@hmcts/media-viewer 4.2.34 → 4.2.37-5161

package/README.md

@@ -122,19 +122,141 @@ Viewer and AAT-backed proxy configuration while keeping the browser at
 the opt-in external-service contracts for those live service probes. The lightweight
 route and health check remains available as `yarn smoke:local:aat`.
 
+### Test a local `em-icp-api` change
+
+The standalone app reaches ICP through its local API. Keep the other services on AAT,
+but override only `ICP_API_URL` in the ignored `.env` file:
+
+```
+ICP_API_URL=http://localhost:8080
+```
+
+Create an isolated worktree for the ICP branch under test. The example below uses
+PR #1546 and leaves the normal ICP checkout untouched:
+
+```
+cd ../em-icp-api
+git fetch origin pull/1546/head
+git worktree add --detach /private/tmp/em-icp-pr1546-validation FETCH_HEAD
+cd /private/tmp/em-icp-pr1546-validation
+yarn install --immutable
+docker compose -f docker-compose.yml up -d redis
+```
+
+Its `config/local-dev.yaml` is ignored by `em-icp-api`; create it and configure the
+AAT IdAM URL, local Redis and AAT Web PubSub client URL:
+
+```yaml
+idam:
+  url: https://idam-api.aat.platform.hmcts.net
+redis:
+  host: localhost
+  port: 6379
+  useTLS: "false"
+icp:
+  wsUrl: wss://em-icp-webpubsub.aat.platform.hmcts.net/client/hubs/localhub
+```
+
+Check that the active Azure identity can read the approved secret without printing its
+value:
+
+```
+az keyvault secret show \
+  --vault-name em-icp-aat \
+  --name em-icp-web-pubsub-primary-connection-string \
+  --query id -o tsv
+```
+
+Immediately before starting ICP, load the connection string into `NODE_CONFIG` only for
+that process. This command does not echo or write the secret to disk:
+
+```
+local_webpubsub_secret="$(az keyvault secret show \
+  --vault-name em-icp-aat \
+  --name em-icp-web-pubsub-primary-connection-string \
+  --query value -o tsv)"
+export NODE_CONFIG="$(LOCAL_WEBPUBSUB_SECRET="$local_webpubsub_secret" node -e 'console.log(JSON.stringify({secrets: {"em-icp": {"em-icp-web-pubsub-primary-connection-string": process.env.LOCAL_WEBPUBSUB_SECRET}}}))')"
+unset local_webpubsub_secret
+```
+
+For Web PubSub callback testing, make the following local-only edits in the ICP
+checkout before starting it. The API currently hard-codes the deployed `Hub`/`hub`
+names in three places, whereas the tunnel uses `localhub`; do not commit these edits
+with the change being tested:
+
+```
+app.ts: new WebPubSubServiceClient(primaryConnectionstring, "localhub")
+app.ts: new WebPubSubEventHandler("localhub", ...)
+api/routes/sessions.ts: new WebPubSubServiceClient(primaryConnectionstring, "localhub")
+```
+
+Then start ICP and check its health:
+
+```
+yarn start:local
+curl -fsS http://localhost:8080/health
+yarn test:unit
+```
+
+Then tunnel the AAT Web PubSub hub to the local ICP process in another terminal. Use
+the AAT Web PubSub endpoint and keep the upstream HTTP URL local:
+
+```
+npx --yes --package @azure/web-pubsub-tunnel-tool awps-tunnel run \
+  --hub localhub \
+  --endpoint https://em-icp-webpubsub-aat.webpubsub.azure.com \
+  --upstream http://localhost:8080 \
+  -s 1c4f0704-a29e-403d-b719-b90c34ef14c9 \
+  -g em-icp-aat
+```
+
+The tunnel needs an authenticated Azure identity that can read the AAT hub settings.
+If it reports `403` after resolving the subscription and resource group, obtain the
+required AAT Web PubSub access policy or RBAC permission; that is an Azure access
+blocker, not a local ICP or Media Viewer failure.
+
+Then start Media Viewer from its repository. Populate the ignored AAT `.env` if it
+does not already contain the approved AAT settings, then set the ICP override:
+
+```
+cd ../rpx-xui-media-viewer
+yarn env:populate:aat
+# In .env set:
+# ICP_API_URL=http://localhost:8080
+yarn start:aat
+```
+
+Open `http://localhost:3000/#/media-viewer`, then run the browser regression lane:
+
+```
+PLAYWRIGHT_REPORTERS=list yarn test:local:aat
+```
+
+This setup tests local ICP code with AAT authentication and Web PubSub; it does not
+recreate the complete retired `em-showcase` Docker stack. The validation run recorded
+19 passing ICP unit tests and 71 passing Media Viewer tests.
+
+Current ICP source warning: `api/routes/sessions.ts` logs the primary Web PubSub
+connection string. Do not make an authenticated `/icp/sessions/...` request with a
+real secret until that log statement is removed; this is a source-security blocker,
+not a Media Viewer setup failure.
+
+Stop the local processes with `Ctrl+C`, then clean up Redis from the ICP worktree with
+`docker compose -f docker-compose.yml down`.
+
 ### 5. Run Playwright tests
-Media Viewer is starting its Playwright migration with the same runner and
-reporting shape used in MC and MO, scaled to the current smoke coverage. The
-legacy Protractor and CodeceptJS functional packs still exist; new browser
-coverage should be added under `playwright_tests/`.
+Media Viewer uses the Playwright runner and reporting shape used in MC and MO.
+The CodeceptJS and Protractor/Cucumber runners are retired. New browser coverage
+belongs under `playwright_tests/`.
 
 Current Playwright lanes:
 
 | Lane | Config/project | Command | Scope |
 | --- | --- | --- | --- |
 | Standalone smoke | `playwright.config.ts`, project `smoke` | `yarn test:playwright:smoke` or `yarn test:smoke` | One readiness contract: loads a standalone PDF and proves the rendered viewer, first page and canvas are usable. |
-| Migrated functional | `playwright.config.ts`, project `functional` | `yarn test:playwright:functional` | 74 fixture-backed browser contracts across 13 feature files, including separate failed PDF/image rendered-state diagnostics. Two additional image-annotation create contracts are discoverable, ticketed against [EXUI-5124](https://tools.hmcts.net/jira/browse/EXUI-5124), and excluded from the default selection because the current product does not persist an image draw-box annotation. See [`playwright_tests/functional/README.md`](playwright_tests/functional/README.md). |
+| Migrated functional | `playwright.config.ts`, project `functional` | `yarn test:playwright:functional` | 84 default fixture-backed browser contracts across 13 feature files, with 86 discoverable when the two EXUI-5124 image-annotation contracts are explicitly included. Multimedia coverage is Chromium-only; external AAT/CCD contracts are separate diagnostics and are not migration assurance. See [`playwright_tests/functional/README.md`](playwright_tests/functional/README.md). |
 | External service diagnostics | `playwright.config.ts`, opt-in project `external-service-contracts` | `yarn test:playwright:external-service-contracts` | Optional live AAT CCD/DM Store/annotation probes for a deliberate environment investigation. The default command executes 6 non-defect service contracts; four CCD browser-route contracts tagged against [EXUI-5122](https://tools.hmcts.net/jira/browse/EXUI-5122) and [EXUI-5123](https://tools.hmcts.net/jira/browse/EXUI-5123) remain discoverable but are excluded by default. Use `PLAYWRIGHT_INCLUDE_KNOWN_DEFECTS=true` to discover and execute all 10. They are never part of normal PR assurance. |
+| Cross-browser smoke | `playwright.config.ts`, projects `smoke-firefox` and `smoke-webkit` | `yarn test:crossbrowser` | Runs the same readiness contract in Firefox and WebKit and publishes separate JUnit/Odhín output under `functional-output/tests/playwright-crossbrowser`. |
 | Viewer support | `playwright.config.ts`, project `support` | `yarn test:playwright:support` | Proves the reusable PDF, image and unsupported-media fixtures, component objects and response diagnostics. |
 
 The current migration slice is deliberately separated from smoke: smoke proves
@@ -152,10 +274,10 @@ route mocks. Tests must not depend on execution order or share mutable
 documents; mutation-heavy AAT journeys must provision a document per test or
 reset it before reuse.
 
-Install Chromium once before local runs when the browser cache is empty:
+Install the Playwright browsers once before local runs when the browser cache is empty:
 
 ```
-yarn test:setup:playwright-install-chromium
+yarn test:setup:playwright-install-browsers
 ```
 
 Run the smoke project against a running standalone demo app. Start the app in
@@ -169,12 +291,16 @@ Then run the smoke in another terminal:
 
 ```
 yarn test:playwright:smoke
+# unified Playwright accessibility pack (Axe, WAVE-like, screen-reader-like)
+yarn test:a11y
+# Firefox and WebKit smoke gate
+yarn test:crossbrowser
 ```
 
 Override the smoke document and case id with `MV_SMOKE_PDF_DOCUMENT_URL` and
 `MV_SMOKE_CASE_ID`. `yarn test:smoke` and `yarn test:local:aat` run the
 Playwright smoke, so the standalone and local-AAT PDF loading journeys no longer
-fall back to CodeceptJS.
+use only the Playwright projects.
 
 The lane wrapper commands write Playwright evidence under `functional-output/tests`:
 
@@ -183,6 +309,8 @@ The lane wrapper commands write Playwright evidence under `functional-output/tes
 | Viewer support | `functional-output/tests/playwright-support/odhin-report/xui-playwright-support.html` | `functional-output/tests/playwright-support/playwright-support-junit.xml` | `functional-output/tests/playwright-support/test-results` |
 | Smoke | `functional-output/tests/playwright-smoke/odhin-report/xui-playwright-smoke.html` | `functional-output/tests/playwright-smoke/playwright-smoke-junit.xml` | `functional-output/tests/playwright-smoke/test-results` |
 | Migrated functional | `functional-output/tests/playwright-functional/odhin-report/xui-playwright-functional.html` | `functional-output/tests/playwright-functional/playwright-functional-junit.xml` | `functional-output/tests/playwright-functional/test-results` |
+| Accessibility | `functional-output/tests/playwright-accessibility/odhin-report/xui-playwright-accessibility.html` | `functional-output/tests/playwright-accessibility/playwright-accessibility-junit.xml` | `functional-output/tests/playwright-accessibility/test-results` |
+| Cross-browser smoke | `functional-output/tests/playwright-crossbrowser/odhin-report/xui-playwright-crossbrowser.html` | `functional-output/tests/playwright-crossbrowser/playwright-crossbrowser-junit.xml` | `functional-output/tests/playwright-crossbrowser/test-results` |
 
 Those are the default lane-specific paths. CNP keeps preview and AAT viewer
 support evidence separate under `functional-output/tests/playwright-support/preview`
@@ -214,9 +342,10 @@ Reporting behavior follows the MC/MO pattern:
   HTML Publisher links.
 
 The Jenkins `YarnBuilder` performs its immutable dependency install before the
-first setup task. The pipeline then installs Puppeteer Chrome once for legacy
-tests and Chromium into the workspace-local `PLAYWRIGHT_BROWSERS_PATH`, and sets
-`PLAYWRIGHT_SKIP_INSTALL=true` so Playwright lanes do not reinstall it.
+first setup task. The pipeline installs Puppeteer Chrome for Karma and the
+functional preflight, then installs Chromium into the workspace-local
+`PLAYWRIGHT_BROWSERS_PATH` and sets `PLAYWRIGHT_SKIP_INSTALL=true` so Playwright
+lanes do not reinstall it.
 
 Useful overrides:
 - `PLAYWRIGHT_BASE_URL` or `TEST_URL`: target application URL, default `http://localhost:3000/`
@@ -262,10 +391,6 @@ Migration boundaries:
 - Put new native Playwright specs under `playwright_tests/`.
 - Keep screen interactions and reusable locators in page objects under
   `playwright_tests/pages/`; keep assertions visible in specs.
-- Historical CodeceptJS scenarios are retained as source traceability only;
-  their executable pipeline routing is retired once the mapped Playwright
-  contract is selected by default or is represented by a discoverable,
-  ticketed product-defect contract.
 - Add stable report output paths for every new Playwright lane so Jenkins can
   publish Odhín and JUnit and archive failure diagnostics without bespoke stage
   logic.
@@ -485,7 +610,9 @@ The list of exceptions thrown by the Media Viewer are as follows:
 - HttpErrorResponse
 - PasswordException
 
-## Cucumber Tests
- ```
-  npm run package, npm run e2e:cucumber
-  ```
+## Legacy browser tests
+
+The CodeceptJS and Protractor/Cucumber runners were retired as part of the
+Playwright migration. Migration closure was recorded in PR #82; the active
+browser test source is now Playwright. Use the Playwright commands above for
+supported browser tests. No recurring legacy-parity test is retained.