@entifix/testing-e2e 0.1.0-0

package/dist/playwright/entity-table.js

@@ -0,0 +1,129 @@
+import { expect } from '@playwright/test';
+/**
+ * A driver for the `EntityTable` organism: filters, sorting, paging and the
+ * rendered rows.
+ *
+ * Every entity listing in the workspace is the same component, so its selectors
+ * belong in one place rather than being re-declared as local helpers in each
+ * suite — which is what the two admin specs did, with two different sets of
+ * conventions for the same widget.
+ *
+ * The wide (grid) layout is what is asserted on. Both layouts always render —
+ * the pivot is CSS-only, so there is no SSR hydration mismatch — and the table
+ * is the one carrying column semantics.
+ */ export class EntityTablePage {
+    /** Rows of the wide layout. */ get rows() {
+        return this.page.locator('table tbody tr');
+    }
+    /** Waits until the listing has painted at least one row. */ async waitForRows() {
+        await expect(this.rows.first()).toBeVisible();
+    }
+    /** Column headers, in render order. */ async headers() {
+        return this.page.locator('table thead th').allInnerTexts();
+    }
+    /**
+   * The values of one column, addressed by its header label rather than by
+   * position: a column added to the entity — or reordered by the user's saved
+   * preferences — must not silently shift what a spec is asserting on.
+   */ async columnValues(header) {
+        const index = (await this.headers()).findIndex((label)=>label.trim() === header);
+        if (index === -1) {
+            throw new Error(`No column headed "${header}". Rendered columns: ${(await this.headers()).join(', ')}.`);
+        }
+        return this.page.locator(`table tbody tr td:nth-child(${index + 1})`).allInnerTexts();
+    }
+    /** The distinct values of a column, sorted — the usual assertion subject. */ async distinctColumnValues(header) {
+        return [
+            ...new Set(await this.columnValues(header))
+        ].sort();
+    }
+    // --- filtering ----------------------------------------------------------
+    async openFilters() {
+        await this.page.getByRole('button', {
+            name: 'Filtros',
+            exact: true
+        }).click();
+    }
+    /** `and` (default) or `or` across the rows of the panel. */ async matchAny(match) {
+        await this.page.getByLabel('Coincidir todos o cualquiera de los filtros').selectOption(match);
+    }
+    /**
+   * Adds a filter row and fills it in.
+   *
+   * The member is always selected explicitly, never left at the default: a new
+   * row defaults to the entity's *first filterable* member, so a spec relying
+   * on it would break the moment a member is declared ahead of that one.
+   */ async addFilter({ member, operator, value }) {
+        const index = await this.page.getByLabel('Miembro del filtro').count();
+        await this.page.getByRole('button', {
+            name: 'Añadir filtro'
+        }).click();
+        await this.page.getByLabel('Miembro del filtro').nth(index).selectOption(member);
+        await this.page.getByLabel('Operador del filtro').nth(index).selectOption(operator);
+        await this.page.getByLabel('Valor del filtro').nth(index).fill(value);
+    }
+    /** Filtering is emitted on Apply, not per keystroke — each emission is a request. */ async applyFilters() {
+        await this.page.getByRole('button', {
+            name: 'Aplicar filtros'
+        }).click();
+    }
+    async clearFilters() {
+        await this.page.getByRole('button', {
+            name: 'Limpiar filtros'
+        }).click();
+    }
+    /** Opens the panel, adds every clause, applies. */ async filterBy(...clauses) {
+        await this.openFilters();
+        for (const clause of clauses){
+            await this.addFilter(clause);
+        }
+        await this.applyFilters();
+    }
+    // --- sorting ------------------------------------------------------------
+    async openSorting() {
+        await this.page.getByRole('button', {
+            name: 'Orden',
+            exact: true
+        }).click();
+    }
+    async addSort({ member, direction = 'asc' }) {
+        const index = await this.page.getByLabel('Miembro de orden').count();
+        await this.page.getByRole('button', {
+            name: 'Añadir orden'
+        }).click();
+        await this.page.getByLabel('Miembro de orden').nth(index).selectOption(member);
+        await this.page.getByLabel('Dirección de orden').nth(index).selectOption(direction);
+    }
+    async applySorting() {
+        await this.page.getByRole('button', {
+            name: 'Aplicar orden'
+        }).click();
+    }
+    /** Opens the panel, adds every term in precedence order, applies. */ async sortBy(...clauses) {
+        await this.openSorting();
+        for (const clause of clauses){
+            await this.addSort(clause);
+        }
+        await this.applySorting();
+    }
+    // --- paging -------------------------------------------------------------
+    /**
+   * `exact` matters: Next.js' dev-tools button also matches a loose "Siguiente".
+   */ async nextPage() {
+        await this.page.getByRole('button', {
+            name: 'Siguiente',
+            exact: true
+        }).click();
+    }
+    async previousPage() {
+        await this.page.getByRole('button', {
+            name: 'Anterior',
+            exact: true
+        }).click();
+    }
+    constructor(page){
+        this.page = page;
+    }
+}
+
+//# sourceMappingURL=entity-table.js.map

package/dist/playwright/entity-table.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/playwright/entity-table.ts"],"sourcesContent":["import { expect, type Locator, type Page } from '@playwright/test';\n\n/** How a filter row is filled in. */\nexport interface FilterClause {\n  member: string;\n  operator: string;\n  value: string;\n}\n\nexport interface SortClause {\n  member: string;\n  direction?: 'asc' | 'desc';\n}\n\n/**\n * A driver for the `EntityTable` organism: filters, sorting, paging and the\n * rendered rows.\n *\n * Every entity listing in the workspace is the same component, so its selectors\n * belong in one place rather than being re-declared as local helpers in each\n * suite — which is what the two admin specs did, with two different sets of\n * conventions for the same widget.\n *\n * The wide (grid) layout is what is asserted on. Both layouts always render —\n * the pivot is CSS-only, so there is no SSR hydration mismatch — and the table\n * is the one carrying column semantics.\n */\nexport class EntityTablePage {\n  constructor(private readonly page: Page) {}\n\n  /** Rows of the wide layout. */\n  get rows(): Locator {\n    return this.page.locator('table tbody tr');\n  }\n\n  /** Waits until the listing has painted at least one row. */\n  async waitForRows(): Promise<void> {\n    await expect(this.rows.first()).toBeVisible();\n  }\n\n  /** Column headers, in render order. */\n  async headers(): Promise<string[]> {\n    return this.page.locator('table thead th').allInnerTexts();\n  }\n\n  /**\n   * The values of one column, addressed by its header label rather than by\n   * position: a column added to the entity — or reordered by the user's saved\n   * preferences — must not silently shift what a spec is asserting on.\n   */\n  async columnValues(header: string): Promise<string[]> {\n    const index = (await this.headers()).findIndex(\n      label => label.trim() === header,\n    );\n    if (index === -1) {\n      throw new Error(\n        `No column headed \"${header}\". Rendered columns: ${(await this.headers()).join(', ')}.`,\n      );\n    }\n    return this.page\n      .locator(`table tbody tr td:nth-child(${index + 1})`)\n      .allInnerTexts();\n  }\n\n  /** The distinct values of a column, sorted — the usual assertion subject. */\n  async distinctColumnValues(header: string): Promise<string[]> {\n    return [...new Set(await this.columnValues(header))].sort();\n  }\n\n  // --- filtering ----------------------------------------------------------\n\n  async openFilters(): Promise<void> {\n    await this.page\n      .getByRole('button', { name: 'Filtros', exact: true })\n      .click();\n  }\n\n  /** `and` (default) or `or` across the rows of the panel. */\n  async matchAny(match: 'and' | 'or'): Promise<void> {\n    await this.page\n      .getByLabel('Coincidir todos o cualquiera de los filtros')\n      .selectOption(match);\n  }\n\n  /**\n   * Adds a filter row and fills it in.\n   *\n   * The member is always selected explicitly, never left at the default: a new\n   * row defaults to the entity's *first filterable* member, so a spec relying\n   * on it would break the moment a member is declared ahead of that one.\n   */\n  async addFilter({ member, operator, value }: FilterClause): Promise<void> {\n    const index = await this.page.getByLabel('Miembro del filtro').count();\n    await this.page.getByRole('button', { name: 'Añadir filtro' }).click();\n    await this.page\n      .getByLabel('Miembro del filtro')\n      .nth(index)\n      .selectOption(member);\n    await this.page\n      .getByLabel('Operador del filtro')\n      .nth(index)\n      .selectOption(operator);\n    await this.page.getByLabel('Valor del filtro').nth(index).fill(value);\n  }\n\n  /** Filtering is emitted on Apply, not per keystroke — each emission is a request. */\n  async applyFilters(): Promise<void> {\n    await this.page.getByRole('button', { name: 'Aplicar filtros' }).click();\n  }\n\n  async clearFilters(): Promise<void> {\n    await this.page.getByRole('button', { name: 'Limpiar filtros' }).click();\n  }\n\n  /** Opens the panel, adds every clause, applies. */\n  async filterBy(...clauses: FilterClause[]): Promise<void> {\n    await this.openFilters();\n    for (const clause of clauses) {\n      await this.addFilter(clause);\n    }\n    await this.applyFilters();\n  }\n\n  // --- sorting ------------------------------------------------------------\n\n  async openSorting(): Promise<void> {\n    await this.page.getByRole('button', { name: 'Orden', exact: true }).click();\n  }\n\n  async addSort({ member, direction = 'asc' }: SortClause): Promise<void> {\n    const index = await this.page.getByLabel('Miembro de orden').count();\n    await this.page.getByRole('button', { name: 'Añadir orden' }).click();\n    await this.page\n      .getByLabel('Miembro de orden')\n      .nth(index)\n      .selectOption(member);\n    await this.page\n      .getByLabel('Dirección de orden')\n      .nth(index)\n      .selectOption(direction);\n  }\n\n  async applySorting(): Promise<void> {\n    await this.page.getByRole('button', { name: 'Aplicar orden' }).click();\n  }\n\n  /** Opens the panel, adds every term in precedence order, applies. */\n  async sortBy(...clauses: SortClause[]): Promise<void> {\n    await this.openSorting();\n    for (const clause of clauses) {\n      await this.addSort(clause);\n    }\n    await this.applySorting();\n  }\n\n  // --- paging -------------------------------------------------------------\n\n  /**\n   * `exact` matters: Next.js' dev-tools button also matches a loose \"Siguiente\".\n   */\n  async nextPage(): Promise<void> {\n    await this.page\n      .getByRole('button', { name: 'Siguiente', exact: true })\n      .click();\n  }\n\n  async previousPage(): Promise<void> {\n    await this.page\n      .getByRole('button', { name: 'Anterior', exact: true })\n      .click();\n  }\n}\n"],"names":["expect","EntityTablePage","rows","page","locator","waitForRows","first","toBeVisible","headers","allInnerTexts","columnValues","header","index","findIndex","label","trim","Error","join","distinctColumnValues","Set","sort","openFilters","getByRole","name","exact","click","matchAny","match","getByLabel","selectOption","addFilter","member","operator","value","count","nth","fill","applyFilters","clearFilters","filterBy","clauses","clause","openSorting","addSort","direction","applySorting","sortBy","nextPage","previousPage"],"mappings":"AAAA,SAASA,MAAM,QAAiC,mBAAmB;AAcnE;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC;IAGX,6BAA6B,GAC7B,IAAIC,OAAgB;QAClB,OAAO,IAAI,CAACC,IAAI,CAACC,OAAO,CAAC;IAC3B;IAEA,0DAA0D,GAC1D,MAAMC,cAA6B;QACjC,MAAML,OAAO,IAAI,CAACE,IAAI,CAACI,KAAK,IAAIC,WAAW;IAC7C;IAEA,qCAAqC,GACrC,MAAMC,UAA6B;QACjC,OAAO,IAAI,CAACL,IAAI,CAACC,OAAO,CAAC,kBAAkBK,aAAa;IAC1D;IAEA;;;;GAIC,GACD,MAAMC,aAAaC,MAAc,EAAqB;QACpD,MAAMC,QAAQ,AAAC,CAAA,MAAM,IAAI,CAACJ,OAAO,EAAC,EAAGK,SAAS,CAC5CC,CAAAA,QAASA,MAAMC,IAAI,OAAOJ;QAE5B,IAAIC,UAAU,CAAC,GAAG;YAChB,MAAM,IAAII,MACR,CAAC,kBAAkB,EAAEL,OAAO,qBAAqB,EAAE,AAAC,CAAA,MAAM,IAAI,CAACH,OAAO,EAAC,EAAGS,IAAI,CAAC,MAAM,CAAC,CAAC;QAE3F;QACA,OAAO,IAAI,CAACd,IAAI,CACbC,OAAO,CAAC,CAAC,4BAA4B,EAAEQ,QAAQ,EAAE,CAAC,CAAC,EACnDH,aAAa;IAClB;IAEA,2EAA2E,GAC3E,MAAMS,qBAAqBP,MAAc,EAAqB;QAC5D,OAAO;eAAI,IAAIQ,IAAI,MAAM,IAAI,CAACT,YAAY,CAACC;SAAS,CAACS,IAAI;IAC3D;IAEA,2EAA2E;IAE3E,MAAMC,cAA6B;QACjC,MAAM,IAAI,CAAClB,IAAI,CACZmB,SAAS,CAAC,UAAU;YAAEC,MAAM;YAAWC,OAAO;QAAK,GACnDC,KAAK;IACV;IAEA,0DAA0D,GAC1D,MAAMC,SAASC,KAAmB,EAAiB;QACjD,MAAM,IAAI,CAACxB,IAAI,CACZyB,UAAU,CAAC,+CACXC,YAAY,CAACF;IAClB;IAEA;;;;;;GAMC,GACD,MAAMG,UAAU,EAAEC,MAAM,EAAEC,QAAQ,EAAEC,KAAK,EAAgB,EAAiB;QACxE,MAAMrB,QAAQ,MAAM,IAAI,CAACT,IAAI,CAACyB,UAAU,CAAC,sBAAsBM,KAAK;QACpE,MAAM,IAAI,CAAC/B,IAAI,CAACmB,SAAS,CAAC,UAAU;YAAEC,MAAM;QAAgB,GAAGE,KAAK;QACpE,MAAM,IAAI,CAACtB,IAAI,CACZyB,UAAU,CAAC,sBACXO,GAAG,CAACvB,OACJiB,YAAY,CAACE;QAChB,MAAM,IAAI,CAAC5B,IAAI,CACZyB,UAAU,CAAC,uBACXO,GAAG,CAACvB,OACJiB,YAAY,CAACG;QAChB,MAAM,IAAI,CAAC7B,IAAI,CAACyB,UAAU,CAAC,oBAAoBO,GAAG,CAACvB,OAAOwB,IAAI,CAACH;IACjE;IAEA,mFAAmF,GACnF,MAAMI,eAA8B;QAClC,MAAM,IAAI,CAAClC,IAAI,CAACmB,SAAS,CAAC,UAAU;YAAEC,MAAM;QAAkB,GAAGE,KAAK;IACxE;IAEA,MAAMa,eAA8B;QAClC,MAAM,IAAI,CAACnC,IAAI,CAACmB,SAAS,CAAC,UAAU;YAAEC,MAAM;QAAkB,GAAGE,KAAK;IACxE;IAEA,iDAAiD,GACjD,MAAMc,SAAS,GAAGC,OAAuB,EAAiB;QACxD,MAAM,IAAI,CAACnB,WAAW;QACtB,KAAK,MAAMoB,UAAUD,QAAS;YAC5B,MAAM,IAAI,CAACV,SAAS,CAACW;QACvB;QACA,MAAM,IAAI,CAACJ,YAAY;IACzB;IAEA,2EAA2E;IAE3E,MAAMK,cAA6B;QACjC,MAAM,IAAI,CAACvC,IAAI,CAACmB,SAAS,CAAC,UAAU;YAAEC,MAAM;YAASC,OAAO;QAAK,GAAGC,KAAK;IAC3E;IAEA,MAAMkB,QAAQ,EAAEZ,MAAM,EAAEa,YAAY,KAAK,EAAc,EAAiB;QACtE,MAAMhC,QAAQ,MAAM,IAAI,CAACT,IAAI,CAACyB,UAAU,CAAC,oBAAoBM,KAAK;QAClE,MAAM,IAAI,CAAC/B,IAAI,CAACmB,SAAS,CAAC,UAAU;YAAEC,MAAM;QAAe,GAAGE,KAAK;QACnE,MAAM,IAAI,CAACtB,IAAI,CACZyB,UAAU,CAAC,oBACXO,GAAG,CAACvB,OACJiB,YAAY,CAACE;QAChB,MAAM,IAAI,CAAC5B,IAAI,CACZyB,UAAU,CAAC,sBACXO,GAAG,CAACvB,OACJiB,YAAY,CAACe;IAClB;IAEA,MAAMC,eAA8B;QAClC,MAAM,IAAI,CAAC1C,IAAI,CAACmB,SAAS,CAAC,UAAU;YAAEC,MAAM;QAAgB,GAAGE,KAAK;IACtE;IAEA,mEAAmE,GACnE,MAAMqB,OAAO,GAAGN,OAAqB,EAAiB;QACpD,MAAM,IAAI,CAACE,WAAW;QACtB,KAAK,MAAMD,UAAUD,QAAS;YAC5B,MAAM,IAAI,CAACG,OAAO,CAACF;QACrB;QACA,MAAM,IAAI,CAACI,YAAY;IACzB;IAEA,2EAA2E;IAE3E;;GAEC,GACD,MAAME,WAA0B;QAC9B,MAAM,IAAI,CAAC5C,IAAI,CACZmB,SAAS,CAAC,UAAU;YAAEC,MAAM;YAAaC,OAAO;QAAK,GACrDC,KAAK;IACV;IAEA,MAAMuB,eAA8B;QAClC,MAAM,IAAI,CAAC7C,IAAI,CACZmB,SAAS,CAAC,UAAU;YAAEC,MAAM;YAAYC,OAAO;QAAK,GACpDC,KAAK;IACV;IA9IA,YAAY,AAAiBtB,IAAU,CAAE;aAAZA,OAAAA;IAAa;AA+I5C"}

package/dist/playwright/index.d.ts

@@ -0,0 +1,6 @@
+export * from './assert-expected-server.js';
+export * from './config.js';
+export * from './entity-table.js';
+export * from './session.js';
+export * from './test.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/playwright/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/playwright/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC"}

package/dist/playwright/index.js

@@ -0,0 +1,7 @@
+export * from './assert-expected-server.js';
+export * from './config.js';
+export * from './entity-table.js';
+export * from './session.js';
+export * from './test.js';
+
+//# sourceMappingURL=index.js.map

package/dist/playwright/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/playwright/index.ts"],"sourcesContent":["export * from './assert-expected-server.js';\nexport * from './config.js';\nexport * from './entity-table.js';\nexport * from './session.js';\nexport * from './test.js';\n"],"names":[],"mappings":"AAAA,cAAc,8BAA8B;AAC5C,cAAc,cAAc;AAC5B,cAAc,oBAAoB;AAClC,cAAc,eAAe;AAC7B,cAAc,YAAY"}

package/dist/playwright/session.d.ts

@@ -0,0 +1,85 @@
+import type { BrowserContext } from '@playwright/test';
+/**
+ * The cookies a signed-in session travels in — the same names
+ * `@entifix/core` declares, **written out rather than imported**.
+ *
+ * ⚠️ **This module must import no built package at runtime.** Nx builds its
+ * project graph by loading every e2e project's `playwright.config.ts` in plain
+ * Node — no source condition, nothing built — and that config reaches this
+ * file. An `import … from '@entifix/core'` here resolves core's `dist`, which a
+ * CI job that only lints never builds, and the whole graph fails with
+ * `Cannot find module …/entifix-ts-core/dist/index.js`. It passed locally only
+ * because a developer machine always has `dist` from a previous build.
+ *
+ * `session-cookies.spec.ts` imports core and fails if these drift, so the
+ * duplication is checked rather than trusted.
+ */
+export declare const ACCESS_COOKIE = "entifix_at";
+export declare const SESSION_COOKIE = "entifix_sid";
+export declare const LOCALE_COOKIE = "entifix_locale";
+export interface SeedSessionOptions {
+    /** Roles the seeded principal should carry. */
+    roles?: readonly string[];
+    /**
+     * The organization the seeded session acts for. Tenant-plane routes resolve
+     * their storage from this claim, so a spec that exercises one and omits it
+     * gets `409 noActiveOrganization` rather than data. Pass `null` to seed a
+     * session with no tenant scope on purpose — an operator, or a buyer.
+     */
+    activeOrganizationId?: string | null;
+    /**
+     * Which population the seeded principal belongs to — `customer`, `vendor` or
+     * `operator`. Defaults to `vendor`, matching the default organization: a
+     * session that acts for one is a vendor member's. A spec exercising platform
+     * staff passes `operator` together with `activeOrganizationId: null`.
+     */
+    partyRole?: string;
+    /**
+     * The party the seeded principal is — the `Individual` id a route scoping a
+     * read to its caller matches against. Defaults to the seeded vendor party, so
+     * the fixture keeps mirroring what a real sign-in produces.
+     *
+     * Pass `null` to seed an account with no party record, which is the case a
+     * scoped read must answer nothing for rather than everything.
+     */
+    partyId?: string | null;
+    /**
+     * The domains the seeded organization is provisioned for — ADR 0007's second
+     * ceiling, which the back-office nav reads.
+     *
+     * Defaults to the one domain `entitlementSeedData` gives the demo
+     * organization, so the fixture keeps mirroring what a real sign-in produces.
+     * Pass `[]` to seed a member of an organization provisioned for nothing;
+     * that is a different principal from one with `activeOrganizationId: null`,
+     * who is outside the ceiling rather than refused by it.
+     */
+    entitlements?: readonly string[];
+    /**
+     * Locale to pin the run to. Seeded in both profiles so a run does not depend
+     * on the CI machine's `Accept-Language` — without it the same spec renders
+     * Spanish locally and English on a differently-configured runner.
+     */
+    locale?: string;
+    /**
+     * Identifier + password for the `live` profile's real sign-in, performed
+     * against Zitadel's hosted login page. The default is the seeded super-admin
+     * and the dev password `auth-service` provisions them with.
+     */
+    identifier?: string;
+    password?: string;
+    /** Where the sign-in surface is served in `live`. */
+    signInAppUrl?: string;
+}
+/**
+ * Give the browser context a signed-in session before the first navigation.
+ *
+ * Profile-aware, because "being signed in" means different things in each:
+ * `mock` fabricates the cookie, while `live` performs a **real sign-in** through
+ * the provider's hosted page so the token is one auth-service actually minted
+ * and the downstream `requirePermission` checks are genuinely exercised.
+ *
+ * Call it before `page.goto` — an app whose middleware protects the route will
+ * otherwise redirect away before the spec can assert anything.
+ */
+export declare const seedSession: (context: BrowserContext, { roles, activeOrganizationId, partyRole, partyId, entitlements, locale, identifier, password, signInAppUrl, }?: SeedSessionOptions) => Promise<void>;
+//# sourceMappingURL=session.d.ts.map

package/dist/playwright/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/playwright/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAQ,MAAM,kBAAkB,CAAC;AAI7D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,eAAe,CAAC;AAC1C,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAC5C,eAAO,MAAM,aAAa,mBAAmB,CAAC;AAgB9C,MAAM,WAAW,kBAAkB;IACjC,+CAA+C;IAC/C,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAoND;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,GACtB,SAAS,cAAc,EACvB,iHAWG,kBAAuB,KACzB,OAAO,CAAC,IAAI,CAuCd,CAAC"}

package/dist/playwright/session.js

@@ -0,0 +1,250 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+var _process_env_BACK_OFFICE_APP_URL;
+import { isMockProfile } from '../profile/profile.js';
+/**
+ * The cookies a signed-in session travels in — the same names
+ * `@entifix/core` declares, **written out rather than imported**.
+ *
+ * ⚠️ **This module must import no built package at runtime.** Nx builds its
+ * project graph by loading every e2e project's `playwright.config.ts` in plain
+ * Node — no source condition, nothing built — and that config reaches this
+ * file. An `import … from '@entifix/core'` here resolves core's `dist`, which a
+ * CI job that only lints never builds, and the whole graph fails with
+ * `Cannot find module …/entifix-ts-core/dist/index.js`. It passed locally only
+ * because a developer machine always has `dist` from a previous build.
+ *
+ * `session-cookies.spec.ts` imports core and fails if these drift, so the
+ * duplication is checked rather than trusted.
+ */ export const ACCESS_COOKIE = 'entifix_at';
+export const SESSION_COOKIE = 'entifix_sid';
+export const LOCALE_COOKIE = 'entifix_locale';
+/** Give a hosted-UI component time to hydrate before its input is retyped. */ const STEP_SETTLE_MS = 1000;
+/**
+ * Ceiling for a single hosted-UI action. Short on purpose: an action that cannot
+ * complete has lost a race with a navigation, and the step machine wants to look
+ * again rather than sit on it until the test's own timeout fires.
+ */ const ACTION_TIMEOUT_MS = 10000;
+/** How long a step waits for the next screen: 40 × 250ms = 10s. */ const STEP_POLLS = 40;
+const STEP_POLL_MS = 250;
+const base64url = (value)=>Buffer.from(value).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+/**
+ * A structurally valid, **deliberately unsigned** access token. It satisfies
+ * exactly the two things the mock profile exercises — the middleware's cookie
+ * presence check and the server-rendered nav's unverified claim read — and
+ * nothing else: no service verifies it, because in `mock` the services are msw
+ * fixtures. Signing it would need the private key, which the suite has no
+ * business knowing and which is exactly what asymmetric signing exists to keep
+ * out of places like this.
+ */ const fabricateToken = (roles, activeOrganizationId, partyRole, partyId, entitlements)=>{
+    const header = base64url(JSON.stringify({
+        alg: 'RS256',
+        kid: 'e2e-not-a-real-key',
+        typ: 'JWT'
+    }));
+    const payload = base64url(JSON.stringify(_extends({
+        userId: 'e2e-user',
+        subject: 'e2e-user',
+        sessionId: 'e2e-session',
+        roles,
+        partyRole
+    }, partyId === null ? {} : {
+        partyId
+    }, activeOrganizationId === null ? {} : {
+        activeOrganizationId,
+        entitlements
+    }, {
+        exp: Math.floor(Date.now() / 1000) + 3600
+    })));
+    return `${header}.${payload}.e2e-not-a-real-signature`;
+};
+/**
+ * Fill one field of the hosted login and submit it.
+ *
+ * The retype is load-bearing, not defensive. v2 disables Continue on
+ * `!formState.isValid` — react-hook-form state, not the DOM value — and
+ * Playwright can type into the input before Next has hydrated the component.
+ * Those keystrokes reach the DOM and never reach the form, so the button never
+ * enables, and the failure screenshot shows the value sitting in the field as if
+ * nothing were wrong. Typing again once the component is live registers it.
+ *
+ * `pressSequentially` rather than `fill` for the same reason at a smaller scale,
+ * and because it is what the login's own acceptance suite uses.
+ *
+ * Every action is bounded and nothing here throws: losing a race with a
+ * navigation is normal (the screen this was called for is already gone), and the
+ * caller re-reads the route and decides what to do next. An unbounded action
+ * would instead hang until the whole test times out, and report the wrong step.
+ */ const submitHostedField = async (page, testId, value)=>{
+    const input = page.getByTestId(testId);
+    const submit = page.getByTestId('submit-button');
+    try {
+        for(let attempt = 0; attempt < 4; attempt += 1){
+            await input.pressSequentially(value, {
+                timeout: ACTION_TIMEOUT_MS
+            });
+            if (await submit.isEnabled()) break;
+            // The keystrokes went to a component that was not listening yet. Clear
+            // what the DOM kept and type it again into the hydrated one.
+            await page.waitForTimeout(STEP_SETTLE_MS);
+            await input.fill('', {
+                timeout: ACTION_TIMEOUT_MS
+            });
+        }
+        await submit.click({
+            timeout: ACTION_TIMEOUT_MS
+        });
+    } catch (unused) {
+    // Deliberately swallowed — see above.
+    }
+};
+/**
+ * Wait for the hosted login to actually move on.
+ *
+ * A fixed sleep after each step is a race, not a wait: when the redirect is slow
+ * the loop re-reads the same route and acts on a screen that is mid-navigation,
+ * and when it is fast the sleep is wasted. This returns as soon as the route
+ * changes or the session lands, whichever comes first.
+ */ const waitForNextStep = async (context, page, fromPath)=>{
+    for(let i = 0; i < STEP_POLLS; i += 1){
+        if ((await context.cookies()).some((c)=>c.name === ACCESS_COOKIE)) return;
+        if (new URL(page.url()).pathname !== fromPath) return;
+        await page.waitForTimeout(STEP_POLL_MS);
+    }
+};
+/**
+ * Sign in for real, through Zitadel's hosted login page.
+ *
+ * There is no API shortcut left and that is by design: no r10c endpoint accepts
+ * a password, because r10c holds none
+ * ([ADR 0016](../../../../../docs/adr/0016-zitadel-authenticates-r10c-authorizes.md)).
+ * The only way to obtain a real session is the flow a person performs, so the
+ * `live` profile performs it — which also means this fixture exercises the
+ * redirect, the PKCE exchange and the callback rather than skipping them.
+ *
+ * Written against the **v2** hosted login (`ghcr.io/zitadel/zitadel-login`,
+ * `infra/local/zitadel-login`). Screens are told apart by their **route**, not by
+ * what is on them: v2 gives each step its own path under `/ui/v2/login`, while
+ * its `data-testid`s are reused across screens (`reset-button` is "Reset
+ * password" on one and "Skip" on another). Routes are also what the login app's
+ * own acceptance suite drives, so they are the part of its surface most likely
+ * to survive a release.
+ */ const signInThroughHostedUi = async (context, options)=>{
+    const page = await context.newPage();
+    try {
+        await page.goto(`${options.signInAppUrl}/api/auth/oidc/start`);
+        // A step machine rather than a fixed sequence, because the hosted UI's path
+        // is not fixed. Four shapes a scripted login/password pair walks into:
+        //
+        // - **`/loginname`**, the identifier screen, where a cold run starts.
+        // - **`/password`**, after it.
+        // - **`/mfa/set`**, offered after the password to anyone with no enrolled
+        //   factor. `forceMfa` is off, so it is a prompt with a skip.
+        // - **`/accounts`**, when the browser still holds a provider session from an
+        //   earlier spec. There is no login field on it at all.
+        // - **no screen at all**, when the provider session is still live and the
+        //   authorization completes on the redirect.
+        //
+        // The loop's exit condition is the access cookie rather than the URL,
+        // because that is what "signed in" actually means here and it is the only
+        // one of the three that a landing origin does not lie about — the callback
+        // lands on whichever app the redirect names.
+        for(let step = 0; step < 8; step += 1){
+            if ((await context.cookies()).some((c)=>c.name === ACCESS_COOKIE)) break;
+            const path = new URL(page.url()).pathname;
+            if (path.endsWith('/accounts')) {
+                await page.getByRole('link', {
+                    name: /add another account/i
+                }).click({
+                    timeout: ACTION_TIMEOUT_MS
+                });
+                await waitForNextStep(context, page, path);
+                continue;
+            }
+            // Skipping the enrolment offer, not declining MFA: a user who HAS a
+            // factor is challenged at `/otp/...` or `/u2f` instead, and those screens
+            // have no skip — which is why a spec needing an enrolled user must seed
+            // its own code.
+            if (path.includes('/mfa/set')) {
+                await page.getByTestId('reset-button').click({
+                    timeout: ACTION_TIMEOUT_MS
+                });
+                await waitForNextStep(context, page, path);
+                continue;
+            }
+            if (path.endsWith('/loginname')) {
+                await submitHostedField(page, 'username-text-input', options.identifier);
+                await waitForNextStep(context, page, path);
+                continue;
+            }
+            if (path.endsWith('/password')) {
+                await submitHostedField(page, 'password-text-input', options.password);
+                await waitForNextStep(context, page, path);
+                continue;
+            }
+            // No cookie yet and on a route this fixture has not been taught — an MFA
+            // challenge, a password change demand, or a screen v2 grew since. Name the
+            // route, because a bare timeout would send the reader looking in the wrong
+            // place.
+            throw new Error(`seedSession: stuck on the hosted login at ${page.url()} ("${await page.title()}"). ` + `Route "${path}" is not one this fixture handles — a second factor, most likely.`);
+        }
+        if (!(await context.cookies()).some((c)=>c.name === ACCESS_COOKIE)) {
+            throw new Error(`seedSession: finished the hosted login but no ${ACCESS_COOKIE} cookie was set. Is auth-service running and seeded into Zitadel?`);
+        }
+    } finally{
+        await page.close();
+    }
+};
+/**
+ * Give the browser context a signed-in session before the first navigation.
+ *
+ * Profile-aware, because "being signed in" means different things in each:
+ * `mock` fabricates the cookie, while `live` performs a **real sign-in** through
+ * the provider's hosted page so the token is one auth-service actually minted
+ * and the downstream `requirePermission` checks are genuinely exercised.
+ *
+ * Call it before `page.goto` — an app whose middleware protects the route will
+ * otherwise redirect away before the spec can assert anything.
+ */ export const seedSession = async (context, { roles = [
+    'user'
+], activeOrganizationId = 'e2e-organization', partyRole = 'vendor', partyId = 'party-user-2', entitlements = [
+    'product-configuration-management'
+], locale = 'es', identifier = 'ada@example.com', password = 'Password123!', signInAppUrl = (_process_env_BACK_OFFICE_APP_URL = process.env['BACK_OFFICE_APP_URL']) != null ? _process_env_BACK_OFFICE_APP_URL : 'http://localhost:3001' } = {})=>{
+    if (!isMockProfile()) {
+        await signInThroughHostedUi(context, {
+            signInAppUrl,
+            identifier,
+            password
+        });
+        await context.addCookies([
+            {
+                name: LOCALE_COOKIE,
+                value: locale,
+                domain: 'localhost',
+                path: '/'
+            }
+        ]);
+        return;
+    }
+    await context.addCookies([
+        {
+            name: ACCESS_COOKIE,
+            value: fabricateToken(roles, activeOrganizationId, partyRole, partyId, entitlements),
+            domain: 'localhost',
+            path: '/'
+        },
+        {
+            name: SESSION_COOKIE,
+            value: 'e2e-session',
+            domain: 'localhost',
+            path: '/'
+        },
+        {
+            name: LOCALE_COOKIE,
+            value: locale,
+            domain: 'localhost',
+            path: '/'
+        }
+    ]);
+};
+
+//# sourceMappingURL=session.js.map

package/dist/playwright/session.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/playwright/session.ts"],"sourcesContent":["import type { BrowserContext, Page } from '@playwright/test';\n\nimport { isMockProfile } from '../profile/profile.js';\n\n/**\n * The cookies a signed-in session travels in — the same names\n * `@entifix/core` declares, **written out rather than imported**.\n *\n * ⚠️ **This module must import no built package at runtime.** Nx builds its\n * project graph by loading every e2e project's `playwright.config.ts` in plain\n * Node — no source condition, nothing built — and that config reaches this\n * file. An `import … from '@entifix/core'` here resolves core's `dist`, which a\n * CI job that only lints never builds, and the whole graph fails with\n * `Cannot find module …/entifix-ts-core/dist/index.js`. It passed locally only\n * because a developer machine always has `dist` from a previous build.\n *\n * `session-cookies.spec.ts` imports core and fails if these drift, so the\n * duplication is checked rather than trusted.\n */\nexport const ACCESS_COOKIE = 'entifix_at';\nexport const SESSION_COOKIE = 'entifix_sid';\nexport const LOCALE_COOKIE = 'entifix_locale';\n\n/** Give a hosted-UI component time to hydrate before its input is retyped. */\nconst STEP_SETTLE_MS = 1_000;\n\n/**\n * Ceiling for a single hosted-UI action. Short on purpose: an action that cannot\n * complete has lost a race with a navigation, and the step machine wants to look\n * again rather than sit on it until the test's own timeout fires.\n */\nconst ACTION_TIMEOUT_MS = 10_000;\n\n/** How long a step waits for the next screen: 40 × 250ms = 10s. */\nconst STEP_POLLS = 40;\nconst STEP_POLL_MS = 250;\n\nexport interface SeedSessionOptions {\n  /** Roles the seeded principal should carry. */\n  roles?: readonly string[];\n  /**\n   * The organization the seeded session acts for. Tenant-plane routes resolve\n   * their storage from this claim, so a spec that exercises one and omits it\n   * gets `409 noActiveOrganization` rather than data. Pass `null` to seed a\n   * session with no tenant scope on purpose — an operator, or a buyer.\n   */\n  activeOrganizationId?: string | null;\n  /**\n   * Which population the seeded principal belongs to — `customer`, `vendor` or\n   * `operator`. Defaults to `vendor`, matching the default organization: a\n   * session that acts for one is a vendor member's. A spec exercising platform\n   * staff passes `operator` together with `activeOrganizationId: null`.\n   */\n  partyRole?: string;\n  /**\n   * The party the seeded principal is — the `Individual` id a route scoping a\n   * read to its caller matches against. Defaults to the seeded vendor party, so\n   * the fixture keeps mirroring what a real sign-in produces.\n   *\n   * Pass `null` to seed an account with no party record, which is the case a\n   * scoped read must answer nothing for rather than everything.\n   */\n  partyId?: string | null;\n  /**\n   * The domains the seeded organization is provisioned for — ADR 0007's second\n   * ceiling, which the back-office nav reads.\n   *\n   * Defaults to the one domain `entitlementSeedData` gives the demo\n   * organization, so the fixture keeps mirroring what a real sign-in produces.\n   * Pass `[]` to seed a member of an organization provisioned for nothing;\n   * that is a different principal from one with `activeOrganizationId: null`,\n   * who is outside the ceiling rather than refused by it.\n   */\n  entitlements?: readonly string[];\n  /**\n   * Locale to pin the run to. Seeded in both profiles so a run does not depend\n   * on the CI machine's `Accept-Language` — without it the same spec renders\n   * Spanish locally and English on a differently-configured runner.\n   */\n  locale?: string;\n  /**\n   * Identifier + password for the `live` profile's real sign-in, performed\n   * against Zitadel's hosted login page. The default is the seeded super-admin\n   * and the dev password `auth-service` provisions them with.\n   */\n  identifier?: string;\n  password?: string;\n  /** Where the sign-in surface is served in `live`. */\n  signInAppUrl?: string;\n}\n\nconst base64url = (value: string): string =>\n  Buffer.from(value)\n    .toString('base64')\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\n/**\n * A structurally valid, **deliberately unsigned** access token. It satisfies\n * exactly the two things the mock profile exercises — the middleware's cookie\n * presence check and the server-rendered nav's unverified claim read — and\n * nothing else: no service verifies it, because in `mock` the services are msw\n * fixtures. Signing it would need the private key, which the suite has no\n * business knowing and which is exactly what asymmetric signing exists to keep\n * out of places like this.\n */\nconst fabricateToken = (\n  roles: readonly string[],\n  activeOrganizationId: string | null,\n  partyRole: string,\n  partyId: string | null,\n  entitlements: readonly string[],\n): string => {\n  const header = base64url(\n    JSON.stringify({ alg: 'RS256', kid: 'e2e-not-a-real-key', typ: 'JWT' }),\n  );\n  const payload = base64url(\n    JSON.stringify({\n      userId: 'e2e-user',\n      subject: 'e2e-user',\n      sessionId: 'e2e-session',\n      roles,\n      partyRole,\n      ...(partyId === null ? {} : { partyId }),\n      ...(activeOrganizationId === null\n        ? {}\n        : { activeOrganizationId, entitlements }),\n      exp: Math.floor(Date.now() / 1000) + 3600,\n    }),\n  );\n  return `${header}.${payload}.e2e-not-a-real-signature`;\n};\n\n/**\n * Fill one field of the hosted login and submit it.\n *\n * The retype is load-bearing, not defensive. v2 disables Continue on\n * `!formState.isValid` — react-hook-form state, not the DOM value — and\n * Playwright can type into the input before Next has hydrated the component.\n * Those keystrokes reach the DOM and never reach the form, so the button never\n * enables, and the failure screenshot shows the value sitting in the field as if\n * nothing were wrong. Typing again once the component is live registers it.\n *\n * `pressSequentially` rather than `fill` for the same reason at a smaller scale,\n * and because it is what the login's own acceptance suite uses.\n *\n * Every action is bounded and nothing here throws: losing a race with a\n * navigation is normal (the screen this was called for is already gone), and the\n * caller re-reads the route and decides what to do next. An unbounded action\n * would instead hang until the whole test times out, and report the wrong step.\n */\nconst submitHostedField = async (\n  page: Page,\n  testId: string,\n  value: string,\n): Promise<void> => {\n  const input = page.getByTestId(testId);\n  const submit = page.getByTestId('submit-button');\n  try {\n    for (let attempt = 0; attempt < 4; attempt += 1) {\n      await input.pressSequentially(value, { timeout: ACTION_TIMEOUT_MS });\n      if (await submit.isEnabled()) break;\n      // The keystrokes went to a component that was not listening yet. Clear\n      // what the DOM kept and type it again into the hydrated one.\n      await page.waitForTimeout(STEP_SETTLE_MS);\n      await input.fill('', { timeout: ACTION_TIMEOUT_MS });\n    }\n    await submit.click({ timeout: ACTION_TIMEOUT_MS });\n  } catch {\n    // Deliberately swallowed — see above.\n  }\n};\n\n/**\n * Wait for the hosted login to actually move on.\n *\n * A fixed sleep after each step is a race, not a wait: when the redirect is slow\n * the loop re-reads the same route and acts on a screen that is mid-navigation,\n * and when it is fast the sleep is wasted. This returns as soon as the route\n * changes or the session lands, whichever comes first.\n */\nconst waitForNextStep = async (\n  context: BrowserContext,\n  page: Page,\n  fromPath: string,\n): Promise<void> => {\n  for (let i = 0; i < STEP_POLLS; i += 1) {\n    if ((await context.cookies()).some(c => c.name === ACCESS_COOKIE)) return;\n    if (new URL(page.url()).pathname !== fromPath) return;\n    await page.waitForTimeout(STEP_POLL_MS);\n  }\n};\n\n/**\n * Sign in for real, through Zitadel's hosted login page.\n *\n * There is no API shortcut left and that is by design: no r10c endpoint accepts\n * a password, because r10c holds none\n * ([ADR 0016](../../../../../docs/adr/0016-zitadel-authenticates-r10c-authorizes.md)).\n * The only way to obtain a real session is the flow a person performs, so the\n * `live` profile performs it — which also means this fixture exercises the\n * redirect, the PKCE exchange and the callback rather than skipping them.\n *\n * Written against the **v2** hosted login (`ghcr.io/zitadel/zitadel-login`,\n * `infra/local/zitadel-login`). Screens are told apart by their **route**, not by\n * what is on them: v2 gives each step its own path under `/ui/v2/login`, while\n * its `data-testid`s are reused across screens (`reset-button` is \"Reset\n * password\" on one and \"Skip\" on another). Routes are also what the login app's\n * own acceptance suite drives, so they are the part of its surface most likely\n * to survive a release.\n */\nconst signInThroughHostedUi = async (\n  context: BrowserContext,\n  options: {\n    readonly signInAppUrl: string;\n    readonly identifier: string;\n    readonly password: string;\n  },\n): Promise<void> => {\n  const page = await context.newPage();\n  try {\n    await page.goto(`${options.signInAppUrl}/api/auth/oidc/start`);\n\n    // A step machine rather than a fixed sequence, because the hosted UI's path\n    // is not fixed. Four shapes a scripted login/password pair walks into:\n    //\n    // - **`/loginname`**, the identifier screen, where a cold run starts.\n    // - **`/password`**, after it.\n    // - **`/mfa/set`**, offered after the password to anyone with no enrolled\n    //   factor. `forceMfa` is off, so it is a prompt with a skip.\n    // - **`/accounts`**, when the browser still holds a provider session from an\n    //   earlier spec. There is no login field on it at all.\n    // - **no screen at all**, when the provider session is still live and the\n    //   authorization completes on the redirect.\n    //\n    // The loop's exit condition is the access cookie rather than the URL,\n    // because that is what \"signed in\" actually means here and it is the only\n    // one of the three that a landing origin does not lie about — the callback\n    // lands on whichever app the redirect names.\n    for (let step = 0; step < 8; step += 1) {\n      if ((await context.cookies()).some(c => c.name === ACCESS_COOKIE)) break;\n\n      const path = new URL(page.url()).pathname;\n\n      if (path.endsWith('/accounts')) {\n        await page\n          .getByRole('link', { name: /add another account/i })\n          .click({ timeout: ACTION_TIMEOUT_MS });\n        await waitForNextStep(context, page, path);\n        continue;\n      }\n\n      // Skipping the enrolment offer, not declining MFA: a user who HAS a\n      // factor is challenged at `/otp/...` or `/u2f` instead, and those screens\n      // have no skip — which is why a spec needing an enrolled user must seed\n      // its own code.\n      if (path.includes('/mfa/set')) {\n        await page\n          .getByTestId('reset-button')\n          .click({ timeout: ACTION_TIMEOUT_MS });\n        await waitForNextStep(context, page, path);\n        continue;\n      }\n\n      if (path.endsWith('/loginname')) {\n        await submitHostedField(\n          page,\n          'username-text-input',\n          options.identifier,\n        );\n        await waitForNextStep(context, page, path);\n        continue;\n      }\n\n      if (path.endsWith('/password')) {\n        await submitHostedField(page, 'password-text-input', options.password);\n        await waitForNextStep(context, page, path);\n        continue;\n      }\n\n      // No cookie yet and on a route this fixture has not been taught — an MFA\n      // challenge, a password change demand, or a screen v2 grew since. Name the\n      // route, because a bare timeout would send the reader looking in the wrong\n      // place.\n      throw new Error(\n        `seedSession: stuck on the hosted login at ${page.url()} (\"${await page.title()}\"). ` +\n          `Route \"${path}\" is not one this fixture handles — a second factor, most likely.`,\n      );\n    }\n\n    if (!(await context.cookies()).some(c => c.name === ACCESS_COOKIE)) {\n      throw new Error(\n        `seedSession: finished the hosted login but no ${ACCESS_COOKIE} cookie was set. Is auth-service running and seeded into Zitadel?`,\n      );\n    }\n  } finally {\n    await page.close();\n  }\n};\n\n/**\n * Give the browser context a signed-in session before the first navigation.\n *\n * Profile-aware, because \"being signed in\" means different things in each:\n * `mock` fabricates the cookie, while `live` performs a **real sign-in** through\n * the provider's hosted page so the token is one auth-service actually minted\n * and the downstream `requirePermission` checks are genuinely exercised.\n *\n * Call it before `page.goto` — an app whose middleware protects the route will\n * otherwise redirect away before the spec can assert anything.\n */\nexport const seedSession = async (\n  context: BrowserContext,\n  {\n    roles = ['user'],\n    activeOrganizationId = 'e2e-organization',\n    partyRole = 'vendor',\n    partyId = 'party-user-2',\n    entitlements = ['product-configuration-management'],\n    locale = 'es',\n    identifier = 'ada@example.com',\n    password = 'Password123!',\n    signInAppUrl = process.env['BACK_OFFICE_APP_URL'] ??\n      'http://localhost:3001',\n  }: SeedSessionOptions = {},\n): Promise<void> => {\n  if (!isMockProfile()) {\n    await signInThroughHostedUi(context, {\n      signInAppUrl,\n      identifier,\n      password,\n    });\n    await context.addCookies([\n      { name: LOCALE_COOKIE, value: locale, domain: 'localhost', path: '/' },\n    ]);\n    return;\n  }\n\n  await context.addCookies([\n    {\n      name: ACCESS_COOKIE,\n      value: fabricateToken(\n        roles,\n        activeOrganizationId,\n        partyRole,\n        partyId,\n        entitlements,\n      ),\n      domain: 'localhost',\n      path: '/',\n    },\n    {\n      name: SESSION_COOKIE,\n      value: 'e2e-session',\n      domain: 'localhost',\n      path: '/',\n    },\n    {\n      name: LOCALE_COOKIE,\n      value: locale,\n      domain: 'localhost',\n      path: '/',\n    },\n  ]);\n};\n"],"names":["process","isMockProfile","ACCESS_COOKIE","SESSION_COOKIE","LOCALE_COOKIE","STEP_SETTLE_MS","ACTION_TIMEOUT_MS","STEP_POLLS","STEP_POLL_MS","base64url","value","Buffer","from","toString","replace","fabricateToken","roles","activeOrganizationId","partyRole","partyId","entitlements","header","JSON","stringify","alg","kid","typ","payload","userId","subject","sessionId","exp","Math","floor","Date","now","submitHostedField","page","testId","input","getByTestId","submit","attempt","pressSequentially","timeout","isEnabled","waitForTimeout","fill","click","waitForNextStep","context","fromPath","i","cookies","some","c","name","URL","url","pathname","signInThroughHostedUi","options","newPage","goto","signInAppUrl","step","path","endsWith","getByRole","includes","identifier","password","Error","title","close","seedSession","locale","env","addCookies","domain"],"mappings":";IAmUmBA;AAjUnB,SAASC,aAAa,QAAQ,wBAAwB;AAEtD;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,gBAAgB,aAAa;AAC1C,OAAO,MAAMC,iBAAiB,cAAc;AAC5C,OAAO,MAAMC,gBAAgB,iBAAiB;AAE9C,4EAA4E,GAC5E,MAAMC,iBAAiB;AAEvB;;;;CAIC,GACD,MAAMC,oBAAoB;AAE1B,iEAAiE,GACjE,MAAMC,aAAa;AACnB,MAAMC,eAAe;AAwDrB,MAAMC,YAAY,CAACC,QACjBC,OAAOC,IAAI,CAACF,OACTG,QAAQ,CAAC,UACTC,OAAO,CAAC,OAAO,KACfA,OAAO,CAAC,OAAO,KACfA,OAAO,CAAC,OAAO;AAEpB;;;;;;;;CAQC,GACD,MAAMC,iBAAiB,CACrBC,OACAC,sBACAC,WACAC,SACAC;IAEA,MAAMC,SAASZ,UACba,KAAKC,SAAS,CAAC;QAAEC,KAAK;QAASC,KAAK;QAAsBC,KAAK;IAAM;IAEvE,MAAMC,UAAUlB,UACda,KAAKC,SAAS,CAAC;QACbK,QAAQ;QACRC,SAAS;QACTC,WAAW;QACXd;QACAE;OACIC,YAAY,OAAO,CAAC,IAAI;QAAEA;IAAQ,GAClCF,yBAAyB,OACzB,CAAC,IACD;QAAEA;QAAsBG;IAAa;QACzCW,KAAKC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,QAAQ;;IAGzC,OAAO,GAAGd,OAAO,CAAC,EAAEM,QAAQ,yBAAyB,CAAC;AACxD;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,MAAMS,oBAAoB,OACxBC,MACAC,QACA5B;IAEA,MAAM6B,QAAQF,KAAKG,WAAW,CAACF;IAC/B,MAAMG,SAASJ,KAAKG,WAAW,CAAC;IAChC,IAAI;QACF,IAAK,IAAIE,UAAU,GAAGA,UAAU,GAAGA,WAAW,EAAG;YAC/C,MAAMH,MAAMI,iBAAiB,CAACjC,OAAO;gBAAEkC,SAAStC;YAAkB;YAClE,IAAI,MAAMmC,OAAOI,SAAS,IAAI;YAC9B,uEAAuE;YACvE,6DAA6D;YAC7D,MAAMR,KAAKS,cAAc,CAACzC;YAC1B,MAAMkC,MAAMQ,IAAI,CAAC,IAAI;gBAAEH,SAAStC;YAAkB;QACpD;QACA,MAAMmC,OAAOO,KAAK,CAAC;YAAEJ,SAAStC;QAAkB;IAClD,EAAE,eAAM;IACN,sCAAsC;IACxC;AACF;AAEA;;;;;;;CAOC,GACD,MAAM2C,kBAAkB,OACtBC,SACAb,MACAc;IAEA,IAAK,IAAIC,IAAI,GAAGA,IAAI7C,YAAY6C,KAAK,EAAG;QACtC,IAAI,AAAC,CAAA,MAAMF,QAAQG,OAAO,EAAC,EAAGC,IAAI,CAACC,CAAAA,IAAKA,EAAEC,IAAI,KAAKtD,gBAAgB;QACnE,IAAI,IAAIuD,IAAIpB,KAAKqB,GAAG,IAAIC,QAAQ,KAAKR,UAAU;QAC/C,MAAMd,KAAKS,cAAc,CAACtC;IAC5B;AACF;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,MAAMoD,wBAAwB,OAC5BV,SACAW;IAMA,MAAMxB,OAAO,MAAMa,QAAQY,OAAO;IAClC,IAAI;QACF,MAAMzB,KAAK0B,IAAI,CAAC,GAAGF,QAAQG,YAAY,CAAC,oBAAoB,CAAC;QAE7D,4EAA4E;QAC5E,uEAAuE;QACvE,EAAE;QACF,sEAAsE;QACtE,+BAA+B;QAC/B,0EAA0E;QAC1E,8DAA8D;QAC9D,6EAA6E;QAC7E,wDAAwD;QACxD,0EAA0E;QAC1E,6CAA6C;QAC7C,EAAE;QACF,sEAAsE;QACtE,0EAA0E;QAC1E,2EAA2E;QAC3E,6CAA6C;QAC7C,IAAK,IAAIC,OAAO,GAAGA,OAAO,GAAGA,QAAQ,EAAG;YACtC,IAAI,AAAC,CAAA,MAAMf,QAAQG,OAAO,EAAC,EAAGC,IAAI,CAACC,CAAAA,IAAKA,EAAEC,IAAI,KAAKtD,gBAAgB;YAEnE,MAAMgE,OAAO,IAAIT,IAAIpB,KAAKqB,GAAG,IAAIC,QAAQ;YAEzC,IAAIO,KAAKC,QAAQ,CAAC,cAAc;gBAC9B,MAAM9B,KACH+B,SAAS,CAAC,QAAQ;oBAAEZ,MAAM;gBAAuB,GACjDR,KAAK,CAAC;oBAAEJ,SAAStC;gBAAkB;gBACtC,MAAM2C,gBAAgBC,SAASb,MAAM6B;gBACrC;YACF;YAEA,oEAAoE;YACpE,0EAA0E;YAC1E,wEAAwE;YACxE,gBAAgB;YAChB,IAAIA,KAAKG,QAAQ,CAAC,aAAa;gBAC7B,MAAMhC,KACHG,WAAW,CAAC,gBACZQ,KAAK,CAAC;oBAAEJ,SAAStC;gBAAkB;gBACtC,MAAM2C,gBAAgBC,SAASb,MAAM6B;gBACrC;YACF;YAEA,IAAIA,KAAKC,QAAQ,CAAC,eAAe;gBAC/B,MAAM/B,kBACJC,MACA,uBACAwB,QAAQS,UAAU;gBAEpB,MAAMrB,gBAAgBC,SAASb,MAAM6B;gBACrC;YACF;YAEA,IAAIA,KAAKC,QAAQ,CAAC,cAAc;gBAC9B,MAAM/B,kBAAkBC,MAAM,uBAAuBwB,QAAQU,QAAQ;gBACrE,MAAMtB,gBAAgBC,SAASb,MAAM6B;gBACrC;YACF;YAEA,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,SAAS;YACT,MAAM,IAAIM,MACR,CAAC,0CAA0C,EAAEnC,KAAKqB,GAAG,GAAG,GAAG,EAAE,MAAMrB,KAAKoC,KAAK,GAAG,IAAI,CAAC,GACnF,CAAC,OAAO,EAAEP,KAAK,iEAAiE,CAAC;QAEvF;QAEA,IAAI,CAAC,AAAC,CAAA,MAAMhB,QAAQG,OAAO,EAAC,EAAGC,IAAI,CAACC,CAAAA,IAAKA,EAAEC,IAAI,KAAKtD,gBAAgB;YAClE,MAAM,IAAIsE,MACR,CAAC,8CAA8C,EAAEtE,cAAc,iEAAiE,CAAC;QAErI;IACF,SAAU;QACR,MAAMmC,KAAKqC,KAAK;IAClB;AACF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,cAAc,OACzBzB,SACA,EACElC,QAAQ;IAAC;CAAO,EAChBC,uBAAuB,kBAAkB,EACzCC,YAAY,QAAQ,EACpBC,UAAU,cAAc,EACxBC,eAAe;IAAC;CAAmC,EACnDwD,SAAS,IAAI,EACbN,aAAa,iBAAiB,EAC9BC,WAAW,cAAc,EACzBP,gBAAehE,mCAAAA,QAAQ6E,GAAG,CAAC,sBAAsB,YAAlC7E,mCACb,uBAAuB,EACN,GAAG,CAAC,CAAC;IAE1B,IAAI,CAACC,iBAAiB;QACpB,MAAM2D,sBAAsBV,SAAS;YACnCc;YACAM;YACAC;QACF;QACA,MAAMrB,QAAQ4B,UAAU,CAAC;YACvB;gBAAEtB,MAAMpD;gBAAeM,OAAOkE;gBAAQG,QAAQ;gBAAab,MAAM;YAAI;SACtE;QACD;IACF;IAEA,MAAMhB,QAAQ4B,UAAU,CAAC;QACvB;YACEtB,MAAMtD;YACNQ,OAAOK,eACLC,OACAC,sBACAC,WACAC,SACAC;YAEF2D,QAAQ;YACRb,MAAM;QACR;QACA;YACEV,MAAMrD;YACNO,OAAO;YACPqE,QAAQ;YACRb,MAAM;QACR;QACA;YACEV,MAAMpD;YACNM,OAAOkE;YACPG,QAAQ;YACRb,MAAM;QACR;KACD;AACH,EAAE"}

package/dist/playwright/test.d.ts

@@ -0,0 +1,51 @@
+import { type NetworkFixture } from '@msw/playwright';
+import type { AnyHandler } from 'msw';
+export interface EntifixE2eFixtures {
+    /** The handlers the mock profile starts from. Overridable per project. */
+    handlers: AnyHandler[];
+    /** The msw network, for per-test overrides in a `*.mock.spec.ts`. */
+    network: NetworkFixture;
+    /** Refuses a hermetic run against a reused development server. */
+    expectedServer: void;
+}
+export interface EntifixE2eTestOptions {
+    /**
+     * The mock backend. Ignored in the `live` profile, where the app talks to a
+     * real service.
+     */
+    handlers?: AnyHandler[];
+    /**
+     * Origins whose unstubbed requests are allowed through — in practice the app
+     * under test itself, which serves its own documents, RSC payloads and
+     * dev-tooling endpoints.
+     *
+     * Everything else must be stubbed: a request to a *service* that nobody
+     * handled fails the test rather than escaping to a machine that may not even
+     * be running.
+     */
+    passthroughOrigins?: string[];
+}
+/**
+ * Playwright's own `test`, plus the reused-server guard and nothing else.
+ *
+ * For a spec that wants no msw network and no seeded session — proving the
+ * unauthenticated redirect, say. It exists so that "this spec needs no
+ * fixtures" cannot quietly mean "this spec is not checked against the artifact
+ * it is running on": importing `test` straight from `@playwright/test` is what
+ * left the account journeys resolving a principal against a live auth-service
+ * while claiming to be hermetic.
+ */
+export declare const baseTest: import("@playwright/test").TestType<import("@playwright/test").PlaywrightTestArgs & import("@playwright/test").PlaywrightTestOptions & Pick<EntifixE2eFixtures, "expectedServer">, import("@playwright/test").PlaywrightWorkerArgs & import("@playwright/test").PlaywrightWorkerOptions>;
+/**
+ * Builds the `test` an entifix app e2e project imports.
+ *
+ * In `mock` it installs the msw handlers over Playwright's `page.route()`
+ * (via `@msw/playwright`), so the browser talks to the fixture backend and the
+ * app itself is untouched — no worker script, no `NEXT_PUBLIC_*` switch, no
+ * mocking code shipped in the application bundle. In `live` the fixture stands
+ * down and the same specs hit the real service.
+ */
+export declare const defineEntifixE2eTest: ({ handlers, passthroughOrigins, }?: EntifixE2eTestOptions) => import("@playwright/test").TestType<import("@playwright/test").PlaywrightTestArgs & import("@playwright/test").PlaywrightTestOptions & Pick<EntifixE2eFixtures, "expectedServer"> & EntifixE2eFixtures, import("@playwright/test").PlaywrightWorkerArgs & import("@playwright/test").PlaywrightWorkerOptions>;
+export type { NetworkFixture } from '@msw/playwright';
+export { expect } from '@playwright/test';
+//# sourceMappingURL=test.d.ts.map

package/dist/playwright/test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test.d.ts","sourceRoot":"","sources":["../../src/playwright/test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE5E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAKtC,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,qEAAqE;IACrE,OAAO,EAAE,cAAc,CAAC;IACxB,kEAAkE;IAClE,cAAc,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IACxB;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAeD;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,0RAUpB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,oCAGlC,qBAA0B,kTAkCzB,CAAC;AAEL,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC"}