@trackunit/iris-app-playwright 0.1.1

package/src/plugins/defaultPlaywrightConfig.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultPlaywrightConfig = void 0;
+exports.findWorkspaceRoot = findWorkspaceRoot;
+const tslib_1 = require("tslib");
+const crypto_1 = tslib_1.__importDefault(require("crypto"));
+const fs_1 = require("fs");
+const path_1 = tslib_1.__importDefault(require("path"));
+const Codeowner_1 = require("../utils/Codeowner");
+/**
+ * Finds the NX workspace root by walking up the directory tree looking for nx.json or workspace.json.
+ *
+ * @param startDir - Starting directory for the search (defaults to current working directory)
+ * @returns {string} Absolute path to the workspace root
+ * @throws Error if workspace root cannot be found
+ */
+function findWorkspaceRoot(startDir = process.cwd()) {
+    let currentDir = startDir;
+    while (currentDir !== path_1.default.dirname(currentDir)) {
+        if ((0, fs_1.existsSync)(path_1.default.join(currentDir, "nx.json")) || (0, fs_1.existsSync)(path_1.default.join(currentDir, "workspace.json"))) {
+            return currentDir;
+        }
+        currentDir = path_1.default.dirname(currentDir);
+    }
+    throw new Error("Could not find NX workspace root (nx.json or workspace.json not found)");
+}
+// Memoized at module scope so multiple `defaultPlaywrightConfig()` calls within
+// a single process (Playwright loads the config twice — once for discovery, once
+// for the run) share the same ids. Otherwise the junit reporter would write to
+// two different filenames and `metadata.runId` would diverge between the two
+// loads.
+const runId = crypto_1.default.randomUUID();
+const junitFileSuffix = crypto_1.default.randomUUID();
+/**
+ * Default cap when running against a shared, rate-limited environment (dev,
+ * stage, prod, feature branches). Picked deliberately: it stays under Okta's
+ * `/api/v1/authn` burst threshold (typically ~5/s) for the initial parallel
+ * login fan-out, while still letting most suites finish in roughly half the
+ * wall-clock of a fully serial run.
+ */
+const SHARED_ENV_WORKER_CAP = 2;
+/**
+ * Recognises whether a `BASE_URL` value points at a developer's own machine
+ * (Vite dev server, in-cluster preview, etc.) vs a shared, rate-limited
+ * environment. We don't try to enumerate every dev pattern — just the few
+ * that genuinely don't share an Okta tenant with other workers running
+ * elsewhere. Anything else (including unset) is treated conservatively.
+ */
+const isSharedEnvironmentBaseURL = (baseURL) => {
+    if (baseURL === undefined || baseURL === "") {
+        return false;
+    }
+    try {
+        // Node's URL parser wraps IPv6 hostnames in brackets (e.g. `"[::1]"`).
+        // Strip them so the IPv6 loopback check below works regardless.
+        const hostname = new URL(baseURL).hostname.toLowerCase().replace(/^\[|\]$/g, "");
+        if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "0.0.0.0" || hostname === "::1") {
+            return false;
+        }
+        if (hostname.endsWith(".local") || hostname.endsWith(".localhost")) {
+            return false;
+        }
+        return true;
+    }
+    catch {
+        // Malformed URLs slip through as "not shared" — Playwright will fail
+        // loudly on its own URL parsing later, and we'd rather not cap workers
+        // based on a value we don't understand.
+        return false;
+    }
+};
+/**
+ * Creates default Playwright configuration for E2E testing.
+ * Returns a partial `PlaywrightTestConfig` that projects can spread and extend.
+ *
+ * @param options - Optional configuration overrides
+ * @returns {Partial<PlaywrightTestConfig>} Playwright test configuration
+ */
+const defaultPlaywrightConfig = (options = {}) => {
+    const { configDir, nxRoot: providedNxRoot, outputDirOverride, projectConfig = {}, behaviorConfig = {}, pluginConfig = {}, } = options;
+    const callerDir = configDir ?? process.cwd();
+    const nxRoot = providedNxRoot ?? findWorkspaceRoot(callerDir);
+    const relativePath = path_1.default.relative(nxRoot, callerDir);
+    const dotsToNxRoot = relativePath
+        .split(path_1.default.sep)
+        .map(_ => "..")
+        .join("/");
+    // Playwright owns its own output-dir env var, decoupled from the
+    // Cypress-owned NX_E2E_OUTPUT_DIR. On CI this points at
+    // `./dist/playwright/executor-N` so Playwright artifacts land in a
+    // first-class `dist/playwright` tree (never inside `dist/cypress`).
+    const envOutputDirOverride = process.env.NX_PLAYWRIGHT_OUTPUT_DIR || outputDirOverride;
+    const buildOutputPath = (subPath) => {
+        if (envOutputDirOverride) {
+            return path_1.default.join(dotsToNxRoot, envOutputDirOverride, subPath);
+        }
+        return `${dotsToNxRoot}/dist/playwright/${relativePath}/${subPath}`;
+    };
+    const codeowner = (0, Codeowner_1.toShortTeamName)((0, Codeowner_1.getCodeowner)(callerDir, nxRoot));
+    // Only set workers / fullyParallel when we have a concrete value. Spreading
+    // `undefined` would still create the key on the returned config, which
+    // Playwright treats as "the user said `undefined`" — surprising semantics
+    // we'd rather avoid by leaving the key absent altogether.
+    //
+    // `workers` resolution order:
+    //   1. Explicit `behaviorConfig.workers` always wins.
+    //   2. Otherwise, when running against a shared environment (BASE_URL set
+    //      and not pointing at localhost) we default to `SHARED_ENV_WORKER_CAP`.
+    //      The `login` fixture's per-worker cache collapses subsequent Okta
+    //      calls within a worker, but the first call on each worker still races
+    //      at suite startup — and Okta's `/api/v1/authn` returns `E0000047`
+    //      ("rate limit") once you fan out past a handful of parallel logins.
+    //      Two workers stays comfortably under that threshold while preserving
+    //      ~2x wall-clock speedup over fully serial execution.
+    //   3. Local/feature-branch runs (`BASE_URL` unset or localhost) keep
+    //      Playwright's default — those environments aren't rate-limited.
+    const baseURL = process.env.NX_FEATURE_BRANCH_BASE_URL ?? process.env.BASE_URL;
+    const optional = {};
+    if (behaviorConfig.workers !== undefined) {
+        optional.workers = behaviorConfig.workers;
+    }
+    else if (isSharedEnvironmentBaseURL(baseURL)) {
+        optional.workers = SHARED_ENV_WORKER_CAP;
+    }
+    if (behaviorConfig.fullyParallel !== undefined) {
+        optional.fullyParallel = behaviorConfig.fullyParallel;
+    }
+    return {
+        timeout: behaviorConfig.timeout ?? 30000,
+        retries: behaviorConfig.retries ?? 3,
+        use: {
+            baseURL: process.env.NX_FEATURE_BRANCH_BASE_URL ?? process.env.BASE_URL ?? undefined,
+            navigationTimeout: behaviorConfig.navigationTimeout ?? 35000,
+            actionTimeout: behaviorConfig.actionTimeout ?? 20000,
+            screenshot: "only-on-failure",
+            video: "retain-on-failure",
+            trace: "retain-on-failure",
+        },
+        outputDir: pluginConfig.outputPath ?? buildOutputPath("test-results"),
+        reporter: [["junit", { outputFile: buildOutputPath(`results-${junitFileSuffix}.xml`) }]],
+        testDir: projectConfig.testDir ?? "./src/e2e",
+        metadata: {
+            codeowner,
+            runId,
+        },
+        ...optional,
+    };
+};
+exports.defaultPlaywrightConfig = defaultPlaywrightConfig;
+//# sourceMappingURL=defaultPlaywrightConfig.js.map

package/src/plugins/logsReporter.d.ts

@@ -0,0 +1,55 @@
+import type { FullConfig, FullResult, Reporter, Suite, TestCase, TestResult } from "@playwright/test/reporter";
+import type { Formatter } from "./writeFileWithPrettier";
+export interface LogsReporterOptions {
+    /** Directory where log files are written on test failure */
+    logsFolder: string;
+    /** Directory where HAR files are moved on test failure (temp HAR deleted on pass) */
+    harsFolder?: string;
+    /** Workspace root used by createLogFile to locate .prettierrc */
+    nxRoot: string;
+    /** Prettier formatter instance */
+    formatter: Formatter;
+}
+/**
+ * Custom Playwright reporter that writes redacted log files on test failure
+ * and manages HAR file cleanup (retain on failure, delete on pass).
+ */
+export declare class LogsReporter implements Reporter {
+    private readonly logsFolder;
+    private readonly harsFolder;
+    private readonly nxRoot;
+    private readonly formatter;
+    /**
+     * Promises of in-flight log file writes from `onTestEnd`. `createLogFile`
+     * formats with Prettier (async) and writes via `writeFileSync`; Playwright
+     * may finish the run before those formats settle, so we track them here and
+     * await them in `onEnd` to surface formatter errors and ensure files exist
+     * by the time the process exits.
+     */
+    private readonly pendingWrites;
+    /** @param options - Reporter configuration options */
+    constructor(options: LogsReporterOptions);
+    /** Creates the logs folder before the run begins. */
+    onBegin(_config: FullConfig, _suite: Suite): void;
+    /** Writes a redacted log file on test failure and manages HAR file retention. */
+    onTestEnd(test: TestCase, result: TestResult): void;
+    /**
+     * Awaits in-flight log writes started in `onTestEnd` before the reporter
+     * signals completion. Without this, Playwright may exit before Prettier
+     * settles, leaving partial or missing log files and swallowing formatter
+     * errors.
+     */
+    onEnd(_result: FullResult): Promise<void>;
+    /** Returns false so Playwright adds its own terminal reporter alongside this one. */
+    printsToStdio(): boolean;
+    /**
+     * Returns the HAR attachment path for *this specific result*. Looking at
+     * `test.results.flatMap(r => r.attachments)` would mix attachments across
+     * retries — on a retry, the first attempt's HAR could be retained instead
+     * of (or alongside) the current attempt's HAR. Per-result scoping keeps
+     * each attempt's artifacts paired with its own log file.
+     */
+    private getResultHarPath;
+    private getResultTracePath;
+}
+export default LogsReporter;

package/src/plugins/logsReporter.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LogsReporter = void 0;
+const tslib_1 = require("tslib");
+const fs_1 = require("fs");
+const path = tslib_1.__importStar(require("path"));
+const fileNameBuilder_1 = require("../utils/fileNameBuilder");
+const createLogFile_1 = require("./createLogFile");
+const redactHar_1 = require("./redactHar");
+const redactSensitive_1 = require("./redactSensitive");
+const redactTrace_1 = require("./redactTrace");
+/**
+ * Custom Playwright reporter that writes redacted log files on test failure
+ * and manages HAR file cleanup (retain on failure, delete on pass).
+ */
+class LogsReporter {
+    /** @param options - Reporter configuration options */
+    constructor(options) {
+        /**
+         * Promises of in-flight log file writes from `onTestEnd`. `createLogFile`
+         * formats with Prettier (async) and writes via `writeFileSync`; Playwright
+         * may finish the run before those formats settle, so we track them here and
+         * await them in `onEnd` to surface formatter errors and ensure files exist
+         * by the time the process exits.
+         */
+        this.pendingWrites = [];
+        this.logsFolder = options.logsFolder;
+        this.harsFolder = options.harsFolder;
+        this.nxRoot = options.nxRoot;
+        this.formatter = options.formatter;
+    }
+    /** Creates the logs folder before the run begins. */
+    onBegin(_config, _suite) {
+        if (!(0, fs_1.existsSync)(this.logsFolder)) {
+            (0, fs_1.mkdirSync)(this.logsFolder, { recursive: true });
+        }
+    }
+    /** Writes a redacted log file on test failure and manages HAR file retention. */
+    onTestEnd(test, result) {
+        const titlePath = test.titlePath().filter(t => t.length > 0);
+        const describeTitle = titlePath.slice(0, -1).join(" > ");
+        const testTitle = test.title;
+        const fullTitle = describeTitle ? `${describeTitle} - ${testTitle}` : testTitle;
+        if (result.status === "failed" || result.status === "timedOut") {
+            const fileName = (0, fileNameBuilder_1.fileNameBuilder)(fullTitle, "failed", result.retry);
+            const logs = result.stdout.concat(result.stderr).map(entry => {
+                const message = typeof entry === "string" ? entry : entry.toString();
+                return {
+                    type: "stdout",
+                    message: (0, redactSensitive_1.redactSensitive)(message),
+                    severity: result.status === "failed" ? "error" : "warning",
+                };
+            });
+            this.pendingWrites.push((0, createLogFile_1.createLogFile)(this.nxRoot, this.logsFolder, fileName, logs, this.formatter));
+            if (this.harsFolder !== undefined) {
+                const tempHarPath = this.getResultHarPath(result);
+                if (tempHarPath !== undefined && (0, fs_1.existsSync)(tempHarPath)) {
+                    if (!(0, fs_1.existsSync)(this.harsFolder)) {
+                        (0, fs_1.mkdirSync)(this.harsFolder, { recursive: true });
+                    }
+                    const harFileName = `${(0, fileNameBuilder_1.fileNameBuilder)(fullTitle, "failed", result.retry)}.har`;
+                    // HARs include Authorization, Cookie, and request/response bodies for
+                    // authenticated traffic. Redact before moving to the shared artifacts folder.
+                    (0, redactHar_1.redactHarFile)(tempHarPath, path.join(this.harsFolder, harFileName));
+                    (0, fs_1.rmSync)(tempHarPath);
+                }
+            }
+            // Defense in depth for trace artifacts: `login()`'s slow path does
+            // `page.goto("/auth/manager-classic#session_token=...")`, and Playwright
+            // records the full `goto` URL as the action argument. With
+            // `trace: "retain-on-failure"` from `defaultPlaywrightConfig`, a live
+            // Okta session token would otherwise persist in the retained trace zip
+            // alongside the test artifacts. The fragment is client-side only — it
+            // never reaches the HTTP server and HAR/log redaction already covers
+            // everything that does — so this pass scrubs the remaining surface.
+            const tracePath = this.getResultTracePath(result);
+            if (tracePath !== undefined && (0, fs_1.existsSync)(tracePath)) {
+                this.pendingWrites.push((0, redactTrace_1.redactTraceFile)(tracePath));
+            }
+        }
+        else if (this.harsFolder !== undefined) {
+            const tempHarPath = this.getResultHarPath(result);
+            if (tempHarPath !== undefined && (0, fs_1.existsSync)(tempHarPath)) {
+                (0, fs_1.rmSync)(tempHarPath);
+            }
+        }
+    }
+    /**
+     * Awaits in-flight log writes started in `onTestEnd` before the reporter
+     * signals completion. Without this, Playwright may exit before Prettier
+     * settles, leaving partial or missing log files and swallowing formatter
+     * errors.
+     */
+    async onEnd(_result) {
+        await Promise.all(this.pendingWrites);
+    }
+    /** Returns false so Playwright adds its own terminal reporter alongside this one. */
+    printsToStdio() {
+        return false;
+    }
+    /**
+     * Returns the HAR attachment path for *this specific result*. Looking at
+     * `test.results.flatMap(r => r.attachments)` would mix attachments across
+     * retries — on a retry, the first attempt's HAR could be retained instead
+     * of (or alongside) the current attempt's HAR. Per-result scoping keeps
+     * each attempt's artifacts paired with its own log file.
+     */
+    getResultHarPath(result) {
+        const attachment = result.attachments.find(a => a.name === "har" && a.path !== undefined);
+        return attachment?.path;
+    }
+    getResultTracePath(result) {
+        const attachment = result.attachments.find(a => a.name === "trace" && a.path !== undefined);
+        return attachment?.path;
+    }
+}
+exports.LogsReporter = LogsReporter;
+exports.default = LogsReporter;
+//# sourceMappingURL=logsReporter.js.map

package/src/plugins/nxPreset.d.ts

@@ -0,0 +1,9 @@
+import { nxE2EPreset } from "@nx/playwright/preset";
+/**
+ * Creates the standard NX E2E preset configuration for Playwright.
+ * Wraps the `@nx/playwright` preset with Trackunit defaults.
+ *
+ * @param filename - Pass `__filename` from the calling `playwright.config.ts`
+ * @returns {ReturnType<typeof nxE2EPreset>} NX Playwright preset configuration
+ */
+export declare function createNxPreset(filename: string): ReturnType<typeof nxE2EPreset>;

package/src/plugins/nxPreset.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createNxPreset = createNxPreset;
+const preset_1 = require("@nx/playwright/preset");
+/**
+ * Creates the standard NX E2E preset configuration for Playwright.
+ * Wraps the `@nx/playwright` preset with Trackunit defaults.
+ *
+ * @param filename - Pass `__filename` from the calling `playwright.config.ts`
+ * @returns {ReturnType<typeof nxE2EPreset>} NX Playwright preset configuration
+ */
+function createNxPreset(filename) {
+    return (0, preset_1.nxE2EPreset)(filename, {
+        testDir: "./src",
+    });
+}
+//# sourceMappingURL=nxPreset.js.map

package/src/plugins/redactHar.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Strips sensitive headers, cookies, query parameters, and bodies from a HAR document.
+ * Returns a new object — the input is not mutated.
+ *
+ * Redacts:
+ * - Headers matching SENSITIVE_HEADER_NAMES (Authorization, Cookie, Set-Cookie, etc.)
+ * - All cookie values (request & response)
+ * - Query-string parameters with sensitive names
+ * - Form params with sensitive names
+ * - JSON-like text in request/response bodies via redactSensitive
+ */
+export declare const redactHar: (har: unknown) => unknown;
+/**
+ * Reads a HAR file, redacts sensitive content, and writes it to a new path.
+ * The source file is unchanged. Returns the bytes written.
+ */
+export declare const redactHarFile: (sourcePath: string, destPath: string) => void;

package/src/plugins/redactHar.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactHarFile = exports.redactHar = void 0;
+const fs_1 = require("fs");
+const redactSensitive_1 = require("./redactSensitive");
+const SENSITIVE_HEADER_NAMES = new Set([...redactSensitive_1.SENSITIVE_KEYS, "authorization", "cookie", "set-cookie", "x-api-key", "x-auth-token", "proxy-authorization"].map(n => n.toLowerCase()));
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const redactHeaderArray = (headers) => {
+    if (!Array.isArray(headers))
+        return headers;
+    return headers.map((h) => {
+        if (!isRecord(h))
+            return h;
+        const name = typeof h.name === "string" ? h.name : "";
+        if (SENSITIVE_HEADER_NAMES.has(name.toLowerCase())) {
+            return { ...h, value: "***" };
+        }
+        return h;
+    });
+};
+const redactCookieArray = (cookies) => {
+    if (!Array.isArray(cookies))
+        return cookies;
+    return cookies.map((c) => (isRecord(c) ? { ...c, value: "***" } : c));
+};
+const redactQueryString = (qs) => {
+    if (!Array.isArray(qs))
+        return qs;
+    return qs.map(entry => {
+        if (!isRecord(entry))
+            return entry;
+        const name = typeof entry.name === "string" ? entry.name : "";
+        if (SENSITIVE_HEADER_NAMES.has(name.toLowerCase())) {
+            return { ...entry, value: "***" };
+        }
+        return entry;
+    });
+};
+const redactStringField = (value) => (typeof value === "string" ? (0, redactSensitive_1.redactSensitive)(value) : value);
+const redactPostData = (postData) => {
+    if (!isRecord(postData))
+        return postData;
+    const next = { ...postData };
+    if (typeof postData.text === "string") {
+        next.text = (0, redactSensitive_1.redactSensitive)(postData.text);
+    }
+    if (Array.isArray(postData.params)) {
+        next.params = postData.params.map(p => {
+            if (!isRecord(p))
+                return p;
+            const name = typeof p.name === "string" ? p.name : "";
+            if (SENSITIVE_HEADER_NAMES.has(name.toLowerCase())) {
+                return { ...p, value: "***" };
+            }
+            return p;
+        });
+    }
+    return next;
+};
+const redactContent = (content) => {
+    if (!isRecord(content))
+        return content;
+    if (typeof content.text === "string") {
+        return { ...content, text: (0, redactSensitive_1.redactSensitive)(content.text) };
+    }
+    return content;
+};
+const redactRequest = (request) => {
+    if (!isRecord(request))
+        return request;
+    const next = { ...request };
+    next.url = redactStringField(request.url);
+    next.headers = redactHeaderArray(request.headers);
+    next.cookies = redactCookieArray(request.cookies);
+    next.queryString = redactQueryString(request.queryString);
+    next.postData = redactPostData(request.postData);
+    return next;
+};
+const redactResponse = (response) => {
+    if (!isRecord(response))
+        return response;
+    const next = { ...response };
+    next.url = redactStringField(response.url);
+    next.headers = redactHeaderArray(response.headers);
+    next.cookies = redactCookieArray(response.cookies);
+    next.content = redactContent(response.content);
+    return next;
+};
+/**
+ * Strips sensitive headers, cookies, query parameters, and bodies from a HAR document.
+ * Returns a new object — the input is not mutated.
+ *
+ * Redacts:
+ * - Headers matching SENSITIVE_HEADER_NAMES (Authorization, Cookie, Set-Cookie, etc.)
+ * - All cookie values (request & response)
+ * - Query-string parameters with sensitive names
+ * - Form params with sensitive names
+ * - JSON-like text in request/response bodies via redactSensitive
+ */
+const redactHar = (har) => {
+    if (!isRecord(har))
+        return har;
+    const log = har.log;
+    if (!isRecord(log))
+        return har;
+    const entries = log.entries;
+    if (!Array.isArray(entries))
+        return har;
+    const redactedEntries = entries.map(entry => {
+        if (!isRecord(entry))
+            return entry;
+        return {
+            ...entry,
+            request: redactRequest(entry.request),
+            response: redactResponse(entry.response),
+        };
+    });
+    return {
+        ...har,
+        log: {
+            ...log,
+            entries: redactedEntries,
+        },
+    };
+};
+exports.redactHar = redactHar;
+/**
+ * Reads a HAR file, redacts sensitive content, and writes it to a new path.
+ * The source file is unchanged. Returns the bytes written.
+ */
+const redactHarFile = (sourcePath, destPath) => {
+    const raw = (0, fs_1.readFileSync)(sourcePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    const redacted = (0, exports.redactHar)(parsed);
+    (0, fs_1.writeFileSync)(destPath, JSON.stringify(redacted));
+};
+exports.redactHarFile = redactHarFile;
+//# sourceMappingURL=redactHar.js.map

package/src/plugins/redactSensitive.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Keys whose values must be redacted when they appear as JSON properties
+ * (`"key": "value"`) or URL-encoded params (`key=value`). Both camelCase and
+ * snake_case variants are listed because Okta uses `session_token` in its
+ * redirect URL while the rest of the codebase uses `sessionToken`.
+ */
+export declare const SENSITIVE_KEYS: string[];
+/**
+ * HTTP header names whose values must be redacted when they appear in
+ * `Header-Name: value` form (e.g. log lines printed by HTTP clients, request
+ * dumps in test output). Header redaction is line-scoped because header
+ * values can contain `=` and `:` characters that would otherwise confuse the
+ * URL/JSON patterns.
+ */
+export declare const SENSITIVE_HEADERS: string[];
+/**
+ * Redacts sensitive key-value pairs from a string in JSON, escaped-JSON,
+ * URL-encoded, and `Header: value` formats.
+ *
+ * Replaces:
+ * - `"key": "<anything>"` → `"key": "***"` (case-insensitive)
+ * - `\"key\": \"<anything>\"` → `\"key\": \"***\"` (case-insensitive — JSON
+ *   string embedded inside another JSON string, e.g. a request body field in
+ *   a Playwright trace entry)
+ * - `key=<anything>` → `key=***` (URL-encoded, value terminates at `&`/whitespace/`"`)
+ * - `Header-Name: <rest-of-line>` → `Header-Name: ***` (case-insensitive, line-scoped)
+ *
+ * @param message - The string to redact sensitive values from
+ * @returns {string} The string with sensitive values replaced by `***`
+ */
+export declare const redactSensitive: (message: string) => string;

package/src/plugins/redactSensitive.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactSensitive = exports.SENSITIVE_HEADERS = exports.SENSITIVE_KEYS = void 0;
+/**
+ * Keys whose values must be redacted when they appear as JSON properties
+ * (`"key": "value"`) or URL-encoded params (`key=value`). Both camelCase and
+ * snake_case variants are listed because Okta uses `session_token` in its
+ * redirect URL while the rest of the codebase uses `sessionToken`.
+ */
+exports.SENSITIVE_KEYS = [
+    "password",
+    "sessionToken",
+    "session_token",
+    "accessToken",
+    "access_token",
+    "refreshToken",
+    "refresh_token",
+    "idToken",
+    "id_token",
+    "authorization",
+    "apiKey",
+    "api_key",
+];
+/**
+ * HTTP header names whose values must be redacted when they appear in
+ * `Header-Name: value` form (e.g. log lines printed by HTTP clients, request
+ * dumps in test output). Header redaction is line-scoped because header
+ * values can contain `=` and `:` characters that would otherwise confuse the
+ * URL/JSON patterns.
+ */
+exports.SENSITIVE_HEADERS = [
+    "authorization",
+    "cookie",
+    "set-cookie",
+    "x-api-key",
+    "x-auth-token",
+    "proxy-authorization",
+];
+/**
+ * Redacts sensitive key-value pairs from a string in JSON, escaped-JSON,
+ * URL-encoded, and `Header: value` formats.
+ *
+ * Replaces:
+ * - `"key": "<anything>"` → `"key": "***"` (case-insensitive)
+ * - `\"key\": \"<anything>\"` → `\"key\": \"***\"` (case-insensitive — JSON
+ *   string embedded inside another JSON string, e.g. a request body field in
+ *   a Playwright trace entry)
+ * - `key=<anything>` → `key=***` (URL-encoded, value terminates at `&`/whitespace/`"`)
+ * - `Header-Name: <rest-of-line>` → `Header-Name: ***` (case-insensitive, line-scoped)
+ *
+ * @param message - The string to redact sensitive values from
+ * @returns {string} The string with sensitive values replaced by `***`
+ */
+const redactSensitive = (message) => {
+    let redacted = message;
+    for (const key of exports.SENSITIVE_KEYS) {
+        // Direct JSON: "key": "value"
+        redacted = redacted.replace(new RegExp(`("${key}"\\s*:\\s*)"[^"]*"`, "gi"), `$1"***"`);
+        // Escaped JSON (one level): \"key\": \"value\" — appears when a JSON
+        // object is serialized as a string field of another JSON object, which
+        // is exactly what Playwright traces store for request/response bodies.
+        redacted = redacted.replace(new RegExp(`(\\\\"${key}\\\\"\\s*:\\s*)\\\\"[^"\\\\]*\\\\"`, "gi"), `$1\\"***\\"`);
+        // URL-encoded: key=value (value terminates at &, whitespace, or quote)
+        redacted = redacted.replace(new RegExp(`(${key}=)[^&\\s"]+`, "gi"), "$1***");
+    }
+    for (const header of exports.SENSITIVE_HEADERS) {
+        redacted = redacted.replace(new RegExp(`(^|[\\r\\n])(${header}\\s*:\\s*)[^\\r\\n]*`, "gim"), "$1$2***");
+    }
+    return redacted;
+};
+exports.redactSensitive = redactSensitive;
+//# sourceMappingURL=redactSensitive.js.map

package/src/plugins/redactTrace.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Rewrites a Playwright trace.zip in place with sensitive values stripped from
+ * the action/network metadata. The `login()` fixture issues a `page.goto`
+ * against `/auth/manager-classic#session_token=...`; Playwright records the
+ * full URL as the action argument, so without this pass a retained trace zip
+ * would carry a live Okta session token alongside the test artifacts.
+ *
+ * The fragment is client-side only — it never reaches the HTTP server, and
+ * HAR/log redaction already covers everything that does — so this pass is the
+ * defense-in-depth layer that scrubs the remaining surface.
+ */
+export declare const redactTraceFile: (filePath: string) => Promise<void>;