {
+            name: 'Edit',
+            exact: true,
+        });
+    }
+    async editVariable(variableName, newValue) {
+        await this.editVariableButton(variableName).click();
+        await (0, test_1.expect)(this.editMenuItem).toBeVisible();
+        await this.editMenuItem.click();
+        await (0, test_1.expect)(this.variableValueField).toBeVisible();
+        await (0, test_1.expect)(this.monacoEditor).toBeVisible();
+        // Monaco editor doesn't respond reliably to clear()/fill() on the
+        // hidden textarea. Use keyboard shortcuts to select-all and replace,
+        // which mirrors real user interaction.
+        // Retry the clear-type-enable cycle because Monaco auto-completion of
+        // brackets / quotes can corrupt JSON input on the first attempt.
+        const MAX_TYPE_ATTEMPTS = 3;
+        for (let attempt = 1; attempt <= MAX_TYPE_ATTEMPTS; attempt++) {
+            await this.monacoEditor.click();
+            await this.monacoEditorTextArea.press('Control+a');
+            await this.monacoEditorTextArea.press('Delete');
+            // Let Monaco settle after clearing content
+            await (0, sleep_1.sleep)(500);
+            await this.monacoEditorTextArea.pressSequentially(newValue, { delay: 20 });
+            // Dismiss any auto-complete popup by clicking the modal heading.
+            // Do NOT use press('Escape') on the textarea — when no autocomplete
+            // is showing, the Escape event propagates to the Carbon modal and
+            // closes the entire dialog.
+            await this.editModalHeading.click();
+            // Let Monaco settle and validate the new content
+            await (0, sleep_1.sleep)(500);
+            try {
+                await (0, test_1.expect)(this.saveVariableButton).toBeEnabled({ timeout: 10000 });
+                break;
+            }
+            catch {
+                if (attempt === MAX_TYPE_ATTEMPTS) {
+                    throw new Error(`Save button did not become enabled after ${MAX_TYPE_ATTEMPTS} typing attempts`);
+                }
+            }
+        }
+        await this.saveVariableButton.click();
+        await (0, test_1.expect)(this.successMessage).toBeVisible();
+        await (0, test_1.expect)(this.editVariableModal).toBeHidden();
+    }
+    async assertVariableExists(variableName) {
+        await (0, test_1.expect)(this.variableRow(variableName)).toBeVisible();
+    }
+    async assertVariableValue(variableName, expectedValue) {
+        const row = this.variableRow(variableName);
+        await (0, test_1.expect)(row).toContainText(expectedValue);
+    }
+}
+exports.OCIdentityClusterVariablesPage = OCIdentityClusterVariablesPage;

package/dist/pages/SM-8.11/OCIdentityGroupsPage.d.ts

@@ -0,0 +1,39 @@
+import { Page, Locator } from '@playwright/test';
+export declare class OCIdentityGroupsPage {
+    private page;
+    readonly groupsList: Locator;
+    readonly createGroupButton: Locator;
+    readonly editGroupButton: (rowName?: string) => Locator;
+    readonly deleteGroupButton: (rowName?: string) => Locator;
+    readonly createGroupModal: Locator;
+    readonly closeCreateGroupModal: Locator;
+    readonly createGroupIdField: Locator;
+    readonly createNameField: Locator;
+    readonly createDescriptionField: Locator;
+    readonly createGroupModalCancelButton: Locator;
+    readonly createGroupModalCreateButton: Locator;
+    readonly editGroupModal: Locator;
+    readonly closeEditGroupModal: Locator;
+    readonly editNameField: Locator;
+    readonly editDescriptionField: Locator;
+    readonly editGroupModalCancelButton: Locator;
+    readonly editGroupModalUpdateButton: Locator;
+    readonly deleteGroupModal: Locator;
+    readonly closeDeleteGroupModal: Locator;
+    readonly deleteGroupModalCancelButton: Locator;
+    readonly deleteGroupModalDeleteButton: Locator;
+    readonly emptyState: Locator;
+    readonly assignUserButton: Locator;
+    readonly searchBox: Locator;
+    readonly searchBoxResult: Locator;
+    readonly assignUserButtonModal: Locator;
+    readonly selectGroupRow: (name: string) => Locator;
+    readonly groupCell: (name: string) => Locator;
+    constructor(page: Page);
+    createGroup(groupId: string, groupName: string, description?: string): Promise<void>;
+    editGroup(currentName: string, newName: string, newDescription?: string): Promise<void>;
+    deleteGroup(groupName: string): Promise<void>;
+    assertGroupExists(groupName: string): Promise<void>;
+    clickGroupId(groupName: string): Promise<void>;
+    assignUserToGroup(userName: string): Promise<void>;
+}