@red-hat-developer-hub/e2e-test-utils 1.1.32 → 1.1.33

package/dist/playwright/global-setup.d.ts

@@ -2,5 +2,6 @@
  * Global setup for Playwright tests.
  * This file runs once before all tests.
  */
-export default function globalSetup(): Promise<void>;
+import { type FullConfig } from "@playwright/test";
+export default function globalSetup(config: FullConfig): Promise<void>;
 //# sourceMappingURL=global-setup.d.ts.map

package/dist/playwright/global-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-setup.d.ts","sourceRoot":"","sources":["../../src/playwright/global-setup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2EH,wBAA8B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAMzD"}
+{"version":3,"file":"global-setup.d.ts","sourceRoot":"","sources":["../../src/playwright/global-setup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AA6EnD,wBAA8B,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3E"}

package/dist/playwright/global-setup.js

@@ -2,10 +2,13 @@
  * Global setup for Playwright tests.
  * This file runs once before all tests.
  */
+import dotenv from "dotenv";
+import { resolve } from "path";
 import { KubernetesClientHelper } from "../utils/kubernetes-client.js";
 import { $ } from "../utils/bash.js";
 import { KeycloakHelper } from "../deployment/keycloak/index.js";
 import { DEFAULT_KEYCLOAK_CONFIG, DEFAULT_RHDH_CLIENT, DEFAULT_USERS, } from "../deployment/keycloak/constants.js";
+import { loadLocalVaultSecrets } from "../utils/vault.js";
 const REQUIRED_BINARIES = ["oc", "kubectl", "helm"];
 async function checkRequiredBinaries() {
     const missingBinaries = [];
@@ -58,10 +61,27 @@ async function deployKeycloak() {
         testPassword: DEFAULT_USERS[0].password,
     });
 }
-export default async function globalSetup() {
+export default async function globalSetup(config) {
     console.log("Running global setup...");
     await checkRequiredBinaries();
+    await loadLocalVaultSecrets();
+    loadDotenvFromProjects(config);
     await setClusterRouterBaseEnv();
     await deployKeycloak();
     console.log("Global setup completed successfully");
 }
+/**
+ * Loads .env files from each project's e2e-tests directory.
+ * Uses `override: true` so local .env values take priority over Vault secrets.
+ */
+function loadDotenvFromProjects(config) {
+    const seen = new Set();
+    for (const project of config.projects) {
+        // testDir points to e2e-tests/tests, go up one level to e2e-tests/
+        const e2eRoot = resolve(project.testDir, "..");
+        if (seen.has(e2eRoot))
+            continue;
+        seen.add(e2eRoot);
+        dotenv.config({ path: resolve(e2eRoot, ".env"), override: true });
+    }
+}

package/dist/utils/vault.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Loads secrets from HashiCorp Vault into process.env.
+ * Only runs when `VAULT=1` or `VAULT=true` is set. Handles OIDC login automatically.
+ *
+ * Fetches secrets from:
+ * - Global path: `<basePath>/global`
+ * - Per-workspace paths: `<basePath>/workspaces/<name>`
+ *
+ * Configure via env vars:
+ * - `VAULT_ADDR` — Vault server URL (default: https://vault.ci.openshift.org)
+ * - `VAULT_BASE_PATH` — Base path in Vault (default: selfservice/rhdh-plugin-export-overlays)
+ *
+ * Security: Only key names are logged, never secret values.
+ */
+export declare function loadLocalVaultSecrets(): Promise<void>;
+//# sourceMappingURL=vault.d.ts.map

package/dist/utils/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/utils/vault.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAiE3D"}

package/dist/utils/vault.js

@@ -0,0 +1,94 @@
+import { $ } from "./bash.js";
+const VAULT_ADDR_DEFAULT = "https://vault.ci.openshift.org";
+const VAULT_BASE_PATH_DEFAULT = "selfservice/rhdh-plugin-export-overlays";
+/**
+ * Loads secrets from HashiCorp Vault into process.env.
+ * Only runs when `VAULT=1` or `VAULT=true` is set. Handles OIDC login automatically.
+ *
+ * Fetches secrets from:
+ * - Global path: `<basePath>/global`
+ * - Per-workspace paths: `<basePath>/workspaces/<name>`
+ *
+ * Configure via env vars:
+ * - `VAULT_ADDR` — Vault server URL (default: https://vault.ci.openshift.org)
+ * - `VAULT_BASE_PATH` — Base path in Vault (default: selfservice/rhdh-plugin-export-overlays)
+ *
+ * Security: Only key names are logged, never secret values.
+ */
+export async function loadLocalVaultSecrets() {
+    if (process.env.VAULT !== "1" && process.env.VAULT !== "true")
+        return;
+    const vaultAddr = process.env.VAULT_ADDR || VAULT_ADDR_DEFAULT;
+    const basePath = process.env.VAULT_BASE_PATH || VAULT_BASE_PATH_DEFAULT;
+    process.env.VAULT_ADDR = vaultAddr;
+    // Check vault CLI is installed
+    const whichResult = await vaultCmd `command -v vault`;
+    if (whichResult.exitCode !== 0) {
+        throw new Error("vault CLI not found. Install from https://developer.hashicorp.com/vault/downloads");
+    }
+    // Check if already logged in
+    const tokenCheck = await vaultCmd `vault token lookup`;
+    if (tokenCheck.exitCode !== 0) {
+        console.log("Vault: not logged in, starting OIDC login...");
+        // vault login needs inherited stdio for browser-based OIDC flow
+        await $ `vault login -no-print -method=oidc`;
+        const retryCheck = await vaultCmd `vault token lookup`;
+        if (retryCheck.exitCode !== 0) {
+            throw new Error("Vault login failed. Run manually:\n  export VAULT_ADDR='" +
+                vaultAddr +
+                "'\n  vault login -method=oidc");
+        }
+    }
+    // Check access by fetching global secrets first
+    const globalResult = await vaultCmd `vault kv get -format=json -mount=kv ${basePath}/global`;
+    if (globalResult.stderr.includes("permission denied")) {
+        console.log("Vault: permission denied. Request access in Slack: #rhdh-e2e-tests");
+        return;
+    }
+    console.log("Loading secrets from vault...");
+    // Load global secrets
+    loadSecretsFromResult(globalResult, "global");
+    // List and fetch per-workspace secrets
+    const listResult = await vaultCmd `vault kv list -format=json -mount=kv ${basePath}/workspaces`;
+    if (listResult.exitCode === 0) {
+        const workspaces = JSON.parse(listResult.stdout);
+        await Promise.all(workspaces.map((ws) => {
+            const name = ws.replace(/\/$/, "");
+            return exportSecretsFromPath(`${basePath}/workspaces/${name}`, name);
+        }));
+    }
+    else {
+        console.log("  No workspace-specific secrets found");
+    }
+    console.log("Vault secrets loaded successfully.");
+}
+/** Runs a shell command with piped stdio and nothrow, for capturing vault CLI output. */
+const vaultCmd = $({
+    stdio: ["pipe", "pipe", "pipe"],
+    nothrow: true,
+});
+async function exportSecretsFromPath(vaultPath, label) {
+    const result = await vaultCmd `vault kv get -format=json -mount=kv ${vaultPath}`;
+    loadSecretsFromResult(result, label);
+}
+function loadSecretsFromResult(result, label) {
+    if (result.exitCode !== 0) {
+        console.log(`  No secrets at: ${label}`);
+        return;
+    }
+    const json = JSON.parse(result.stdout);
+    const secrets = json?.data?.data;
+    if (!secrets) {
+        console.log(`  No secrets at: ${label}`);
+        return;
+    }
+    console.log(`  From: ${label}`);
+    for (const [key, value] of Object.entries(secrets)) {
+        if (key.startsWith("secretsync/"))
+            continue;
+        if (!key.startsWith("VAULT_"))
+            continue;
+        const safeKey = key.replace(/[.\-/]/g, "_");
+        process.env[safeKey] = value;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@red-hat-developer-hub/e2e-test-utils",
-  "version": "1.1.32",
+  "version": "1.1.33",
   "description": "Test utilities for RHDH E2E tests",
   "license": "Apache-2.0",
   "repository": {
@@ -107,6 +107,7 @@
     "@eslint/js": "10.0.1",
     "@keycloak/keycloak-admin-client": "26.5.6",
     "@kubernetes/client-node": "1.4.0",
+    "dotenv": "17.4.2",
     "eslint": "10.2.0",
     "eslint-plugin-check-file": "3.3.1",
     "eslint-plugin-playwright": "2.10.1",