@camunda/e2e-test-suite 0.0.982 → 0.0.984

package/dist/pages/SM-8.7/ModelerCreatePage.d.ts

@@ -101,9 +101,9 @@ declare class ModelerCreatePage {
     clickSecondPlacedGateway(): Promise<void>;
     private reloadAndWaitForCanvas;
     /**
-     * Detects if the page has been redirected to the Keycloak login page
-     * (session expiry) or is in the middle of an OIDC redirect, and performs
-     * a re-login if necessary.
+     * Detects if the page has been redirected to a login page (session expiry)
+     * or is in the middle of an OIDC redirect, and performs a re-login if
+     * necessary.
      */
     private handleSessionExpiry;
     clickStartInstanceMainButton(): Promise<void>;

package/dist/pages/SM-8.7/ModelerCreatePage.js

@@ -483,9 +483,9 @@ class ModelerCreatePage {
         await element.waitFor({ state: 'visible', timeout: 120000 });
     }
     /**
-     * Detects if the page has been redirected to the Keycloak login page
-     * (session expiry) or is in the middle of an OIDC redirect, and performs
-     * a re-login if necessary.
+     * Detects if the page has been redirected to a login page (session expiry)
+     * or is in the middle of an OIDC redirect, and performs a re-login if
+     * necessary.
      */
     async handleSessionExpiry() {
         const currentUrl = this.page.url();
@@ -501,12 +501,30 @@ class ModelerCreatePage {
         const loginPage = new LoginPage_1.LoginPage(this.page);
         const keycloakBanner = this.page.locator('body#keycloak-bg[data-page-id="login-login"]');
         const usernameField = this.page.locator('#username');
-        // Check if we landed on a login page (Keycloak form)
-        const isOnLoginPage = await keycloakBanner
+        // `loginPage.usernameInput` covers the Camunda Identity form, which carries
+        // neither the Keycloak body id nor a `#username` input, so neither of the
+        // two locators above matches it.
+        const loginForm = keycloakBanner
             .or(usernameField)
-            .isVisible({ timeout: 5000 })
-            .catch(() => false);
-        if (!isOnLoginPage) {
+            .or(loginPage.usernameInput)
+            .first();
+        // `Run` and the login form are mutually exclusive, so race them rather than
+        // sampling one: an expired session redirects through the OIDC callback
+        // after the reload has already resolved, so a point-in-time visibility
+        // check still sees the Modeler document and misses the login form that
+        // replaces it a moment later. The race also costs nothing on the happy
+        // path — it returns as soon as `Run` renders.
+        const landedOn = await Promise.race([
+            loginForm
+                .waitFor({ state: 'visible', timeout: 15000 })
+                .then(() => 'login')
+                .catch(() => 'unknown'),
+            this.startInstanceMainButton
+                .waitFor({ state: 'visible', timeout: 15000 })
+                .then(() => 'app')
+                .catch(() => 'unknown'),
+        ]);
+        if (landedOn !== 'login') {
             return;
         }
         console.warn('clickStartInstanceMainButton: session expired — performing re-login');

package/dist/pages/SM-8.7/TaskPanelPage.js

@@ -4,6 +4,7 @@ exports.TaskPanelPage = void 0;
 const test_1 = require("@playwright/test");
 const constants_1 = require("../../utils/constants");
 const sleep_1 = require("../../utils/sleep");
+const gatewayErrors_1 = require("../../utils/gatewayErrors");
 class TaskPanelPage {
     page;
     availableTasks;
@@ -39,6 +40,9 @@ class TaskPanelPage {
     }
     async openTask(name, assignButton = true) {
         const maxAttempts = 10;
+        // Shared by every attempt so that a sustained Tasklist outage still fails
+        // this call rather than stretching it by ten times this budget.
+        const gatewayRecoveryDeadline = Date.now() + constants_1._1_SECOND_IN_MS * 60;
         for (let attempt = 1; attempt <= maxAttempts; attempt++) {
             try {
                 await this.page.waitForLoadState('domcontentloaded');
@@ -56,7 +60,7 @@ class TaskPanelPage {
             catch (error) {
                 if (attempt < maxAttempts) {
                     console.warn(`Attempt ${attempt} failed. Reloading page...`);
-                    await this.page.reload();
+                    await (0, gatewayErrors_1.reloadPastGatewayError)(this.page, gatewayRecoveryDeadline);
                     await this.page.waitForLoadState('domcontentloaded');
                 }
                 else {

package/dist/pages/SM-8.7/UtlitiesPage.js

@@ -4,6 +4,8 @@ exports.modelDiagramFromFile = exports.modelAndRunConnectorsTimerEventDiagram =
 const test_1 = require("@playwright/test");
 const fileUpload_1 = require("../../utils/fileUpload");
 const sleep_1 = require("../../utils/sleep");
+const gatewayErrors_1 = require("../../utils/gatewayErrors");
+const constants_1 = require("../../utils/constants");
 // Tasklist renders "No permission for Tasklist" as a terminal page: it reads the
 // permissions off the token minted at login and never re-evaluates them, so a
 // user whose Identity role assignment has not propagated yet stays stuck there.
@@ -61,6 +63,9 @@ async function createAndRunProcess(modelerHomePage, modelerCreatePage, processNa
 }
 exports.createAndRunProcess = createAndRunProcess;
 async function completeTaskWithRetry(page, taskPanelPage, taskDetailsPage, taskName, taskPriority, maxRetries = 5) {
+    // Shared by every attempt so that a sustained Tasklist outage still fails
+    // this call rather than stretching it by five times this budget.
+    const gatewayRecoveryDeadline = Date.now() + constants_1._1_SECOND_IN_MS * 60;
     for (let attempt = 0; attempt < maxRetries; attempt++) {
         try {
             await page.waitForLoadState('domcontentloaded');
@@ -98,7 +103,7 @@ async function completeTaskWithRetry(page, taskPanelPage, taskDetailsPage, taskN
         catch (error) {
             console.warn(`Attempt ${attempt + 1} failed for completing task ${taskName}:`, error instanceof Error ? error.message : error);
             if (attempt < maxRetries - 1) {
-                await page.reload();
+                await (0, gatewayErrors_1.reloadPastGatewayError)(page, gatewayRecoveryDeadline);
                 await page.waitForLoadState('domcontentloaded');
                 await (0, sleep_1.sleep)(1000);
             }

package/dist/tests/8.10/optimize-api-tests.spec.js

@@ -33,6 +33,7 @@ const assertUnauthorizedResponseBody = async (response) => {
 };
 _8_10_1.test.describe('API optimize SaaS Tests', () => {
     let optimizeCookie;
+    let csrfToken;
     let optimizeBearerToken;
     let collectionIdValue;
     let dashboardIdValue;
@@ -41,16 +42,18 @@ _8_10_1.test.describe('API optimize SaaS Tests', () => {
     let baseUrl;
     _8_10_1.test.beforeAll(async ({ browser, request }) => {
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         collectionIdValue = await (0, apiHelpers_1.createCollection)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Test Collection'),
             optimizeCookie,
+            csrfToken,
         });
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
         await (0, apiHelpers_1.updateCollectionScope)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: collectionIdValue,
             data: [
                 {
@@ -64,10 +67,12 @@ _8_10_1.test.describe('API optimize SaaS Tests', () => {
         dashboardIdValue = await (0, apiHelpers_1.createDashboard)(request, {
             name: dashboardNameValue,
             optimizeCookie,
+            csrfToken,
             collectionId: collectionIdValue,
         });
         reportId = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: collectionIdValue,
             name: 'Blank report',
             definitions: [
@@ -189,6 +194,7 @@ _8_10_1.test.describe('API optimize SaaS Tests', () => {
         const dashboardToDeleteId = await (0, apiHelpers_1.createDashboard)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Dashboard To Delete'),
             optimizeCookie,
+            csrfToken,
             collectionId: collectionIdValue,
         });
         await _8_10_1.test.step('Delete dashboard successfully (200)', async () => {
@@ -284,6 +290,7 @@ _8_10_1.test.describe('API optimize SaaS Tests', () => {
     (0, _8_10_1.test)('Delete report and verify it is no longer retrievable', async ({ request, }) => {
         const reportToDeleteId = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: collectionIdValue,
             name: await (0, randomName_1.randomNameAgregator)('Report To Delete'),
             definitions: [
@@ -375,6 +382,7 @@ _8_10_1.test.describe('API optimize SaaS Tests', () => {
 });
 _8_10_1.test.describe('API optimize SaaS Tests - Conditional Events', () => {
     let optimizeCookie;
+    let csrfToken;
     let optimizeBearerToken;
     let conditionalEventsCollectionId;
     let conditionalEventsReportId;
@@ -383,15 +391,17 @@ _8_10_1.test.describe('API optimize SaaS Tests - Conditional Events', () => {
     const CONDITIONAL_EVENTS_PROCESS_KEY = 'conditional-events-auto-process';
     _8_10_1.test.beforeAll(async ({ browser, request }) => {
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         conditionalEventsCollectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Conditional Events Collection'),
             optimizeCookie,
+            csrfToken,
         });
         await (0, apiHelpers_1.updateCollectionScope)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: conditionalEventsCollectionId,
             data: [
                 {
@@ -404,6 +414,7 @@ _8_10_1.test.describe('API optimize SaaS Tests - Conditional Events', () => {
         conditionalEventsReportName = await (0, randomName_1.randomNameAgregator)('Conditional Events Report');
         conditionalEventsReportId = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: conditionalEventsCollectionId,
             name: conditionalEventsReportName,
             definitions: [
@@ -428,6 +439,7 @@ _8_10_1.test.describe('API optimize SaaS Tests - Conditional Events', () => {
             const response = await request.post(`${baseUrl}/api/report/process/single`, {
                 headers: {
                     Cookie: optimizeCookie,
+                    'X-CSRF-TOKEN': csrfToken,
                     'Content-Type': 'application/json',
                 },
                 data: {
@@ -507,6 +519,7 @@ _8_10_1.test.describe('API optimize SaaS Tests - Conditional Events', () => {
     (0, _8_10_1.test)('CE-OPT-13: Deleting the Conditional Events report via API succeeds with HTTP 200', async ({ request, }) => {
         const reportToDeleteId = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: conditionalEventsCollectionId,
             name: await (0, randomName_1.randomNameAgregator)('CE Report To Delete'),
             definitions: [
@@ -527,6 +540,7 @@ _8_10_1.test.describe('API optimize SaaS Tests - Conditional Events', () => {
     (0, _8_10_1.test)('CE-OPT-14: A deleted Conditional Events report is no longer retrievable via the API', async ({ request, }) => {
         const reportToDeleteId = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: conditionalEventsCollectionId,
             name: await (0, randomName_1.randomNameAgregator)('CE Report Delete Verify'),
             definitions: [
@@ -566,13 +580,13 @@ _8_10_1.test.describe('API optimize SaaS Tests - Health Readiness', () => {
             (0, test_1.expect)(response.status()).toBe(200);
         });
     });
-    (0, _8_10_1.test)('Health readiness rejects requests that include an Authorization header', async ({ request, }) => {
-        await _8_10_1.test.step('GET /api/readyz with Authorization header should be rejected', async () => {
+    (0, _8_10_1.test)('Health readiness returns 200 when request includes an Authorization header', async ({ request, }) => {
+        await _8_10_1.test.step('GET /api/readyz with Authorization header still returns 200', async () => {
             const token = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
             const response = await request.get(`${baseUrl}/api/readyz`, {
                 headers: { Authorization: token },
             });
-            (0, test_1.expect)([400, 401, 403]).toContain(response.status());
+            (0, test_1.expect)(response.status()).toBe(200);
         });
     });
 });
@@ -583,6 +597,15 @@ _8_10_1.test.describe('API optimize SaaS Tests - Sharing', () => {
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
     });
+    // Sharing is cluster-global, so leaving it off would break every
+    // concurrently running spec that shares a report or dashboard.
+    _8_10_1.test.afterAll(async ({ request }) => {
+        await (0, apiHelpers_1.setOptimizeSharing)(request, {
+            baseUrl,
+            bearerToken: optimizeBearerToken,
+            enabled: true,
+        });
+    });
     (0, _8_10_1.test)('Enable sharing with valid token returns 200 or 204', async ({ request, }) => {
         await _8_10_1.test.step('POST /api/public/share/enable with valid token (200 or 204)', async () => {
             const response = await request.post(`${baseUrl}/api/public/share/enable`, { headers: { Authorization: optimizeBearerToken } });
@@ -606,6 +629,13 @@ _8_10_1.test.describe('API optimize SaaS Tests - Sharing', () => {
             const response = await request.post(`${baseUrl}/api/public/share/disable`, { headers: { Authorization: optimizeBearerToken } });
             (0, test_1.expect)([200, 204]).toContain(response.status());
         });
+        await _8_10_1.test.step('Re-enable sharing to restore the cluster-wide setting', async () => {
+            await (0, apiHelpers_1.setOptimizeSharing)(request, {
+                baseUrl,
+                bearerToken: optimizeBearerToken,
+                enabled: true,
+            });
+        });
     });
     (0, _8_10_1.test)('Disable sharing without token returns 401', async ({ request }) => {
         await _8_10_1.test.step('POST /api/public/share/disable without token (401)', async () => {
@@ -637,17 +667,19 @@ _8_10_1.test.describe('API optimize SaaS Tests - Sharing', () => {
 _8_10_1.test.describe('API optimize SaaS Tests - Dashboard and Report GET edge cases', () => {
     let optimizeBearerToken;
     let optimizeCookie;
+    let csrfToken;
     let collectionId;
     let baseUrl;
     _8_10_1.test.beforeAll(async ({ browser, request }) => {
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
         collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: await (0, randomName_1.randomNameAgregator)('GET Edge Cases Collection'),
             optimizeCookie,
+            csrfToken,
         });
     });
     _8_10_1.test.afterAll(async ({ request }) => {
@@ -695,6 +727,7 @@ _8_10_1.test.describe('API optimize SaaS Tests - Dashboard and Report GET edge c
 _8_10_1.test.describe('API optimize SaaS Tests - Export edge cases', () => {
     let optimizeBearerToken;
     let optimizeCookie;
+    let csrfToken;
     let collectionId;
     let dashboardId1;
     let dashboardId2;
@@ -703,26 +736,30 @@ _8_10_1.test.describe('API optimize SaaS Tests - Export edge cases', () => {
     let baseUrl;
     _8_10_1.test.beforeAll(async ({ browser, request }) => {
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
         collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Export Edge Cases Collection'),
             optimizeCookie,
+            csrfToken,
         });
         dashboardId1 = await (0, apiHelpers_1.createDashboard)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Export Dashboard 1'),
             optimizeCookie,
+            csrfToken,
             collectionId,
         });
         dashboardId2 = await (0, apiHelpers_1.createDashboard)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Export Dashboard 2'),
             optimizeCookie,
+            csrfToken,
             collectionId,
         });
         reportId1 = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId,
             name: await (0, randomName_1.randomNameAgregator)('Export Report 1'),
             definitions: [
@@ -737,6 +774,7 @@ _8_10_1.test.describe('API optimize SaaS Tests - Export edge cases', () => {
         });
         reportId2 = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId,
             name: await (0, randomName_1.randomNameAgregator)('Export Report 2'),
             definitions: [

package/dist/tests/8.10/optimize-collections-api.spec.js

@@ -7,11 +7,12 @@ const randomName_1 = require("../../utils/randomName");
 _8_10_1.test.describe.configure({ mode: 'parallel' });
 _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collections-api @8.10', () => {
     let optimizeCookie;
+    let csrfToken;
     let optimizeBearerToken;
     let baseUrl;
     _8_10_1.test.beforeAll(async ({ browser }) => {
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
@@ -21,6 +22,7 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: collectionName,
             optimizeCookie,
+            csrfToken,
         });
         await _8_10_1.test.step('GET /api/collection/{id} returns the created collection (200)', async () => {
             const response = await request.get(`${baseUrl}/api/collection/${collectionId}`, { headers: { Cookie: optimizeCookie } });
@@ -38,12 +40,14 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: originalName,
             optimizeCookie,
+            csrfToken,
         });
         const renamedName = await (0, randomName_1.randomNameAgregator)('Collection Renamed');
         await _8_10_1.test.step('PUT /api/collection/{id} updates the collection name', async () => {
             const response = await request.put(`${baseUrl}/api/collection/${collectionId}`, {
                 headers: {
                     Cookie: optimizeCookie,
+                    'X-CSRF-TOKEN': csrfToken,
                     'Content-Type': 'application/json',
                 },
                 data: { name: renamedName },
@@ -65,11 +69,13 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: collectionName,
             optimizeCookie,
+            csrfToken,
         });
         const definitionKey = 'customer_onboarding_en';
         await _8_10_1.test.step('PUT /api/collection/{id}/scope adds a process definition', async () => {
             await (0, apiHelpers_1.updateCollectionScope)(request, {
                 optimizeCookie,
+                csrfToken,
                 collectionId,
                 data: [
                     {
@@ -97,6 +103,7 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: collectionName,
             optimizeCookie,
+            csrfToken,
         });
         let deleteSucceeded = false;
         await _8_10_1.test.step('DELETE /api/public/collection/{id} is accepted (200; SaaS may respond 500)', async () => {
@@ -126,6 +133,7 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: collectionName,
             optimizeCookie,
+            csrfToken,
         });
         await _8_10_1.test.step('GET /api/collection/{id} without cookie (401)', async () => {
             const response = await request.get(`${baseUrl}/api/collection/${collectionId}`);
@@ -140,6 +148,7 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: collectionName,
             optimizeCookie,
+            csrfToken,
         });
         await _8_10_1.test.step('DELETE /api/public/collection/{id} without token (401)', async () => {
             const response = await request.delete(`${baseUrl}/api/public/collection/${collectionId}`);
@@ -154,6 +163,7 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: collectionName,
             optimizeCookie,
+            csrfToken,
         });
         await _8_10_1.test.step('DELETE /api/public/collection/{id} with invalid token (401)', async () => {
             const response = await request.delete(`${baseUrl}/api/public/collection/${collectionId}`, { headers: { Authorization: 'Bearer invalid_token' } });

package/dist/tests/8.10/optimize-exporter-filters-importer-e2e.spec.js

@@ -25,6 +25,7 @@ let originalFilters = null;
 let dataFiltersAvailable = false;
 let zeebeToken;
 let optimizeCookie;
+let csrfToken;
 let optimizeExportToken;
 let optimizeBaseUrl;
 const createdCollectionIds = [];
@@ -81,10 +82,12 @@ const getOrCreateReport = async (request, definitionKey) => {
     const collectionId = await (0, apiHelpers_1.createCollection)(request, {
         name: await (0, randomName_1.randomNameAgregator)('ExporterFilters E2E'),
         optimizeCookie,
+        csrfToken,
     });
     createdCollectionIds.push(collectionId);
     await (0, apiHelpers_1.updateCollectionScope)(request, {
         optimizeCookie,
+        csrfToken,
         collectionId,
         data: [
             {
@@ -97,6 +100,7 @@ const getOrCreateReport = async (request, definitionKey) => {
     const reportResponse = await request.post(`${optimizeBaseUrl}/api/report/process/single`, {
         headers: {
             Cookie: optimizeCookie,
+            'X-CSRF-TOKEN': csrfToken,
             'Content-Type': 'application/json',
         },
         data: {
@@ -184,7 +188,7 @@ _8_10_1.test.beforeAll(async ({ browser }) => {
         optimizeExportToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         optimizeBaseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
     }
     catch (error) {

package/dist/tests/8.10/optimize-sharing-alerts-export-api.spec.js

@@ -36,6 +36,7 @@ const createNumberReport = async (request, options) => {
     const response = await request.post(`${options.baseUrl}/api/report/process/single`, {
         headers: {
             Cookie: options.optimizeCookie,
+            'X-CSRF-TOKEN': options.csrfToken,
             'Content-Type': 'application/json',
         },
         data: {
@@ -67,6 +68,7 @@ const createRawDataReport = async (request, options) => {
     const response = await request.post(`${options.baseUrl}/api/report/process/single`, {
         headers: {
             Cookie: options.optimizeCookie,
+            'X-CSRF-TOKEN': options.csrfToken,
             'Content-Type': 'application/json',
         },
         data: {
@@ -96,6 +98,7 @@ const createRawDataReport = async (request, options) => {
 };
 _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sharing-alerts-export-api @8.10', () => {
     let optimizeCookie;
+    let csrfToken;
     let optimizeBearerToken;
     let baseUrl;
     let collectionId;
@@ -104,16 +107,18 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
     let dashboardId;
     _8_10_1.test.beforeAll(async ({ browser, request }) => {
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
         collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Sharing Alerts Collection'),
             optimizeCookie,
+            csrfToken,
         });
         await (0, apiHelpers_1.updateCollectionScope)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId,
             data: [
                 {
@@ -126,18 +131,21 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
         numberReportId = await createNumberReport(request, {
             baseUrl,
             optimizeCookie,
+            csrfToken,
             collectionId,
             name: await (0, randomName_1.randomNameAgregator)('Number Report'),
         });
         rawDataReportId = await createRawDataReport(request, {
             baseUrl,
             optimizeCookie,
+            csrfToken,
             collectionId,
             name: await (0, randomName_1.randomNameAgregator)('Raw Data Report'),
         });
         dashboardId = await (0, apiHelpers_1.createDashboard)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Sharing Dashboard'),
             optimizeCookie,
+            csrfToken,
             collectionId,
         });
     });
@@ -188,10 +196,18 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
     });
     (0, _8_10_1.test)('Enable, evaluate and delete a report share', async ({ request }) => {
         let reportShareId = '';
+        await _8_10_1.test.step('Ensure sharing is enabled cluster-wide', async () => {
+            await (0, apiHelpers_1.setOptimizeSharing)(request, {
+                baseUrl,
+                bearerToken: optimizeBearerToken,
+                enabled: true,
+            });
+        });
         await _8_10_1.test.step('POST /api/share/report enables sharing (200)', async () => {
             const response = await request.post(`${baseUrl}/api/share/report`, {
                 headers: {
                     Cookie: optimizeCookie,
+                    'X-CSRF-TOKEN': csrfToken,
                     'Content-Type': 'application/json',
                 },
                 data: { reportId: numberReportId },
@@ -210,7 +226,7 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
             (0, test_1.expect)([200, 201]).toContain(response.status());
         });
         await _8_10_1.test.step('DELETE /api/share/report/{shareId} removes the share', async () => {
-            const response = await request.delete(`${baseUrl}/api/share/report/${reportShareId}`, { headers: { Cookie: optimizeCookie } });
+            const response = await request.delete(`${baseUrl}/api/share/report/${reportShareId}`, { headers: { Cookie: optimizeCookie, 'X-CSRF-TOKEN': csrfToken } });
             (0, test_1.expect)([200, 204]).toContain(response.status());
         });
     });
@@ -225,10 +241,18 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
     });
     (0, _8_10_1.test)('Enable and delete a dashboard share', async ({ request }) => {
         let dashboardShareId = '';
+        await _8_10_1.test.step('Ensure sharing is enabled cluster-wide', async () => {
+            await (0, apiHelpers_1.setOptimizeSharing)(request, {
+                baseUrl,
+                bearerToken: optimizeBearerToken,
+                enabled: true,
+            });
+        });
         await _8_10_1.test.step('POST /api/share/dashboard enables sharing (200)', async () => {
             const response = await request.post(`${baseUrl}/api/share/dashboard`, {
                 headers: {
                     Cookie: optimizeCookie,
+                    'X-CSRF-TOKEN': csrfToken,
                     'Content-Type': 'application/json',
                 },
                 data: { dashboardId },
@@ -240,7 +264,7 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
             (0, test_1.expect)(dashboardShareId.length).toBeGreaterThan(0);
         });
         await _8_10_1.test.step('DELETE /api/share/dashboard/{shareId} removes the share', async () => {
-            const response = await request.delete(`${baseUrl}/api/share/dashboard/${dashboardShareId}`, { headers: { Cookie: optimizeCookie } });
+            const response = await request.delete(`${baseUrl}/api/share/dashboard/${dashboardShareId}`, { headers: { Cookie: optimizeCookie, 'X-CSRF-TOKEN': csrfToken } });
             (0, test_1.expect)([200, 204]).toContain(response.status());
         });
     });
@@ -251,6 +275,7 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
             const response = await request.post(`${baseUrl}/api/alert`, {
                 headers: {
                     Cookie: optimizeCookie,
+                    'X-CSRF-TOKEN': csrfToken,
                     'Content-Type': 'application/json',
                 },
                 data: {
@@ -281,7 +306,7 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
         });
         await _8_10_1.test.step('DELETE /api/alert/{id} removes the alert', async () => {
             const response = await request.delete(`${baseUrl}/api/alert/${alertId}`, {
-                headers: { Cookie: optimizeCookie },
+                headers: { Cookie: optimizeCookie, 'X-CSRF-TOKEN': csrfToken },
             });
             (0, test_1.expect)([200, 204]).toContain(response.status());
         });

package/dist/tests/8.10/optimize-sharing-alerts-export-ui.spec.js

@@ -14,6 +14,7 @@ _8_10_1.test.describe.configure({ mode: 'parallel' });
 _8_10_1.test.describe('Optimize Sharing & Export UI Tests @optimize-sharing-alerts-export-ui @8.10', () => {
     let baseUrl;
     let optimizeCookie;
+    let csrfToken;
     let optimizeBearerToken;
     let collectionId;
     let reportId;
@@ -22,15 +23,17 @@ _8_10_1.test.describe('Optimize Sharing & Export UI Tests @optimize-sharing-aler
     _8_10_1.test.beforeAll(async ({ browser, request }) => {
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
         const seedPage = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(seedPage);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(seedPage));
         await seedPage.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Sharing UI Collection'),
             optimizeCookie,
+            csrfToken,
         });
         await (0, apiHelpers_1.updateCollectionScope)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId,
             data: [
                 {
@@ -47,6 +50,7 @@ _8_10_1.test.describe('Optimize Sharing & Export UI Tests @optimize-sharing-aler
         const reportResponse = await (0, apiHelpers_1.retryOn500)(() => request.post(`${baseUrl}/api/report/process/single`, {
             headers: {
                 Cookie: optimizeCookie,
+                'X-CSRF-TOKEN': csrfToken,
                 'Content-Type': 'application/json',
             },
             data: {
@@ -75,6 +79,7 @@ _8_10_1.test.describe('Optimize Sharing & Export UI Tests @optimize-sharing-aler
         dashboardId = await (0, apiHelpers_1.createDashboard)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Sharing UI Dashboard'),
             optimizeCookie,
+            csrfToken,
             collectionId,
         });
         // Optimize only renders the CSV download action on raw-data reports
@@ -85,6 +90,7 @@ _8_10_1.test.describe('Optimize Sharing & Export UI Tests @optimize-sharing-aler
         const csvReportResponse = await (0, apiHelpers_1.retryOn500)(() => request.post(`${baseUrl}/api/report/process/single`, {
             headers: {
                 Cookie: optimizeCookie,
+                'X-CSRF-TOKEN': csrfToken,
                 'Content-Type': 'application/json',
             },
             data: {
@@ -111,7 +117,14 @@ _8_10_1.test.describe('Optimize Sharing & Export UI Tests @optimize-sharing-aler
         (0, test_1.expect)(csvReportResponse.status()).toBe(200);
         csvReportId = (await csvReportResponse.json()).id;
     });
-    _8_10_1.test.beforeEach(async ({ page, loginPage }, testInfo) => {
+    // The share button is rendered from ui-configuration, which the app reads once
+    // per page load, so the setting has to be right before we navigate.
+    _8_10_1.test.beforeEach(async ({ page, loginPage, request }, testInfo) => {
+        await (0, apiHelpers_1.setOptimizeSharing)(request, {
+            baseUrl,
+            bearerToken: optimizeBearerToken,
+            enabled: true,
+        });
         await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, testUser, (testInfo.workerIndex + 1) * 1000);
     });
     _8_10_1.test.afterEach(async ({ page }, testInfo) => {

package/dist/tests/SM-8.10/mt-enabled-user-flows.spec.js

@@ -19,7 +19,8 @@ if (process.env.IS_MT === 'true') {
             await (0, _setup_1.captureScreenshot)(page, testInfo);
             await (0, _setup_1.captureFailureVideo)(page, testInfo);
         });
-        (0, SM_8_10_1.test)('Main User Can Create & Access Tenant & User Without Access Cannot - User Task Flow', async ({ page, modelerHomePage, modelerCreatePage, taskPanelPage, operateProcessInstancePage, operateProcessesPage, taskDetailsPage, operateHomePage, navigationPage, ocTenantPage, optimizeHomePage, optimizeDashboardPage, browser, ocIdentityHomePage, managementIdentityTenantPage, managementIdentityPage, keycloakAdminPage, keycloakLoginPage, ocIdentityMappingRulesPage, ocIdentityRolesPage, }) => {
+        // Skipped due to bug #60836: https://github.com/camunda/camunda/issues/60836
+        SM_8_10_1.test.skip('Main User Can Create & Access Tenant & User Without Access Cannot - User Task Flow', async ({ page, modelerHomePage, modelerCreatePage, taskPanelPage, operateProcessInstancePage, operateProcessesPage, taskDetailsPage, operateHomePage, navigationPage, ocTenantPage, optimizeHomePage, optimizeDashboardPage, browser, ocIdentityHomePage, managementIdentityTenantPage, managementIdentityPage, keycloakAdminPage, keycloakLoginPage, ocIdentityMappingRulesPage, ocIdentityRolesPage, }) => {
             SM_8_10_1.test.slow();
             const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
             const processName = 'Main_User_Task_Flow_' + randomString;
@@ -127,7 +128,8 @@ if (process.env.IS_MT === 'true') {
                 }
             });
         });
-        (0, SM_8_10_1.test)('Main User Can Create & Access Tenant - Connectors Flow @tasklistV2', async ({ page, modelerHomePage, modelerCreatePage, operateProcessInstancePage, operateProcessesPage, operateHomePage, navigationPage, managementIdentityTenantPage, connectorSettingsPage, connectorMarketplacePage, optimizeHomePage, optimizeDashboardPage, ocIdentityHomePage, ocTenantPage, }) => {
+        // Skipped due to bug #60836: https://github.com/camunda/camunda/issues/60836
+        SM_8_10_1.test.skip('Main User Can Create & Access Tenant - Connectors Flow @tasklistV2', async ({ page, modelerHomePage, modelerCreatePage, operateProcessInstancePage, operateProcessesPage, operateHomePage, navigationPage, managementIdentityTenantPage, connectorSettingsPage, connectorMarketplacePage, optimizeHomePage, optimizeDashboardPage, ocIdentityHomePage, ocTenantPage, }) => {
             SM_8_10_1.test.slow();
             const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
             const processName = 'Main_User_Connectors_Flow_' + randomString;
@@ -259,7 +261,8 @@ if (process.env.IS_MT === 'true') {
                 });
             }
         });
-        (0, SM_8_10_1.test)('Second User Can Access Tenant Created By Main User - Connectors Flow @tasklistV2', async ({ page, modelerHomePage, modelerCreatePage, operateProcessInstancePage, operateProcessesPage, operateHomePage, navigationPage, managementIdentityTenantPage, connectorSettingsPage, connectorMarketplacePage, optimizeHomePage, optimizeDashboardPage, ocIdentityHomePage, ocTenantPage, managementIdentityPage, keycloakAdminPage, keycloakLoginPage, ocIdentityRolesPage, ocIdentityMappingRulesPage, browser, }) => {
+        // Skipped due to bug #60836: https://github.com/camunda/camunda/issues/60836
+        SM_8_10_1.test.skip('Second User Can Access Tenant Created By Main User - Connectors Flow @tasklistV2', async ({ page, modelerHomePage, modelerCreatePage, operateProcessInstancePage, operateProcessesPage, operateHomePage, navigationPage, managementIdentityTenantPage, connectorSettingsPage, connectorMarketplacePage, optimizeHomePage, optimizeDashboardPage, ocIdentityHomePage, ocTenantPage, managementIdentityPage, keycloakAdminPage, keycloakLoginPage, ocIdentityRolesPage, ocIdentityMappingRulesPage, browser, }) => {
             SM_8_10_1.test.slow();
             const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
             const processName = 'Second_User_Connectors_Flow_' + randomString;
@@ -330,7 +333,8 @@ if (process.env.IS_MT === 'true') {
                 });
             }
         });
-        (0, SM_8_10_1.test)('Default Tenant Is Available And Used When Tenant Not Set In Deployment', async ({ page, modelerHomePage, modelerCreatePage, taskPanelPage, operateProcessInstancePage, operateProcessesPage, taskDetailsPage, operateHomePage, navigationPage, managementIdentityTenantPage, optimizeHomePage, optimizeDashboardPage, ocIdentityHomePage, ocTenantPage, }) => {
+        // Skipped due to bug #60836: https://github.com/camunda/camunda/issues/60836
+        SM_8_10_1.test.skip('Default Tenant Is Available And Used When Tenant Not Set In Deployment', async ({ page, modelerHomePage, modelerCreatePage, taskPanelPage, operateProcessInstancePage, operateProcessesPage, taskDetailsPage, operateHomePage, navigationPage, managementIdentityTenantPage, optimizeHomePage, optimizeDashboardPage, ocIdentityHomePage, ocTenantPage, }) => {
             SM_8_10_1.test.slow();
             const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
             const processName = 'Default_Tenant_Flow_' + randomString;
@@ -466,7 +470,8 @@ if (process.env.IS_MT === 'true') {
                 await operateProcessInstancePage.tenantNameAssertion(tenantName2);
             });
         });
-        (0, SM_8_10_1.test)('Revoking Tenant Access User Flow', async ({ page, modelerHomePage, modelerCreatePage, taskPanelPage, operateProcessInstancePage, operateProcessesPage, taskDetailsPage, operateHomePage, navigationPage, managementIdentityTenantPage, optimizeHomePage, optimizeDashboardPage, ocIdentityHomePage, ocTenantPage, }) => {
+        // Skipped due to bug #60836: https://github.com/camunda/camunda/issues/60836
+        SM_8_10_1.test.skip('Revoking Tenant Access User Flow', async ({ page, modelerHomePage, modelerCreatePage, taskPanelPage, operateProcessInstancePage, operateProcessesPage, taskDetailsPage, operateHomePage, navigationPage, managementIdentityTenantPage, optimizeHomePage, optimizeDashboardPage, ocIdentityHomePage, ocTenantPage, }) => {
             SM_8_10_1.test.slow();
             const randomString = await (0, _setup_1.generateRandomStringAsync)(3);
             const processName1 = 'Revoke_Tenant_Flow_1' + randomString;

package/dist/utils/apiHelpers.d.ts

@@ -35,26 +35,39 @@ interface ReportDefinition {
 }
 interface CreateSingleProcessReportOptions {
     optimizeCookie: string;
+    csrfToken?: string;
     collectionId: string;
     name: string;
     description?: string | null;
     definitions?: ReportDefinition[];
     configuration?: Record<string, unknown>;
 }
+export declare function loginToOptimizeSession(page: Page): Promise<{
+    optimizeCookie: string;
+    csrfToken: string;
+}>;
 export declare function getOptimizeCoockie(page: Page): Promise<string>;
 export declare function getOptimizeCookieSm(page: Page): Promise<string>;
 export declare function createCollection(request: APIRequestContext, options: {
     name: string;
     optimizeCookie: string;
+    csrfToken?: string;
 }): Promise<string>;
 export declare function createDashboard(request: APIRequestContext, options: {
     name: string;
     optimizeCookie: string;
+    csrfToken?: string;
     collectionId?: string;
 }): Promise<any>;
+export declare function setOptimizeSharing(request: APIRequestContext, options: {
+    baseUrl: string;
+    bearerToken: string;
+    enabled: boolean;
+}): Promise<void>;
 export declare function createSingleProcessReport(request: APIRequestContext, options: CreateSingleProcessReportOptions): Promise<any>;
 export declare function updateCollectionScope(request: APIRequestContext, options: {
     optimizeCookie: string;
+    csrfToken?: string;
     collectionId: string;
     data: Array<{
         definitionKey: string;

package/dist/utils/apiHelpers.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.updateClusterDataFilters = exports.getClusterDataFilters = exports.getTestClusterUuid = exports.authConsoleManagementAPI = exports.updateCollectionScope = exports.createSingleProcessReport = exports.createDashboard = exports.createCollection = exports.getOptimizeCookieSm = exports.getOptimizeCoockie = exports.createStringClusterVariable = exports.createJsonClusterVariable = exports.waitForProcessInstanceVisible = exports.createProcessInstance = exports.deployProcess = exports.waitForOrchestrationClusterReady = exports.waitForInboundWebhookRegistered = exports.waitForConnectorsReady = exports.validateMcpServerHealth = exports.authC8runAPI = exports.authSmAPI = exports.authSaasAPI = exports.authAPI = exports.buildZeebeApiUrl = exports.retryOn500 = exports.sendRequestAndAssertResponse = exports.assertUnauthorizedResponseBody = exports.expectUnauthorizedErrorBody = exports.assertResponseStatus = exports.getApiRequestContext = void 0;
+exports.updateClusterDataFilters = exports.getClusterDataFilters = exports.getTestClusterUuid = exports.authConsoleManagementAPI = exports.updateCollectionScope = exports.createSingleProcessReport = exports.setOptimizeSharing = exports.createDashboard = exports.createCollection = exports.getOptimizeCookieSm = exports.getOptimizeCoockie = exports.loginToOptimizeSession = exports.createStringClusterVariable = exports.createJsonClusterVariable = exports.waitForProcessInstanceVisible = exports.createProcessInstance = exports.deployProcess = exports.waitForOrchestrationClusterReady = exports.waitForInboundWebhookRegistered = exports.waitForConnectorsReady = exports.validateMcpServerHealth = exports.authC8runAPI = exports.authSmAPI = exports.authSaasAPI = exports.authAPI = exports.buildZeebeApiUrl = exports.retryOn500 = exports.sendRequestAndAssertResponse = exports.assertUnauthorizedResponseBody = exports.expectUnauthorizedErrorBody = exports.assertResponseStatus = exports.getApiRequestContext = void 0;
 const test_1 = require("@playwright/test");
 const sleep_1 = require("./sleep");
 const randomSleep_1 = require("./randomSleep");
@@ -666,7 +666,50 @@ async function createStringClusterVariable(authToken, environment = 'saas', cust
     await createClusterVariableInternal(authToken ?? '', environment, variableName, variableValue, 'String', clusterType);
 }
 exports.createStringClusterVariable = createStringClusterVariable;
-async function getOptimizeCoockie(page) {
+// CSL (8.10+) protects writes with a CSRF token in addition to the session
+// cookie (see optimize/client/src/modules/csrf.ts); the legacy security stack
+// used by getOptimizeCoockie/getOptimizeCookieSm (8.8/8.9/SM) never issues
+// one, so it stays undefined there and this header is simply omitted.
+function optimizeCookieHeaders(options) {
+    const headers = { Cookie: options.optimizeCookie };
+    if (options.csrfToken)
+        headers['X-CSRF-TOKEN'] = options.csrfToken;
+    return headers;
+}
+const OPTIMIZE_SESSION_UNAUTHENTICATED = 'OPTIMIZE_SESSION_UNAUTHENTICATED';
+// Verifying the session is part of logging in, not a wait that can be retried
+// afterwards: on SaaS the OIDC callback (GET /{clusterId}/sso-callback) answers
+// 401 for a share of concurrent logins, and because that 401 page is still
+// served from the Optimize base URL, loginToApp's
+// waitForURL(url.startsWith(appName), {waitUntil: 'commit'}) resolves on it and
+// reports success. The session then stays unauthenticated for good -- no amount
+// of polling recovers it, only a fresh login does. So probe an endpoint that is
+// on the CSL API chain and let performOptimizeInteractiveLogin's retry loop
+// start over when it comes back unauthenticated.
+//
+// The probe doubles as the CSRF-token source: CSL's CSRF setup is a
+// double-submit cookie (Spring's CookieCsrfTokenRepository), so the first
+// authenticated GET is what issues the X-CSRF-TOKEN cookie, echoing the token
+// as an x-csrf-token response header. Returns that token when authenticated,
+// null when not.
+async function probeOptimizeSession(page) {
+    const optimizeUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
+    const response = await page
+        .context()
+        .request.get(`${optimizeUrl}/api/identity/current/user`);
+    // Require both a successful response AND a token, mirroring the product's
+    // own rule for when to trust the header (optimize/client/src/modules/csrf.ts
+    // storeCsrfToken): a non-2xx (a transient 5xx, or a 401/403 from a stale
+    // session) or a 2xx with no token yet must be treated as unauthenticated,
+    // not as "authenticated with an empty token" -- the latter would exit the
+    // login retry loop with a cookie that then fails every write.
+    const token = response.headers()['x-csrf-token'];
+    if (!response.ok() || !token) {
+        return null;
+    }
+    return token;
+}
+async function performOptimizeInteractiveLogin(page, callerLabel, verifySession) {
     const optimizeUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
     const maxLoginAttempts = 4;
     // This hook runs once per worker that picks up any test from an Optimize
@@ -675,7 +718,13 @@ async function getOptimizeCoockie(page) {
     // spread that burst -- it is enough on its own to trip Auth0's tenant-wide
     // rate limit, which then fails every worker at once. Retries back off via
     // randomSleep below, so this only needs to run once.
-    await (0, randomSleep_1.randomSleep)(0, 15000);
+    //
+    // The window has to be wider than a rejection burst, not just wider than the
+    // instant the workers start: 8.10 has eight Optimize describes each doing one
+    // interactive login, and the sso-callback rejections below come in bursts
+    // lasting tens of seconds, so a 15s spread put every login inside the same
+    // burst and the losers then spent their whole attempt budget in it.
+    await (0, randomSleep_1.randomSleep)(0, 60000);
     // Auth0 can fail or rate-limit concurrent logins. Retry the whole flow if
     // loginToApp throws (e.g. waitForURL times out after a bad Auth0 redirect).
     for (let loginAttempt = 0; loginAttempt < maxLoginAttempts; loginAttempt++) {
@@ -683,12 +732,16 @@ async function getOptimizeCoockie(page) {
             await page.goto('about:blank');
             await page.context().clearCookies();
             await (0, utils_1.loginToApp)(optimizeUrl, page);
-            break;
+            if (verifySession && !(await verifySession(page))) {
+                throw new Error(OPTIMIZE_SESSION_UNAUTHENTICATED);
+            }
+            return;
         }
         catch (error) {
             if (loginAttempt < maxLoginAttempts - 1) {
                 const rateLimited = String(error).includes(utils_1.AUTH0_RATE_LIMIT);
-                console.warn(`getOptimizeCoockie: login attempt ${loginAttempt + 1} failed, retrying after backoff...`, error);
+                const unauthenticated = String(error).includes(OPTIMIZE_SESSION_UNAUTHENTICATED);
+                console.warn(`${callerLabel}: login attempt ${loginAttempt + 1} failed, retrying after backoff...`, error);
                 await page.goto('about:blank');
                 if (rateLimited) {
                     // Auth0 rate-limit windows commonly last 30-90s. Back off long
@@ -696,6 +749,19 @@ async function getOptimizeCoockie(page) {
                     // the same window and burns the attempt budget for nothing.
                     await (0, randomSleep_1.randomSleep)(60000, 90000);
                 }
+                else if (unauthenticated) {
+                    // The rejected callbacks come in bursts lasting tens of seconds
+                    // (every login inside the burst window fails, isolated ones all
+                    // succeed), so back off past the burst rather than retrying inside
+                    // it. Widen the band on each attempt instead of re-drawing from a
+                    // fixed one: every worker caught by the same burst backs off from
+                    // the same distribution at the same moment, so a fixed band keeps
+                    // the herd synchronised and they re-collide on the next attempt.
+                    // Growing the ceiling fans them out while the floor still lets a
+                    // lucky worker recover quickly. Worst case stays well inside the
+                    // 12-minute hook timeout.
+                    await (0, randomSleep_1.randomSleep)(20000, 45000 + loginAttempt * 45000);
+                }
                 else {
                     await (0, randomSleep_1.randomSleep)(10000, 20000);
                 }
@@ -705,6 +771,38 @@ async function getOptimizeCoockie(page) {
             }
         }
     }
+}
+// 8.10+ (CSL) replaces the legacy X-Optimize-* cookies below with its own
+// stateful OIDC webapp session (ADR-0038:
+// https://github.com/camunda/camunda-security-library/blob/main/docs/adr/0038-optimize-reuses-stateful-oidc-webapp-chain.md).
+// The session cookie is just as portable as the legacy one -- extract it as a
+// plain string (and the accompanying CSRF token) and the caller can close the
+// page immediately, exactly like getOptimizeCoockie below.
+async function loginToOptimizeSession(page) {
+    // A write is only valid if the X-CSRF-TOKEN cookie AND a matching header are
+    // both present, and it is the probe inside the login that issues that cookie
+    // -- so the probe has to run before cookies() is read here, which it does.
+    let csrfToken = '';
+    await performOptimizeInteractiveLogin(page, 'loginToOptimizeSession', async (loggedInPage) => {
+        const token = await probeOptimizeSession(loggedInPage);
+        if (token === null) {
+            return false;
+        }
+        csrfToken = token;
+        return true;
+    });
+    // Scoped to optimizeUrl: an unscoped cookies() call returns the whole
+    // browser context jar, including cookies set on the Auth0/Console origins
+    // visited during the interactive login, which would otherwise get flattened
+    // into a Cookie header Optimize never asked for.
+    const optimizeCookie = (await page.context().cookies(process.env.CAMUNDA_OPTIMIZE_BASE_URL))
+        .map((cookie) => `${cookie.name}=${cookie.value}`)
+        .join('; ');
+    return { optimizeCookie, csrfToken };
+}
+exports.loginToOptimizeSession = loginToOptimizeSession;
+async function getOptimizeCoockie(page) {
+    await performOptimizeInteractiveLogin(page, 'getOptimizeCoockie');
     const context = page.context();
     // Optimize sets its session cookies asynchronously after the Auth0 redirect.
     // Poll storage state until both cookies are present (up to ~30 s).
@@ -782,9 +880,7 @@ exports.getOptimizeCookieSm = getOptimizeCookieSm;
 async function createCollection(request, options) {
     return retryOnTransientApiError(async () => {
         const optimizeResponse = await request.post(`${process.env.CAMUNDA_OPTIMIZE_BASE_URL}/api/collection`, {
-            headers: {
-                Cookie: options.optimizeCookie,
-            },
+            headers: optimizeCookieHeaders(options),
             data: {
                 name: options.name,
             },
@@ -798,9 +894,7 @@ exports.createCollection = createCollection;
 async function createDashboard(request, options) {
     return retryOnTransientApiError(async () => {
         const optimizeResponse = await request.post(`${process.env.CAMUNDA_OPTIMIZE_BASE_URL}/api/dashboard`, {
-            headers: {
-                Cookie: options.optimizeCookie,
-            },
+            headers: optimizeCookieHeaders(options),
             data: {
                 collectionId: options.collectionId,
                 name: options.name,
@@ -819,6 +913,23 @@ async function createDashboard(request, options) {
     }, 'createDashboard');
 }
 exports.createDashboard = createDashboard;
+// Sharing is a cluster-global Optimize setting, not a per-entity one: with it
+// off, POST /api/share/{report,dashboard} answers 500 (SharingNotAllowedException
+// has no exception mapper) and the UI renders the share button disabled. Specs
+// that toggle it therefore have to restore it, and specs that depend on it have
+// to assert the precondition themselves -- otherwise they see each other's
+// writes when they run concurrently.
+async function setOptimizeSharing(request, options) {
+    const action = options.enabled ? 'enable' : 'disable';
+    return retryOnTransientApiError(async () => {
+        const response = await request.post(`${options.baseUrl}/api/public/share/${action}`, { headers: { Authorization: options.bearerToken } });
+        if (![200, 204].includes(response.status())) {
+            throw new Error(`Expected 200 or 204 from /api/public/share/${action}, Received: ` +
+                `${response.status()} ${await response.text()}`);
+        }
+    }, `setOptimizeSharing(${action})`);
+}
+exports.setOptimizeSharing = setOptimizeSharing;
 async function createSingleProcessReport(request, options) {
     // Default configuration (can be overridden)
     const defaultConfiguration = {
@@ -880,7 +991,7 @@ async function createSingleProcessReport(request, options) {
     return retryOnTransientApiError(async () => {
         const response = await request.post(`${process.env.CAMUNDA_OPTIMIZE_BASE_URL}/api/report/process/single`, {
             headers: {
-                Cookie: options.optimizeCookie,
+                ...optimizeCookieHeaders(options),
                 'Content-Type': 'application/json',
             },
             data: payload,
@@ -899,7 +1010,7 @@ async function updateCollectionScope(request, options) {
     return retryOnTransientApiError(async () => {
         const response = await request.put(url, {
             headers: {
-                Cookie: options.optimizeCookie,
+                ...optimizeCookieHeaders(options),
                 'Content-Type': 'application/json',
             },
             data: options.data,

package/dist/utils/gatewayErrors.d.ts

@@ -0,0 +1,3 @@
+import { Page } from '@playwright/test';
+export declare function isGatewayErrorPage(page: Page): Promise<boolean>;
+export declare function reloadPastGatewayError(page: Page, deadline: number): Promise<void>;

package/dist/utils/gatewayErrors.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reloadPastGatewayError = exports.isGatewayErrorPage = void 0;
+const constants_1 = require("./constants");
+const GATEWAY_ERROR_HEADING = /50[234]\s+(Bad Gateway|Service Temporarily Unavailable|Gateway Time-?out)/i;
+async function isGatewayErrorPage(page) {
+    return page
+        .getByRole('heading', { name: GATEWAY_ERROR_HEADING })
+        .first()
+        .isVisible()
+        .catch(() => false);
+}
+exports.isGatewayErrorPage = isGatewayErrorPage;
+// While a component's pod restarts, its ingress answers with an nginx 50x page
+// that carries none of the app. A 5xx does not reject `page.reload`, so a retry
+// loop that reloads after every failed attempt keeps re-rendering that error
+// page and spends its whole attempt budget in seconds, long before the
+// component is back. Reload until the component answers again, bounded by
+// `deadline` so a sustained outage still fails the caller.
+async function reloadPastGatewayError(page, deadline) {
+    for (let attempt = 1;; attempt++) {
+        const response = await page.reload({ waitUntil: 'domcontentloaded' });
+        const status = response?.status();
+        const unavailable = (status !== undefined && status >= 500) ||
+            (await isGatewayErrorPage(page));
+        if (!unavailable || Date.now() >= deadline) {
+            return;
+        }
+        console.warn(`reloadPastGatewayError: ${page.url()} answered ${status} — waiting for the component to come back (attempt ${attempt})`);
+        await page.waitForTimeout(Math.min(constants_1._1_SECOND_IN_MS * 5 * attempt, deadline - Date.now()));
+    }
+}
+exports.reloadPastGatewayError = reloadPastGatewayError;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/e2e-test-suite",
-  "version": "0.0.982",
+  "version": "0.0.984",
   "description": "End-to-end test helpers for Camunda 8",
   "repository": {
     "type": "git",