@open-mercato/cli 0.10.1-develop.7994.1.c9f31972aa → 0.10.1-develop.8022.1.b6753de892

package/dist/lib/testing/integration.js

@@ -10,6 +10,7 @@ import spawn from "cross-spawn";
 import { fetchWithTimeout } from "@open-mercato/shared/lib/http/fetchWithTimeout";
 import { isUnsafeJwtSecret } from "@open-mercato/shared/lib/auth/jwt";
 import { resolveEnvironment } from "../resolver.js";
+import { resolveInitSuperadminCredentials } from "../init-secrets.js";
 import { resolveSpawnCommand } from "../spawn.js";
 import { discoverIntegrationSpecFiles as discoverIntegrationSpecFilesShared } from "./integration-discovery.js";
 import { resolveDockerHostFromContext, runCommandAndCapture } from "./runtime-utils.js";
@@ -52,6 +53,21 @@ function resolveEphemeralJwtSecret(env2 = process.env) {
   }
   return DEFAULT_EPHEMERAL_JWT_SECRET;
 }
+const DEFAULT_EPHEMERAL_SUPERADMIN_PASSWORD = "Om-Ephemeral-Superadmin-2026!";
+function resolveEphemeralSuperadminPassword(env2 = process.env) {
+  const inherited = env2.OM_INIT_SUPERADMIN_PASSWORD;
+  if (inherited !== void 0 && inherited.trim().length > 0) {
+    try {
+      resolveInitSuperadminCredentials([], { ...env2, NODE_ENV: "production", OM_INIT_SUPERADMIN_PASSWORD: inherited });
+      return inherited;
+    } catch {
+      console.warn(
+        "[integration] Ignoring the inherited OM_INIT_SUPERADMIN_PASSWORD: it is a placeholder or fails the password policy and the ephemeral app initializes with NODE_ENV=production. Using the ephemeral default instead."
+      );
+    }
+  }
+  return DEFAULT_EPHEMERAL_SUPERADMIN_PASSWORD;
+}
 const PLAYWRIGHT_ENV_UNAVAILABLE_PATTERNS = [
   /net::ERR_CONNECTION_REFUSED/i,
   /Failed to connect to .* (localhost|127\.0\.0\.1)/i,
@@ -1597,6 +1613,7 @@ function buildReusableEnvironment(baseUrl, databaseUrl, queueBaseDir, captureScr
     // OM_INIT_*_PASSWORD to fix the seeded credential.
     OM_INIT_ADMIN_PASSWORD: process.env.OM_INIT_ADMIN_PASSWORD ?? "secret",
     OM_INIT_EMPLOYEE_PASSWORD: process.env.OM_INIT_EMPLOYEE_PASSWORD ?? "secret",
+    OM_INIT_SUPERADMIN_PASSWORD: resolveEphemeralSuperadminPassword(),
     OM_INTEGRATION_TEST: "true",
     OM_ENABLE_ENTERPRISE_MODULES: enterpriseModulesFlag,
     OM_ENABLE_ENTERPRISE_MODULES_SSO: process.env.OM_ENABLE_ENTERPRISE_MODULES_SSO ?? enterpriseModulesFlag,
@@ -2806,6 +2823,10 @@ async function startEphemeralEnvironment(options) {
       // NODE_ENV=production.
       OM_INIT_ADMIN_PASSWORD: process.env.OM_INIT_ADMIN_PASSWORD ?? "secret",
       OM_INIT_EMPLOYEE_PASSWORD: process.env.OM_INIT_EMPLOYEE_PASSWORD ?? "secret",
+      // Production init refuses a missing or placeholder superadmin password
+      // (#8896). Integration auth helpers read OM_INIT_SUPERADMIN_PASSWORD, so
+      // the Playwright runner logs in with the same value.
+      OM_INIT_SUPERADMIN_PASSWORD: resolveEphemeralSuperadminPassword(),
       // Pool sizing for the ephemeral integration runtime. Defaults were once
       // very aggressive (max=5, idle=1000) which exposed flaky 'timeout exceeded
       // when trying to connect' errors on `progressService.createJob`-backed
@@ -3298,6 +3319,7 @@ export {
   resolveBuildCacheTtlSeconds,
   resolveEphemeralJwtSecret,
   resolveEphemeralPostgresImage,
+  resolveEphemeralSuperadminPassword,
   runEphemeralAppForQa,
   runIntegrationCoverageReport,
   runIntegrationSpecCoverageReport,