@monster-orange/den 0.0.0 → 0.2.0

package/src/pillars/browser/global-setup.ts

@@ -0,0 +1,140 @@
+/**
+ * Global Setup for Staged Synthetic Tests
+ *
+ * 1. Verify web host is reachable (fail fast if app is down)
+ * 2. Log in as admin + user in parallel via headless browser login
+ *    — credentials from the secrets backend (local) or ENV vars (CI)
+ *    — sessions are ephemeral: written fresh each run, never manually managed
+ */
+
+import { type FullConfig } from "@playwright/test";
+import * as path from "path";
+import * as fs from "fs";
+import {
+  getCredentials,
+  headlessLogin,
+} from "../../shared/auth/headless-login.js";
+import { envSelector } from "../../shared/environment/env-selector.js";
+import type {
+  BrowserLoginConfig,
+  Environment,
+} from "../../shared/types/index.js";
+import { getDistRoot } from "../../shared/paths.js";
+
+import { product } from "../../shared/product.js";
+// Den-root anchored, NOT process.cwd(): auth sessions are WRITTEN here and
+// the consuming configs read storageState from the anchored resolveAuthPath.
+const AUTH_DIR = path.resolve(getDistRoot(), "playwright/.auth");
+
+async function login(
+  role: "admin" | "user" | "beta",
+  baseUrl: string,
+  environment: Environment,
+  browserLogin?: BrowserLoginConfig,
+): Promise<void> {
+  const authFile = path.join(AUTH_DIR, `${role}-${environment}.json`);
+  const creds = await getCredentials(role, environment);
+  if (!creds) {
+    const localHint =
+      role === "admin"
+        ? `  Local: make auth-configure env=${environment}  (sets up your admin account)\n`
+        : `  Local: sign in to the secrets backend; the ${role} account comes from test_accounts in the org config\n`;
+    throw new Error(
+      `No credentials for ${role}.\n` +
+        localHint +
+        `  CI: set E2E_${role.toUpperCase()}_EMAIL / E2E_${role.toUpperCase()}_PASSWORD`,
+    );
+  }
+  await headlessLogin(
+    role,
+    baseUrl,
+    creds.email,
+    creds.password,
+    authFile,
+    browserLogin,
+  );
+}
+
+async function globalSetup(_config: FullConfig) {
+  const environment = (process.env.E2E_ENVIRONMENT as Environment) || "local";
+  const envConfig = await envSelector.loadEnvironment(environment);
+  const baseUrl = envConfig.baseUrls.web;
+  const browserLogin = envConfig.auth?.browser;
+
+  // ─── Health Check ──────────────────────────────────────────────────────────
+  console.log(`\n🏥 Health check: ${baseUrl}\n`);
+  try {
+    const response = await fetch(baseUrl, {
+      method: "GET",
+      signal: AbortSignal.timeout(5000),
+    });
+
+    if (!response.ok && response.status !== 401 && response.status !== 403) {
+      console.error(`❌ Host returned error status: ${response.status}`);
+      console.error(`   URL: ${baseUrl}`);
+      console.error(
+        `\n💡 Make sure the app is running before running tests.\n`,
+      );
+      process.exit(1);
+    }
+
+    console.log(`✅ Host is reachable (status: ${response.status})\n`);
+  } catch (error: unknown) {
+    const isLocalUrl = baseUrl.startsWith("http://");
+
+    console.error(`❌ Cannot reach host: ${baseUrl}`);
+    console.error(`   Error: ${(error as Error).message}`);
+    if (isLocalUrl) {
+      console.error(`\n💡 The app does not appear to be running.`);
+      console.error(
+        `   Start it first (for example: ${product().cli} up, or the app repo's own make up).\n`,
+      );
+    } else {
+      console.error(`\n💡 Cannot reach ${baseUrl}. Check your network.\n`);
+    }
+    process.exit(1);
+  }
+
+  // ─── Auth: parallel headless login ─────────────────────────────────────────
+  console.log("🔐 Authenticating (admin + user + beta in parallel)...\n");
+
+  if (!fs.existsSync(AUTH_DIR)) {
+    fs.mkdirSync(AUTH_DIR, { recursive: true });
+  }
+
+  // admin + user are required — any failure aborts the run.
+  // beta is optional — account may not be seeded in all envs yet;
+  // a failure here warns and skips, letting beta tests fail on their own.
+  try {
+    await Promise.all([
+      login("admin", baseUrl, environment, browserLogin),
+      login("user", baseUrl, environment, browserLogin),
+    ]);
+  } catch (err: unknown) {
+    console.error(`\n❌ Authentication failed: ${(err as Error).message}\n`);
+    process.exit(1);
+  }
+
+  try {
+    await login("beta", baseUrl, environment, browserLogin);
+  } catch (err: unknown) {
+    console.warn(`\n⚠️  Beta login skipped: ${(err as Error).message}`);
+    console.warn(
+      `   Ensure the beta test account exists for ${environment}.\n`,
+    );
+  }
+
+  // Create bare symlinks (admin.json, user.json, beta.json) pointing to the
+  // current env's auth files. Some spec files in linked repos hardcode the
+  // non-suffixed path; these symlinks keep them working without code changes.
+  for (const role of ["admin", "user", "beta"]) {
+    const bare = path.join(AUTH_DIR, `${role}.json`);
+    const target = `${role}-${environment}.json`;
+    if (fs.existsSync(bare)) fs.unlinkSync(bare);
+    fs.symlinkSync(target, bare);
+  }
+
+  console.log("\n✅ Pre-flight checks complete\n");
+}
+
+export default globalSetup;

package/src/pillars/browser/global-teardown.ts

@@ -0,0 +1,48 @@
+/**
+ * Global Teardown for Staged Synthetic Tests
+ * Logs screenshot count retained in test-results/.
+ */
+
+import { type FullConfig } from "@playwright/test";
+import * as path from "path";
+import * as fs from "fs/promises";
+import { getDistRoot } from "../../shared/paths.js";
+
+async function globalTeardown(_config: FullConfig) {
+  console.log("\n📸 Ensuring screenshots are retained...");
+
+  // read-only screenshot count; anchored so it matches the config outputDir
+  const testResultsDir = path.join(getDistRoot(), "test-results");
+
+  try {
+    const exists = await fs
+      .access(testResultsDir)
+      .then(() => true)
+      .catch(() => false);
+
+    if (exists) {
+      const entries = await fs.readdir(testResultsDir, { withFileTypes: true });
+      let screenshotCount = 0;
+
+      for (const entry of entries) {
+        if (entry.isDirectory() && !entry.name.startsWith(".")) {
+          const testDir = path.join(testResultsDir, entry.name);
+          const files = await fs.readdir(testDir);
+          screenshotCount += files.filter((f) => f.endsWith(".png")).length;
+        }
+      }
+
+      console.log(
+        `✓ ${screenshotCount} screenshots retained in test-results/\n`,
+      );
+    } else {
+      console.log("⚠️  No test-results directory found\n");
+    }
+  } catch (error) {
+    console.warn(
+      `Warning: Could not check screenshots: ${(error as Error).message}\n`,
+    );
+  }
+}
+
+export default globalTeardown;

package/src/pillars/browser/playwright.config.ts

@@ -0,0 +1,212 @@
+/**
+ * Playwright Configuration for Staged Synthetic Tests
+ *
+ * Runs test files from .synth-run/<repo>/ (staged by pillars/browser/setup.ts).
+ *   - chromium             regular tests (no saved auth)
+ *   - chromium-admin       admin-named tests (saved admin session)
+ *   - chromium-user        user-named tests (saved user session)
+ *   - firefox              cross-browser (no saved auth)
+ *   - webkit               cross-browser (no saved auth)
+ *   - chromium-last        *.last.spec.ts tests, run LAST (via dependencies) —
+ *                          for suites that change shared state other tests read
+ */
+
+import { defineConfig, devices } from "@playwright/test";
+import type {
+  Reporter,
+  TestCase,
+  TestResult as PlaywrightTestResult,
+} from "@playwright/test/reporter";
+import * as fs from "fs";
+import * as path from "path";
+import { getDistRoot } from "../../shared/paths.js";
+import { distPath } from "../../shared/engine.js";
+import { fileURLToPath } from "url";
+import { resultWriter } from "../../shared/results/result-writer.js";
+import {
+  resolveAuthPath,
+  resolveEnv,
+} from "../../shared/environment/playwright-env.js";
+import * as os from "os";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+// Auto-detect: SYNTH_REPO env, or the first directory in .synth-run/
+const repoName = (() => {
+  if (process.env.SYNTH_REPO) return process.env.SYNTH_REPO;
+  const synthRunDir = distPath(".synth-run");
+  try {
+    const entries = fs.readdirSync(synthRunDir, { withFileTypes: true });
+    const dir = entries.find((e) => e.isDirectory());
+    if (dir) return dir.name;
+  } catch {
+    /* .synth-run doesn't exist yet */
+  }
+  throw new Error(
+    "SYNTH_REPO is not set and nothing is staged in .synth-run/ — run the " +
+      "synthetic setup for a repo first (make test-syn repo=<name>).",
+  );
+})();
+const env = resolveEnv("local");
+// The distribution root: setup.ts stages .synth-run there; auth lives there.
+const repoRoot = getDistRoot();
+
+const adminAuthPath = resolveAuthPath("admin", env, repoRoot);
+const userAuthPath = resolveAuthPath("user", env, repoRoot);
+const betaAuthPath = resolveAuthPath("beta", env, repoRoot);
+
+// repoRoot-anchored in lockstep with setup.ts (the .synth-run writer).
+const stagingDir = path.resolve(repoRoot, `.synth-run/${repoName}`);
+
+// Specs that must run after every other project (they change shared state).
+const LAST_SPECS = /.*\.last\.spec\.ts$/;
+
+// Inline JSONL Reporter
+class JSONLReporter implements Reporter {
+  async onTestEnd(test: TestCase, result: PlaywrightTestResult) {
+    try {
+      const environment = (process.env.E2E_ENVIRONMENT || "local") as any;
+      const testTitle = test.titlePath().slice(1).join(" › ");
+      const testFile =
+        test.location.file
+          .split(`/.synth-run/${repoName}/`)[1]
+          ?.replace(/\.spec\.ts$/, "") ||
+        path.basename(test.location.file, ".spec.ts");
+
+      let status: "passed" | "failed" | "skipped";
+      if (result.status === "passed") status = "passed";
+      else if (result.status === "skipped") status = "skipped";
+      else status = "failed";
+
+      const screenshot = result.attachments.find(
+        (a) => a.name === "screenshot" || a.contentType?.startsWith("image/"),
+      )?.path;
+      const trace = result.attachments.find(
+        (a) => a.name === "trace" || a.contentType?.includes("zip"),
+      )?.path;
+
+      await resultWriter.writeResult({
+        timestamp: new Date().toISOString(),
+        pillar: "synthetic",
+        environment,
+        test: `${testFile} › ${testTitle}`,
+        status,
+        duration: result.duration,
+        user: process.env.USER || os.userInfo().username || "unknown",
+        error: result.error?.message,
+        screenshot,
+        trace,
+        metadata: {
+          browser: test.parent.project()?.name,
+          retries: result.retry,
+        },
+      });
+    } catch (error) {
+      console.warn(
+        `[JSONL Reporter] Failed to write result: ${(error as Error).message}`,
+      );
+    }
+  }
+}
+
+export default defineConfig({
+  testDir: stagingDir,
+
+  globalSetup: path.resolve(__dirname, "./global-setup.ts"),
+  globalTeardown: path.resolve(__dirname, "./global-teardown.ts"),
+
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  workers: process.env.CI ? 1 : undefined,
+
+  reporter: [
+    ["html", { outputFolder: distPath("playwright-report") }],
+    ["list"],
+  ],
+
+  use: {
+    baseURL: process.env.BASE_URL || "http://localhost:3000",
+    trace: "retain-on-failure",
+    screenshot: "on",
+    video: "retain-on-failure",
+    actionTimeout: 10000,
+    navigationTimeout: 60000,
+  },
+
+  projects: [
+    // Regular tests (no saved auth)
+    {
+      name: "chromium",
+      use: { ...devices["Desktop Chrome"] },
+      testIgnore: [
+        /.*user.*\.spec\.ts$/,
+        /.*admin.*\.spec\.ts$/,
+        /.*beta.*\.spec\.ts$/,
+        LAST_SPECS,
+      ],
+    },
+
+    // Admin tests (saved admin session)
+    {
+      name: "chromium-admin",
+      use: {
+        ...devices["Desktop Chrome"],
+        storageState: adminAuthPath,
+      },
+      testMatch: /.*admin.*.spec.ts/,
+    },
+
+    // User tests (saved user session)
+    {
+      name: "chromium-user",
+      use: {
+        ...devices["Desktop Chrome"],
+        storageState: userAuthPath,
+      },
+      testMatch: /.*user.*\.spec\.ts$/,
+    },
+
+    // Beta tests (saved beta session) — restricted-access user
+    {
+      name: "chromium-beta",
+      use: {
+        ...devices["Desktop Chrome"],
+        storageState: betaAuthPath,
+      },
+      testMatch: /.*beta.*\.spec\.ts$/,
+    },
+
+    {
+      name: "firefox",
+      use: { ...devices["Desktop Firefox"] },
+      testIgnore: [LAST_SPECS, /.*beta.*\.spec\.ts$/],
+    },
+
+    {
+      name: "webkit",
+      use: { ...devices["Desktop Safari"] },
+      testIgnore: [LAST_SPECS, /.*beta.*\.spec\.ts$/],
+    },
+
+    // *.last.spec.ts — runs AFTER all others complete
+    {
+      name: "chromium-last",
+      use: { ...devices["Desktop Chrome"] },
+      testMatch: LAST_SPECS,
+      dependencies: [
+        "chromium",
+        "chromium-admin",
+        "chromium-user",
+        "chromium-beta",
+        "firefox",
+        "webkit",
+      ],
+    },
+  ],
+
+  timeout: 60000,
+  expect: { timeout: 10000 },
+  outputDir: distPath("test-results"),
+});

package/src/pillars/browser/setup.ts

@@ -0,0 +1,219 @@
+/**
+ * Synthetic Test Staging Setup
+ *
+ * Creates .synth-run/{repo}/ before each test run:
+ *
+ *   1. Copies all *.spec.ts files + fixture assets from the repo's testDir
+ *   2. Creates node_modules/@playwright/test → den's playwright
+ *   3. Creates node_modules/@den/test → den's pillars/browser/fixtures/
+ *
+ * Why: service repos usually have their own @playwright/test in
+ * node_modules. If Playwright's test runner loads test files from those
+ * directories, Node resolves @playwright/test to the repo's copy — which is
+ * a different module instance than the runner's, causing the "Requiring
+ * @playwright/test second time" error.
+ *
+ * Staging the files inside den (with a node_modules shim) ensures
+ * there is exactly one @playwright/test instance: den's.
+ *
+ * The @den/test shim lets test files import from `@den/test`
+ * instead of fragile relative paths like `../../fixtures/index.js`.
+ *
+ * The staged dir is gitignored (.synth-run/) and re-created fresh each run.
+ */
+
+import * as fs from "fs";
+import * as path from "path";
+import {
+  discoverRepos,
+  findManifest,
+  resolveRepoPath,
+} from "../smoke/discover.js";
+import type { Environment } from "../../shared/types/index.js";
+import { getDistRoot } from "../../shared/paths.js";
+
+import { product } from "../../shared/product.js";
+import { enginePath } from "../../shared/engine.js";
+// Den-root anchored, NOT process.cwd(): stages (rm -rf + mkdir + symlink
+// + copy) .synth-run, and CLI-spawned runs inherit the user's cwd.
+const PROJECT_ROOT = getDistRoot();
+
+const SYNTH_RUN_DIR = path.resolve(PROJECT_ROOT, ".synth-run");
+const ENGINE_MODULES = path.resolve(PROJECT_ROOT, "node_modules");
+const SYNTHETIC_FIXTURES = enginePath("src/pillars/browser/fixtures");
+interface SyntheticsManifest {
+  testDir: string;
+  testMatch: string;
+  baseUrlKey: "api" | "web";
+  auth: ("admin" | "user")[];
+}
+
+interface SyntheticsManifest {
+  name?: string;
+  synthetics?: SyntheticsManifest;
+}
+
+function findSyntheticsManifest(
+  repoName: string,
+): { repoPath: string; synthetics: SyntheticsManifest; name: string } | null {
+  // Use workspace-aware discovery (active workspace when Local Dev is enabled,
+  // registered-repos.json + .den/ symlinks otherwise).
+  const discovered = findManifest(repoName);
+  if (!discovered) return null;
+
+  const manifest = discovered.manifest as SyntheticsManifest | null;
+  if (!manifest?.synthetics) return null;
+  return {
+    repoPath: discovered.repoPath,
+    synthetics: manifest.synthetics,
+    name: manifest.name ?? repoName,
+  };
+}
+
+// SPEC_RE matches .spec.ts files but not .spec.ts.skip files
+const SPEC_RE = /\.spec\.ts$/;
+
+// Asset extensions that should be copied alongside spec files (fixtures)
+const ASSET_RE =
+  /\.(png|jpg|jpeg|gif|webp|pdf|glb|npy|zip|json|txt|csv|mp4|mp3|wav|svg)$/i;
+
+function copyDir(src: string, dst: string): number {
+  let count = 0;
+  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+    if (entry.name.startsWith(".")) continue;
+
+    if (entry.isDirectory()) {
+      const subDst = path.join(dst, entry.name);
+      fs.mkdirSync(subDst, { recursive: true });
+      count += copyDir(path.join(src, entry.name), subDst);
+    } else if (
+      SPEC_RE.test(entry.name) ||
+      entry.name === "manifest.yml" ||
+      ASSET_RE.test(entry.name)
+    ) {
+      fs.copyFileSync(path.join(src, entry.name), path.join(dst, entry.name));
+      count++;
+    }
+  }
+  return count;
+}
+
+/**
+ * Auto-detect which discovered repo has a synthetics section with a valid
+ * testDir. Returns the first match, or null if none found.
+ */
+function autoDetectSyntheticsRepo(): {
+  repoPath: string;
+  synthetics: SyntheticsManifest;
+  name: string;
+} | null {
+  for (const repo of discoverRepos()) {
+    const manifest = repo.manifest as SyntheticsManifest | null;
+    if (!manifest?.synthetics) continue;
+    const testDir = path.resolve(repo.repoPath, manifest.synthetics.testDir);
+    if (fs.existsSync(testDir)) {
+      return {
+        repoPath: repo.repoPath,
+        synthetics: manifest.synthetics,
+        name: manifest.name ?? repo.repoName,
+      };
+    }
+  }
+  return null;
+}
+
+async function main() {
+  const explicitRepo = process.env.SYNTH_REPO;
+  const environment = (process.env.E2E_ENVIRONMENT || "local") as Environment;
+
+  // If SYNTH_REPO is set, look up that specific repo. Otherwise auto-detect
+  // from the active workspace (or registered repos) by finding the first repo
+  // whose synthetics.testDir actually exists on disk.
+  const discovered = explicitRepo
+    ? findSyntheticsManifest(explicitRepo)
+    : autoDetectSyntheticsRepo();
+
+  if (!discovered) {
+    const hint = explicitRepo
+      ? `repo "${explicitRepo}"`
+      : "any discovered repo";
+    console.error(`❌ No synthetics config found in ${hint}.`);
+    console.error(
+      `   Ensure the repo is in your active workspace or registered via make register-repos,`,
+    );
+    console.error(
+      `   and that its ${product().manifestYml} contains a "synthetics" section with a valid testDir.`,
+    );
+    process.exit(1);
+  }
+
+  const repoName = discovered.name;
+
+  // For non-local environments, read test files from the SHA-pinned clone
+  // so tests always match the deployed code (no drift).
+  // setup-env.ts must have been run first to create the clone.
+  let repoPath = discovered.repoPath;
+  if (environment !== "local") {
+    const repo = findManifest(repoName);
+    if (repo) {
+      try {
+        repoPath = resolveRepoPath(repo, environment);
+      } catch (err) {
+        console.error(`❌ ${(err as Error).message}`);
+        process.exit(1);
+      }
+    }
+  }
+
+  const { synthetics } = discovered;
+  const testDir = path.resolve(repoPath, synthetics.testDir);
+
+  if (!fs.existsSync(testDir)) {
+    console.error(`❌ Synthetics testDir not found: ${testDir}`);
+    process.exit(1);
+  }
+
+  const stagingDir = path.join(SYNTH_RUN_DIR, repoName);
+
+  // Clean the entire .synth-run/ dir (not just this repo's subdir) so that
+  // stale dirs from a previous repo don't confuse auto-detection downstream.
+  fs.rmSync(SYNTH_RUN_DIR, { recursive: true, force: true });
+  fs.mkdirSync(stagingDir, { recursive: true });
+
+  // ── Node modules shim ──────────────────────────────────────────────────────
+  // @playwright/test → den's playwright (prevents "second time" error)
+  // @den/test  → den's pillars/browser/fixtures/ (clean fixture import)
+  const nmDir = path.join(stagingDir, "node_modules");
+  const pwScopeDir = path.join(nmDir, "@playwright");
+  const denScopeDir = path.join(nmDir, `@${product().cli}`);
+  fs.mkdirSync(pwScopeDir, { recursive: true });
+  fs.mkdirSync(denScopeDir, { recursive: true });
+
+  const pwTestSrc = path.join(ENGINE_MODULES, "@playwright", "test");
+  const pwTestDst = path.join(pwScopeDir, "test");
+  fs.symlinkSync(pwTestSrc, pwTestDst);
+
+  const pwSrc = path.join(ENGINE_MODULES, "playwright");
+  const pwDst = path.join(nmDir, "playwright");
+  fs.symlinkSync(pwSrc, pwDst);
+
+  // @den/test — current import name
+  const denTestDst = path.join(denScopeDir, "test");
+  fs.symlinkSync(SYNTHETIC_FIXTURES, denTestDst);
+
+  // ── Copy test files + assets ───────────────────────────────────────────────
+  const count = copyDir(testDir, stagingDir);
+  if (count === 0) {
+    console.warn(`  ⚠  No .spec.ts or asset files found in ${testDir}`);
+  }
+
+  console.log(`✅ Staged ${count} file(s) → .synth-run/${repoName}/`);
+  console.log(
+    `   Shims: @playwright/test → ${product().cli}/node_modules, @${product().cli}/test → pillars/browser/fixtures/`,
+  );
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});