@camunda/e2e-test-suite 0.0.983 → 0.0.985

package/dist/pages/8.7/ModelerCreatePage.js

@@ -589,8 +589,42 @@ class ModelerCreatePage {
     async fillNamedInput(name) {
         await this.nameInput.fill(name, { timeout: 60000 });
     }
+    // The breadcrumb is clicked one second after the just-uploaded diagram is
+    // opened, while the hub is still importing the BPMN - the canvas shows a
+    // spinner and the properties panel is empty. Clicking into that still-loading
+    // editor either hangs Playwright's actionability/scroll step for the whole
+    // timeout (seen locally) or lands without opening the dropdown, so the
+    // follow-up "Rename" lookup times out instead (seen in the nightly). Wait for
+    // the properties panel to finish mounting, then retry until the dropdown is
+    // really open.
     async clickDiagramBreadcrumb() {
-        await this.diagramBreadcrumb.click({ timeout: 30000 });
+        await (0, test_1.expect)(this.generalPanel).toBeVisible({ timeout: 120000 });
+        const maxAttempts = 3;
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            // A second click would toggle an already-open dropdown shut, so never
+            // re-click when the previous attempt did open it.
+            const isOpen = await this.renameDiagramNameButton
+                .isVisible()
+                .catch(() => false);
+            if (isOpen) {
+                return;
+            }
+            try {
+                await this.diagramBreadcrumb.click({ timeout: 20000 });
+                await this.renameDiagramNameButton.waitFor({
+                    state: 'visible',
+                    timeout: 20000,
+                });
+                return;
+            }
+            catch (error) {
+                if (attempt === maxAttempts) {
+                    throw error;
+                }
+                console.warn(`Diagram breadcrumb dropdown did not open ` +
+                    `(attempt ${attempt}/${maxAttempts}). Retrying.`);
+            }
+        }
     }
     async clickEditDiagramNameButton() {
         await this.renameDiagramNameButton.click({ timeout: 60000 });

package/dist/pages/8.7/ModelerHomePage.d.ts

@@ -26,6 +26,8 @@ declare class ModelerHomePage {
     readonly messageBanner: Locator;
     readonly closeButton: Locator;
     readonly formNameBreadcrumb: (formName: string) => Locator;
+    readonly formBreadcrumbButton: Locator;
+    readonly renameFormMenuItem: Locator;
     constructor(page: Page);
     dismissOverlays(): Promise<void>;
     clickCreateNewProjectButton(): Promise<void>;
@@ -43,6 +45,7 @@ declare class ModelerHomePage {
     clickIdpApplicationTemplateOption(): Promise<void>;
     clickFormOption(): Promise<void>;
     enterFormName(name: string): Promise<void>;
+    openFormRenameEditor(): Promise<void>;
     clickProjectBreadcrumb(): Promise<void>;
     clickHomeBreadcrumb(): Promise<void>;
     clickOpenOrganizationsButton(): Promise<void>;

package/dist/pages/8.7/ModelerHomePage.js

@@ -31,6 +31,8 @@ class ModelerHomePage {
     messageBanner;
     closeButton;
     formNameBreadcrumb;
+    formBreadcrumbButton;
+    renameFormMenuItem;
     constructor(page) {
         this.page = page;
         this.modelerPageBanner = page.getByRole('banner', {
@@ -77,6 +79,8 @@ class ModelerHomePage {
         this.formNameBreadcrumb = (formName) => page.locator('button[data-test="breadcrumb-form"]', {
             hasText: formName,
         });
+        this.formBreadcrumbButton = page.locator('button[data-test="breadcrumb-form"]');
+        this.renameFormMenuItem = page.locator('[data-test="rename-form"]');
     }
     async dismissOverlays() {
         for (const locator of [
@@ -177,10 +181,46 @@ class ModelerHomePage {
     async clickFormOption() {
         await this.formTemplateOption.click();
     }
+    // Right after a form is created the hub renders its breadcrumb name in
+    // inline-edit mode, but once the form store finishes loading it re-renders
+    // the breadcrumb as a plain dropdown button and the inline input is gone for
+    // good - Playwright then reports "element was detached from the DOM,
+    // retrying" until the click times out. The editor is re-openable through the
+    // breadcrumb's own Rename item (camunda-hub
+    // frontend/apps/hub/src/app/pages/form/Header.tsx), so fall back to that
+    // whenever the inline input is not there, and confirm the name landed.
     async enterFormName(name) {
-        await this.formNameInput.click({ timeout: 60000 });
-        await this.formNameInput.fill(name);
-        await this.formNameInput.press('Enter');
+        const maxAttempts = 3;
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+                const editorOpen = await this.formNameInput
+                    .waitFor({ state: 'visible', timeout: 15000 })
+                    .then(() => true)
+                    .catch(() => false);
+                if (!editorOpen) {
+                    await this.openFormRenameEditor();
+                }
+                await this.formNameInput.click({ timeout: 30000 });
+                await this.formNameInput.fill(name);
+                await this.formNameInput.press('Enter');
+                await this.formNameBreadcrumb(name).waitFor({
+                    state: 'visible',
+                    timeout: 30000,
+                });
+                return;
+            }
+            catch (error) {
+                if (attempt === maxAttempts) {
+                    throw error;
+                }
+                console.warn(`Form rename to "${name}" did not commit ` +
+                    `(attempt ${attempt}/${maxAttempts}). Retrying.`);
+            }
+        }
+    }
+    async openFormRenameEditor() {
+        await this.formBreadcrumbButton.click({ timeout: 60000 });
+        await this.renameFormMenuItem.click({ timeout: 30000 });
     }
     async clickProjectBreadcrumb() {
         await this.projectBreadcrumb.click({ timeout: 60000 });

package/dist/tests/8.10/optimize-api-tests.spec.js

@@ -33,6 +33,7 @@ const assertUnauthorizedResponseBody = async (response) => {
 };
 _8_10_1.test.describe('API optimize SaaS Tests', () => {
     let optimizeCookie;
+    let csrfToken;
     let optimizeBearerToken;
     let collectionIdValue;
     let dashboardIdValue;
@@ -41,16 +42,18 @@ _8_10_1.test.describe('API optimize SaaS Tests', () => {
     let baseUrl;
     _8_10_1.test.beforeAll(async ({ browser, request }) => {
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         collectionIdValue = await (0, apiHelpers_1.createCollection)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Test Collection'),
             optimizeCookie,
+            csrfToken,
         });
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
         await (0, apiHelpers_1.updateCollectionScope)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: collectionIdValue,
             data: [
                 {
@@ -64,10 +67,12 @@ _8_10_1.test.describe('API optimize SaaS Tests', () => {
         dashboardIdValue = await (0, apiHelpers_1.createDashboard)(request, {
             name: dashboardNameValue,
             optimizeCookie,
+            csrfToken,
             collectionId: collectionIdValue,
         });
         reportId = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: collectionIdValue,
             name: 'Blank report',
             definitions: [
@@ -189,6 +194,7 @@ _8_10_1.test.describe('API optimize SaaS Tests', () => {
         const dashboardToDeleteId = await (0, apiHelpers_1.createDashboard)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Dashboard To Delete'),
             optimizeCookie,
+            csrfToken,
             collectionId: collectionIdValue,
         });
         await _8_10_1.test.step('Delete dashboard successfully (200)', async () => {
@@ -284,6 +290,7 @@ _8_10_1.test.describe('API optimize SaaS Tests', () => {
     (0, _8_10_1.test)('Delete report and verify it is no longer retrievable', async ({ request, }) => {
         const reportToDeleteId = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: collectionIdValue,
             name: await (0, randomName_1.randomNameAgregator)('Report To Delete'),
             definitions: [
@@ -375,6 +382,7 @@ _8_10_1.test.describe('API optimize SaaS Tests', () => {
 });
 _8_10_1.test.describe('API optimize SaaS Tests - Conditional Events', () => {
     let optimizeCookie;
+    let csrfToken;
     let optimizeBearerToken;
     let conditionalEventsCollectionId;
     let conditionalEventsReportId;
@@ -383,15 +391,17 @@ _8_10_1.test.describe('API optimize SaaS Tests - Conditional Events', () => {
     const CONDITIONAL_EVENTS_PROCESS_KEY = 'conditional-events-auto-process';
     _8_10_1.test.beforeAll(async ({ browser, request }) => {
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         conditionalEventsCollectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Conditional Events Collection'),
             optimizeCookie,
+            csrfToken,
         });
         await (0, apiHelpers_1.updateCollectionScope)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: conditionalEventsCollectionId,
             data: [
                 {
@@ -404,6 +414,7 @@ _8_10_1.test.describe('API optimize SaaS Tests - Conditional Events', () => {
         conditionalEventsReportName = await (0, randomName_1.randomNameAgregator)('Conditional Events Report');
         conditionalEventsReportId = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: conditionalEventsCollectionId,
             name: conditionalEventsReportName,
             definitions: [
@@ -428,6 +439,7 @@ _8_10_1.test.describe('API optimize SaaS Tests - Conditional Events', () => {
             const response = await request.post(`${baseUrl}/api/report/process/single`, {
                 headers: {
                     Cookie: optimizeCookie,
+                    'X-CSRF-TOKEN': csrfToken,
                     'Content-Type': 'application/json',
                 },
                 data: {
@@ -507,6 +519,7 @@ _8_10_1.test.describe('API optimize SaaS Tests - Conditional Events', () => {
     (0, _8_10_1.test)('CE-OPT-13: Deleting the Conditional Events report via API succeeds with HTTP 200', async ({ request, }) => {
         const reportToDeleteId = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: conditionalEventsCollectionId,
             name: await (0, randomName_1.randomNameAgregator)('CE Report To Delete'),
             definitions: [
@@ -527,6 +540,7 @@ _8_10_1.test.describe('API optimize SaaS Tests - Conditional Events', () => {
     (0, _8_10_1.test)('CE-OPT-14: A deleted Conditional Events report is no longer retrievable via the API', async ({ request, }) => {
         const reportToDeleteId = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId: conditionalEventsCollectionId,
             name: await (0, randomName_1.randomNameAgregator)('CE Report Delete Verify'),
             definitions: [
@@ -566,13 +580,13 @@ _8_10_1.test.describe('API optimize SaaS Tests - Health Readiness', () => {
             (0, test_1.expect)(response.status()).toBe(200);
         });
     });
-    (0, _8_10_1.test)('Health readiness rejects requests that include an Authorization header', async ({ request, }) => {
-        await _8_10_1.test.step('GET /api/readyz with Authorization header should be rejected', async () => {
+    (0, _8_10_1.test)('Health readiness returns 200 when request includes an Authorization header', async ({ request, }) => {
+        await _8_10_1.test.step('GET /api/readyz with Authorization header still returns 200', async () => {
             const token = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
             const response = await request.get(`${baseUrl}/api/readyz`, {
                 headers: { Authorization: token },
             });
-            (0, test_1.expect)([400, 401, 403]).toContain(response.status());
+            (0, test_1.expect)(response.status()).toBe(200);
         });
     });
 });
@@ -583,6 +597,15 @@ _8_10_1.test.describe('API optimize SaaS Tests - Sharing', () => {
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
     });
+    // Sharing is cluster-global, so leaving it off would break every
+    // concurrently running spec that shares a report or dashboard.
+    _8_10_1.test.afterAll(async ({ request }) => {
+        await (0, apiHelpers_1.setOptimizeSharing)(request, {
+            baseUrl,
+            bearerToken: optimizeBearerToken,
+            enabled: true,
+        });
+    });
     (0, _8_10_1.test)('Enable sharing with valid token returns 200 or 204', async ({ request, }) => {
         await _8_10_1.test.step('POST /api/public/share/enable with valid token (200 or 204)', async () => {
             const response = await request.post(`${baseUrl}/api/public/share/enable`, { headers: { Authorization: optimizeBearerToken } });
@@ -606,6 +629,13 @@ _8_10_1.test.describe('API optimize SaaS Tests - Sharing', () => {
             const response = await request.post(`${baseUrl}/api/public/share/disable`, { headers: { Authorization: optimizeBearerToken } });
             (0, test_1.expect)([200, 204]).toContain(response.status());
         });
+        await _8_10_1.test.step('Re-enable sharing to restore the cluster-wide setting', async () => {
+            await (0, apiHelpers_1.setOptimizeSharing)(request, {
+                baseUrl,
+                bearerToken: optimizeBearerToken,
+                enabled: true,
+            });
+        });
     });
     (0, _8_10_1.test)('Disable sharing without token returns 401', async ({ request }) => {
         await _8_10_1.test.step('POST /api/public/share/disable without token (401)', async () => {
@@ -637,17 +667,19 @@ _8_10_1.test.describe('API optimize SaaS Tests - Sharing', () => {
 _8_10_1.test.describe('API optimize SaaS Tests - Dashboard and Report GET edge cases', () => {
     let optimizeBearerToken;
     let optimizeCookie;
+    let csrfToken;
     let collectionId;
     let baseUrl;
     _8_10_1.test.beforeAll(async ({ browser, request }) => {
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
         collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: await (0, randomName_1.randomNameAgregator)('GET Edge Cases Collection'),
             optimizeCookie,
+            csrfToken,
         });
     });
     _8_10_1.test.afterAll(async ({ request }) => {
@@ -695,6 +727,7 @@ _8_10_1.test.describe('API optimize SaaS Tests - Dashboard and Report GET edge c
 _8_10_1.test.describe('API optimize SaaS Tests - Export edge cases', () => {
     let optimizeBearerToken;
     let optimizeCookie;
+    let csrfToken;
     let collectionId;
     let dashboardId1;
     let dashboardId2;
@@ -703,26 +736,30 @@ _8_10_1.test.describe('API optimize SaaS Tests - Export edge cases', () => {
     let baseUrl;
     _8_10_1.test.beforeAll(async ({ browser, request }) => {
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
         collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Export Edge Cases Collection'),
             optimizeCookie,
+            csrfToken,
         });
         dashboardId1 = await (0, apiHelpers_1.createDashboard)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Export Dashboard 1'),
             optimizeCookie,
+            csrfToken,
             collectionId,
         });
         dashboardId2 = await (0, apiHelpers_1.createDashboard)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Export Dashboard 2'),
             optimizeCookie,
+            csrfToken,
             collectionId,
         });
         reportId1 = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId,
             name: await (0, randomName_1.randomNameAgregator)('Export Report 1'),
             definitions: [
@@ -737,6 +774,7 @@ _8_10_1.test.describe('API optimize SaaS Tests - Export edge cases', () => {
         });
         reportId2 = await (0, apiHelpers_1.createSingleProcessReport)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId,
             name: await (0, randomName_1.randomNameAgregator)('Export Report 2'),
             definitions: [

package/dist/tests/8.10/optimize-collections-api.spec.js

@@ -7,11 +7,12 @@ const randomName_1 = require("../../utils/randomName");
 _8_10_1.test.describe.configure({ mode: 'parallel' });
 _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collections-api @8.10', () => {
     let optimizeCookie;
+    let csrfToken;
     let optimizeBearerToken;
     let baseUrl;
     _8_10_1.test.beforeAll(async ({ browser }) => {
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
@@ -21,6 +22,7 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: collectionName,
             optimizeCookie,
+            csrfToken,
         });
         await _8_10_1.test.step('GET /api/collection/{id} returns the created collection (200)', async () => {
             const response = await request.get(`${baseUrl}/api/collection/${collectionId}`, { headers: { Cookie: optimizeCookie } });
@@ -38,12 +40,14 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: originalName,
             optimizeCookie,
+            csrfToken,
         });
         const renamedName = await (0, randomName_1.randomNameAgregator)('Collection Renamed');
         await _8_10_1.test.step('PUT /api/collection/{id} updates the collection name', async () => {
             const response = await request.put(`${baseUrl}/api/collection/${collectionId}`, {
                 headers: {
                     Cookie: optimizeCookie,
+                    'X-CSRF-TOKEN': csrfToken,
                     'Content-Type': 'application/json',
                 },
                 data: { name: renamedName },
@@ -65,11 +69,13 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: collectionName,
             optimizeCookie,
+            csrfToken,
         });
         const definitionKey = 'customer_onboarding_en';
         await _8_10_1.test.step('PUT /api/collection/{id}/scope adds a process definition', async () => {
             await (0, apiHelpers_1.updateCollectionScope)(request, {
                 optimizeCookie,
+                csrfToken,
                 collectionId,
                 data: [
                     {
@@ -97,6 +103,7 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: collectionName,
             optimizeCookie,
+            csrfToken,
         });
         let deleteSucceeded = false;
         await _8_10_1.test.step('DELETE /api/public/collection/{id} is accepted (200; SaaS may respond 500)', async () => {
@@ -126,6 +133,7 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: collectionName,
             optimizeCookie,
+            csrfToken,
         });
         await _8_10_1.test.step('GET /api/collection/{id} without cookie (401)', async () => {
             const response = await request.get(`${baseUrl}/api/collection/${collectionId}`);
@@ -140,6 +148,7 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: collectionName,
             optimizeCookie,
+            csrfToken,
         });
         await _8_10_1.test.step('DELETE /api/public/collection/{id} without token (401)', async () => {
             const response = await request.delete(`${baseUrl}/api/public/collection/${collectionId}`);
@@ -154,6 +163,7 @@ _8_10_1.test.describe('API Optimize Collections Lifecycle Tests @optimize-collec
         const collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: collectionName,
             optimizeCookie,
+            csrfToken,
         });
         await _8_10_1.test.step('DELETE /api/public/collection/{id} with invalid token (401)', async () => {
             const response = await request.delete(`${baseUrl}/api/public/collection/${collectionId}`, { headers: { Authorization: 'Bearer invalid_token' } });

package/dist/tests/8.10/optimize-exporter-filters-importer-e2e.spec.js

@@ -25,6 +25,7 @@ let originalFilters = null;
 let dataFiltersAvailable = false;
 let zeebeToken;
 let optimizeCookie;
+let csrfToken;
 let optimizeExportToken;
 let optimizeBaseUrl;
 const createdCollectionIds = [];
@@ -81,10 +82,12 @@ const getOrCreateReport = async (request, definitionKey) => {
     const collectionId = await (0, apiHelpers_1.createCollection)(request, {
         name: await (0, randomName_1.randomNameAgregator)('ExporterFilters E2E'),
         optimizeCookie,
+        csrfToken,
     });
     createdCollectionIds.push(collectionId);
     await (0, apiHelpers_1.updateCollectionScope)(request, {
         optimizeCookie,
+        csrfToken,
         collectionId,
         data: [
             {
@@ -97,6 +100,7 @@ const getOrCreateReport = async (request, definitionKey) => {
     const reportResponse = await request.post(`${optimizeBaseUrl}/api/report/process/single`, {
         headers: {
             Cookie: optimizeCookie,
+            'X-CSRF-TOKEN': csrfToken,
             'Content-Type': 'application/json',
         },
         data: {
@@ -184,7 +188,7 @@ _8_10_1.test.beforeAll(async ({ browser }) => {
         optimizeExportToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         optimizeBaseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
     }
     catch (error) {

package/dist/tests/8.10/optimize-sharing-alerts-export-api.spec.js

@@ -36,6 +36,7 @@ const createNumberReport = async (request, options) => {
     const response = await request.post(`${options.baseUrl}/api/report/process/single`, {
         headers: {
             Cookie: options.optimizeCookie,
+            'X-CSRF-TOKEN': options.csrfToken,
             'Content-Type': 'application/json',
         },
         data: {
@@ -67,6 +68,7 @@ const createRawDataReport = async (request, options) => {
     const response = await request.post(`${options.baseUrl}/api/report/process/single`, {
         headers: {
             Cookie: options.optimizeCookie,
+            'X-CSRF-TOKEN': options.csrfToken,
             'Content-Type': 'application/json',
         },
         data: {
@@ -96,6 +98,7 @@ const createRawDataReport = async (request, options) => {
 };
 _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sharing-alerts-export-api @8.10', () => {
     let optimizeCookie;
+    let csrfToken;
     let optimizeBearerToken;
     let baseUrl;
     let collectionId;
@@ -104,16 +107,18 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
     let dashboardId;
     _8_10_1.test.beforeAll(async ({ browser, request }) => {
         const page = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(page);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(page));
         await page.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
         collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Sharing Alerts Collection'),
             optimizeCookie,
+            csrfToken,
         });
         await (0, apiHelpers_1.updateCollectionScope)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId,
             data: [
                 {
@@ -126,18 +131,21 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
         numberReportId = await createNumberReport(request, {
             baseUrl,
             optimizeCookie,
+            csrfToken,
             collectionId,
             name: await (0, randomName_1.randomNameAgregator)('Number Report'),
         });
         rawDataReportId = await createRawDataReport(request, {
             baseUrl,
             optimizeCookie,
+            csrfToken,
             collectionId,
             name: await (0, randomName_1.randomNameAgregator)('Raw Data Report'),
         });
         dashboardId = await (0, apiHelpers_1.createDashboard)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Sharing Dashboard'),
             optimizeCookie,
+            csrfToken,
             collectionId,
         });
     });
@@ -188,10 +196,18 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
     });
     (0, _8_10_1.test)('Enable, evaluate and delete a report share', async ({ request }) => {
         let reportShareId = '';
+        await _8_10_1.test.step('Ensure sharing is enabled cluster-wide', async () => {
+            await (0, apiHelpers_1.setOptimizeSharing)(request, {
+                baseUrl,
+                bearerToken: optimizeBearerToken,
+                enabled: true,
+            });
+        });
         await _8_10_1.test.step('POST /api/share/report enables sharing (200)', async () => {
             const response = await request.post(`${baseUrl}/api/share/report`, {
                 headers: {
                     Cookie: optimizeCookie,
+                    'X-CSRF-TOKEN': csrfToken,
                     'Content-Type': 'application/json',
                 },
                 data: { reportId: numberReportId },
@@ -210,7 +226,7 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
             (0, test_1.expect)([200, 201]).toContain(response.status());
         });
         await _8_10_1.test.step('DELETE /api/share/report/{shareId} removes the share', async () => {
-            const response = await request.delete(`${baseUrl}/api/share/report/${reportShareId}`, { headers: { Cookie: optimizeCookie } });
+            const response = await request.delete(`${baseUrl}/api/share/report/${reportShareId}`, { headers: { Cookie: optimizeCookie, 'X-CSRF-TOKEN': csrfToken } });
             (0, test_1.expect)([200, 204]).toContain(response.status());
         });
     });
@@ -225,10 +241,18 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
     });
     (0, _8_10_1.test)('Enable and delete a dashboard share', async ({ request }) => {
         let dashboardShareId = '';
+        await _8_10_1.test.step('Ensure sharing is enabled cluster-wide', async () => {
+            await (0, apiHelpers_1.setOptimizeSharing)(request, {
+                baseUrl,
+                bearerToken: optimizeBearerToken,
+                enabled: true,
+            });
+        });
         await _8_10_1.test.step('POST /api/share/dashboard enables sharing (200)', async () => {
             const response = await request.post(`${baseUrl}/api/share/dashboard`, {
                 headers: {
                     Cookie: optimizeCookie,
+                    'X-CSRF-TOKEN': csrfToken,
                     'Content-Type': 'application/json',
                 },
                 data: { dashboardId },
@@ -240,7 +264,7 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
             (0, test_1.expect)(dashboardShareId.length).toBeGreaterThan(0);
         });
         await _8_10_1.test.step('DELETE /api/share/dashboard/{shareId} removes the share', async () => {
-            const response = await request.delete(`${baseUrl}/api/share/dashboard/${dashboardShareId}`, { headers: { Cookie: optimizeCookie } });
+            const response = await request.delete(`${baseUrl}/api/share/dashboard/${dashboardShareId}`, { headers: { Cookie: optimizeCookie, 'X-CSRF-TOKEN': csrfToken } });
             (0, test_1.expect)([200, 204]).toContain(response.status());
         });
     });
@@ -251,6 +275,7 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
             const response = await request.post(`${baseUrl}/api/alert`, {
                 headers: {
                     Cookie: optimizeCookie,
+                    'X-CSRF-TOKEN': csrfToken,
                     'Content-Type': 'application/json',
                 },
                 data: {
@@ -281,7 +306,7 @@ _8_10_1.test.describe('API Optimize Sharing, Alerts & Export Tests @optimize-sha
         });
         await _8_10_1.test.step('DELETE /api/alert/{id} removes the alert', async () => {
             const response = await request.delete(`${baseUrl}/api/alert/${alertId}`, {
-                headers: { Cookie: optimizeCookie },
+                headers: { Cookie: optimizeCookie, 'X-CSRF-TOKEN': csrfToken },
             });
             (0, test_1.expect)([200, 204]).toContain(response.status());
         });

package/dist/tests/8.10/optimize-sharing-alerts-export-ui.spec.js

@@ -14,6 +14,7 @@ _8_10_1.test.describe.configure({ mode: 'parallel' });
 _8_10_1.test.describe('Optimize Sharing & Export UI Tests @optimize-sharing-alerts-export-ui @8.10', () => {
     let baseUrl;
     let optimizeCookie;
+    let csrfToken;
     let optimizeBearerToken;
     let collectionId;
     let reportId;
@@ -22,15 +23,17 @@ _8_10_1.test.describe('Optimize Sharing & Export UI Tests @optimize-sharing-aler
     _8_10_1.test.beforeAll(async ({ browser, request }) => {
         baseUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
         const seedPage = await browser.newPage();
-        optimizeCookie = await (0, apiHelpers_1.getOptimizeCoockie)(seedPage);
+        ({ optimizeCookie, csrfToken } = await (0, apiHelpers_1.loginToOptimizeSession)(seedPage));
         await seedPage.close();
         optimizeBearerToken = await (0, apiHelpers_1.authSaasAPI)(process.env.OPTIMIZE_API_TOKEN_AUDIENCE);
         collectionId = await (0, apiHelpers_1.createCollection)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Sharing UI Collection'),
             optimizeCookie,
+            csrfToken,
         });
         await (0, apiHelpers_1.updateCollectionScope)(request, {
             optimizeCookie,
+            csrfToken,
             collectionId,
             data: [
                 {
@@ -47,6 +50,7 @@ _8_10_1.test.describe('Optimize Sharing & Export UI Tests @optimize-sharing-aler
         const reportResponse = await (0, apiHelpers_1.retryOn500)(() => request.post(`${baseUrl}/api/report/process/single`, {
             headers: {
                 Cookie: optimizeCookie,
+                'X-CSRF-TOKEN': csrfToken,
                 'Content-Type': 'application/json',
             },
             data: {
@@ -75,6 +79,7 @@ _8_10_1.test.describe('Optimize Sharing & Export UI Tests @optimize-sharing-aler
         dashboardId = await (0, apiHelpers_1.createDashboard)(request, {
             name: await (0, randomName_1.randomNameAgregator)('Sharing UI Dashboard'),
             optimizeCookie,
+            csrfToken,
             collectionId,
         });
         // Optimize only renders the CSV download action on raw-data reports
@@ -85,6 +90,7 @@ _8_10_1.test.describe('Optimize Sharing & Export UI Tests @optimize-sharing-aler
         const csvReportResponse = await (0, apiHelpers_1.retryOn500)(() => request.post(`${baseUrl}/api/report/process/single`, {
             headers: {
                 Cookie: optimizeCookie,
+                'X-CSRF-TOKEN': csrfToken,
                 'Content-Type': 'application/json',
             },
             data: {
@@ -111,7 +117,14 @@ _8_10_1.test.describe('Optimize Sharing & Export UI Tests @optimize-sharing-aler
         (0, test_1.expect)(csvReportResponse.status()).toBe(200);
         csvReportId = (await csvReportResponse.json()).id;
     });
-    _8_10_1.test.beforeEach(async ({ page, loginPage }, testInfo) => {
+    // The share button is rendered from ui-configuration, which the app reads once
+    // per page load, so the setting has to be right before we navigate.
+    _8_10_1.test.beforeEach(async ({ page, loginPage, request }, testInfo) => {
+        await (0, apiHelpers_1.setOptimizeSharing)(request, {
+            baseUrl,
+            bearerToken: optimizeBearerToken,
+            enabled: true,
+        });
         await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, testUser, (testInfo.workerIndex + 1) * 1000);
     });
     _8_10_1.test.afterEach(async ({ page }, testInfo) => {

package/dist/utils/apiHelpers.d.ts

@@ -35,26 +35,39 @@ interface ReportDefinition {
 }
 interface CreateSingleProcessReportOptions {
     optimizeCookie: string;
+    csrfToken?: string;
     collectionId: string;
     name: string;
     description?: string | null;
     definitions?: ReportDefinition[];
     configuration?: Record<string, unknown>;
 }
+export declare function loginToOptimizeSession(page: Page): Promise<{
+    optimizeCookie: string;
+    csrfToken: string;
+}>;
 export declare function getOptimizeCoockie(page: Page): Promise<string>;
 export declare function getOptimizeCookieSm(page: Page): Promise<string>;
 export declare function createCollection(request: APIRequestContext, options: {
     name: string;
     optimizeCookie: string;
+    csrfToken?: string;
 }): Promise<string>;
 export declare function createDashboard(request: APIRequestContext, options: {
     name: string;
     optimizeCookie: string;
+    csrfToken?: string;
     collectionId?: string;
 }): Promise<any>;
+export declare function setOptimizeSharing(request: APIRequestContext, options: {
+    baseUrl: string;
+    bearerToken: string;
+    enabled: boolean;
+}): Promise<void>;
 export declare function createSingleProcessReport(request: APIRequestContext, options: CreateSingleProcessReportOptions): Promise<any>;
 export declare function updateCollectionScope(request: APIRequestContext, options: {
     optimizeCookie: string;
+    csrfToken?: string;
     collectionId: string;
     data: Array<{
         definitionKey: string;

package/dist/utils/apiHelpers.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.updateClusterDataFilters = exports.getClusterDataFilters = exports.getTestClusterUuid = exports.authConsoleManagementAPI = exports.updateCollectionScope = exports.createSingleProcessReport = exports.createDashboard = exports.createCollection = exports.getOptimizeCookieSm = exports.getOptimizeCoockie = exports.createStringClusterVariable = exports.createJsonClusterVariable = exports.waitForProcessInstanceVisible = exports.createProcessInstance = exports.deployProcess = exports.waitForOrchestrationClusterReady = exports.waitForInboundWebhookRegistered = exports.waitForConnectorsReady = exports.validateMcpServerHealth = exports.authC8runAPI = exports.authSmAPI = exports.authSaasAPI = exports.authAPI = exports.buildZeebeApiUrl = exports.retryOn500 = exports.sendRequestAndAssertResponse = exports.assertUnauthorizedResponseBody = exports.expectUnauthorizedErrorBody = exports.assertResponseStatus = exports.getApiRequestContext = void 0;
+exports.updateClusterDataFilters = exports.getClusterDataFilters = exports.getTestClusterUuid = exports.authConsoleManagementAPI = exports.updateCollectionScope = exports.createSingleProcessReport = exports.setOptimizeSharing = exports.createDashboard = exports.createCollection = exports.getOptimizeCookieSm = exports.getOptimizeCoockie = exports.loginToOptimizeSession = exports.createStringClusterVariable = exports.createJsonClusterVariable = exports.waitForProcessInstanceVisible = exports.createProcessInstance = exports.deployProcess = exports.waitForOrchestrationClusterReady = exports.waitForInboundWebhookRegistered = exports.waitForConnectorsReady = exports.validateMcpServerHealth = exports.authC8runAPI = exports.authSmAPI = exports.authSaasAPI = exports.authAPI = exports.buildZeebeApiUrl = exports.retryOn500 = exports.sendRequestAndAssertResponse = exports.assertUnauthorizedResponseBody = exports.expectUnauthorizedErrorBody = exports.assertResponseStatus = exports.getApiRequestContext = void 0;
 const test_1 = require("@playwright/test");
 const sleep_1 = require("./sleep");
 const randomSleep_1 = require("./randomSleep");
@@ -666,7 +666,50 @@ async function createStringClusterVariable(authToken, environment = 'saas', cust
     await createClusterVariableInternal(authToken ?? '', environment, variableName, variableValue, 'String', clusterType);
 }
 exports.createStringClusterVariable = createStringClusterVariable;
-async function getOptimizeCoockie(page) {
+// CSL (8.10+) protects writes with a CSRF token in addition to the session
+// cookie (see optimize/client/src/modules/csrf.ts); the legacy security stack
+// used by getOptimizeCoockie/getOptimizeCookieSm (8.8/8.9/SM) never issues
+// one, so it stays undefined there and this header is simply omitted.
+function optimizeCookieHeaders(options) {
+    const headers = { Cookie: options.optimizeCookie };
+    if (options.csrfToken)
+        headers['X-CSRF-TOKEN'] = options.csrfToken;
+    return headers;
+}
+const OPTIMIZE_SESSION_UNAUTHENTICATED = 'OPTIMIZE_SESSION_UNAUTHENTICATED';
+// Verifying the session is part of logging in, not a wait that can be retried
+// afterwards: on SaaS the OIDC callback (GET /{clusterId}/sso-callback) answers
+// 401 for a share of concurrent logins, and because that 401 page is still
+// served from the Optimize base URL, loginToApp's
+// waitForURL(url.startsWith(appName), {waitUntil: 'commit'}) resolves on it and
+// reports success. The session then stays unauthenticated for good -- no amount
+// of polling recovers it, only a fresh login does. So probe an endpoint that is
+// on the CSL API chain and let performOptimizeInteractiveLogin's retry loop
+// start over when it comes back unauthenticated.
+//
+// The probe doubles as the CSRF-token source: CSL's CSRF setup is a
+// double-submit cookie (Spring's CookieCsrfTokenRepository), so the first
+// authenticated GET is what issues the X-CSRF-TOKEN cookie, echoing the token
+// as an x-csrf-token response header. Returns that token when authenticated,
+// null when not.
+async function probeOptimizeSession(page) {
+    const optimizeUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
+    const response = await page
+        .context()
+        .request.get(`${optimizeUrl}/api/identity/current/user`);
+    // Require both a successful response AND a token, mirroring the product's
+    // own rule for when to trust the header (optimize/client/src/modules/csrf.ts
+    // storeCsrfToken): a non-2xx (a transient 5xx, or a 401/403 from a stale
+    // session) or a 2xx with no token yet must be treated as unauthenticated,
+    // not as "authenticated with an empty token" -- the latter would exit the
+    // login retry loop with a cookie that then fails every write.
+    const token = response.headers()['x-csrf-token'];
+    if (!response.ok() || !token) {
+        return null;
+    }
+    return token;
+}
+async function performOptimizeInteractiveLogin(page, callerLabel, verifySession) {
     const optimizeUrl = process.env.CAMUNDA_OPTIMIZE_BASE_URL;
     const maxLoginAttempts = 4;
     // This hook runs once per worker that picks up any test from an Optimize
@@ -675,7 +718,13 @@ async function getOptimizeCoockie(page) {
     // spread that burst -- it is enough on its own to trip Auth0's tenant-wide
     // rate limit, which then fails every worker at once. Retries back off via
     // randomSleep below, so this only needs to run once.
-    await (0, randomSleep_1.randomSleep)(0, 15000);
+    //
+    // The window has to be wider than a rejection burst, not just wider than the
+    // instant the workers start: 8.10 has eight Optimize describes each doing one
+    // interactive login, and the sso-callback rejections below come in bursts
+    // lasting tens of seconds, so a 15s spread put every login inside the same
+    // burst and the losers then spent their whole attempt budget in it.
+    await (0, randomSleep_1.randomSleep)(0, 60000);
     // Auth0 can fail or rate-limit concurrent logins. Retry the whole flow if
     // loginToApp throws (e.g. waitForURL times out after a bad Auth0 redirect).
     for (let loginAttempt = 0; loginAttempt < maxLoginAttempts; loginAttempt++) {
@@ -683,12 +732,16 @@ async function getOptimizeCoockie(page) {
             await page.goto('about:blank');
             await page.context().clearCookies();
             await (0, utils_1.loginToApp)(optimizeUrl, page);
-            break;
+            if (verifySession && !(await verifySession(page))) {
+                throw new Error(OPTIMIZE_SESSION_UNAUTHENTICATED);
+            }
+            return;
         }
         catch (error) {
             if (loginAttempt < maxLoginAttempts - 1) {
                 const rateLimited = String(error).includes(utils_1.AUTH0_RATE_LIMIT);
-                console.warn(`getOptimizeCoockie: login attempt ${loginAttempt + 1} failed, retrying after backoff...`, error);
+                const unauthenticated = String(error).includes(OPTIMIZE_SESSION_UNAUTHENTICATED);
+                console.warn(`${callerLabel}: login attempt ${loginAttempt + 1} failed, retrying after backoff...`, error);
                 await page.goto('about:blank');
                 if (rateLimited) {
                     // Auth0 rate-limit windows commonly last 30-90s. Back off long
@@ -696,6 +749,19 @@ async function getOptimizeCoockie(page) {
                     // the same window and burns the attempt budget for nothing.
                     await (0, randomSleep_1.randomSleep)(60000, 90000);
                 }
+                else if (unauthenticated) {
+                    // The rejected callbacks come in bursts lasting tens of seconds
+                    // (every login inside the burst window fails, isolated ones all
+                    // succeed), so back off past the burst rather than retrying inside
+                    // it. Widen the band on each attempt instead of re-drawing from a
+                    // fixed one: every worker caught by the same burst backs off from
+                    // the same distribution at the same moment, so a fixed band keeps
+                    // the herd synchronised and they re-collide on the next attempt.
+                    // Growing the ceiling fans them out while the floor still lets a
+                    // lucky worker recover quickly. Worst case stays well inside the
+                    // 12-minute hook timeout.
+                    await (0, randomSleep_1.randomSleep)(20000, 45000 + loginAttempt * 45000);
+                }
                 else {
                     await (0, randomSleep_1.randomSleep)(10000, 20000);
                 }
@@ -705,6 +771,38 @@ async function getOptimizeCoockie(page) {
             }
         }
     }
+}
+// 8.10+ (CSL) replaces the legacy X-Optimize-* cookies below with its own
+// stateful OIDC webapp session (ADR-0038:
+// https://github.com/camunda/camunda-security-library/blob/main/docs/adr/0038-optimize-reuses-stateful-oidc-webapp-chain.md).
+// The session cookie is just as portable as the legacy one -- extract it as a
+// plain string (and the accompanying CSRF token) and the caller can close the
+// page immediately, exactly like getOptimizeCoockie below.
+async function loginToOptimizeSession(page) {
+    // A write is only valid if the X-CSRF-TOKEN cookie AND a matching header are
+    // both present, and it is the probe inside the login that issues that cookie
+    // -- so the probe has to run before cookies() is read here, which it does.
+    let csrfToken = '';
+    await performOptimizeInteractiveLogin(page, 'loginToOptimizeSession', async (loggedInPage) => {
+        const token = await probeOptimizeSession(loggedInPage);
+        if (token === null) {
+            return false;
+        }
+        csrfToken = token;
+        return true;
+    });
+    // Scoped to optimizeUrl: an unscoped cookies() call returns the whole
+    // browser context jar, including cookies set on the Auth0/Console origins
+    // visited during the interactive login, which would otherwise get flattened
+    // into a Cookie header Optimize never asked for.
+    const optimizeCookie = (await page.context().cookies(process.env.CAMUNDA_OPTIMIZE_BASE_URL))
+        .map((cookie) => `${cookie.name}=${cookie.value}`)
+        .join('; ');
+    return { optimizeCookie, csrfToken };
+}
+exports.loginToOptimizeSession = loginToOptimizeSession;
+async function getOptimizeCoockie(page) {
+    await performOptimizeInteractiveLogin(page, 'getOptimizeCoockie');
     const context = page.context();
     // Optimize sets its session cookies asynchronously after the Auth0 redirect.
     // Poll storage state until both cookies are present (up to ~30 s).
@@ -782,9 +880,7 @@ exports.getOptimizeCookieSm = getOptimizeCookieSm;
 async function createCollection(request, options) {
     return retryOnTransientApiError(async () => {
         const optimizeResponse = await request.post(`${process.env.CAMUNDA_OPTIMIZE_BASE_URL}/api/collection`, {
-            headers: {
-                Cookie: options.optimizeCookie,
-            },
+            headers: optimizeCookieHeaders(options),
             data: {
                 name: options.name,
             },
@@ -798,9 +894,7 @@ exports.createCollection = createCollection;
 async function createDashboard(request, options) {
     return retryOnTransientApiError(async () => {
         const optimizeResponse = await request.post(`${process.env.CAMUNDA_OPTIMIZE_BASE_URL}/api/dashboard`, {
-            headers: {
-                Cookie: options.optimizeCookie,
-            },
+            headers: optimizeCookieHeaders(options),
             data: {
                 collectionId: options.collectionId,
                 name: options.name,
@@ -819,6 +913,23 @@ async function createDashboard(request, options) {
     }, 'createDashboard');
 }
 exports.createDashboard = createDashboard;
+// Sharing is a cluster-global Optimize setting, not a per-entity one: with it
+// off, POST /api/share/{report,dashboard} answers 500 (SharingNotAllowedException
+// has no exception mapper) and the UI renders the share button disabled. Specs
+// that toggle it therefore have to restore it, and specs that depend on it have
+// to assert the precondition themselves -- otherwise they see each other's
+// writes when they run concurrently.
+async function setOptimizeSharing(request, options) {
+    const action = options.enabled ? 'enable' : 'disable';
+    return retryOnTransientApiError(async () => {
+        const response = await request.post(`${options.baseUrl}/api/public/share/${action}`, { headers: { Authorization: options.bearerToken } });
+        if (![200, 204].includes(response.status())) {
+            throw new Error(`Expected 200 or 204 from /api/public/share/${action}, Received: ` +
+                `${response.status()} ${await response.text()}`);
+        }
+    }, `setOptimizeSharing(${action})`);
+}
+exports.setOptimizeSharing = setOptimizeSharing;
 async function createSingleProcessReport(request, options) {
     // Default configuration (can be overridden)
     const defaultConfiguration = {
@@ -880,7 +991,7 @@ async function createSingleProcessReport(request, options) {
     return retryOnTransientApiError(async () => {
         const response = await request.post(`${process.env.CAMUNDA_OPTIMIZE_BASE_URL}/api/report/process/single`, {
             headers: {
-                Cookie: options.optimizeCookie,
+                ...optimizeCookieHeaders(options),
                 'Content-Type': 'application/json',
             },
             data: payload,
@@ -899,7 +1010,7 @@ async function updateCollectionScope(request, options) {
     return retryOnTransientApiError(async () => {
         const response = await request.put(url, {
             headers: {
-                Cookie: options.optimizeCookie,
+                ...optimizeCookieHeaders(options),
                 'Content-Type': 'application/json',
             },
             data: options.data,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/e2e-test-suite",
-  "version": "0.0.983",
+  "version": "0.0.985",
   "description": "End-to-end test helpers for Camunda 8",
   "repository": {
     "type": "git",