@camunda/e2e-test-suite 0.0.754 → 0.0.756

package/dist/fixtures/8.10.d.ts

@@ -34,6 +34,7 @@ import { OCIdentityRolesPage } from '../pages/8.10/OCIdentityRolesPage';
 import { OCIdentityAuthorizationsPage } from '../pages/8.10/OCIdentityAuthorizationsPage';
 import { OCIdentityClusterVariablesPage } from '../pages/8.10/OCIdentityClusterVariablesPage';
 import { ClientCredentialsDetailsPage } from '../pages/8.10/ClientCredentialsDetailsPage';
+import { AuditLogPage } from '../pages/8.10/AuditLogPage';
 type PlaywrightFixtures = {
     makeAxeBuilder: () => AxeBuilder;
     loginPage: LoginPage;
@@ -71,6 +72,7 @@ type PlaywrightFixtures = {
     ocIdentityAuthorizationsPage: OCIdentityAuthorizationsPage;
     ocIdentityClusterVariablesPage: OCIdentityClusterVariablesPage;
     clientCredentialsDetailsPage: ClientCredentialsDetailsPage;
+    auditLogPage: AuditLogPage;
     overrideTrackingScripts: void;
 };
 declare const test: import("@playwright/test").TestType<import("@playwright/test").PlaywrightTestArgs & import("@playwright/test").PlaywrightTestOptions & PlaywrightFixtures, import("@playwright/test").PlaywrightWorkerArgs & import("@playwright/test").PlaywrightWorkerOptions>;

package/dist/fixtures/8.10.js

@@ -41,6 +41,7 @@ const OCIdentityRolesPage_1 = require("../pages/8.10/OCIdentityRolesPage");
 const OCIdentityAuthorizationsPage_1 = require("../pages/8.10/OCIdentityAuthorizationsPage");
 const OCIdentityClusterVariablesPage_1 = require("../pages/8.10/OCIdentityClusterVariablesPage");
 const ClientCredentialsDetailsPage_1 = require("../pages/8.10/ClientCredentialsDetailsPage");
+const AuditLogPage_1 = require("../pages/8.10/AuditLogPage");
 const test = test_1.test.extend({
     makeAxeBuilder: async ({ page }, use) => {
         const makeAxeBuilder = () => new playwright_1.default({ page }).withTags([
@@ -158,6 +159,9 @@ const test = test_1.test.extend({
     clientCredentialsDetailsPage: async ({ page }, use) => {
         await use(new ClientCredentialsDetailsPage_1.ClientCredentialsDetailsPage(page));
     },
+    auditLogPage: async ({ page }, use) => {
+        await use(new AuditLogPage_1.AuditLogPage(page));
+    },
     overrideTrackingScripts: [
         async ({ context }, use) => {
             await context.route('https://cmp.osano.com/16CVvwSNKHi9t1grQ/9403708a-488b-4f3b-aea6-613825dec79f/osano.js', (route) => route.fulfill({

package/dist/pages/8.10/AuditLogPage.d.ts

@@ -0,0 +1,14 @@
+import { Page, Locator } from '@playwright/test';
+type AuditLogCategory = 'Administration' | 'Deployed resources' | 'User tasks';
+declare class AuditLogPage {
+    readonly auditLogTab: Locator;
+    readonly updateButton: Locator;
+    readonly clientOperationsSection: Locator;
+    readonly clientCategoryCheckbox: (category: AuditLogCategory) => Locator;
+    readonly clientCategoryLabel: (category: AuditLogCategory) => Locator;
+    constructor(page: Page);
+    clickAuditLogTab(): Promise<void>;
+    private ensureChecked;
+    enableClientOperationLogging(): Promise<void>;
+}
+export { AuditLogPage };

package/dist/pages/8.10/AuditLogPage.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditLogPage = void 0;
+const test_1 = require("@playwright/test");
+class AuditLogPage {
+    auditLogTab;
+    updateButton;
+    clientOperationsSection;
+    clientCategoryCheckbox;
+    clientCategoryLabel;
+    constructor(page) {
+        this.auditLogTab = page.getByRole('tab', { name: 'Audit log' });
+        const auditLogPanel = page.getByRole('tabpanel', { name: 'Audit log' });
+        this.updateButton = auditLogPanel.getByRole('button', {
+            name: 'Update',
+            exact: true,
+        });
+        // Scope to the Client block: the category labels also exist under the User section.
+        this.clientOperationsSection = auditLogPanel
+            .getByText('Client operations to log', { exact: true })
+            .locator('..');
+        this.clientCategoryCheckbox = (category) => this.clientOperationsSection.getByRole('checkbox', { name: category });
+        // Carbon hides the real <input>; toggle via the visible label.
+        this.clientCategoryLabel = (category) => this.clientOperationsSection.locator('label').filter({ hasText: category });
+    }
+    async clickAuditLogTab() {
+        await (0, test_1.expect)(this.auditLogTab).toBeVisible({ timeout: 60000 });
+        await this.auditLogTab.click({ timeout: 60000 });
+    }
+    async ensureChecked(category) {
+        const checkbox = this.clientCategoryCheckbox(category);
+        await (0, test_1.expect)(checkbox).toBeAttached({ timeout: 30000 });
+        if (!(await checkbox.isChecked())) {
+            await this.clientCategoryLabel(category).click({ timeout: 30000 });
+            await (0, test_1.expect)(checkbox).toBeChecked();
+        }
+    }
+    async enableClientOperationLogging() {
+        const categories = [
+            'Administration',
+            'Deployed resources',
+            'User tasks',
+        ];
+        for (const category of categories) {
+            await this.ensureChecked(category);
+        }
+        if (await this.updateButton.isEnabled()) {
+            await this.updateButton.click({ timeout: 60000 });
+            await (0, test_1.expect)(this.updateButton).toBeDisabled({ timeout: 60000 });
+        }
+    }
+}
+exports.AuditLogPage = AuditLogPage;

package/dist/pages/8.7/ModelerHomePage.d.ts

@@ -1,6 +1,5 @@
 import { Page, Locator } from '@playwright/test';
 import { LoginPage } from './LoginPage';
-import { AppsPage } from './AppsPage';
 declare class ModelerHomePage {
     private defaultFolderName;
     private page;
@@ -55,15 +54,23 @@ declare class ModelerHomePage {
     assertFormBreadcrumbVisible(formName: string): Promise<void>;
     /**
      * Handles navigation after clicking an invitation link in email.
-     * The invitation link may auto-authenticate the second user and land them in
-     * the correct org's Modeler. If the Modeler banner is visible, navigate to
-     * the Modeler home within the same org context — clearing cookies and
-     * re-logging in via the app switcher lands in the user's personal org where
-     * the shared project is not listed.
-     * If auto-authentication did not occur (page ended up on Auth0), falls back
-     * to the explicit login path.
+     *
+     * The invited user follows the link while logged out, so the invitation flow
+     * presents the Auth0 login. Completing the login ON the invitation flow lets
+     * SaaS accept the invite and land the user directly in the SHARED org's
+     * Modeler, where the shared project is listed.
+     *
+     * We deliberately do NOT clear cookies and re-login via the app switcher:
+     * that path authenticates into the user's PERSONAL org, where the shared
+     * project does not exist and the folder can never appear — the previous
+     * fallback raced a 15s window and, whenever the (normal) login + invite-accept
+     * redirect chain took longer, dropped into that personal-org path and hung.
+     *
+     * If the link auto-authenticated (the banner is already up), no login is
+     * needed. The redirect chain routinely takes longer than a few seconds, so
+     * wait generously for the banner instead of racing a short window.
      */
-    navigateAfterInvitationLink(loginPage: LoginPage, appsPage: AppsPage, credentials: {
+    navigateAfterInvitationLink(loginPage: LoginPage, credentials: {
         username: string;
         password: string;
     }): Promise<void>;

package/dist/pages/8.7/ModelerHomePage.js

@@ -4,7 +4,6 @@ exports.ModelerHomePage = void 0;
 const test_1 = require("@playwright/test");
 const sleep_1 = require("../../utils/sleep");
 const clickLocatorWithRetry_1 = require("../../utils/assertionHelpers/clickLocatorWithRetry");
-const UtilitiesPage_1 = require("./UtilitiesPage");
 class ModelerHomePage {
     defaultFolderName = 'Cross Component Test Project';
     page;
@@ -276,34 +275,44 @@ class ModelerHomePage {
     }
     /**
      * Handles navigation after clicking an invitation link in email.
-     * The invitation link may auto-authenticate the second user and land them in
-     * the correct org's Modeler. If the Modeler banner is visible, navigate to
-     * the Modeler home within the same org context — clearing cookies and
-     * re-logging in via the app switcher lands in the user's personal org where
-     * the shared project is not listed.
-     * If auto-authentication did not occur (page ended up on Auth0), falls back
-     * to the explicit login path.
+     *
+     * The invited user follows the link while logged out, so the invitation flow
+     * presents the Auth0 login. Completing the login ON the invitation flow lets
+     * SaaS accept the invite and land the user directly in the SHARED org's
+     * Modeler, where the shared project is listed.
+     *
+     * We deliberately do NOT clear cookies and re-login via the app switcher:
+     * that path authenticates into the user's PERSONAL org, where the shared
+     * project does not exist and the folder can never appear — the previous
+     * fallback raced a 15s window and, whenever the (normal) login + invite-accept
+     * redirect chain took longer, dropped into that personal-org path and hung.
+     *
+     * If the link auto-authenticated (the banner is already up), no login is
+     * needed. The redirect chain routinely takes longer than a few seconds, so
+     * wait generously for the banner instead of racing a short window.
      */
-    async navigateAfterInvitationLink(loginPage, appsPage, credentials) {
-        const autoAuthenticated = await this.modelerPageBanner
-            .waitFor({ state: 'visible', timeout: 15000 })
+    async navigateAfterInvitationLink(loginPage, credentials) {
+        // If the invitation flow shows the Auth0 login, authenticate in place so
+        // the invite is accepted in the shared-org context. If it doesn't appear,
+        // the link already auto-authenticated us and we skip straight to the banner.
+        const onLogin = await loginPage.usernameInput
+            .waitFor({ state: 'visible', timeout: 60000 })
             .then(() => true)
             .catch(() => false);
-        if (autoAuthenticated) {
-            try {
-                await this.clickHomeBreadcrumb();
-            }
-            catch {
-                // Already on the Modeler home page
-            }
+        if (onLogin) {
+            await loginPage.fillUsername(credentials.username);
+            await loginPage.clickContinueButton();
+            await loginPage.fillPassword(credentials.password);
+            await loginPage.clickLoginButton();
         }
-        else {
-            await this.page.context().clearCookies();
-            await (0, UtilitiesPage_1.loginWithRetry)(this.page, loginPage, credentials, 1000, 3, true);
-            await appsPage.clickCamundaApps();
-            await appsPage.clickModeler();
+        await (0, test_1.expect)(this.modelerPageBanner).toBeVisible({ timeout: 180000 });
+        try {
+            await this.clickHomeBreadcrumb();
+        }
+        catch {
+            // Already on the Modeler home page
         }
-        await (0, test_1.expect)(this.modelerPageBanner).toBeVisible({ timeout: 120000 });
+        await (0, test_1.expect)(this.modelerPageBanner).toBeVisible({ timeout: 30000 });
     }
 }
 exports.ModelerHomePage = ModelerHomePage;

package/dist/pages/8.7/UtilitiesPage.d.ts

@@ -29,6 +29,7 @@ export declare function runMultipleProcesses(clusterName: string, page: Page, mo
     numberOfProcesses?: number;
     processName?: string;
     uploadFromFile?: string;
+    settleBetween?: (processId: string) => Promise<void>;
 }): Promise<void>;
 export declare function runProcess(clusterName: string, page: Page, modelerHomePage: ModelerHomePage, modelerCreatePage: ModelerCreatePage, processName: string, processId?: string, uploadFromFile?: string): Promise<void>;
 export declare function modelDiagramFromFile(page: Page, modelerHomePage: ModelerHomePage, modelerCreatePage: ModelerCreatePage, processName: string, fileName?: string, nrOfRenamedUserTasks?: number, taskName?: string): Promise<void>;

package/dist/pages/8.7/UtilitiesPage.js

@@ -219,10 +219,20 @@ async function completeTaskWithRetry(taskPanelPage, taskDetailsPage, taskName, t
 }
 exports.completeTaskWithRetry = completeTaskWithRetry;
 async function runMultipleProcesses(clusterName, page, modelerHomePage, modelerCreatePage, options) {
-    const { processName = 'Camunda_User_Task', numberOfProcesses = 2, uploadFromFile = '', } = options || {};
+    const { processName = 'Camunda_User_Task', numberOfProcesses = 2, uploadFromFile = '', settleBetween, } = options || {};
     for (let i = 1; i <= numberOfProcesses; i++) {
         await runProcess(clusterName, page, modelerHomePage, modelerCreatePage, processName + i, processName + i, uploadFromFile);
         await modelerHomePage.clickProjectBreadcrumb();
+        // When RBA is enabled, deploying a process auto-provisions a resource
+        // authorization for the deployer keyed on the process definition id. The
+        // identity service writes that grant with a read-modify-write, so deploying
+        // the next process before this grant lands clobbers it (lost update) and it
+        // is permanently missing. When a settleBetween hook is supplied, wait for
+        // the just-deployed grant to be durably provisioned before the next deploy —
+        // a deterministic wait, not a fixed sleep.
+        if (settleBetween && i < numberOfProcesses) {
+            await settleBetween(processName + i);
+        }
     }
 }
 exports.runMultipleProcesses = runMultipleProcesses;

package/dist/tests/8.10/orchestration-cluster-mcp-server/api/mcp-processes-audit-log.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/8.10/orchestration-cluster-mcp-server/api/mcp-processes-audit-log.spec.js

@@ -0,0 +1,146 @@
+"use strict";
+/*
+ * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH under
+ * one or more contributor license agreements. See the NOTICE file distributed
+ * with this work for additional information regarding copyright ownership.
+ * Licensed under the Camunda License 1.0. You may not use this file
+ * except in compliance with the Camunda License 1.0.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+/*
+ * MCP audit-log inbound channel provenance — camunda/camunda#56234
+ * (SC-AUD-01/02/03).
+ */
+const _8_10_1 = require("../../../../fixtures/8.10");
+const test_1 = require("@playwright/test");
+const apiHelpers_1 = require("../../../../utils/apiHelpers");
+const mcpHelpers_1 = require("../../../../utils/mcpHelpers");
+const constants_1 = require("../../../../utils/constants");
+// Raw BPMN `io.camunda.tool:name` annotation — what the audit log stores in
+// inboundChannelToolName (not the composite tools/list name).
+const TOOL_NAME_RAW = 'mcp-as-tool-process';
+const MCP_PROCESS_DEFINITION_ID = 'mcpAsToolProcess';
+let authToken;
+let mcpProcessesUrl;
+let messageSubscriptionsSearchUrl;
+let auditLogsSearchUrl;
+let mcpSessionId = null;
+let restProcessDefinitionKey;
+let compositeToolName;
+_8_10_1.test.describe.configure({ mode: 'parallel' });
+_8_10_1.test.describe('Orchestration Cluster MCP Server — audit log inbound channel', () => {
+    _8_10_1.test.beforeAll(async () => {
+        authToken = await (0, apiHelpers_1.authSaasAPI)(undefined, 'agentic_cluster');
+        mcpProcessesUrl = (0, apiHelpers_1.buildZeebeApiUrl)('/mcp/processes', 'saas', 'agentic_cluster');
+        messageSubscriptionsSearchUrl = (0, apiHelpers_1.buildZeebeApiUrl)('/v2/message-subscriptions/search', 'saas', 'agentic_cluster');
+        auditLogsSearchUrl = (0, apiHelpers_1.buildZeebeApiUrl)('/v2/audit-logs/search', 'saas', 'agentic_cluster');
+        const apiContext = await (0, apiHelpers_1.getApiRequestContext)();
+        mcpSessionId = await (0, mcpHelpers_1.initializeMcpSession)(apiContext, mcpProcessesUrl, authToken, mcpSessionId);
+        const [mcpKey, restKey] = await Promise.all([
+            (0, apiHelpers_1.deployProcess)('./resources/mcp_server_saas/mcp_as_tool_process.bpmn', authToken, 'saas', 'agentic_cluster'),
+            (0, apiHelpers_1.deployProcess)('./resources/mcp_server_saas/mcp_process_instance_test_file.bpmn', authToken, 'saas', 'agentic_cluster'),
+        ]);
+        if (mcpKey == null) {
+            throw new Error('Failed to deploy mcp_as_tool_process.bpmn');
+        }
+        if (restKey == null) {
+            throw new Error('Failed to deploy mcp_process_instance_test_file.bpmn');
+        }
+        restProcessDefinitionKey = String(restKey);
+        // Composite tool name is `<toolName>_<messageSubscriptionKey>`.
+        await (0, test_1.expect)(async () => {
+            const res = await apiContext.post(messageSubscriptionsSearchUrl, {
+                headers: (0, mcpHelpers_1.buildMcpHeaders)(authToken, mcpSessionId),
+                data: {
+                    filter: {
+                        processDefinitionId: MCP_PROCESS_DEFINITION_ID,
+                        messageSubscriptionType: 'START_EVENT',
+                    },
+                    sort: [{ field: 'processDefinitionVersion', order: 'desc' }],
+                    page: { limit: 1 },
+                },
+            });
+            await (0, mcpHelpers_1.assertResponseStatus)(res, 200);
+            const json = (await res.json());
+            (0, test_1.expect)(json.items.length).toBeGreaterThanOrEqual(1);
+            compositeToolName = `${TOOL_NAME_RAW}_${json.items[0].messageSubscriptionKey}`;
+        }).toPass(constants_1.deletionAssertionOptions);
+    });
+    (0, _8_10_1.test)('SC-AUD-01 — MCP tools/call produces audit entry with inboundChannelType=MCP', async () => {
+        const apiContext = await (0, apiHelpers_1.getApiRequestContext)();
+        const callBody = await (0, mcpHelpers_1.callTool)(apiContext, mcpProcessesUrl, authToken, mcpSessionId, compositeToolName, {});
+        (0, test_1.expect)(callBody.result).toBeDefined();
+        (0, test_1.expect)(callBody.result.isError).not.toBe(true);
+        const pik = (0, mcpHelpers_1.extractProcessInstanceKey)(callBody.result.content[0]?.text ?? '');
+        (0, test_1.expect)(pik, 'Expected processInstanceKey from MCP tools/call').not.toBeNull();
+        await (0, test_1.expect)(async () => {
+            const res = await apiContext.post(auditLogsSearchUrl, {
+                headers: (0, mcpHelpers_1.buildMcpHeaders)(authToken, mcpSessionId),
+                data: {
+                    filter: {
+                        processInstanceKey: pik,
+                        operationType: 'CREATE',
+                    },
+                    page: { limit: 10 },
+                },
+            });
+            await (0, mcpHelpers_1.assertResponseStatus)(res, 200);
+            const json = (await res.json());
+            const entry = json.items.find((i) => i.entityType === 'PROCESS_INSTANCE');
+            (0, test_1.expect)(entry, `Expected a PROCESS_INSTANCE CREATE audit entry for pik ${pik}`).toBeDefined();
+            (0, test_1.expect)(entry.inboundChannelType).toBe('MCP');
+        }).toPass(constants_1.auditLogAssertionOptions);
+    });
+    (0, _8_10_1.test)('SC-AUD-02 — MCP audit entry captures the raw tool name in inboundChannelToolName', async () => {
+        const apiContext = await (0, apiHelpers_1.getApiRequestContext)();
+        const callBody = await (0, mcpHelpers_1.callTool)(apiContext, mcpProcessesUrl, authToken, mcpSessionId, compositeToolName, {});
+        (0, test_1.expect)(callBody.result).toBeDefined();
+        (0, test_1.expect)(callBody.result.isError).not.toBe(true);
+        const pik = (0, mcpHelpers_1.extractProcessInstanceKey)(callBody.result.content[0]?.text ?? '');
+        (0, test_1.expect)(pik).not.toBeNull();
+        await (0, test_1.expect)(async () => {
+            const res = await apiContext.post(auditLogsSearchUrl, {
+                headers: (0, mcpHelpers_1.buildMcpHeaders)(authToken, mcpSessionId),
+                data: {
+                    filter: {
+                        processInstanceKey: pik,
+                        operationType: 'CREATE',
+                    },
+                    page: { limit: 10 },
+                },
+            });
+            await (0, mcpHelpers_1.assertResponseStatus)(res, 200);
+            const json = (await res.json());
+            const entry = json.items.find((i) => i.entityType === 'PROCESS_INSTANCE');
+            (0, test_1.expect)(entry, `Expected a PROCESS_INSTANCE CREATE audit entry for pik ${pik}`).toBeDefined();
+            // Raw annotation value, not the composite tools/list name.
+            (0, test_1.expect)(entry.inboundChannelToolName).toBe(TOOL_NAME_RAW);
+            (0, test_1.expect)(entry.inboundChannelType).toBe('MCP');
+        }).toPass(constants_1.auditLogAssertionOptions);
+    });
+    (0, _8_10_1.test)('SC-AUD-03 — REST-triggered start is distinguishable from MCP (inboundChannelType and tool name both null)', async () => {
+        const apiContext = await (0, apiHelpers_1.getApiRequestContext)();
+        // NONE-start BPMN started via REST — bypasses MCP entirely.
+        const restPik = await (0, apiHelpers_1.createProcessInstance)(restProcessDefinitionKey, authToken, 'saas', 'agentic_cluster');
+        (0, test_1.expect)(restPik).toBeTruthy();
+        await (0, test_1.expect)(async () => {
+            const res = await apiContext.post(auditLogsSearchUrl, {
+                headers: (0, mcpHelpers_1.buildMcpHeaders)(authToken, mcpSessionId),
+                data: {
+                    filter: {
+                        processInstanceKey: restPik,
+                        operationType: 'CREATE',
+                    },
+                    page: { limit: 10 },
+                },
+            });
+            await (0, mcpHelpers_1.assertResponseStatus)(res, 200);
+            const json = (await res.json());
+            const entry = json.items.find((i) => i.entityType === 'PROCESS_INSTANCE');
+            (0, test_1.expect)(entry, `Expected a PROCESS_INSTANCE CREATE audit entry for REST pik ${restPik}`).toBeDefined();
+            // REST-triggered entries have both fields null (verified on 8.10-SNAPSHOT).
+            (0, test_1.expect)(entry.inboundChannelType).toBeNull();
+            (0, test_1.expect)(entry.inboundChannelToolName).toBeNull();
+        }).toPass(constants_1.auditLogAssertionOptions);
+    });
+});

package/dist/tests/8.10/test-setup.spec.js

@@ -47,7 +47,7 @@ _8_10_1.test.describe('Cluster Setup Tests', () => {
             await clusterSecretsPage.createSetOfSecrets(clusterName, connectorSecrets_1.bedrockCodeInterpreterSecretsValues);
         }
     });
-    (0, _8_10_1.test)('Create Agentic Orchestration Cluster', async ({ page, loginPage, homePage, clusterPage, clusterDetailsPage, clusterSecretsPage, }, testInfo) => {
+    (0, _8_10_1.test)('Create Agentic Orchestration Cluster', async ({ page, loginPage, homePage, clusterPage, clusterDetailsPage, clusterSecretsPage, auditLogPage, }, testInfo) => {
         _8_10_1.test.skip(process.env.IS_PROD === 'true', 'Skipping test because not required on PROD test org');
         _8_10_1.test.skip(process.env.IS_AG === 'true', 'Skipping test because not required when IS_AG is true');
         _8_10_1.test.slow();
@@ -60,6 +60,8 @@ _8_10_1.test.describe('Cluster Setup Tests', () => {
         await clusterPage.assertClusterHealthyStatusWithRetry(clusterName, 300000, 1500000);
         await clusterPage.clickClusterLink(clusterName);
         await clusterDetailsPage.assertComponentsHealth();
+        await auditLogPage.clickAuditLogTab();
+        await auditLogPage.enableClientOperationLogging();
         await clusterDetailsPage.clickSettingsTab();
         await clusterDetailsPage.checkMcpSupportToggle();
         await homePage.clickClusters();

package/dist/tests/8.7/rba-enabled-user-flows.spec.js

@@ -236,6 +236,31 @@ _8_7_1.test.describe('RBA Enabled User Flows Test', () => {
             await (0, UtilitiesPage_1.runMultipleProcesses)(clusterName, page, modelerHomePage, modelerCreatePage, {
                 processName: processName,
                 uploadFromFile: 'Camunda_Simple_User_Task_1',
+                // RBA is enabled before this deploy, so each process start
+                // auto-provisions the deployer's resource authorization via a
+                // read-modify-write. Deploying the second process before the first
+                // grant lands clobbers it (lost update), permanently dropping one of
+                // the two process ids — which no downstream wait can recover (see
+                // authorizedResourcesAssertion). Before deploying the next process,
+                // wait for the just-deployed grant to appear in Console, then return
+                // to the project. Deterministic, unlike a fixed sleep.
+                settleBetween: async (processId) => {
+                    await appsPage.clickCamundaApps();
+                    await appsPage.clickConsoleLink();
+                    await homePage.clickOrganization();
+                    await consoleOrganizationsPage.clickUsersTab();
+                    await consoleOrganizationsPage.clickMainUser(mainUser.username);
+                    await consoleOrganizationsPage.clickAuthorizations();
+                    await consoleOrganizationsPage.authorizedResourcesAssertion([
+                        processId,
+                    ]);
+                    await appsPage.clickCamundaApps();
+                    await appsPage.clickModeler();
+                    await (0, test_1.expect)(modelerHomePage.modelerPageBanner).toBeVisible({
+                        timeout: 120000,
+                    });
+                    await modelerHomePage.clickCrossComponentProjectFolder();
+                },
             });
             await (0, sleep_1.sleep)(60000);
         });

package/dist/tests/8.7/web-modeler-user-flows.spec.js

@@ -514,12 +514,17 @@ _8_7_1.test.describe('Web Modeler User Flow Tests', () => {
         });
         await _8_7_1.test.step('Log in with Second User and Navigate to Cross Component Test project as Collaborator', async () => {
             await (0, UtilitiesPage_1.clickInvitationLinkInEmail)(page, id);
-            await (0, sleep_1.sleep)(60000);
-            await modelerHomePage.navigateAfterInvitationLink(loginPage, appsPage, {
+            await modelerHomePage.navigateAfterInvitationLink(loginPage, {
                 username: emailAddress,
                 password: password,
             });
-            await (0, UtilitiesPage_1.assertLocatorVisibleWithRetry)(modelerHomePage, modelerHomePage.crossComponentProjectFolder, 'Cross Component Test Project', 90000, 20);
+            // navigateAfterInvitationLink lands the invited user in the SHARED org's
+            // Modeler home (it logs in on the invitation flow rather than
+            // re-authenticating into the personal org), so the shared project is
+            // present. Assert its visibility directly — no session-breaking reload.
+            await (0, test_1.expect)(modelerHomePage.crossComponentProjectFolder).toBeVisible({
+                timeout: 120000,
+            });
         });
         await _8_7_1.test.step('Log out from Second User', async () => {
             await settingsPage.clickOpenSettingsButton();

package/dist/utils/constants.d.ts

@@ -10,6 +10,10 @@ export declare const deletionAssertionOptions: {
     intervals: number[];
     timeout: number;
 };
+export declare const auditLogAssertionOptions: {
+    intervals: number[];
+    timeout: number;
+};
 export declare const TIMEOUT: {
     short: number;
     medium: number;

package/dist/utils/constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TIMEOUT = exports.deletionAssertionOptions = exports.defaultAssertionOptions = exports._3_MINUTES_IN_MS = exports._1_MINUTE_IN_MS = exports._1_SECOND_IN_MS = exports._100_MS = void 0;
+exports.TIMEOUT = exports.auditLogAssertionOptions = exports.deletionAssertionOptions = exports.defaultAssertionOptions = exports._3_MINUTES_IN_MS = exports._1_MINUTE_IN_MS = exports._1_SECOND_IN_MS = exports._100_MS = void 0;
 exports._100_MS = 100;
 exports._1_SECOND_IN_MS = 1000;
 exports._1_MINUTE_IN_MS = 60 * 1000;
@@ -14,6 +14,12 @@ exports.deletionAssertionOptions = {
     intervals: [5000, 10000, 15000, 30000],
     timeout: 60000,
 };
+// Longest options for audit-log assertions: entries land in secondary storage
+// only after the audit config propagates to the exporters.
+exports.auditLogAssertionOptions = {
+    intervals: [5000, 10000, 15000, 15000],
+    timeout: 90000,
+};
 exports.TIMEOUT = {
     short: 15000,
     medium: 30000,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/e2e-test-suite",
-  "version": "0.0.754",
+  "version": "0.0.756",
   "description": "End-to-end test helpers for Camunda 8",
   "repository": {
     "type": "git",