@globisnv/cypress-core 2.1.3 → 2.2.0

package/README.md

@@ -221,10 +221,10 @@ Set via Cypress env (`config.env`, `CYPRESS_*`, or `--env`) unless noted.
 | Key | Purpose |
 | --- | --- |
 | `globisUrl` | Base solution URL. `GLJ/GLS/GLT_login` rewrite the `/solution/<name>` segment off this. |
-| `portalUrl`, `formBuilderUrl`, `oktaUrl` | Entry URLs for the portal, form builder and Okta login flows. |
+| `portalUrl`, `formBuilderUrl`, `ssoUrl` | Entry URLs for the portal, form builder and Okta login flows (`ssoUrl` was `oktaUrl`). With `loginType: sso` the provider follows from it: Okta when it contains `okta`, otherwise Keycloak (default `https://auth.globis.cloud`). |
 | `username`, `username2` | Default and alternate login users. |
-| `password`, `password2`, `api_key` | Secrets — kept node-side, never exposed to the browser. |
-| `loginType`, `ownerName`, `formBuilderStandalone`, `saveData` | Login/flow switches read by the commands. |
+| `password`, `password2`, `api_key`, `otpSecret` | Secrets — kept node-side, never exposed to the browser. `otpSecret` is the base32 TOTP secret for Keycloak users with OTP. |
+| `loginType` (`default`/`servoy`/`sso`), `ownerName`, `formBuilderStandalone`, `saveData` | Login/flow switches read by the commands. |
 | `BUILD_NUMBER` | Used by `getOrCreateUuid()` to build a stable `CYP<build>` test-data prefix. |
 | `extraParams` | Object of Jenkins-passed extras; `cypressWebsocketLoader` and `cypressWebsocketDebug` (`'true'`) live here. |
 | `AMP_REMOTE_WRITE_URL`, `AMP_REGION` | Node `process.env` — Prometheus remote-write target and region. |

package/dist/ci/sso-login.cy.js

@@ -0,0 +1,8 @@
+"use strict";
+// CI pre-step: logs in once so parallel runners on other machines can take over the SSO session (env ssoSessionFile).
+// Run it with: cypress run --spec node_modules/@globisnv/cypress-core/dist/ci/sso-login.cy.js
+describe('SSO login once', () => {
+    it('logs in and stores the IdP session for the other runners', () => {
+        cy.GLO_login();
+    });
+});

package/dist/commands/FOB_commands.d.ts

@@ -29,7 +29,7 @@ declare global {
              * @param {string} [company] - Optional parameter representing the company name.
              * @param {boolean} [formBuilderStandalone] - Optional check if test uses standalone formbuilder or not.
              */
-            FOB_oktaLogin(company?: string, formBuilderStandalone?: boolean): void;
+            FOB_ssoLogin(company?: string, formBuilderStandalone?: boolean): void;
             /**
              * Command to add a new custom view.
              *

package/dist/commands/FOB_commands.js

@@ -8,8 +8,8 @@ Cypress.Commands.add('FOB_login', (company, formBuilderStandalone) => {
         case 'servoy':
             cy.POR_servoyLogin(company, formBuilderStandalone);
             break;
-        case 'okta':
-            cy.FOB_oktaLogin(company, formBuilderStandalone);
+        case 'sso':
+            cy.FOB_ssoLogin(company, formBuilderStandalone);
             break;
         case 'default':
             cy.FOB_defaultLogin(company, formBuilderStandalone);
@@ -66,14 +66,14 @@ Cypress.Commands.add('FOB_defaultLogin', (company, formBuilderStandalone) => {
     }
     cy.get(`[data-cy="formbuilder${formBuilderStandalone ? '_standalone' : ''}.navbar_top"]`, { timeout: 120000 }).should('exist');
 });
-Cypress.Commands.add('FOB_oktaLogin', (company, formBuilderStandalone) => {
+Cypress.Commands.add('FOB_ssoLogin', (company, formBuilderStandalone) => {
     // Change the Url if necessary
     const url = Cypress.expose('formBuilderUrl');
     cy.visit(url);
     // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for okta redirect page load
     cy.wait(2000);
     cy.task('log', 'Redirect to okta url');
-    cy.origin(Cypress.expose('oktaUrl'), () => {
+    cy.origin(Cypress.expose('ssoUrl'), () => {
         cy.get('.o-form-input')
             .find('[autocomplete="username"]')
             .type(Cypress.expose('username'));

package/dist/commands/GLO_commands.d.ts

@@ -65,15 +65,6 @@ declare global {
              * If provided, the specified company will be selected during login.
              */
             GLO_defaultloginExtraUser(usernameENV: string, passwordENV: string, company?: string): void;
-            /**
-             * Command to perform a login using Okta authentication.
-             *
-             * @param {string} [company] - Optional parameter representing the company name.
-             * If provided, it selects the specified company after login.
-             * @param {urlTypeType} [urlType] - This optional parameter is used to change the url solution parameter from 'online' to something else, e.g. 'pos'.
-             * @param {skipCheckFlag} [skipNavCheck] - This optional parameter is used to skip the navbar validation. Only use this in rare cases
-             */
-            GLO_oktaLogin(company?: string, urlType?: urlTypeType, skipNavCheck?: skipCheckFlag): void;
             /**
              * Command to perform a logout.
              */

package/dist/commands/GLO_commands.js

@@ -88,14 +88,14 @@ Cypress.Commands.add('GLO_login', (company, urlType) => {
         case 'servoy':
             cy.GLO_servoyLogin(company);
             break;
-        case 'okta':
-            cy.GLO_oktaLogin(company, urlType);
+        case 'sso':
+            ssoLogin(company, urlType);
             break;
         case 'default':
             cy.GLO_defaultlogin(company, undefined, undefined, urlType);
             break;
         default:
-            throw new Error('Incorrect type for GLO_login. Available types: servoy, okta, default');
+            throw new Error('Incorrect type for GLO_login. Available types: servoy, sso, default');
     }
 });
 Cypress.Commands.add('GLO_defaultlogin', (company, usernameENV = 'username', passwordENV = 'password', urlType) => {
@@ -164,8 +164,12 @@ Cypress.Commands.add('GLO_defaultloginExtraUser', (usernameENV, passwordENV, com
     }
     cy.get('[data-cy="ng$main_form2.navbar_top"]', { timeout: 120000 }).should('exist');
 });
-const waitForWebSocketAfterOkta = () => {
-    cy.url({ timeout: 60000 }).should('not.include', new URL(Cypress.expose('oktaUrl')).hostname);
+// loginType sso: the URL of the identity provider, Globis Online's own Keycloak is the default
+const ssoUrl = () => Cypress.expose('ssoUrl') || 'https://auth.globis.cloud';
+// The provider follows from the URL. ponytail: add a provider here when a third one is supported
+const ssoProvider = () => (new URL(ssoUrl()).hostname.includes('okta') ? 'okta' : 'keycloak');
+const waitForWebSocketAfterSso = (idp = ssoUrl()) => {
+    cy.url({ timeout: 60000 }).should('not.include', new URL(idp).hostname);
     cy.window({ timeout: 60000 }).should((win) => {
         const w = win;
         if (!w.wsMessages)
@@ -177,20 +181,8 @@ const waitForWebSocketAfterOkta = () => {
         cy.task('log', `WebSocket spy confirmed connected, ${win.wsMessages?.messages.length} messages captured so far`);
     });
 };
-Cypress.Commands.add('GLO_oktaLogin', (company, urlType, skipvNavCheck) => {
-    // Change the Url if necessary
-    let url = Cypress.expose('globisUrl');
-    if (urlType) {
-        const target = globisUrlTypes.includes(urlType) ? 'globis_online' : 'online';
-        url = url.replace(target, urlType);
-    }
-    // Stateless Okta login redirects server side before any Servoy client boots, so there is no
-    // websocket to wait for on the first visit — the connection is only asserted after the Okta
-    // round trip (see waitForWebSocketAfterOkta). The spy itself is attached globally on every
-    // AUT page load (see websocketDetector.ts), which covers this server-side redirect too.
-    cy.visit(url);
-    cy.task('log', 'Redirect to okta url');
-    cy.origin(Cypress.expose('oktaUrl'), () => {
+const oktaIdpLogin = () => {
+    cy.origin(ssoUrl(), () => {
         cy.get('.o-form-input', { timeout: 60000 })
             .find('[autocomplete="username"]')
             .clear()
@@ -205,11 +197,96 @@ Cypress.Commands.add('GLO_oktaLogin', (company, urlType, skipvNavCheck) => {
         cy.task('log', 'Filled in password');
         cy.get('[type="submit"]').click();
     });
+};
+// Keycloak: username page, password page, then a one-time code page when the user has OTP (otpSecret is set)
+const keycloakIdpLogin = () => {
+    // The code is made outside cy.origin: a task that waits for a free OTP window times out after 4s inside it.
+    // It is claimed right before the IdP pages, so it is still fresh when typed.
+    cy.env(['otpSecret']).then(({ otpSecret }) => {
+        if (otpSecret)
+            cy.task('totp', otpSecret, { log: false, timeout: 200000 }).then((code) => keycloakOrigin(code));
+        else
+            keycloakOrigin(undefined);
+    });
+};
+const keycloakOrigin = (code) => {
+    cy.origin(ssoUrl(), { args: { code } }, ({ code }) => {
+        cy.get('input[name="username"]', { timeout: 60000 })
+            .clear()
+            .type(Cypress.expose('username'));
+        cy.task('log', 'Filled in username');
+        cy.get('#kc-login').click();
+        cy.env(['password']).then(({ password }) => {
+            cy.get('input[name="password"]', { timeout: 20000 }).type(password, { log: false });
+            cy.task('log', 'Filled in password');
+            cy.get('#kc-login').click();
+            if (code) {
+                cy.get('input[name="otp"]', { timeout: 20000 }).should('be.visible');
+                cy.get('input[name="otp"]').type(code, { log: false });
+                cy.task('log', 'Filled in one-time code');
+                cy.get('#kc-login').click();
+            }
+        });
+    });
+};
+// One IdP login per run (cy.session, also across specs): every later call only revisits the app,
+// which the IdP signs in silently, so no password/OTP is asked again.
+// ponytail: no `validate` — an expired IdP session shows up as a login page, add a validate if that happens
+const ssoLogin = (company, urlType, skipvNavCheck) => {
+    const provider = ssoProvider();
+    // Change the Url if necessary
+    let url = Cypress.expose('globisUrl');
+    if (urlType) {
+        const target = globisUrlTypes.includes(urlType) ? 'globis_online' : 'online';
+        url = url.replace(target, urlType);
+    }
+    cy.session(['sso', provider, Cypress.expose('username'), ssoUrl(), url], () => {
+        const file = Cypress.expose('ssoSessionFile');
+        const idpHost = new URL(ssoUrl()).hostname;
+        const isIdpCookie = (c) => idpHost === c.domain.replace(/^\./, '') || idpHost.endsWith(`.${c.domain.replace(/^\./, '')}`);
+        const login = () => {
+            // Stateless SSO login redirects server side before any Servoy client boots, so there is no
+            // websocket to wait for on the first visit — the connection is only asserted after the IdP
+            // round trip (see waitForWebSocketAfterSso). The spy itself is attached globally on every
+            // AUT page load (see websocketDetector.ts), which covers this server-side redirect too.
+            cy.visit(url);
+            cy.task('log', `Redirect to ${provider} url`);
+            if (provider === 'okta')
+                oktaIdpLogin();
+            else
+                keycloakIdpLogin();
+            // Let the app finish its login callback, then keep only the IdP cookies: the app's own client session
+            // does not survive a restore, so every call starts a fresh app client that the IdP signs in silently.
+            if (cypressWebsocketLoader)
+                waitForWebSocketAfterSso(ssoUrl());
+            else
+                cy.url({ timeout: 60000 }).should('not.include', idpHost);
+            cy.getAllCookies({ log: false }).then((all) => {
+                for (const c of all)
+                    if (!isIdpCookie(c))
+                        cy.clearCookie(c.name, { domain: c.domain, log: false });
+                if (file)
+                    cy.task('ssoSessionWrite', { file, cookies: all.filter(isIdpCookie) }, { log: false });
+            });
+            cy.clearAllSessionStorage({ log: false });
+        };
+        // ssoSessionFile: another machine already logged in (CI pre-step), so take over its IdP cookies, no password/OTP here
+        if (!file)
+            return login();
+        cy.task('ssoSessionRead', file, { log: false }).then((saved) => {
+            if (!saved)
+                return login();
+            for (const c of saved) {
+                cy.setCookie(c.name, c.value, { domain: c.domain, path: c.path, secure: c.secure, httpOnly: c.httpOnly, sameSite: c.sameSite, expiry: c.expiry, log: false });
+            }
+        });
+    }, { cacheAcrossSpecs: true });
+    cy.visit(url);
     if (company) {
         cy.GLO_selectCompany(company);
     }
     if (cypressWebsocketLoader)
-        waitForWebSocketAfterOkta();
+        waitForWebSocketAfterSso(ssoUrl());
     cy.task('log', 'Start navbar check');
     if (!skipvNavCheck) {
         const navbarSelectors = {
@@ -228,7 +305,7 @@ Cypress.Commands.add('GLO_oktaLogin', (company, urlType, skipvNavCheck) => {
         cy.GLO_checkLoadingIndicator();
     }
     cy.task('log', 'End navbar check');
-});
+};
 Cypress.Commands.add('GLO_logout', () => {
     cy.document({ log: false }).then((doc) => {
         cy.GLO_getElement(['ng$main_form2', 'navbar_top']).find('.lucide-LogOut').click();
@@ -1974,7 +2051,7 @@ Cypress.Commands.add('GLO_oktaAlternativeLogin', (altUser, company) => {
         });
     }
     if (altUser) {
-        cy.origin(Cypress.expose('oktaUrl'), () => {
+        cy.origin(ssoUrl(), () => {
             cy.get('.okta-container', { timeout: 120000 });
             cy.get('.o-form-input', { timeout: 60000 })
                 .find('[autocomplete="username"]')
@@ -1993,7 +2070,7 @@ Cypress.Commands.add('GLO_oktaAlternativeLogin', (altUser, company) => {
         cy.GLO_log(`Logged in as ${Cypress.expose('username2')}`);
     }
     else {
-        cy.origin(Cypress.expose('oktaUrl'), () => {
+        cy.origin(ssoUrl(), () => {
             cy.get('.okta-container', { timeout: 120000 });
             cy.get('.o-form-input', { timeout: 60000 })
                 .find('[autocomplete="username"]')
@@ -2012,7 +2089,7 @@ Cypress.Commands.add('GLO_oktaAlternativeLogin', (altUser, company) => {
         cy.GLO_log(`Logged in as ${Cypress.expose('username')}`);
     }
     if (cypressWebsocketLoader)
-        waitForWebSocketAfterOkta();
+        waitForWebSocketAfterSso();
     cy.get('[data-cy$="ng$main_form2.navbar_top"]', { timeout: 120000 }).should('exist');
     if (company)
         cy.GLO_checkAndSelectCompany(company);

package/dist/commands/POR_commands.js

@@ -14,7 +14,7 @@ Cypress.Commands.add('POR_portalLogin', () => {
     cy.visit(Cypress.expose('portalUrl'));
     // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for portal login redirect
     cy.wait(2000);
-    cy.origin(Cypress.expose('oktaUrl'), () => {
+    cy.origin(Cypress.expose('ssoUrl'), () => {
         cy.get('.o-form-input')
             .find('[autocomplete="username"]')
             .type(Cypress.expose('username'));

package/dist/config.js

@@ -45,7 +45,7 @@ export function defineGlobisConfig(overrides = {}) {
             ...overrides.e2e,
             setupNodeEvents(on, config) {
                 // Sensitive keys never get exposed to the browser via config.expose.
-                const sensitiveEnvKeys = new Set(['password', 'password2', 'api_key', 'QLIKURLS', 'S3_KEY', 'S3_SECRET']);
+                const sensitiveEnvKeys = new Set(['password', 'password2', 'api_key', 'QLIKURLS', 'S3_KEY', 'S3_SECRET', 'otpSecret']);
                 for (const [key, val] of Object.entries(config.env)) {
                     if (!sensitiveEnvKeys.has(key))
                         config.expose[key] = val;
@@ -92,6 +92,18 @@ export function defineGlobisConfig(overrides = {}) {
                         });
                         return result;
                     },
+                    // IdP session handed from one machine to the others (CI stashes the file), see ssoLogin in GLO_commands
+                    async ssoSessionRead(file) {
+                        return (await import('./ssoSessionFile.js')).readSsoSession(file);
+                    },
+                    async ssoSessionWrite({ file, cookies }) {
+                        (await import('./ssoSessionFile.js')).writeSsoSession(file, cookies);
+                        return null;
+                    },
+                    async totp(secret) {
+                        const { nextTotp } = await import('./totp.js');
+                        return nextTotp(secret);
+                    },
                     ...overrides.extraTasks
                 });
                 on('before:browser:launch', (browser, launchOptions) => {

package/dist/ssoSessionFile.d.ts

@@ -0,0 +1,2 @@
+export declare const readSsoSession: (file: string) => unknown[] | null;
+export declare const writeSsoSession: (file: string, cookies: unknown[]) => void;

package/dist/ssoSessionFile.js

@@ -0,0 +1,43 @@
+import fs from 'node:fs';
+import path from 'node:path';
+const MAX_AGE_MS = 8 * 3600 * 1000;
+const NOFOLLOW = fs.constants.O_NOFOLLOW ?? 0;
+// The file name comes from an env value, so its real location (parent symlinks resolved) must stay inside the
+// project (cwd). The file itself is opened with O_NOFOLLOW so it can not be a symlink either.
+const safePath = (file) => {
+    const resolved = path.resolve(file);
+    const parent = fs.realpathSync(path.dirname(resolved));
+    const target = path.join(parent, path.basename(resolved));
+    const relative = path.relative(fs.realpathSync(process.cwd()), target);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative))
+        throw new Error(`ssoSessionFile must be a file inside the project, got: ${file}`);
+    // no O_NOFOLLOW (Windows): reject a symlinked file up front instead
+    if (!NOFOLLOW && fs.lstatSync(target, { throwIfNoEntry: false })?.isSymbolicLink())
+        throw new Error('ssoSessionFile must not be a symlink');
+    return target;
+};
+export const readSsoSession = (file) => {
+    const target = safePath(file);
+    try {
+        const fd = fs.openSync(target, fs.constants.O_RDONLY | NOFOLLOW);
+        try {
+            const saved = JSON.parse(fs.readFileSync(fd, 'utf8'));
+            return Date.now() - saved.savedAt < MAX_AGE_MS ? saved.cookies : null;
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    catch {
+        return null;
+    }
+};
+export const writeSsoSession = (file, cookies) => {
+    const fd = fs.openSync(safePath(file), fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC | NOFOLLOW, 0o600);
+    try {
+        fs.writeSync(fd, JSON.stringify({ savedAt: Date.now(), cookies }));
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+};

package/dist/totp.d.ts

@@ -0,0 +1,2 @@
+export declare const totp: (secret: string, timeMs?: number) => string;
+export declare const nextTotp: (secret: string) => Promise<string>;

package/dist/totp.js

@@ -0,0 +1,54 @@
+import { createHash, createHmac } from 'node:crypto';
+import fs from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+// RFC 6238: HMAC-SHA1, 6 digits, 30 second period (Keycloak defaults, identical in every realm)
+const PERIOD_MS = 30000;
+const BASE32 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+const base32Decode = (secret) => {
+    const bytes = [];
+    let bits = 0;
+    let value = 0;
+    for (const char of secret.replace(/[\s=]/g, '').toUpperCase()) {
+        const index = BASE32.indexOf(char);
+        if (index < 0)
+            throw new Error('otpSecret is not valid base32');
+        value = (value << 5) | index;
+        bits += 5;
+        if (bits >= 8) {
+            bytes.push((value >>> (bits - 8)) & 255);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(bytes);
+};
+export const totp = (secret, timeMs = Date.now()) => {
+    const counter = Buffer.alloc(8);
+    counter.writeBigUInt64BE(BigInt(Math.floor(timeMs / PERIOD_MS)));
+    const hash = createHmac('sha1', base32Decode(secret)).update(counter).digest();
+    const offset = hash[hash.length - 1] & 15;
+    const code = (hash.readUInt32BE(offset) & 0x7fffffff) % 1_000_000;
+    return String(code).padStart(6, '0');
+};
+// Keycloak refuses a code twice. Parallel runners are separate processes, so a window is claimed with an
+// exclusive marker file in the temp dir (atomic): a runner that finds its window taken waits for the next one.
+// ponytail: same machine only, runners on other machines (CI agents) still need staggering
+const claimWindow = (secret, window) => {
+    const id = createHash('sha256').update(secret).digest('hex').slice(0, 12);
+    try {
+        fs.writeFileSync(join(tmpdir(), `globis-otp-${id}-${window}`), '', { flag: 'wx' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+export const nextTotp = async (secret) => {
+    for (let attempt = 0; attempt < 6; attempt++) {
+        const window = Math.floor(Date.now() / PERIOD_MS);
+        if (claimWindow(secret, window))
+            return totp(secret);
+        await new Promise((resolve) => setTimeout(resolve, (window + 1) * PERIOD_MS - Date.now() + 500));
+    }
+    throw new Error('No free OTP window after 6 tries, too many runners share this user');
+};

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@globisnv/cypress-core",
-    "version": "2.1.3",
+    "version": "2.2.0",
     "description": "Core building blocks for Globis Cypress E2E tests",
     "license": "UNLICENSED",
     "type": "module",

package/template/cypress.env.json.example

@@ -2,14 +2,15 @@
 // Delete these comments
 
 {
-    "loginType": "<default/servoy/okta>",
+    "loginType": "<default/servoy/sso>",
     "username": "<enter your username here>",
     "password": "<enter your password here>",
     "username2": "<optional - alternate login user, used by tests that switch users>",
     "password2": "<optional - password for username2>",
 
     "globisUrl": "<enter your globisUrl here>",
-    "oktaUrl": "<optional - only used when loginType is okta>",
+    "ssoUrl": "<optional - IdP URL, only used when loginType is sso: Okta when it contains okta, otherwise Keycloak. Default https://auth.globis.cloud>",
+    "otpSecret": "<optional - base32 TOTP secret, only used when loginType is sso with Keycloak and the user has OTP>",
     "ownerName": "<optional - only used for a local Servoy instance>",
 
     "api_key": "<optional - only used when a command needs an API key>",