@red-hat-developer-hub/e2e-test-utils 2.1.11 → 2.1.13

package/dist/deployment/openldap/deployment.js

@@ -0,0 +1,219 @@
+import * as fs from "fs";
+import { KubernetesClientHelper } from "../../utils/kubernetes-client.js";
+import { $, runQuietUnlessFailure } from "../../utils/bash.js";
+import { DEFAULT_OPENLDAP_CONFIG, DEFAULT_CONFIG_PATHS, buildBindDn, buildUsersDn, buildGroupsDn, } from "./constants.js";
+/**
+ * Orchestrator-style OpenLDAP helper (Bitnami legacy image).
+ * Call from test.runOnce — not globalSetup. Deploys into the Playwright project namespace.
+ */
+export class OpenLDAPHelper {
+    k8sClient = new KubernetesClientHelper();
+    deploymentConfig;
+    ldapUrl = "";
+    constructor(options = {}) {
+        this.deploymentConfig = this._buildDeploymentConfig(options);
+    }
+    /**
+     * Deploy OpenLDAP into the given namespace (creates namespace if needed).
+     */
+    async deploy(namespace) {
+        this.deploymentConfig.namespace = namespace;
+        this._log(`Starting OpenLDAP deployment in ${namespace}...`);
+        await this.k8sClient.createNamespaceIfNotExists(namespace);
+        await this._applyManifests();
+        await this.waitUntilReady();
+        this.ldapUrl = this.getServiceUrl();
+        this._log(`OpenLDAP ready at ${this.ldapUrl}`);
+    }
+    /**
+     * True if the OpenLDAP service already exists in the configured namespace.
+     */
+    async isRunning() {
+        const { namespace, releaseName } = this.deploymentConfig;
+        if (!namespace) {
+            return false;
+        }
+        try {
+            const result = await $ `kubectl get svc ${releaseName} -n ${namespace} -o name`.nothrow();
+            return result.exitCode === 0;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Cluster-internal LDAP URL (Keycloak federation / RHDH ldapOrg). */
+    getServiceUrl() {
+        const { releaseName, namespace, port } = this.deploymentConfig;
+        if (!namespace) {
+            throw new Error("OpenLDAP namespace is not set — call deploy(namespace) first");
+        }
+        return `ldap://${releaseName}.${namespace}.svc.cluster.local:${port}`;
+    }
+    getBindConfig() {
+        const { adminPassword, baseDn, adminUser, usersOu, groupsOu } = this.deploymentConfig;
+        return {
+            bindDn: buildBindDn({ adminUser, baseDn }),
+            bindSecret: adminPassword,
+            usersDn: buildUsersDn({ usersOu, baseDn }),
+            groupsDn: buildGroupsDn({ groupsOu, baseDn }),
+            baseDn,
+        };
+    }
+    /** Export LDAP_* env vars for RHDH secrets / app-config substitution. */
+    exportEnv() {
+        const bind = this.getBindConfig();
+        process.env.LDAP_TARGET_URL = this.getServiceUrl();
+        process.env.LDAP_BIND_DN = bind.bindDn;
+        process.env.LDAP_BIND_SECRET = bind.bindSecret;
+        process.env.LDAP_USERS_DN = bind.usersDn;
+        process.env.LDAP_GROUPS_DN = bind.groupsDn;
+    }
+    async waitUntilReady(timeout = 300) {
+        const { namespace, releaseName } = this.deploymentConfig;
+        this._log("Waiting for OpenLDAP pods...");
+        const labelSelector = `app.kubernetes.io/name=openldap,app.kubernetes.io/instance=${releaseName}`;
+        await this.k8sClient.waitForPodsWithFailureDetection(namespace, labelSelector, timeout);
+    }
+    async teardown() {
+        const { namespace, releaseName } = this.deploymentConfig;
+        this._log(`Tearing down OpenLDAP ${releaseName} in ${namespace}...`);
+        await $ `kubectl delete deployment,svc,configmap -l app.kubernetes.io/instance=${releaseName} -n ${namespace} --ignore-not-found=true`.nothrow();
+    }
+    _buildDeploymentConfig(options) {
+        return {
+            namespace: "",
+            releaseName: options.releaseName ?? DEFAULT_OPENLDAP_CONFIG.releaseName,
+            adminUser: options.adminUser ?? DEFAULT_OPENLDAP_CONFIG.adminUser,
+            adminPassword: options.adminPassword ?? DEFAULT_OPENLDAP_CONFIG.adminPassword,
+            baseDn: options.baseDn ?? DEFAULT_OPENLDAP_CONFIG.baseDn,
+            usersOu: options.usersOu ?? DEFAULT_OPENLDAP_CONFIG.usersOu,
+            groupsOu: options.groupsOu ?? DEFAULT_OPENLDAP_CONFIG.groupsOu,
+            port: options.port ?? DEFAULT_OPENLDAP_CONFIG.port,
+            imageRepository: options.imageRepository ?? DEFAULT_OPENLDAP_CONFIG.imageRepository,
+            imageTag: options.imageTag ?? DEFAULT_OPENLDAP_CONFIG.imageTag,
+            seedLdifFile: options.seedLdifFile ?? DEFAULT_CONFIG_PATHS.seedLdifFile,
+        };
+    }
+    async _applyManifests() {
+        const cfg = this.deploymentConfig;
+        if (!fs.existsSync(cfg.seedLdifFile)) {
+            throw new Error(`OpenLDAP seed LDIF not found: ${cfg.seedLdifFile}`);
+        }
+        const seedContent = fs.readFileSync(cfg.seedLdifFile, "utf-8");
+        const manifest = `
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ${cfg.releaseName}-seed
+  namespace: ${cfg.namespace}
+  labels:
+    app.kubernetes.io/name: openldap
+    app.kubernetes.io/instance: ${cfg.releaseName}
+data:
+  seed.ldif: |
+${seedContent
+            .split("\n")
+            .map((line) => `    ${line}`)
+            .join("\n")}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ${cfg.releaseName}
+  namespace: ${cfg.namespace}
+  labels:
+    app.kubernetes.io/name: openldap
+    app.kubernetes.io/instance: ${cfg.releaseName}
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: openldap
+    app.kubernetes.io/instance: ${cfg.releaseName}
+  ports:
+    - name: ldap
+      port: ${cfg.port}
+      targetPort: ldap
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${cfg.releaseName}
+  namespace: ${cfg.namespace}
+  labels:
+    app.kubernetes.io/name: openldap
+    app.kubernetes.io/instance: ${cfg.releaseName}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: openldap
+      app.kubernetes.io/instance: ${cfg.releaseName}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: openldap
+        app.kubernetes.io/instance: ${cfg.releaseName}
+    spec:
+      containers:
+        - name: openldap
+          image: ${cfg.imageRepository}:${cfg.imageTag}
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: ldap
+              containerPort: ${cfg.port}
+          # Bitnami slapd/slappasswd carry setcap CAP_NET_BIND_SERVICE; OpenShift
+          # restricted-v2 drops ALL capabilities unless NET_BIND_SERVICE is added
+          # explicitly (otherwise: "slappasswd: Operation not permitted").
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+              add: ["NET_BIND_SERVICE"]
+            runAsNonRoot: true
+          env:
+            - name: LDAP_ROOT
+              value: "${cfg.baseDn}"
+            - name: LDAP_ADMIN_USERNAME
+              value: "${cfg.adminUser}"
+            - name: LDAP_ADMIN_PASSWORD
+              value: "${cfg.adminPassword}"
+            - name: LDAP_PORT_NUMBER
+              value: "${cfg.port}"
+            - name: LDAP_CUSTOM_LDIF_DIR
+              value: /ldifs
+            - name: LDAP_ALLOW_ANON_BINDING
+              value: "no"
+          volumeMounts:
+            - name: seed
+              mountPath: /ldifs
+              readOnly: true
+          readinessProbe:
+            tcpSocket:
+              port: ldap
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            failureThreshold: 12
+          livenessProbe:
+            tcpSocket:
+              port: ldap
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            failureThreshold: 6
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+      volumes:
+        - name: seed
+          configMap:
+            name: ${cfg.releaseName}-seed
+`;
+        await runQuietUnlessFailure `echo ${manifest} | kubectl apply -f -`;
+    }
+    _log(message) {
+        console.log(`[OpenLDAP] ${message}`);
+    }
+}

package/dist/deployment/openldap/index.d.ts

@@ -0,0 +1,4 @@
+export { OpenLDAPHelper } from "./deployment.js";
+export { DEFAULT_OPENLDAP_CONFIG, DEFAULT_OPENLDAP_PASSWORD, DEFAULT_USERS as DEFAULT_OPENLDAP_USERS, buildBindDn, buildUsersDn, buildGroupsDn, } from "./constants.js";
+export type { OpenLDAPDeploymentOptions, OpenLDAPDeploymentConfig, OpenLDAPBindConfig, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/deployment/openldap/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/deployment/openldap/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,aAAa,IAAI,sBAAsB,EACvC,WAAW,EACX,YAAY,EACZ,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,YAAY,CAAC"}

package/dist/deployment/openldap/index.js

@@ -0,0 +1,2 @@
+export { OpenLDAPHelper } from "./deployment.js";
+export { DEFAULT_OPENLDAP_CONFIG, DEFAULT_OPENLDAP_PASSWORD, DEFAULT_USERS as DEFAULT_OPENLDAP_USERS, buildBindDn, buildUsersDn, buildGroupsDn, } from "./constants.js";

package/dist/deployment/openldap/types.d.ts

@@ -0,0 +1,34 @@
+export type OpenLDAPDeploymentOptions = {
+    releaseName?: string;
+    adminUser?: string;
+    adminPassword?: string;
+    baseDn?: string;
+    usersOu?: string;
+    groupsOu?: string;
+    port?: number;
+    imageRepository?: string;
+    imageTag?: string;
+    valuesFile?: string;
+    seedLdifFile?: string;
+};
+export type OpenLDAPDeploymentConfig = {
+    namespace: string;
+    releaseName: string;
+    adminUser: string;
+    adminPassword: string;
+    baseDn: string;
+    usersOu: string;
+    groupsOu: string;
+    port: number;
+    imageRepository: string;
+    imageTag: string;
+    seedLdifFile: string;
+};
+export type OpenLDAPBindConfig = {
+    bindDn: string;
+    bindSecret: string;
+    usersDn: string;
+    groupsDn: string;
+    baseDn: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/deployment/openldap/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/deployment/openldap/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC"}

package/dist/deployment/openldap/types.js

@@ -0,0 +1 @@
+export {};

package/dist/playwright/helpers/common.d.ts

@@ -1,5 +1,70 @@
 import { UIhelper } from "./ui-helper.js";
-import type { Browser, Page, TestInfo } from "@playwright/test";
+import type { Browser, BrowserContext, Page, TestInfo } from "@playwright/test";
+/**
+ * Where a GitHub storage state is cached, and the lock that serialises access to it.
+ *
+ * The name used to be a bare relative `authState_<user>.json`, resolved against
+ * `process.cwd()` — which the worker fixture sets to the workspace's `e2e-tests`
+ * directory, the same value for every project in that workspace. So every lane and
+ * every worker shared one file with no lock: a reader could land mid-write and fail on
+ * truncated JSON, and a stale file could survive into a run that needed a fresh login.
+ *
+ * Deliberately still one file per *user*, not per project. Scoping it per project was
+ * the obvious fix and is the wrong one: `logintoGithub` derives its 2FA code from a
+ * single shared TOTP secret, so two lanes logging in inside the same 30-second window
+ * submit the identical code and GitHub rejects the second — a failure this file already
+ * has retry handling for. Sharing the session is the point of caching it; what was
+ * missing was making concurrent access safe, which is what the lock and the atomic
+ * write below do. RHDH cookies from another lane are harmless: each lane's RHDH lives
+ * on its own namespace hostname, so they are never sent anywhere they matter.
+ */
+export declare function githubSessionFile(userid: string): string;
+/**
+ * Cookies from a stored session, or `undefined` when there is nothing usable.
+ *
+ * A cached session is an optimisation, so a missing, truncated or malformed file must
+ * fall through to a full login rather than fail the test. Before this, a partially
+ * written file threw out of `JSON.parse` and read as a plugin failure.
+ */
+export type StoredCookies = Parameters<BrowserContext["addCookies"]>[0];
+export declare function readStoredCookies(file: string): StoredCookies | undefined;
+/**
+ * Writes the storage state so a concurrent reader never sees a partial file.
+ *
+ * `storageState({ path })` writes in place, so a reader can observe the file between
+ * create and write. Writing to a temp name and renaming makes the appearance of the
+ * final path atomic. The temp name carries the pid because Playwright workers are
+ * separate processes, and it is removed even when the write fails so failed runs do
+ * not litter the workspace.
+ */
+export declare function writeStorageStateAtomically(page: Page, file: string): Promise<void>;
+/**
+ * Runs `fn` with exclusive access to the session file, across workers and lanes.
+ *
+ * Without this the first lane to start would not have finished writing before the
+ * others decided there was no session and each began its own login — which is the
+ * TOTP collision described above, not merely wasted work. The lock target is created
+ * rather than assumed: `proper-lockfile` needs an existing path, and the session file
+ * itself does not exist on the run that has to create it.
+ */
+export declare function withGithubSessionLock<T>(file: string, fn: () => Promise<T>): Promise<T>;
+/**
+ * Creates the shared GitHub session if it is missing, and says which happened.
+ *
+ * Only creation needs to be exclusive: it drives a real GitHub sign-in whose 2FA
+ * code comes from one shared TOTP secret, so two lanes doing it inside the same
+ * 30-second window submit the identical code and the second is rejected. Reusing
+ * an existing session is just cookies plus a Sign In click against a different
+ * namespace host, and serialising that behind the lock made every lane queue for
+ * a sign-in it did not need — long enough that a waiter could exhaust Playwright's
+ * default test timeout before the lock's own retries ran out. `test.setTimeout`
+ * is raised inside the login itself, which is precisely the path a waiter is not on.
+ *
+ * The re-read inside the lock is what keeps that safe: whoever held the lock before
+ * us has almost certainly just created the session, and logging in again would be
+ * the same collision the lock exists to prevent.
+ */
+export declare function ensureGithubSession(file: string, create: () => Promise<void>): Promise<"reused" | "created">;
 export declare class LoginHelper {
     page: Page;
     uiHelper: UIhelper;
@@ -8,8 +73,14 @@ export declare class LoginHelper {
     signOut(): Promise<void>;
     private logintoGithub;
     logintoKeycloak(popup: Page, userid: string, password: string): Promise<void>;
+    /**
+     * Sign in via Keycloak popup. Supports both OIDC ("Sign In") and the
+     * community keycloak provider ("Sign in using Keycloak").
+     */
     loginAsKeycloakUser(userid?: string, password?: string): Promise<void>;
     loginAsGithubUser(userid?: string): Promise<void>;
+    private _reuseGithubSession;
+    private _createGithubSession;
     checkAndReauthorizeGithubApp(): Promise<void>;
     private handleGithubPopupReauth;
     googleSignIn(email: string): Promise<void>;
@@ -26,6 +97,6 @@ export declare class LoginHelper {
 }
 export declare function setupBrowser(browser: Browser, testInfo: TestInfo): Promise<{
     page: Page;
-    context: import("playwright-core").BrowserContext;
+    context: BrowserContext;
 }>;
 //# sourceMappingURL=common.d.ts.map

package/dist/playwright/helpers/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/playwright/helpers/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAMhE,qBAAa,WAAW;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;gBAEP,IAAI,EAAE,IAAI;IAKhB,YAAY;IAcZ,OAAO;YAMC,aAAa;IA2CrB,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAO7D,mBAAmB,CACvB,MAAM,GAAE,MAAkC,EAC1C,QAAQ,GAAE,MAAkC;IAWxC,iBAAiB,CACrB,MAAM,GAAE,MAA+C;IAoDnD,4BAA4B;YASpB,uBAAuB;IAgB/B,YAAY,CAAC,KAAK,EAAE,MAAM;IA2B1B,2BAA2B,CAAC,KAAK,UAAQ;IAU/C,mBAAmB,IAAI,MAAM;IAIvB,mBAAmB;IAgBzB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAevC,eAAe,IAAI,MAAM;IAKnB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;YAqCxC,sBAAsB;IAoD9B,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAYjE,2BAA2B,CAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM;IAYb,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CA2C7D;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;;;GAWtE"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/playwright/helpers/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAOhF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAExE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAQzE;AAED;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAYZ;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAC1B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAQ/B;AAED,qBAAa,WAAW;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;gBAEP,IAAI,EAAE,IAAI;IAKhB,YAAY;IAcZ,OAAO;YAMC,aAAa;IA2CrB,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAOnE;;;OAGG;IACG,mBAAmB,CACvB,MAAM,GAAE,MAAkC,EAC1C,QAAQ,GAAE,MAAkC;IAoBxC,iBAAiB,CACrB,MAAM,GAAE,MAA+C;YAa3C,mBAAmB;YAwCnB,oBAAoB;IAW5B,4BAA4B;YASpB,uBAAuB;IAgB/B,YAAY,CAAC,KAAK,EAAE,MAAM;IA2B1B,2BAA2B,CAAC,KAAK,UAAQ;IAU/C,mBAAmB,IAAI,MAAM;IAIvB,mBAAmB;IAgBzB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAevC,eAAe,IAAI,MAAM;IAKnB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;YAqCxC,sBAAsB;IAoD9B,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAYjE,2BAA2B,CAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM;IAYb,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CA2C7D;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;;;GAWtE"}

package/dist/playwright/helpers/common.js

@@ -4,7 +4,108 @@ import { test, expect } from "@playwright/test";
 import { SETTINGS_PAGE_COMPONENTS } from "../page-objects/page-obj.js";
 import * as path from "path";
 import * as fs from "fs";
+import lockfile from "proper-lockfile";
 import { DEFAULT_USERS } from "../../deployment/keycloak/constants.js";
+/**
+ * Where a GitHub storage state is cached, and the lock that serialises access to it.
+ *
+ * The name used to be a bare relative `authState_<user>.json`, resolved against
+ * `process.cwd()` — which the worker fixture sets to the workspace's `e2e-tests`
+ * directory, the same value for every project in that workspace. So every lane and
+ * every worker shared one file with no lock: a reader could land mid-write and fail on
+ * truncated JSON, and a stale file could survive into a run that needed a fresh login.
+ *
+ * Deliberately still one file per *user*, not per project. Scoping it per project was
+ * the obvious fix and is the wrong one: `logintoGithub` derives its 2FA code from a
+ * single shared TOTP secret, so two lanes logging in inside the same 30-second window
+ * submit the identical code and GitHub rejects the second — a failure this file already
+ * has retry handling for. Sharing the session is the point of caching it; what was
+ * missing was making concurrent access safe, which is what the lock and the atomic
+ * write below do. RHDH cookies from another lane are harmless: each lane's RHDH lives
+ * on its own namespace hostname, so they are never sent anywhere they matter.
+ */
+export function githubSessionFile(userid) {
+    const safe = String(userid).replace(/[^a-zA-Z0-9._-]/g, "_");
+    return path.resolve(`authState_${safe}.json`);
+}
+export function readStoredCookies(file) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
+        const cookies = parsed?.cookies;
+        return Array.isArray(cookies) && cookies.length > 0 ? cookies : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Writes the storage state so a concurrent reader never sees a partial file.
+ *
+ * `storageState({ path })` writes in place, so a reader can observe the file between
+ * create and write. Writing to a temp name and renaming makes the appearance of the
+ * final path atomic. The temp name carries the pid because Playwright workers are
+ * separate processes, and it is removed even when the write fails so failed runs do
+ * not litter the workspace.
+ */
+export async function writeStorageStateAtomically(page, file) {
+    const pending = `${file}.${process.pid}.tmp`;
+    try {
+        await page.context().storageState({ path: pending });
+        fs.renameSync(pending, file);
+    }
+    finally {
+        fs.rmSync(pending, { force: true });
+    }
+}
+/**
+ * Runs `fn` with exclusive access to the session file, across workers and lanes.
+ *
+ * Without this the first lane to start would not have finished writing before the
+ * others decided there was no session and each began its own login — which is the
+ * TOTP collision described above, not merely wasted work. The lock target is created
+ * rather than assumed: `proper-lockfile` needs an existing path, and the session file
+ * itself does not exist on the run that has to create it.
+ */
+export async function withGithubSessionLock(file, fn) {
+    const target = `${file}.lock-target`;
+    fs.writeFileSync(target, "", { flag: "a" });
+    const release = await lockfile.lock(target, {
+        retries: { retries: 60, minTimeout: 1_000 },
+        stale: 300_000,
+    });
+    try {
+        return await fn();
+    }
+    finally {
+        await release();
+    }
+}
+/**
+ * Creates the shared GitHub session if it is missing, and says which happened.
+ *
+ * Only creation needs to be exclusive: it drives a real GitHub sign-in whose 2FA
+ * code comes from one shared TOTP secret, so two lanes doing it inside the same
+ * 30-second window submit the identical code and the second is rejected. Reusing
+ * an existing session is just cookies plus a Sign In click against a different
+ * namespace host, and serialising that behind the lock made every lane queue for
+ * a sign-in it did not need — long enough that a waiter could exhaust Playwright's
+ * default test timeout before the lock's own retries ran out. `test.setTimeout`
+ * is raised inside the login itself, which is precisely the path a waiter is not on.
+ *
+ * The re-read inside the lock is what keeps that safe: whoever held the lock before
+ * us has almost certainly just created the session, and logging in again would be
+ * the same collision the lock exists to prevent.
+ */
+export async function ensureGithubSession(file, create) {
+    if (readStoredCookies(file))
+        return "reused";
+    return await withGithubSessionLock(file, async () => {
+        if (readStoredCookies(file))
+            return "reused";
+        await create();
+        return "created";
+    });
+}
 export class LoginHelper {
     page;
     uiHelper;
@@ -61,55 +162,74 @@ export class LoginHelper {
         await popup.locator("#password").fill(password);
         await popup.locator("#kc-login").click();
     }
+    /**
+     * Sign in via Keycloak popup. Supports both OIDC ("Sign In") and the
+     * community keycloak provider ("Sign in using Keycloak").
+     */
     async loginAsKeycloakUser(userid = DEFAULT_USERS[0].username, password = DEFAULT_USERS[0].password) {
         await this.page.goto("/");
         await this.uiHelper.waitForLoad(240000);
         const popupPromise = this.page.waitForEvent("popup");
-        await this.uiHelper.clickButton("Sign In");
+        const keycloakProviderBtn = this.page.getByRole("button", {
+            name: /sign in using keycloak/i,
+        });
+        if (await keycloakProviderBtn.isVisible().catch(() => false)) {
+            await keycloakProviderBtn.click();
+        }
+        else {
+            await this.uiHelper.clickButton("Sign In");
+        }
         const popup = await popupPromise;
         await this.logintoKeycloak(popup, userid, password);
-        await this.page.waitForSelector("nav a", { timeout: 10_000 });
+        await this.page.waitForSelector("nav a", { timeout: 30_000 });
     }
     async loginAsGithubUser(userid = process.env.VAULT_GH_USER_ID) {
-        const sessionFileName = `authState_${userid}.json`;
-        // Check if a session file for this specific user already exists
-        if (fs.existsSync(sessionFileName)) {
-            // Load and reuse existing authentication state
-            const cookies = JSON.parse(fs.readFileSync(sessionFileName, "utf-8")).cookies;
-            await this.page.context().addCookies(cookies);
-            console.log(`Reusing existing authentication state for user: ${userid}`);
-            await this.page.goto("/");
-            await this.uiHelper.waitForLoad(12000);
-            await this.uiHelper.clickButton("Sign In");
-            // Wait for either: sidebar appears (auto-login) or popup opens (needs auth)
-            const navPromise = this.page
-                .waitForSelector("nav a", { timeout: 15_000 })
-                .then(() => "nav")
-                .catch(() => null);
-            const popupPromise = this.page
-                .waitForEvent("popup", { timeout: 15_000 })
-                .then((popup) => ({ popup }))
-                .catch(() => null);
-            const result = await Promise.race([navPromise, popupPromise]);
-            if (result === null) {
-                throw new Error("GitHub login failed: neither sidebar nor popup appeared after Sign In — session file may be stale");
-            }
-            if (typeof result === "object" && "popup" in result) {
-                // Popup opened — handle reauthorization
-                await this.handleGithubPopupReauth(result.popup);
-            }
+        const sessionFileName = githubSessionFile(userid);
+        const outcome = await ensureGithubSession(sessionFileName, () => this._createGithubSession(userid, sessionFileName));
+        // Creating already left this page signed in; replaying the reuse path would
+        // click Sign In a second time against a session that is already live.
+        if (outcome === "reused") {
+            await this._reuseGithubSession(userid, sessionFileName);
         }
-        else {
-            // Perform login if no session file exists, then save the state
-            await this.logintoGithub(userid);
-            await this.page.goto("/");
-            await this.uiHelper.waitForLoad(240000);
-            await this.uiHelper.clickButton("Sign In");
-            await this.checkAndReauthorizeGithubApp();
-            await this.page.waitForSelector("nav a", { timeout: 10_000 });
-            await this.page.context().storageState({ path: sessionFileName });
-            console.log(`Authentication state saved for user: ${userid}`);
+    }
+    async _reuseGithubSession(userid, sessionFileName) {
+        const cookies = readStoredCookies(sessionFileName);
+        if (!cookies) {
+            throw new Error(`GitHub session file for ${userid} disappeared between the check and the read: ${sessionFileName}`);
         }
+        // Load and reuse existing authentication state
+        await this.page.context().addCookies(cookies);
+        console.log(`Reusing existing authentication state for user: ${userid}`);
+        await this.page.goto("/");
+        await this.uiHelper.waitForLoad(12000);
+        await this.uiHelper.clickButton("Sign In");
+        // Wait for either: sidebar appears (auto-login) or popup opens (needs auth)
+        const navPromise = this.page
+            .waitForSelector("nav a", { timeout: 15_000 })
+            .then(() => "nav")
+            .catch(() => null);
+        const popupPromise = this.page
+            .waitForEvent("popup", { timeout: 15_000 })
+            .then((popup) => ({ popup }))
+            .catch(() => null);
+        const result = await Promise.race([navPromise, popupPromise]);
+        if (result === null) {
+            throw new Error("GitHub login failed: neither sidebar nor popup appeared after Sign In — session file may be stale");
+        }
+        if (typeof result === "object" && "popup" in result) {
+            // Popup opened — handle reauthorization
+            await this.handleGithubPopupReauth(result.popup);
+        }
+    }
+    async _createGithubSession(userid, sessionFileName) {
+        await this.logintoGithub(userid);
+        await this.page.goto("/");
+        await this.uiHelper.waitForLoad(240000);
+        await this.uiHelper.clickButton("Sign In");
+        await this.checkAndReauthorizeGithubApp();
+        await this.page.waitForSelector("nav a", { timeout: 10_000 });
+        await writeStorageStateAtomically(this.page, sessionFileName);
+        console.log(`Authentication state saved for user: ${userid}`);
     }
     async checkAndReauthorizeGithubApp() {
         await new Promise((resolve) => {

package/dist/playwright/helpers/github-session.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=github-session.test.d.ts.map

package/dist/playwright/helpers/github-session.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-session.test.d.ts","sourceRoot":"","sources":["../../../src/playwright/helpers/github-session.test.ts"],"names":[],"mappings":""}