@camunda/e2e-test-suite 0.0.231 → 0.0.233

package/dist/fixtures/8.6.d.ts

@@ -26,6 +26,7 @@ import { ModelerUserInvitePage } from '../pages/8.6/ModelerUserInvitePage';
 import { SignUpPage } from '../pages/8.6/SignUpPage';
 import { PlayPage } from '../pages/8.6/PlayPage';
 import { ConnectorTemplatePage } from '../pages/8.6/ConnectorTemplatePage';
+import { ClientCredentialsDetailsPage } from '../pages/8.6/ClientCredentialsDetailsPage';
 type PlaywrightFixtures = {
     makeAxeBuilder: () => AxeBuilder;
     loginPage: LoginPage;
@@ -55,6 +56,7 @@ type PlaywrightFixtures = {
     signUpPage: SignUpPage;
     playPage: PlayPage;
     connectorTemplatePage: ConnectorTemplatePage;
+    clientCredentialsDetailsPage: ClientCredentialsDetailsPage;
     overrideTrackingScripts: void;
 };
 declare const test: import("@playwright/test").TestType<import("@playwright/test").PlaywrightTestArgs & import("@playwright/test").PlaywrightTestOptions & PlaywrightFixtures, import("@playwright/test").PlaywrightWorkerArgs & import("@playwright/test").PlaywrightWorkerOptions>;

package/dist/fixtures/8.6.js

@@ -33,6 +33,7 @@ const ModelerUserInvitePage_1 = require("../pages/8.6/ModelerUserInvitePage");
 const SignUpPage_1 = require("../pages/8.6/SignUpPage");
 const PlayPage_1 = require("../pages/8.6/PlayPage");
 const ConnectorTemplatePage_1 = require("../pages/8.6/ConnectorTemplatePage");
+const ClientCredentialsDetailsPage_1 = require("../pages/8.6/ClientCredentialsDetailsPage");
 const test = test_1.test.extend({
     makeAxeBuilder: async ({ page }, use) => {
         const makeAxeBuilder = () => new playwright_1.default({ page }).withTags([
@@ -125,6 +126,9 @@ const test = test_1.test.extend({
     connectorTemplatePage: async ({ page }, use) => {
         await use(new ConnectorTemplatePage_1.ConnectorTemplatePage(page));
     },
+    clientCredentialsDetailsPage: async ({ page }, use) => {
+        await use(new ClientCredentialsDetailsPage_1.ClientCredentialsDetailsPage(page));
+    },
     overrideTrackingScripts: [
         async ({ context }, use) => {
             await context.route('https://cmp.osano.com/16CVvwSNKHi9t1grQ/9403708a-488b-4f3b-aea6-613825dec79f/osano.js', (route) => route.fulfill({

package/dist/fixtures/8.9.d.ts

@@ -32,6 +32,7 @@ import { OCIdentityHomePage } from '../pages/8.9/OCIdentityHomePage';
 import { OCIdentityMappingRulesPage } from '../pages/8.9/OCIdentityMappingRulesPage';
 import { OCIdentityRolesPage } from '../pages/8.9/OCIdentityRolesPage';
 import { OCIdentityAuthorizationsPage } from '../pages/8.9/OCIdentityAuthorizationsPage';
+import { OCIdentityClusterVariablesPage } from '../pages/8.9/OCIdentityClusterVariablesPage';
 import { ClientCredentialsDetailsPage } from '../pages/8.9/ClientCredentialsDetailsPage';
 type PlaywrightFixtures = {
     makeAxeBuilder: () => AxeBuilder;
@@ -68,6 +69,7 @@ type PlaywrightFixtures = {
     ocIdentityMappingRulesPage: OCIdentityMappingRulesPage;
     ocIdentityRolesPage: OCIdentityRolesPage;
     ocIdentityAuthorizationsPage: OCIdentityAuthorizationsPage;
+    ocIdentityClusterVariablesPage: OCIdentityClusterVariablesPage;
     clientCredentialsDetailsPage: ClientCredentialsDetailsPage;
     overrideTrackingScripts: void;
 };

package/dist/fixtures/8.9.js

@@ -39,6 +39,7 @@ const OCIdentityHomePage_1 = require("../pages/8.9/OCIdentityHomePage");
 const OCIdentityMappingRulesPage_1 = require("../pages/8.9/OCIdentityMappingRulesPage");
 const OCIdentityRolesPage_1 = require("../pages/8.9/OCIdentityRolesPage");
 const OCIdentityAuthorizationsPage_1 = require("../pages/8.9/OCIdentityAuthorizationsPage");
+const OCIdentityClusterVariablesPage_1 = require("../pages/8.9/OCIdentityClusterVariablesPage");
 const ClientCredentialsDetailsPage_1 = require("../pages/8.9/ClientCredentialsDetailsPage");
 const test = test_1.test.extend({
     makeAxeBuilder: async ({ page }, use) => {
@@ -151,6 +152,9 @@ const test = test_1.test.extend({
     ocIdentityGroupsPage: async ({ page }, use) => {
         await use(new OCIdentityGroupsPage_1.OCIdentityGroupsPage(page));
     },
+    ocIdentityClusterVariablesPage: async ({ page }, use) => {
+        await use(new OCIdentityClusterVariablesPage_1.OCIdentityClusterVariablesPage(page));
+    },
     clientCredentialsDetailsPage: async ({ page }, use) => {
         await use(new ClientCredentialsDetailsPage_1.ClientCredentialsDetailsPage(page));
     },

package/dist/pages/8.6/ClientCredentialsDetailsPage.d.ts

@@ -0,0 +1,12 @@
+import { Page, Locator } from '@playwright/test';
+declare class ClientCredentialsDetailsPage {
+    private page;
+    readonly operateUrlRow: Locator;
+    readonly operateUrlValue: Locator;
+    readonly clientNameHeading: (clientName: string) => Locator;
+    constructor(page: Page);
+    isOpen(clientName: string): Promise<void>;
+    getOperateUrl(): Promise<string>;
+    goBack(): Promise<void>;
+}
+export { ClientCredentialsDetailsPage };

package/dist/pages/8.6/ClientCredentialsDetailsPage.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientCredentialsDetailsPage = void 0;
+const test_1 = require("@playwright/test");
+class ClientCredentialsDetailsPage {
+    page;
+    operateUrlRow;
+    operateUrlValue;
+    clientNameHeading;
+    constructor(page) {
+        this.page = page;
+        this.operateUrlRow = page.getByRole('cell', { name: 'Operate URL' });
+        this.operateUrlValue = this.operateUrlRow.getByRole('textbox');
+        this.clientNameHeading = (clientName) => page.getByRole('heading', { name: clientName });
+    }
+    async isOpen(clientName) {
+        await (0, test_1.expect)(this.clientNameHeading(clientName)).toBeVisible({
+            timeout: 30000,
+        });
+    }
+    async getOperateUrl() {
+        if (await this.operateUrlValue.isVisible({ timeout: 10000 }).catch(() => false)) {
+            return await this.operateUrlValue.inputValue();
+        }
+        const text = await this.page.innerText('body');
+        const match = text.match(/Operate URL\s*([\w:/.-]+\/?)/i);
+        if (!match || !match[1]) {
+            throw new Error('Operate URL not found in client credentials page');
+        }
+        return match[1];
+    }
+    async goBack() {
+        await this.page.goBack();
+    }
+}
+exports.ClientCredentialsDetailsPage = ClientCredentialsDetailsPage;

package/dist/pages/8.6/ClusterDetailsPage.d.ts

@@ -1,4 +1,5 @@
 import { Page, Locator } from '@playwright/test';
+import { ClientCredentialsDetailsPage } from '../8.6/ClientCredentialsDetailsPage';
 declare class ClusterDetailsPage {
     private page;
     readonly apiTab: Locator;
@@ -32,9 +33,12 @@ declare class ClusterDetailsPage {
     readonly createAlertButton: Locator;
     readonly rbaHeading: Locator;
     readonly rbaEnabledMessage: Locator;
+    readonly clientCredentialsLink: (clientCredentials: string) => Locator;
+    readonly clientRow: (name: string) => Locator;
+    readonly clientRowDeleteButton: (name: string) => Locator;
     constructor(page: Page);
     clickAPITab(): Promise<void>;
-    deleteAPIClientsIfExist(): Promise<void>;
+    deleteAPIClientsIfExist(name?: string): Promise<void>;
     clickAlertsTab(): Promise<void>;
     clickCreateFirstAlertButton(): Promise<void>;
     clickCreateNewAlertButton(): Promise<void>;
@@ -43,6 +47,7 @@ declare class ClusterDetailsPage {
     clickCreateAlertButton(): Promise<void>;
     deleteAlerts(): Promise<void>;
     private doDelete;
+    clickCreateClientButton(): Promise<void>;
     clickCreateFirstClientButton(): Promise<void>;
     reload(): Promise<void>;
     clickClientNameTextbox(): Promise<void>;
@@ -54,6 +59,8 @@ declare class ClusterDetailsPage {
     clickCreateButton(): Promise<void>;
     clickCloseModalButton(): Promise<void>;
     clickSettingsTab(): Promise<void>;
+    createAPIClient(name: string): Promise<void>;
+    searchAndClickClientCredentialsLink(name: string): Promise<ClientCredentialsDetailsPage>;
     enableRBA(): Promise<void>;
     disableRBA(): Promise<void>;
     assertComponentsHealth(components?: string[]): Promise<void>;

package/dist/pages/8.6/ClusterDetailsPage.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClusterDetailsPage = void 0;
 const test_1 = require("@playwright/test");
 const sleep_1 = require("../../utils/sleep");
+const ClientCredentialsDetailsPage_1 = require("../8.6/ClientCredentialsDetailsPage");
+const clickLocatorWithRetry_1 = require("../../utils/assertionHelpers/clickLocatorWithRetry");
 class ClusterDetailsPage {
     page;
     apiTab;
@@ -36,6 +38,9 @@ class ClusterDetailsPage {
     createAlertButton;
     rbaHeading;
     rbaEnabledMessage;
+    clientCredentialsLink;
+    clientRow;
+    clientRowDeleteButton;
     constructor(page) {
         this.page = page;
         this.apiTab = page.getByRole('tab', { name: 'API' });
@@ -107,12 +112,33 @@ class ClusterDetailsPage {
             name: 'Resource-based authorizations',
         });
         this.clientsList = page.getByRole('row').filter({ hasNotText: 'Scopes' });
+        this.clientCredentialsLink = (clientCredentials) => page.getByRole('cell', { name: clientCredentials });
+        this.clientRow = (name) => this.clientsList.filter({ hasText: name });
+        this.clientRowDeleteButton = (name) => this.clientRow(name).getByRole('button', { name: 'Delete' });
     }
     async clickAPITab() {
         await (0, test_1.expect)(this.apiTab).toBeVisible({ timeout: 15000 });
         await this.apiTab.click({ timeout: 15000 });
     }
-    async deleteAPIClientsIfExist() {
+    async deleteAPIClientsIfExist(name) {
+        if (name) {
+            const row = this.clientRow(name);
+            const deleteButton = this.clientRowDeleteButton(name);
+            try {
+                await (0, test_1.expect)(deleteButton).toBeVisible({ timeout: 10000 });
+                await deleteButton.click();
+                await (0, test_1.expect)(this.dialog).toBeVisible();
+                await this.deleteSubButton.click();
+                await (0, test_1.expect)(this.page.getByText('Deleting...')).not.toBeVisible({
+                    timeout: 10000,
+                });
+                await (0, test_1.expect)(row).not.toBeVisible();
+            }
+            catch (error) {
+                console.warn(`No client row found for ${name} or deletion failed: ${error}`);
+            }
+            return;
+        }
         await this.doDelete(this.dialog, 'API clients');
     }
     async clickAlertsTab() {
@@ -189,6 +215,9 @@ class ClusterDetailsPage {
             console.error(`Error during ${text} deletion: `, error);
         }
     }
+    async clickCreateClientButton() {
+        await (0, clickLocatorWithRetry_1.clickLocatorWithRetry)(this.page, this.createFirstClientButton.or(this.createClientButton));
+    }
     async clickCreateFirstClientButton() {
         const maxRetries = 3;
         for (let retries = 0; retries < maxRetries; retries++) {
@@ -252,6 +281,36 @@ class ClusterDetailsPage {
             await this.settingsTab.click({ timeout: 120000 });
         }
     }
+    async createAPIClient(name) {
+        await this.clickCreateClientButton();
+        await (0, test_1.expect)(this.createClientCredentialsDialog).toBeVisible({
+            timeout: 60000,
+        });
+        await this.clickClientNameTextbox();
+        await this.fillClientNameTextbox(name);
+        await this.clickTasklistCheckbox();
+        await this.clickOperateCheckbox();
+        await this.clickOptimizeCheckbox();
+        await this.clickSecretsCheckbox();
+        await this.clickCreateButton();
+        await (0, test_1.expect)(this.clientCredentialsDialog).toBeVisible({
+            timeout: 20000,
+        });
+        await (0, test_1.expect)(this.clientCredentialsDialog
+            .getByText('The Client Secret will not be shown again.')
+            .first()).toBeVisible({
+            timeout: 60000,
+        });
+    }
+    async searchAndClickClientCredentialsLink(name) {
+        await (0, test_1.expect)(this.clientsList.first()).toBeVisible({ timeout: 60000 });
+        const clientLink = this.clientCredentialsLink(name);
+        await (0, test_1.expect)(clientLink).toBeVisible({ timeout: 30000 });
+        await clientLink.click();
+        const clientCredentialsDetailsPage = new ClientCredentialsDetailsPage_1.ClientCredentialsDetailsPage(this.page);
+        await clientCredentialsDetailsPage.isOpen(name);
+        return clientCredentialsDetailsPage;
+    }
     async enableRBA() {
         await (0, test_1.expect)(this.rbaHeading).toBeVisible({ timeout: 60000 });
         // Locate all elements with class .cds--toggle__text

package/dist/pages/8.9/OCIdentityClusterVariablesPage.d.ts

@@ -0,0 +1,20 @@
+import { Page, Locator } from '@playwright/test';
+export declare class OCIdentityClusterVariablesPage {
+    private page;
+    readonly variablesList: Locator;
+    readonly editVariableButton: (variableName: string) => Locator;
+    readonly editVariableModal: Locator;
+    readonly variableValueField: Locator;
+    readonly saveVariableButton: Locator;
+    readonly closeEditVariableModal: Locator;
+    readonly cancelButton: Locator;
+    readonly variableRow: (variableName: string) => Locator;
+    readonly monacoEditor: Locator;
+    readonly monacoEditorTextArea: Locator;
+    readonly successMessage: Locator;
+    readonly editMenuItem: Locator;
+    constructor(page: Page);
+    editVariable(variableName: string, newValue: string): Promise<void>;
+    assertVariableExists(variableName: string): Promise<void>;
+    assertVariableValue(variableName: string, expectedValue: string): Promise<void>;
+}

package/dist/pages/8.9/OCIdentityClusterVariablesPage.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OCIdentityClusterVariablesPage = void 0;
+const test_1 = require("@playwright/test");
+class OCIdentityClusterVariablesPage {
+    page;
+    variablesList;
+    editVariableButton;
+    editVariableModal;
+    variableValueField;
+    saveVariableButton;
+    closeEditVariableModal;
+    cancelButton;
+    variableRow;
+    monacoEditor;
+    monacoEditorTextArea;
+    successMessage;
+    editMenuItem;
+    constructor(page) {
+        this.page = page;
+        this.variablesList = page.locator('table.cds--data-table');
+        this.variableRow = (variableName) => this.variablesList
+            .locator('tbody')
+            .getByRole('row')
+            .filter({ hasText: variableName });
+        this.editVariableButton = (variableName) => this.variableRow(variableName).getByRole('button', { name: 'Options' });
+        this.editVariableModal = page.getByRole('dialog', {
+            name: /Edit.*variable/i,
+        });
+        this.variableValueField = this.editVariableModal.getByRole('textbox', {
+            name: 'Editor content',
+        });
+        this.saveVariableButton = this.editVariableModal.locator('.cds--modal-footer button.cds--btn--primary');
+        this.closeEditVariableModal = this.editVariableModal.getByRole('button', {
+            name: 'Close',
+        });
+        this.cancelButton = this.editVariableModal.getByRole('button', {
+            name: 'Cancel',
+        });
+        this.monacoEditor = this.editVariableModal.locator('.monaco-editor');
+        this.monacoEditorTextArea = this.monacoEditor.locator('textarea.inputarea');
+        this.successMessage = this.page.getByText('Cluster variable updated');
+        this.editMenuItem = this.page
+            .locator('button[role="menuitem"]')
+            .filter({ hasText: /^Edit$/ });
+    }
+    async editVariable(variableName, newValue) {
+        await this.editVariableButton(variableName).click();
+        await (0, test_1.expect)(this.editMenuItem).toBeVisible();
+        await this.editMenuItem.click();
+        await (0, test_1.expect)(this.variableValueField).toBeVisible();
+        await (0, test_1.expect)(this.monacoEditor).toBeVisible();
+        await this.monacoEditor.click();
+        await this.monacoEditorTextArea.clear();
+        await this.monacoEditorTextArea.fill(newValue);
+        await (0, test_1.expect)(this.saveVariableButton).toBeEnabled();
+        await this.saveVariableButton.click();
+        await (0, test_1.expect)(this.successMessage).toBeVisible();
+        await (0, test_1.expect)(this.editVariableModal).toBeHidden();
+    }
+    async assertVariableExists(variableName) {
+        await (0, test_1.expect)(this.variableRow(variableName)).toBeVisible();
+    }
+    async assertVariableValue(variableName, expectedValue) {
+        const row = this.variableRow(variableName);
+        await (0, test_1.expect)(row).toContainText(expectedValue);
+    }
+}
+exports.OCIdentityClusterVariablesPage = OCIdentityClusterVariablesPage;

package/dist/pages/8.9/OCIdentityHomePage.d.ts

@@ -5,6 +5,7 @@ declare class OCIdentityHomePage {
     readonly adminBanner: Locator;
     readonly rolesTab: Locator;
     readonly authorizationsTab: Locator;
+    readonly clusterVariablesTab: Locator;
     readonly licenseKeyTagNonProduction: Locator;
     readonly licenseKeyTagNonCommercial: Locator;
     readonly licenseKeyTagProduction: Locator;
@@ -14,5 +15,6 @@ declare class OCIdentityHomePage {
     clickAuthorizationsTab(): Promise<void>;
     clickRolesTab(): Promise<void>;
     clickGroupsTab(): Promise<void>;
+    clickClusterVariablesTab(): Promise<void>;
 }
 export { OCIdentityHomePage };

package/dist/pages/8.9/OCIdentityHomePage.js

@@ -8,6 +8,7 @@ class OCIdentityHomePage {
     adminBanner;
     rolesTab;
     authorizationsTab;
+    clusterVariablesTab;
     licenseKeyTagNonProduction;
     licenseKeyTagNonCommercial;
     licenseKeyTagProduction;
@@ -33,6 +34,16 @@ class OCIdentityHomePage {
             .getByLabel('Admin')
             .locator('a')
             .filter({ hasText: /^Authorizations$/ });
+        this.clusterVariablesTab = page
+            .getByRole('banner')
+            .getByLabel('Admin')
+            .locator('a')
+            .filter({ hasText: /Cluster variables/i })
+            .or(page
+            .getByRole('banner')
+            .getByLabel('Admin')
+            .locator('a')
+            .filter({ hasText: /Variables/i }));
         this.licenseKeyTagNonProduction = page
             .getByText('Non-production license')
             .first();
@@ -53,5 +64,9 @@ class OCIdentityHomePage {
         await (0, expectLocatorWithRetry_1.expectLocatorWithRetry)(this.page, this.groupsTab);
         await this.groupsTab.click({ timeout: 30000 });
     }
+    async clickClusterVariablesTab() {
+        await (0, expectLocatorWithRetry_1.expectLocatorWithRetry)(this.page, this.clusterVariablesTab);
+        await this.clusterVariablesTab.click({ timeout: 30000 });
+    }
 }
 exports.OCIdentityHomePage = OCIdentityHomePage;

package/dist/tests/8.6/console-user-flows.spec.js

@@ -30,21 +30,7 @@ _8_6_1.test.describe('Console User Flow Tests', () => {
             await clusterPage.clickClusterLink(defaultClusterName);
             await clusterDetailsPage.clickAPITab();
             await clusterDetailsPage.deleteAPIClientsIfExist();
-            await clusterDetailsPage.clickCreateFirstClientButton();
-            await (0, test_1.expect)(clusterDetailsPage.createClientCredentialsDialog).toBeVisible({ timeout: 60000 });
-            await clusterDetailsPage.clickClientNameTextbox();
-            await clusterDetailsPage.fillClientNameTextbox(clientName);
-            await clusterDetailsPage.clickTasklistCheckbox();
-            await clusterDetailsPage.clickOperateCheckbox();
-            await clusterDetailsPage.clickOptimizeCheckbox();
-            await clusterDetailsPage.clickSecretsCheckbox();
-            await clusterDetailsPage.clickCreateButton();
-            await (0, test_1.expect)(clusterDetailsPage.clientCredentialsDialog).toBeVisible({
-                timeout: 20000,
-            });
-            await (0, test_1.expect)(clusterDetailsPage.clientCredentialsDialog
-                .getByText('The Client Secret will not be shown again.')
-                .first()).toBeVisible({ timeout: 60000 });
+            await clusterDetailsPage.createAPIClient(clientName);
             await clusterDetailsPage.clickCloseModalButton();
             await (0, test_1.expect)(clusterDetailsPage.clientsList.filter({ hasText: clientName })).toContainText('Zeebe, Tasklist, Operate, Optimize, and Secrets');
         });

package/dist/tests/8.6/operate-access-flow.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/8.6/operate-access-flow.spec.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const test_1 = require("@playwright/test");
+const _8_6_1 = require("../../fixtures/8.6");
+const UtilitiesPage_1 = require("../../pages/8.6/UtilitiesPage");
+const _setup_1 = require("../../test-setup.js");
+const users_1 = require("../../utils/users");
+const urlHelpers_1 = require("../../utils/urlHelpers");
+const testUser = (0, users_1.getTestUser)('twentySecondUser');
+// This test covers the manual scenario: create a new API client via UI, copy the Operate URL, and verify the Operate endpoint denies unauthenticated access.
+_8_6_1.test.describe.configure({ mode: 'parallel' });
+_8_6_1.test.describe('Operate access requires authentication', () => {
+    let clientName;
+    const clusterName = 'Test Cluster';
+    _8_6_1.test.beforeEach(async ({ page, loginPage }, testInfo) => {
+        await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, testUser, (testInfo.workerIndex + 1) * 1000);
+    });
+    _8_6_1.test.afterEach(async ({ page, homePage, clusterPage, clusterDetailsPage }, testInfo) => {
+        await (0, _setup_1.captureScreenshot)(page, testInfo);
+        await (0, _setup_1.captureFailureVideo)(page, testInfo);
+        if (clientName) {
+            await homePage.clickClusters();
+            await clusterPage.clickClusterLink(clusterName);
+            await clusterDetailsPage.clickAPITab();
+            await clusterDetailsPage.deleteAPIClientsIfExist(clientName);
+        }
+    });
+    (0, _8_6_1.test)('check that POST /v1/process-definitions/search without credentials returns 403 Forbidden with JSON body', async ({ homePage, clusterPage, clusterDetailsPage, clientCredentialsDetailsPage, request, }) => {
+        clientName = `operate-deny-${await (0, _setup_1.generateRandomStringAsync)(5)}`;
+        await _8_6_1.test.step('Add API Client to Cluster', async () => {
+            await homePage.clickClusters();
+            await clusterPage.clickClusterLink(clusterName);
+            await clusterDetailsPage.clickAPITab();
+            await clusterDetailsPage.createAPIClient(clientName);
+            await clusterDetailsPage.clickCloseModalButton();
+            await (0, test_1.expect)(clusterDetailsPage.clientsList.filter({ hasText: clientName })).toBeVisible({ timeout: 6000 });
+        });
+        let operateUrl = '';
+        await _8_6_1.test.step('Capture Operate URL from client credentials page and close it', async () => {
+            await clusterDetailsPage.searchAndClickClientCredentialsLink(clientName);
+            operateUrl = await clientCredentialsDetailsPage.getOperateUrl();
+            (0, test_1.expect)(operateUrl).toMatch(/^https?:\/\//);
+            await clientCredentialsDetailsPage.goBack();
+            await clusterDetailsPage.clickAPITab();
+        });
+        await _8_6_1.test.step('POST search endpoint without auth should be rejected', async () => {
+            const sanitizedOperateUrl = (0, urlHelpers_1.sanitizeUrl)(operateUrl);
+            const response = await request.post(`${sanitizedOperateUrl}/v1/process-definitions/search`, {
+                data: { filter: {}, size: 10 },
+            });
+            (0, test_1.expect)(response.status()).toBe(403);
+            const body = await response.json();
+            (0, test_1.expect)(body.status).toBe(403);
+            (0, test_1.expect)(body.error).toBe('Forbidden');
+        });
+    });
+});

package/dist/tests/8.9/cluster-variables.spec.js

@@ -6,16 +6,91 @@ const _setup_1 = require("../../test-setup.js");
 const apiHelpers_1 = require("../../utils/apiHelpers");
 const sleep_1 = require("../../utils/sleep");
 const users_1 = require("../../utils/users");
+const randomName_1 = require("../../utils/randomName");
+const CLUSTER_VAR_NAMES = {
+    ORIGINAL_JSON: 'ORIGINAL_API_INFO',
+    UPDATABLE_JSON: 'UPDATABLE_API_INFO',
+    ORIGINAL_STRING: 'ORIGINAL_APP_VERSION',
+    UPDATABLE_STRING: 'UPDATABLE_APP_VERSION',
+};
+function getConfigByType(type) {
+    const configs = {
+        JSON: {
+            processName: 'Cluster Variable Original JSON',
+            processNameUpdatable: 'Cluster Variable Updatable JSON',
+            taskName: 'Preview JSON cluster variables',
+            originalVariableName: CLUSTER_VAR_NAMES.ORIGINAL_JSON,
+            updatableVariableName: CLUSTER_VAR_NAMES.UPDATABLE_JSON,
+            originalValue: originalJsonClusterVariableValue,
+            operateVariableName: 'URL',
+            randomValuePrefix: 'https://updated.api.com',
+        },
+        String: {
+            processName: 'Cluster Variable Original String',
+            processNameUpdatable: 'Cluster Variable Updatable String',
+            taskName: 'Preview String cluster variable',
+            originalVariableName: CLUSTER_VAR_NAMES.ORIGINAL_STRING,
+            updatableVariableName: CLUSTER_VAR_NAMES.UPDATABLE_STRING,
+            originalValue: originalStringClusterVariableValue,
+            operateVariableName: 'APP_VERSION_VALUE',
+            randomValuePrefix: 'v3.0.0-updated',
+        },
+    };
+    return configs[type];
+}
 const testUser = (0, users_1.getTestUser)('sixteenthUser');
 let authToken;
-let jsonClusterVariableValue;
+let originalJsonClusterVariableValue;
+let originalStringClusterVariableValue;
+let jsonProcessKeyDisplay;
+let jsonProcessKeyUpdate;
+let stringProcessKeyDisplay;
+let stringProcessKeyUpdate;
 _8_9_1.test.describe.configure({ mode: 'parallel' });
 _8_9_1.test.describe('Cluster Variables User Flows', () => {
     const clusterName = 'Test Cluster';
     _8_9_1.test.beforeAll(async () => {
         authToken = await (0, apiHelpers_1.authSaasAPI)();
-        await (0, apiHelpers_1.createGlobalClusterVariable)(authToken);
-        jsonClusterVariableValue = JSON.parse(process.env.CLUSTER_VARIABLE_JSON);
+        await Promise.all([
+            (0, apiHelpers_1.createJsonClusterVariable)(authToken, 'saas', CLUSTER_VAR_NAMES.ORIGINAL_JSON, process.env.CLUSTER_VARIABLE_JSON_VALUE),
+            (0, apiHelpers_1.createJsonClusterVariable)(authToken, 'saas', CLUSTER_VAR_NAMES.UPDATABLE_JSON, process.env.CLUSTER_VARIABLE_JSON_VALUE),
+            (0, apiHelpers_1.createStringClusterVariable)(authToken, 'saas', CLUSTER_VAR_NAMES.ORIGINAL_STRING, process.env.CLUSTER_VARIABLE_STRING_VALUE),
+            (0, apiHelpers_1.createStringClusterVariable)(authToken, 'saas', CLUSTER_VAR_NAMES.UPDATABLE_STRING, process.env.CLUSTER_VARIABLE_STRING_VALUE),
+        ]);
+        originalJsonClusterVariableValue = JSON.parse(process.env.CLUSTER_VARIABLE_JSON_VALUE);
+        originalStringClusterVariableValue =
+            process.env.CLUSTER_VARIABLE_STRING_VALUE;
+        const deployments = [
+            {
+                path: './resources/cluster_variables/cluster_variable_json_readonly.bpmn',
+                assignTo: 'jsonProcessKeyDisplay',
+            },
+            {
+                path: './resources/cluster_variables/cluster_variable_json_mutable.bpmn',
+                assignTo: 'jsonProcessKeyUpdate',
+            },
+            {
+                path: './resources/cluster_variables/cluster_variable_json_form.form',
+                assignTo: null,
+            },
+            {
+                path: './resources/cluster_variables/cluster_variable_string_readonly.bpmn',
+                assignTo: 'stringProcessKeyDisplay',
+            },
+            {
+                path: './resources/cluster_variables/cluster_variable_string_mutable.bpmn',
+                assignTo: 'stringProcessKeyUpdate',
+            },
+            {
+                path: './resources/cluster_variables/cluster_variable_string_form.form',
+                assignTo: null,
+            },
+        ];
+        const deploymentResults = await Promise.all(deployments.map((d) => (0, apiHelpers_1.deployProcess)(d.path, authToken)));
+        jsonProcessKeyDisplay = deploymentResults[0];
+        jsonProcessKeyUpdate = deploymentResults[1];
+        stringProcessKeyDisplay = deploymentResults[3];
+        stringProcessKeyUpdate = deploymentResults[4];
     });
     _8_9_1.test.beforeEach(async ({ page, appsPage, loginPage }, testInfo) => {
         await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, testUser, (testInfo.workerIndex + 1) * 1000);
@@ -27,44 +102,99 @@ _8_9_1.test.describe('Cluster Variables User Flows', () => {
         await (0, _setup_1.captureFailureVideo)(page, testInfo);
     });
     _8_9_1.test.describe('Global cluster variable', () => {
-        (0, _8_9_1.test)('User deploys a process and accesses global cluster variable on Tasklist', async ({ appsPage, operateHomePage, operateProcessesPage, operateProcessInstancePage, taskPanelPage, taskDetailsPage, }) => {
-            _8_9_1.test.slow();
-            const [processKey] = await Promise.all([
-                (0, apiHelpers_1.deployProcess)('./resources/cluster_variables/cluster_variable_global_scope.bpmn', authToken),
-                (0, apiHelpers_1.deployProcess)('./resources/cluster_variables/preview_cluster_variables.form', authToken),
-            ]);
-            if (processKey == null) {
-                throw new Error('Failed to deploy process or missing processDefinitionKey');
-            }
-            const instanceKey = await (0, apiHelpers_1.createProcessInstance)(String(processKey), authToken);
-            await _8_9_1.test.step('User can access the process on operate', async () => {
-                await operateHomePage.clickProcessesTab();
-                await operateProcessesPage.applyMoreFilters('Process Instance Key(s)', String(instanceKey));
-                await operateProcessesPage.clickProcessInstanceLink(`Cluster Variable Global scope - API INFO`);
-                await operateProcessInstancePage.assertActiveTokenIsPresent();
+        const testConfigs = [
+            {
+                type: 'JSON',
+                processKeyDisplay: () => jsonProcessKeyDisplay,
+                processKeyUpdate: () => jsonProcessKeyUpdate,
+            },
+            {
+                type: 'String',
+                processKeyDisplay: () => stringProcessKeyDisplay,
+                processKeyUpdate: () => stringProcessKeyUpdate,
+            },
+        ];
+        for (const config of testConfigs) {
+            (0, _8_9_1.test)(`User views ${config.type} cluster variable in Tasklist from readonly process and completes task`, async ({ appsPage, operateHomePage, operateProcessesPage, operateProcessInstancePage, taskPanelPage, taskDetailsPage, }) => {
+                _8_9_1.test.slow();
+                const derived = getConfigByType(config.type);
+                const instanceKey = await (0, apiHelpers_1.createProcessInstance)(String(config.processKeyDisplay()), authToken);
+                await _8_9_1.test.step('User can access the process on operate', async () => {
+                    await operateHomePage.clickProcessesTab();
+                    await operateProcessesPage.applyMoreFilters('Process Instance Key(s)', String(instanceKey));
+                    await operateProcessesPage.clickProcessInstanceLink(derived.processName);
+                    await operateProcessInstancePage.assertActiveTokenIsPresent();
+                });
+                await _8_9_1.test.step(`User can view the process with ${config.type} cluster variable on tasklist`, async () => {
+                    await appsPage.clickCamundaApps();
+                    await appsPage.clickTasklist(clusterName);
+                    await (0, sleep_1.sleep)(5000);
+                    await taskPanelPage.openTask(derived.taskName);
+                    await taskDetailsPage.clickAssignToMeButton();
+                });
+                await _8_9_1.test.step(`User can view the value of ${config.type} cluster variable and complete the task`, async () => {
+                    if (config.type === 'JSON') {
+                        for (const value of Object.values(derived.originalValue)) {
+                            await taskDetailsPage.assertTextIsPresent(String(value));
+                        }
+                    }
+                    else {
+                        await taskDetailsPage.assertTextIsPresent(String(derived.originalValue));
+                    }
+                    await taskDetailsPage.clickCompleteTaskButton();
+                });
+                await _8_9_1.test.step('User can assert the process is completed on Operate', async () => {
+                    await appsPage.clickCamundaApps();
+                    await appsPage.clickOperate(clusterName);
+                    await operateHomePage.clickProcessesTab();
+                    await operateProcessesPage.clickProcessCompletedCheckbox();
+                    await operateProcessesPage.applyMoreFilters('Process Instance Key(s)', String(instanceKey));
+                    await operateProcessesPage.clickProcessInstanceLink(derived.processName);
+                    await operateProcessInstancePage.assertProcessCompleteStatusWithRetry();
+                });
             });
-            await _8_9_1.test.step('User can view the process with cluster variables on tasklist', async () => {
-                await appsPage.clickCamundaApps();
-                await appsPage.clickTasklist(clusterName);
-                await (0, sleep_1.sleep)(5000);
-                await taskPanelPage.openTask(`Preview cluster variables form`);
-                await taskDetailsPage.clickAssignToMeButton();
+        }
+        for (const config of testConfigs) {
+            (0, _8_9_1.test)(`User updates ${config.type} cluster variable in Admin UI and verifies changes in Operate`, async ({ appsPage, ocIdentityHomePage, ocIdentityClusterVariablesPage, operateHomePage, operateProcessesPage, operateProcessInstancePage, }) => {
+                _8_9_1.test.slow();
+                const derived = getConfigByType(config.type);
+                const randomRawValue = await (0, randomName_1.randomNameAgregator)(derived.randomValuePrefix);
+                const newValue = config.type === 'JSON'
+                    ? JSON.stringify({
+                        endpoint: randomRawValue,
+                        timeout_ms: '5000',
+                        array: ['updated_item1', 'updated_item2'],
+                    })
+                    : JSON.stringify(randomRawValue);
+                await _8_9_1.test.step('User navigates to Admin UI', async () => {
+                    await appsPage.clickCamundaApps();
+                    await appsPage.clickAdmin(clusterName);
+                });
+                await _8_9_1.test.step('User navigates to Cluster Variables tab', async () => {
+                    await ocIdentityHomePage.clickClusterVariablesTab();
+                });
+                await _8_9_1.test.step(`User verifies ${config.type} cluster variable exists`, async () => {
+                    await ocIdentityClusterVariablesPage.assertVariableExists(derived.updatableVariableName);
+                });
+                await _8_9_1.test.step(`User updates the ${config.type} cluster variable value`, async () => {
+                    await ocIdentityClusterVariablesPage.editVariable(derived.updatableVariableName, newValue);
+                });
+                await _8_9_1.test.step(`User creates a process instance with the updated ${config.type} cluster variable`, async () => {
+                    const instanceKey = await (0, apiHelpers_1.createProcessInstance)(String(config.processKeyUpdate()), authToken);
+                    await _8_9_1.test.step('User navigates to the process instance on Operate', async () => {
+                        await appsPage.clickCamundaApps();
+                        await appsPage.clickOperate(clusterName);
+                        await operateHomePage.clickProcessesTab();
+                        await operateProcessesPage.clickProcessCompletedCheckbox();
+                        await operateProcessesPage.applyMoreFilters('Process Instance Key(s)', String(instanceKey));
+                        await operateProcessesPage.clickProcessInstanceLink(derived.processNameUpdatable);
+                        await operateProcessInstancePage.assertProcessCompleteStatusWithRetry();
+                    });
+                    await _8_9_1.test.step(`User verifies the updated ${config.type} cluster variable value is present in process variables`, async () => {
+                        await operateProcessInstancePage.assertProcessVariableContainsText(derived.operateVariableName, randomRawValue);
+                    });
+                });
             });
-            await _8_9_1.test.step('User can view the values of cluster variables and complete the task', async () => {
-                for (const [, value] of Object.entries(jsonClusterVariableValue)) {
-                    await taskDetailsPage.assertTextIsPresent(String(value));
-                }
-                await taskDetailsPage.clickCompleteTaskButton();
-            });
-            await _8_9_1.test.step('User can assert the process is completed on Operate', async () => {
-                await appsPage.clickCamundaApps();
-                await appsPage.clickOperate(clusterName);
-                await operateHomePage.clickProcessesTab();
-                await operateProcessesPage.clickProcessCompletedCheckbox();
-                await operateProcessesPage.applyMoreFilters('Process Instance Key(s)', String(instanceKey));
-                await operateProcessesPage.clickProcessInstanceLink(`Cluster Variable Global scope - API INFO`);
-                await operateProcessInstancePage.assertProcessCompleteStatusWithRetry();
-            });
-        });
+        }
     });
 });

package/dist/utils/apiHelpers.d.ts

@@ -13,7 +13,16 @@ export declare function authC8runAPI(name: string, password: string): Promise<vo
 export declare function validateMcpServerHealth(serverUrl?: string): Promise<APIResponse>;
 export declare function deployProcess(filePath: string, authToken?: string, environment?: 'saas' | 'sm'): Promise<number | null>;
 export declare function createProcessInstance(processDefinitionKey: string, authToken?: string, environment?: 'saas' | 'sm'): Promise<string>;
-export declare function createGlobalClusterVariable(authToken?: string, environment?: 'saas' | 'sm'): Promise<void>;
+export declare function createJsonClusterVariable(authToken?: string, environment?: 'saas' | 'sm', customVariableName?: string, customVariableValue?: string): Promise<void>;
+export declare function createStringClusterVariable(authToken?: string, environment?: 'saas' | 'sm', customVariableName?: string, customVariableValue?: string): Promise<void>;
+/**
+ * @deprecated This function will be removed when SM-8.9 cluster variables test is updated.
+ * Use createJsonClusterVariable() for JSON variables or
+ * createStringClusterVariable() for String variables instead.
+ *
+ * Maintained for backward compatibility with tests/SM-8.9/cluster-variables.spec.ts
+ */
+export declare function createGlobalClusterVariable(authToken: string, environment?: 'saas' | 'sm'): Promise<Record<string, unknown>>;
 interface ReportDefinition {
     key: string;
     filter?: unknown[];

package/dist/utils/apiHelpers.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.updateCollectionScope = exports.createSingleProcessReport = exports.createDashboard = exports.createCollection = exports.getOptimizeCoockie = exports.createGlobalClusterVariable = exports.createProcessInstance = exports.deployProcess = exports.validateMcpServerHealth = exports.authC8runAPI = exports.authSmAPI = exports.authSaasAPI = exports.authAPI = exports.sendRequestAndAssertResponse = exports.assertResponseStatus = void 0;
+exports.updateCollectionScope = exports.createSingleProcessReport = exports.createDashboard = exports.createCollection = exports.getOptimizeCoockie = exports.createGlobalClusterVariable = exports.createStringClusterVariable = exports.createJsonClusterVariable = exports.createProcessInstance = exports.deployProcess = exports.validateMcpServerHealth = exports.authC8runAPI = exports.authSmAPI = exports.authSaasAPI = exports.authAPI = exports.sendRequestAndAssertResponse = exports.assertResponseStatus = void 0;
 const test_1 = require("@playwright/test");
 const sleep_1 = require("./sleep");
 const fs_1 = __importDefault(require("fs"));
@@ -242,32 +242,65 @@ async function createProcessInstance(processDefinitionKey, authToken, environmen
     return String(processInstanceKey);
 }
 exports.createProcessInstance = createProcessInstance;
-async function createGlobalClusterVariable(authToken, environment) {
-    apiRequestContext = await getApiRequestContext();
-    const url = buildZeebeApiUrl('/v2/cluster-variables/global', environment);
-    const response = await apiRequestContext.post(url, {
-        headers: {
-            Authorization: authToken ?? '',
-        },
-        data: {
-            name: String(process.env.CLUSTER_VARIABLE_NAME),
-            value: JSON.parse(process.env.CLUSTER_VARIABLE_JSON),
-        },
-    });
-    const status = response.status();
-    // Accept common successful statuses
-    if (status === 200 || status === 201 || status === 204) {
-        return;
+async function createClusterVariableInternal(authToken, environment, variableName, variableValue, variableType) {
+    try {
+        apiRequestContext = await getApiRequestContext();
+        const url = buildZeebeApiUrl('/v2/cluster-variables/global', environment);
+        const response = await apiRequestContext.post(url, {
+            headers: {
+                Authorization: authToken,
+            },
+            data: {
+                name: variableName,
+                value: variableValue,
+            },
+        });
+        const status = response.status();
+        if (status === 200 || status === 201 || status === 204) {
+            return;
+        }
+        // Handle "already exists" as a benign condition
+        if (status === 409) {
+            console.warn(`${variableType} cluster variable "${variableName}" already exists (HTTP 409).`);
+            return;
+        }
+        const bodyText = await response.text();
+        throw new Error(`Failed to create ${variableType} cluster variable "${variableName}": HTTP ${status} - ${bodyText}`);
     }
-    // Handle "already exists" as a benign condition
-    if (status === 409) {
-        console.warn(`Global cluster variable "${process.env
-            .CLUSTER_VARIABLE_NAME}" already exists (HTTP 409).`);
-        return;
+    catch (error) {
+        if (error instanceof Error && error.message.includes('Failed to create')) {
+            throw error;
+        }
+        // Wrap unexpected errors with context
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        throw new Error(`Unexpected error creating ${variableType} cluster variable "${variableName}": ${errorMessage}`);
     }
-    const bodyText = await response.text();
-    throw new Error(`Failed to create global cluster variable "${process.env
-        .CLUSTER_VARIABLE_NAME}": HTTP ${status} - ${bodyText}`);
+}
+async function createJsonClusterVariable(authToken, environment = 'saas', customVariableName, customVariableValue) {
+    const variableName = customVariableName ?? String(process.env.CLUSTER_VARIABLE_NAME);
+    const variableValue = customVariableValue
+        ? JSON.parse(customVariableValue)
+        : JSON.parse(process.env.CLUSTER_VARIABLE_JSON);
+    await createClusterVariableInternal(authToken ?? '', environment, variableName, variableValue, 'JSON');
+}
+exports.createJsonClusterVariable = createJsonClusterVariable;
+async function createStringClusterVariable(authToken, environment = 'saas', customVariableName, customVariableValue) {
+    const variableName = customVariableName ?? String(process.env.CLUSTER_VARIABLE_STRING_NAME);
+    const variableValue = customVariableValue ?? process.env.CLUSTER_VARIABLE_STRING_VALUE;
+    await createClusterVariableInternal(authToken ?? '', environment, variableName, variableValue, 'String');
+}
+exports.createStringClusterVariable = createStringClusterVariable;
+/**
+ * @deprecated This function will be removed when SM-8.9 cluster variables test is updated.
+ * Use createJsonClusterVariable() for JSON variables or
+ * createStringClusterVariable() for String variables instead.
+ *
+ * Maintained for backward compatibility with tests/SM-8.9/cluster-variables.spec.ts
+ */
+async function createGlobalClusterVariable(authToken, environment = 'saas') {
+    const variableValue = process.env.CLUSTER_VARIABLE_JSON_VALUE;
+    await createJsonClusterVariable(authToken, environment, 'ORIGINAL_API_INFO', variableValue);
+    return JSON.parse(variableValue);
 }
 exports.createGlobalClusterVariable = createGlobalClusterVariable;
 async function getOptimizeCoockie(page) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/e2e-test-suite",
-  "version": "0.0.231",
+  "version": "0.0.233",
   "description": "End-to-end test helpers for Camunda 8",
   "repository": {
     "type": "git",