@trackunit/iris-app-playwright 0.2.53-alpha-037fb409571.0 → 0.2.55

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trackunit/iris-app-playwright",
-  "version": "0.2.53-alpha-037fb409571.0",
+  "version": "0.2.55",
   "repository": "https://github.com/Trackunit/manager",
   "license": "SEE LICENSE IN LICENSE.txt",
   "generators": "./generators.json",
@@ -37,7 +37,13 @@
     "tslib": "^2.6.2"
   },
   "peerDependencies": {
-    "@playwright/test": "^1.60.0"
+    "@playwright/test": "^1.60.0",
+    "node-vault": "^0.10.2"
+  },
+  "peerDependenciesMeta": {
+    "node-vault": {
+      "optional": true
+    }
   },
   "migrations": "./migrations.json",
   "type": "commonjs"

package/src/credentials/fixtureAccounts.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Returns a fixture's `username` when the file is a **credential** fixture — a
+ * JSON object with a non-blank string `username` that is not the `REPLACE_ME`
+ * placeholder. Data fixtures (no `username`) and unparseable files yield
+ * `undefined`. The `password` field is intentionally NOT required, so this keeps
+ * working after passwords are removed from the repo.
+ */
+export declare const readFixtureAccount: (fixturePath: string) => string | undefined;
+/** Lists the `*.json` files directly under a fixtures directory (non-recursive, sorted). */
+export declare const listFixtureFiles: (fixturesDir: string) => Array<string>;
+/**
+ * Discovers the **distinct** account identifiers referenced by **all** credential
+ * fixtures directly under `fixturesDir` — every `*.json` with a `username`, not
+ * just `auth.json`. A project's `playwright/fixtures/` can hold many credential
+ * files (`managere2e.json`, `managere2e-admin.json`, `reporte2e.json`, …), each
+ * a different account; this returns one entry per distinct account so every one
+ * can be resolved.
+ */
+export declare const discoverFixtureAccounts: (fixturesDir: string) => Array<string>;

package/src/credentials/fixtureAccounts.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.discoverFixtureAccounts = exports.listFixtureFiles = exports.readFixtureAccount = void 0;
+const tslib_1 = require("tslib");
+const fs_1 = require("fs");
+const path = tslib_1.__importStar(require("path"));
+const guards_1 = require("./guards");
+/** Fixtures still holding this placeholder are unconfigured and ignored. */
+const PLACEHOLDER = "REPLACE_ME";
+/**
+ * Returns a fixture's `username` when the file is a **credential** fixture — a
+ * JSON object with a non-blank string `username` that is not the `REPLACE_ME`
+ * placeholder. Data fixtures (no `username`) and unparseable files yield
+ * `undefined`. The `password` field is intentionally NOT required, so this keeps
+ * working after passwords are removed from the repo.
+ */
+const readFixtureAccount = (fixturePath) => {
+    let parsed;
+    try {
+        parsed = JSON.parse((0, fs_1.readFileSync)(fixturePath, "utf-8"));
+    }
+    catch {
+        return undefined;
+    }
+    if (!(0, guards_1.isRecord)(parsed)) {
+        return undefined;
+    }
+    const username = parsed.username;
+    if (typeof username !== "string" || username.trim() === "" || username === PLACEHOLDER) {
+        return undefined;
+    }
+    return username;
+};
+exports.readFixtureAccount = readFixtureAccount;
+/** Lists the `*.json` files directly under a fixtures directory (non-recursive, sorted). */
+const listFixtureFiles = (fixturesDir) => {
+    let entries;
+    try {
+        entries = (0, fs_1.readdirSync)(fixturesDir);
+    }
+    catch {
+        return [];
+    }
+    return entries
+        .filter(name => name.endsWith(".json"))
+        .map(name => path.join(fixturesDir, name))
+        .sort();
+};
+exports.listFixtureFiles = listFixtureFiles;
+/**
+ * Discovers the **distinct** account identifiers referenced by **all** credential
+ * fixtures directly under `fixturesDir` — every `*.json` with a `username`, not
+ * just `auth.json`. A project's `playwright/fixtures/` can hold many credential
+ * files (`managere2e.json`, `managere2e-admin.json`, `reporte2e.json`, …), each
+ * a different account; this returns one entry per distinct account so every one
+ * can be resolved.
+ */
+const discoverFixtureAccounts = (fixturesDir) => {
+    const seen = new Set();
+    for (const file of (0, exports.listFixtureFiles)(fixturesDir)) {
+        const username = (0, exports.readFixtureAccount)(file);
+        if (username !== undefined) {
+            seen.add(username);
+        }
+    }
+    return [...seen];
+};
+exports.discoverFixtureAccounts = discoverFixtureAccounts;
+//# sourceMappingURL=fixtureAccounts.js.map

package/src/credentials/globalSetup.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Reads the account name from a name-only `auth.json` fixture (`{ "username": ... }`).
+ * The password field has been removed from the repo; only the identifier remains.
+ */
+export declare const readFixtureUsername: (fixturePath: string) => string;
+export interface InjectE2ECredentialsOptions {
+    fixturePath: string;
+    env?: NodeJS.ProcessEnv;
+    /** Password resolver seam (defaults to the real `resolveE2EPassword`). */
+    resolve?: (username: string, options: {
+        env: NodeJS.ProcessEnv;
+    }) => Promise<string>;
+}
+/**
+ * Resolves the fixture account's password (env-first, else Vault) and injects
+ * `PLAYWRIGHT_USERNAME`/`PLAYWRIGHT_PASSWORD` into the process env. Playwright
+ * spawns workers after `globalSetup`, so the published `resolveCredentials`
+ * env-var path picks these up unchanged — no change to the login fixture or the
+ * `await login()` call sites.
+ */
+export declare const injectE2ECredentials: (options: InjectE2ECredentialsOptions) => Promise<void>;
+export interface InjectAllE2ECredentialsOptions {
+    /**
+     * Directory holding the project's credential fixtures. **Every** `*.json` with
+     * a `username` is loaded (not just `auth.json`). Ignored when `usernames` is given.
+     */
+    fixturesDir?: string;
+    /** Explicit account list, overriding the directory scan. */
+    usernames?: ReadonlyArray<string>;
+    env?: NodeJS.ProcessEnv;
+    /** Password resolver seam (defaults to the real `resolveE2EPassword`). */
+    resolve?: (username: string, options: {
+        env: NodeJS.ProcessEnv;
+    }) => Promise<string>;
+}
+/**
+ * Resolves **every** account referenced by the project's credential fixtures and
+ * injects one env var per account: `E2E_PW_<SLUG> = password`.
+ *
+ * A project's `playwright/fixtures/` can reference many accounts across many
+ * files (e.g. `apps/manager/playwright/fixtures`), and a single test can log in
+ * as more than one. A single `PLAYWRIGHT_USERNAME`/`PLAYWRIGHT_PASSWORD` pair
+ * can't carry those, so we set a per-account variable instead; the published
+ * `resolveCredentials` then resolves each fixture's `username` to its
+ * `E2E_PW_<SLUG>` value at `login()` time. In CI the variables are already
+ * present (the CircleCI context), so `resolveE2EPassword` returns them without
+ * touching Vault; locally they are resolved from Vault.
+ */
+export declare const injectAllE2ECredentials: (options: InjectAllE2ECredentialsOptions) => Promise<void>;
+/**
+ * Minimal shape of the Playwright `FullConfig` fields we use — avoids a runtime
+ * dependency on `@playwright/test` in this lib. `rootDir` is the config's base
+ * directory (the project directory, e.g. `libs/auth/main`), so the fixture sits
+ * at `<rootDir>/playwright/fixtures/auth.json`.
+ */
+interface PlaywrightConfigLike {
+    rootDir?: string;
+}
+/**
+ * Playwright `globalSetup` entry point. Resolves credentials for **all** account
+ * fixtures under the running project's `playwright/fixtures/` (every `*.json`,
+ * not just `auth.json`), located relative to the config's `rootDir`.
+ * `process.cwd()` is NOT used as the base: when the `e2e` target runs
+ * `playwright test --config=<project>`, cwd is the nx workspace root, not the
+ * project.
+ */
+declare const globalSetup: (config?: PlaywrightConfigLike) => Promise<void>;
+export default globalSetup;

package/src/credentials/globalSetup.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.injectAllE2ECredentials = exports.injectE2ECredentials = exports.readFixtureUsername = void 0;
+const tslib_1 = require("tslib");
+const fs_1 = require("fs");
+const path = tslib_1.__importStar(require("path"));
+const fixtureAccounts_1 = require("./fixtureAccounts");
+const guards_1 = require("./guards");
+const keys_1 = require("./keys");
+const resolveE2EPassword_1 = require("./resolveE2EPassword");
+/**
+ * Reads the account name from a name-only `auth.json` fixture (`{ "username": ... }`).
+ * The password field has been removed from the repo; only the identifier remains.
+ */
+const readFixtureUsername = (fixturePath) => {
+    if (!(0, fs_1.existsSync)(fixturePath)) {
+        throw new Error(`E2E credentials: fixture not found at "${fixturePath}".`);
+    }
+    const parsed = JSON.parse((0, fs_1.readFileSync)(fixturePath, "utf-8"));
+    if (!(0, guards_1.isRecord)(parsed) || typeof parsed.username !== "string" || parsed.username === "") {
+        throw new Error(`E2E credentials: fixture "${fixturePath}" has no "username".`);
+    }
+    return parsed.username;
+};
+exports.readFixtureUsername = readFixtureUsername;
+/**
+ * Resolves the fixture account's password (env-first, else Vault) and injects
+ * `PLAYWRIGHT_USERNAME`/`PLAYWRIGHT_PASSWORD` into the process env. Playwright
+ * spawns workers after `globalSetup`, so the published `resolveCredentials`
+ * env-var path picks these up unchanged — no change to the login fixture or the
+ * `await login()` call sites.
+ */
+const injectE2ECredentials = async (options) => {
+    const env = options.env ?? process.env;
+    const resolve = options.resolve ?? resolveE2EPassword_1.resolveE2EPassword;
+    const username = (0, exports.readFixtureUsername)(options.fixturePath);
+    const password = await resolve(username, { env });
+    env.PLAYWRIGHT_USERNAME = username;
+    env.PLAYWRIGHT_PASSWORD = password;
+};
+exports.injectE2ECredentials = injectE2ECredentials;
+/**
+ * Resolves **every** account referenced by the project's credential fixtures and
+ * injects one env var per account: `E2E_PW_<SLUG> = password`.
+ *
+ * A project's `playwright/fixtures/` can reference many accounts across many
+ * files (e.g. `apps/manager/playwright/fixtures`), and a single test can log in
+ * as more than one. A single `PLAYWRIGHT_USERNAME`/`PLAYWRIGHT_PASSWORD` pair
+ * can't carry those, so we set a per-account variable instead; the published
+ * `resolveCredentials` then resolves each fixture's `username` to its
+ * `E2E_PW_<SLUG>` value at `login()` time. In CI the variables are already
+ * present (the CircleCI context), so `resolveE2EPassword` returns them without
+ * touching Vault; locally they are resolved from Vault.
+ */
+const injectAllE2ECredentials = async (options) => {
+    const env = options.env ?? process.env;
+    const resolve = options.resolve ?? resolveE2EPassword_1.resolveE2EPassword;
+    const usernames = options.usernames ?? (options.fixturesDir !== undefined ? (0, fixtureAccounts_1.discoverFixtureAccounts)(options.fixturesDir) : []);
+    // Resolve every account before mutating `env`. Two distinct accounts can slug
+    // to the same `E2E_PW_<SLUG>` key; silently overwriting would run tests with
+    // the wrong account's password, so reject the collision (mirrors the publish
+    // side's `buildFields`). Resolving up front also keeps injection atomic: a
+    // late resolver failure never leaves a partially-injected environment.
+    const resolved = new Map();
+    for (const username of usernames) {
+        const key = (0, keys_1.deriveEnvKey)(username);
+        const existing = resolved.get(key);
+        if (existing !== undefined) {
+            throw new Error(`E2E credentials: accounts "${existing.username}" and "${username}" both map to ${key} — cannot inject both.`);
+        }
+        resolved.set(key, { username, password: await resolve(username, { env }) });
+    }
+    for (const [key, { password }] of resolved) {
+        env[key] = password;
+    }
+};
+exports.injectAllE2ECredentials = injectAllE2ECredentials;
+/**
+ * Playwright `globalSetup` entry point. Resolves credentials for **all** account
+ * fixtures under the running project's `playwright/fixtures/` (every `*.json`,
+ * not just `auth.json`), located relative to the config's `rootDir`.
+ * `process.cwd()` is NOT used as the base: when the `e2e` target runs
+ * `playwright test --config=<project>`, cwd is the nx workspace root, not the
+ * project.
+ */
+const globalSetup = async (config) => {
+    const baseDir = config?.rootDir ?? process.cwd();
+    await (0, exports.injectAllE2ECredentials)({ fixturesDir: path.join(baseDir, "playwright", "fixtures") });
+};
+exports.default = globalSetup;
+//# sourceMappingURL=globalSetup.js.map

package/src/credentials/guards.d.ts

@@ -0,0 +1,2 @@
+/** Narrows `unknown` to a plain object without a type assertion. */
+export declare const isRecord: (value: unknown) => value is Record<string, unknown>;

package/src/credentials/guards.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRecord = void 0;
+/** Narrows `unknown` to a plain object without a type assertion. */
+const isRecord = (value) => typeof value === "object" && value !== null;
+exports.isRecord = isRecord;
+//# sourceMappingURL=guards.js.map

package/src/credentials/keys.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Credential-key derivation for the manager E2E password lookup (GLU-1451 / GLU-1452).
+ *
+ * An `auth.json` fixture identifies its account by `username` only — the password
+ * is resolved at runtime by a stable key derived from the name: from a CircleCI
+ * env variable in CI and from Vault locally.
+ *
+ * The `E2E_PW_<SLUG>` convention MUST stay in sync with the publish side in
+ * `devtools/e2e-okta-rotation/slug.ts` (which writes the CircleCI/Vault values).
+ */
+/**
+ * Uppercase slug of an account name: non-alphanumeric runs collapse to a single
+ * `_`, with leading/trailing separators trimmed. Keeps account names with spaces
+ * and dashes valid as env-var/Vault-field keys.
+ *
+ * `Team Helios - E2E Test` -> `TEAM_HELIOS_E2E_TEST`
+ */
+export declare const slugifyUsername: (username: string) => string;
+/** The environment-variable key for an account's password: `E2E_PW_<SLUG>`. */
+export declare const deriveEnvKey: (username: string) => string;
+/**
+ * The Vault field key for an account's password. This is the **same** key as the
+ * env variable (`E2E_PW_<SLUG>`): the publish side writes each account's password
+ * to a Vault field named by `devtools/e2e-okta-rotation/slug.ts`'s `envKey()`
+ * (`E2E_PW_<SLUG>`), so the resolver must read it back under that exact key. A
+ * lowercased-slug field would never be found once Vault is seeded.
+ */
+export declare const deriveVaultField: (username: string) => string;

package/src/credentials/keys.js

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * Credential-key derivation for the manager E2E password lookup (GLU-1451 / GLU-1452).
+ *
+ * An `auth.json` fixture identifies its account by `username` only — the password
+ * is resolved at runtime by a stable key derived from the name: from a CircleCI
+ * env variable in CI and from Vault locally.
+ *
+ * The `E2E_PW_<SLUG>` convention MUST stay in sync with the publish side in
+ * `devtools/e2e-okta-rotation/slug.ts` (which writes the CircleCI/Vault values).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveVaultField = exports.deriveEnvKey = exports.slugifyUsername = void 0;
+/**
+ * Uppercase slug of an account name: non-alphanumeric runs collapse to a single
+ * `_`, with leading/trailing separators trimmed. Keeps account names with spaces
+ * and dashes valid as env-var/Vault-field keys.
+ *
+ * `Team Helios - E2E Test` -> `TEAM_HELIOS_E2E_TEST`
+ */
+const slugifyUsername = (username) => username
+    .toUpperCase()
+    .replace(/[^A-Z0-9]+/g, "_")
+    .replace(/^_+|_+$/g, "");
+exports.slugifyUsername = slugifyUsername;
+/** The environment-variable key for an account's password: `E2E_PW_<SLUG>`. */
+const deriveEnvKey = (username) => `E2E_PW_${(0, exports.slugifyUsername)(username)}`;
+exports.deriveEnvKey = deriveEnvKey;
+/**
+ * The Vault field key for an account's password. This is the **same** key as the
+ * env variable (`E2E_PW_<SLUG>`): the publish side writes each account's password
+ * to a Vault field named by `devtools/e2e-okta-rotation/slug.ts`'s `envKey()`
+ * (`E2E_PW_<SLUG>`), so the resolver must read it back under that exact key. A
+ * lowercased-slug field would never be found once Vault is seeded.
+ */
+const deriveVaultField = (username) => (0, exports.deriveEnvKey)(username);
+exports.deriveVaultField = deriveVaultField;
+//# sourceMappingURL=keys.js.map

package/src/credentials/resolveE2EPassword.d.ts

@@ -0,0 +1,35 @@
+export type VaultKvVersion = 1 | 2;
+/**
+ * Minimal structural view of the `node-vault` client's KV read: it returns
+ * `{ data: ... }` (KV v1) or `{ data: { data: ... } }` (KV v2). Kept as an
+ * interface so tests inject a fake and neither `node-vault` nor a real
+ * Vault/VPN is needed. `read` returns `unknown` so callers narrow structurally
+ * (no `as` cast at the boundary).
+ */
+export interface VaultReader {
+    read(secretPath: string): Promise<unknown>;
+}
+export interface ResolveE2EPasswordOptions {
+    /** Process env to read (env-first precedence). Defaults to `process.env`. */
+    env?: NodeJS.ProcessEnv;
+    /**
+     * Vault client factory (local path). Returns `undefined` when Vault can't be
+     * reached/authenticated (e.g. no `~/.vault-token`). Defaults to a `node-vault`
+     * client using the local token, matching `libs/server/vault`.
+     */
+    createVault?: (env: NodeJS.ProcessEnv) => Promise<VaultReader | undefined>;
+}
+/**
+ * Resolves an account's E2E password by name.
+ *
+ * Order: env variable `E2E_PW_<SLUG>` (CI path, never touches Vault) -> Vault
+ * field `<slug>` (local path). Throws a clear, account-named, redacted error on
+ * miss. The password is never included in any error/diagnostic (on failure there
+ * is no resolved value to leak).
+ *
+ * @param username - Account identifier from the fixture (`auth.json` `username`).
+ * @param options - Process env and Vault-client seams.
+ * @returns {Promise<string>} The resolved password.
+ * @throws when the fixture is a placeholder, or neither env nor Vault yields a value.
+ */
+export declare const resolveE2EPassword: (username: string, options?: ResolveE2EPasswordOptions) => Promise<string>;

package/src/credentials/resolveE2EPassword.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveE2EPassword = void 0;
+const tslib_1 = require("tslib");
+const fs_1 = require("fs");
+const os = tslib_1.__importStar(require("os"));
+const path = tslib_1.__importStar(require("path"));
+const redactSensitive_1 = require("../plugins/redactSensitive");
+const guards_1 = require("./guards");
+const keys_1 = require("./keys");
+/** Logical KV path the publish side writes to (see devtools/e2e-okta-rotation). */
+const DEFAULT_VAULT_PATH = "secret/manager/e2e-playwright";
+/** KV v2 stores secrets at `mount/data/rest`; KV v1 uses the logical path verbatim. */
+const toKvV2DataPath = (logicalPath) => {
+    const segments = logicalPath.replace(/^\/+|\/+$/g, "").split("/");
+    const [mount, ...rest] = segments;
+    return [mount, "data", ...rest].join("/");
+};
+/**
+ * Reads a field from a node-vault KV read result. KV v2 nests the fields under
+ * `data.data`; KV v1 puts them directly on `data`. Narrows structurally.
+ */
+const readVaultField = (result, field) => {
+    if (!(0, guards_1.isRecord)(result)) {
+        return undefined;
+    }
+    const outer = result.data;
+    if (!(0, guards_1.isRecord)(outer)) {
+        return undefined;
+    }
+    const fields = (0, guards_1.isRecord)(outer.data) ? outer.data : outer;
+    const value = fields[field];
+    return typeof value === "string" && value !== "" ? value : undefined;
+};
+/**
+ * Default Vault client: reads the local `~/.vault-token` and points `node-vault`
+ * at the endpoint from `E2E_VAULT_ENDPOINT` (or `VAULT_ENDPOINT`).
+ *
+ * The Vault address is **never hardcoded** — it is supplied by the environment,
+ * so any consumer of this package can opt into their own Vault. `node-vault` is
+ * an optional peer dependency, imported lazily and only on the local path, so
+ * consumers that only use the env-var (CI) path never load it.
+ */
+const defaultCreateVault = async (env) => {
+    const home = env.HOME ?? os.homedir();
+    let token;
+    try {
+        token = (0, fs_1.readFileSync)(path.join(home, ".vault-token"), "utf-8").trim();
+    }
+    catch {
+        return undefined; // not logged in / not on VPN
+    }
+    if (token === "") {
+        return undefined;
+    }
+    const endpoint = env.E2E_VAULT_ENDPOINT ?? env.VAULT_ENDPOINT;
+    if (endpoint === undefined || endpoint === "") {
+        throw new Error("E2E credentials: a Vault token was found but no endpoint — set E2E_VAULT_ENDPOINT (or VAULT_ENDPOINT) to your Vault address.");
+    }
+    // Imported lazily so consumers on the env-var path (and unit tests, which
+    // inject `createVault`) never load the optional `node-vault` peer. Its absence
+    // is an expected configuration state, so fail with the resolver's actionable,
+    // redacted style instead of leaking a raw `ERR_MODULE_NOT_FOUND` stack.
+    const nodeVault = await Promise.resolve().then(() => tslib_1.__importStar(require("node-vault"))).catch(() => undefined);
+    if (nodeVault === undefined) {
+        return fail("E2E credentials: install the optional `node-vault` peer dependency for local Vault lookup, " +
+            "or set the E2E_PW_<SLUG> env variable.");
+    }
+    const client = nodeVault.default({ endpoint, token, requestOptions: { strictSSL: true } });
+    return { read: secretPath => client.read(secretPath) };
+};
+/** Throws an error whose message is routed through `redactSensitive` (defence in depth). */
+const fail = (message) => {
+    throw new Error((0, redactSensitive_1.redactSensitive)(message));
+};
+/**
+ * Resolves an account's E2E password by name.
+ *
+ * Order: env variable `E2E_PW_<SLUG>` (CI path, never touches Vault) -> Vault
+ * field `<slug>` (local path). Throws a clear, account-named, redacted error on
+ * miss. The password is never included in any error/diagnostic (on failure there
+ * is no resolved value to leak).
+ *
+ * @param username - Account identifier from the fixture (`auth.json` `username`).
+ * @param options - Process env and Vault-client seams.
+ * @returns {Promise<string>} The resolved password.
+ * @throws when the fixture is a placeholder, or neither env nor Vault yields a value.
+ */
+const resolveE2EPassword = async (username, options = {}) => {
+    if (username === "" || username === "REPLACE_ME") {
+        return fail(`E2E credentials: fixture account name is unresolved ("${username}").`);
+    }
+    const env = options.env ?? process.env;
+    const key = (0, keys_1.deriveEnvKey)(username);
+    // CI path: an injected env variable wins and Vault is never contacted.
+    const fromEnv = env[key];
+    if (fromEnv !== undefined && fromEnv !== "") {
+        return fromEnv;
+    }
+    // Local path: read the password from Vault by the same key.
+    const createVault = options.createVault ?? defaultCreateVault;
+    const vault = await createVault(env);
+    if (vault === undefined) {
+        return fail(`E2E credentials for "${username}": no env variable (${key}) and Vault is unavailable ` +
+            `(not authenticated / not on VPN). Run \`vault login -method=oidc -path=okta\` on VPN, or set the env variable.`);
+    }
+    const kvVersion = env.E2E_VAULT_KV_VERSION === "1" ? 1 : 2;
+    const logicalPath = env.E2E_VAULT_PATH ?? DEFAULT_VAULT_PATH;
+    const readPath = kvVersion === 2 ? toKvV2DataPath(logicalPath) : logicalPath;
+    let result;
+    try {
+        result = await vault.read(readPath);
+    }
+    catch {
+        return fail(`E2E credentials for "${username}": Vault read of "${readPath}" failed.`);
+    }
+    const fromVault = readVaultField(result, (0, keys_1.deriveVaultField)(username));
+    if (fromVault === undefined) {
+        return fail(`E2E credentials for "${username}": no field "${(0, keys_1.deriveVaultField)(username)}" at Vault path "${readPath}".`);
+    }
+    return fromVault;
+};
+exports.resolveE2EPassword = resolveE2EPassword;
+//# sourceMappingURL=resolveE2EPassword.js.map

package/src/fixtures/resolveCredentials.d.ts

@@ -8,7 +8,9 @@ export interface ResolveCredentialsOptions {
     fixturePath?: string;
 }
 /**
- * Resolves auth credentials from (in order): explicit options, JSON fixture file, env vars.
+ * Resolves auth credentials from (in order): explicit options, a full JSON
+ * fixture (`{ username, password }`), a **name-only** fixture whose password
+ * comes from its `E2E_PW_<SLUG>` env var, then `PLAYWRIGHT_USERNAME`/`PLAYWRIGHT_PASSWORD`.
  * Throws if none yield a complete credential pair.
  */
 export declare const resolveCredentials: (options?: ResolveCredentialsOptions) => AuthCredentials;

package/src/fixtures/resolveCredentials.js

@@ -4,6 +4,7 @@ exports.resolveCredentials = void 0;
 const tslib_1 = require("tslib");
 const fs_1 = require("fs");
 const path = tslib_1.__importStar(require("path"));
+const keys_1 = require("../credentials/keys");
 const isAuthCredentials = (value) => {
     if (typeof value !== "object" || value === null) {
         return false;
@@ -25,7 +26,38 @@ const readFixtureCredentials = (fixturePath) => {
     return parsed;
 };
 /**
- * Resolves auth credentials from (in order): explicit options, JSON fixture file, env vars.
+ * Reads a fixture's `username` when present and usable (non-blank, not the
+ * `REPLACE_ME` placeholder), even if the fixture has no `password` — i.e. a
+ * name-only fixture, which is what remains once passwords leave the repo.
+ */
+const readFixtureUsername = (fixturePath) => {
+    if (!(0, fs_1.existsSync)(fixturePath)) {
+        return undefined;
+    }
+    const parsed = JSON.parse((0, fs_1.readFileSync)(fixturePath, "utf-8"));
+    if (typeof parsed !== "object" || parsed === null) {
+        return undefined;
+    }
+    const record = { ...parsed };
+    const username = record.username;
+    if (typeof username !== "string" || username === "" || username === "REPLACE_ME") {
+        return undefined;
+    }
+    return username;
+};
+/**
+ * Resolves the password for a name-only fixture from the per-account env var set
+ * by the credential `globalSetup` (locally, from Vault) or by the CircleCI
+ * context (CI): `E2E_PW_<SLUG>`. Returns `undefined` when it is not set.
+ */
+const resolvePasswordFromEnv = (username) => {
+    const password = process.env[(0, keys_1.deriveEnvKey)(username)];
+    return password !== undefined && password !== "" ? password : undefined;
+};
+/**
+ * Resolves auth credentials from (in order): explicit options, a full JSON
+ * fixture (`{ username, password }`), a **name-only** fixture whose password
+ * comes from its `E2E_PW_<SLUG>` env var, then `PLAYWRIGHT_USERNAME`/`PLAYWRIGHT_PASSWORD`.
  * Throws if none yield a complete credential pair.
  */
 const resolveCredentials = (options) => {
@@ -37,13 +69,22 @@ const resolveCredentials = (options) => {
     if (fromFixture !== undefined) {
         return fromFixture;
     }
+    // Name-only fixture: the password lives in the per-account env var.
+    const username = readFixtureUsername(fixturePath);
+    if (username !== undefined) {
+        const password = resolvePasswordFromEnv(username);
+        if (password !== undefined) {
+            return { username, password };
+        }
+    }
     const envUsername = process.env.PLAYWRIGHT_USERNAME;
     const envPassword = process.env.PLAYWRIGHT_PASSWORD;
     if (envUsername !== undefined && envUsername !== "" && envPassword !== undefined && envPassword !== "") {
         return { username: envUsername, password: envPassword };
     }
-    throw new Error(`No credentials provided to login(). Tried: options.credentials, ${fixturePath}, PLAYWRIGHT_USERNAME/PLAYWRIGHT_PASSWORD env vars. ` +
-        `Fill in playwright/fixtures/auth.json, set the env vars, or pass credentials to login().`);
+    throw new Error(`No credentials provided to login(). Tried: options.credentials, ${fixturePath} ` +
+        `(incl. its E2E_PW_<slug> env var for a name-only fixture), PLAYWRIGHT_USERNAME/PLAYWRIGHT_PASSWORD env vars. ` +
+        `Fill in the fixture, set the env vars, or pass credentials to login().`);
 };
 exports.resolveCredentials = resolveCredentials;
 //# sourceMappingURL=resolveCredentials.js.map

package/src/index.d.ts

@@ -8,6 +8,11 @@ export * from "./plugins/writeFileWithPrettier";
 export * from "./utils/Codeowner";
 export * from "./utils/fileNameBuilder";
 export * from "./utils/fileUpdater";
+export * from "./credentials/fixtureAccounts";
+export * from "./credentials/globalSetup";
+export { default as e2eCredentialsGlobalSetup } from "./credentials/globalSetup";
+export * from "./credentials/keys";
+export * from "./credentials/resolveE2EPassword";
 export type { FeatureFlag, FeatureFlagFixtures } from "./fixtures/featureFlags.fixture";
 export type { CachedStorageState } from "./fixtures/hydrateStorageState";
 export type { IrisAppFixtures, IrisAppOptions, StorybookPreviewOptions } from "./fixtures/irisApp.fixture";

package/src/index.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.e2eCredentialsGlobalSetup = void 0;
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./plugins/createLogFile"), exports);
 tslib_1.__exportStar(require("./plugins/defaultPlaywrightConfig"), exports);
@@ -11,4 +12,14 @@ tslib_1.__exportStar(require("./plugins/writeFileWithPrettier"), exports);
 tslib_1.__exportStar(require("./utils/Codeowner"), exports);
 tslib_1.__exportStar(require("./utils/fileNameBuilder"), exports);
 tslib_1.__exportStar(require("./utils/fileUpdater"), exports);
+// Opt-in E2E credential resolution: resolve an account's password at runtime by
+// name (env-var first, then Vault). Vault access uses the optional `node-vault`
+// peer and an env-supplied endpoint — never hardcoded — so any consumer can wire
+// their own Vault. See ./credentials.
+tslib_1.__exportStar(require("./credentials/fixtureAccounts"), exports);
+tslib_1.__exportStar(require("./credentials/globalSetup"), exports);
+var globalSetup_1 = require("./credentials/globalSetup");
+Object.defineProperty(exports, "e2eCredentialsGlobalSetup", { enumerable: true, get: function () { return tslib_1.__importDefault(globalSetup_1).default; } });
+tslib_1.__exportStar(require("./credentials/keys"), exports);
+tslib_1.__exportStar(require("./credentials/resolveE2EPassword"), exports);
 //# sourceMappingURL=index.js.map

package/src/plugins/logsReporter.d.ts

@@ -42,6 +42,19 @@ export declare class LogsReporter implements Reporter {
     onEnd(_result: FullResult): Promise<void>;
     /** Returns false so Playwright adds its own terminal reporter alongside this one. */
     printsToStdio(): boolean;
+    /**
+     * Scrubs Playwright's `error-context.md` failure attachment in place.
+     *
+     * On failure Playwright writes an `error-context.md` under `test-results/`
+     * (uploaded as a CI artifact) that embeds the failing assertion's *received*
+     * value and a page/aria snapshot. The `login()` slow path navigates to
+     * `/auth/manager-classic#session_token=...`, so this file carries a live Okta
+     * session token — and would carry the password if it ever surfaced in an
+     * assertion's received value. It is neither a trace, HAR, nor a stdout log, so
+     * the other redaction passes miss it entirely; scrub it here. Best-effort:
+     * redaction never fails the reporter.
+     */
+    private redactErrorContext;
     private getResultTracePath;
     /**
      * Persists (on failure) or cleans up (always) the per-test HAR recorded by the

package/src/plugins/logsReporter.js

@@ -66,6 +66,7 @@ class LogsReporter {
             if (tracePath !== undefined && (0, fs_1.existsSync)(tracePath)) {
                 this.pendingWrites.push((0, redactTrace_1.redactTraceFile)(tracePath));
             }
+            this.redactErrorContext(result);
         }
         this.persistHar(fullTitle, test, result, isFailure);
     }
@@ -82,6 +83,32 @@ class LogsReporter {
     printsToStdio() {
         return false;
     }
+    /**
+     * Scrubs Playwright's `error-context.md` failure attachment in place.
+     *
+     * On failure Playwright writes an `error-context.md` under `test-results/`
+     * (uploaded as a CI artifact) that embeds the failing assertion's *received*
+     * value and a page/aria snapshot. The `login()` slow path navigates to
+     * `/auth/manager-classic#session_token=...`, so this file carries a live Okta
+     * session token — and would carry the password if it ever surfaced in an
+     * assertion's received value. It is neither a trace, HAR, nor a stdout log, so
+     * the other redaction passes miss it entirely; scrub it here. Best-effort:
+     * redaction never fails the reporter.
+     */
+    redactErrorContext(result) {
+        for (const attachment of result.attachments) {
+            const attachmentPath = attachment.path;
+            if (attachmentPath === undefined || !attachmentPath.endsWith("error-context.md") || !(0, fs_1.existsSync)(attachmentPath)) {
+                continue;
+            }
+            try {
+                (0, fs_1.writeFileSync)(attachmentPath, (0, redactSensitive_1.redactSensitive)((0, fs_1.readFileSync)(attachmentPath, "utf-8")));
+            }
+            catch {
+                /* Redaction is best-effort; never fail the reporter over it. */
+            }
+        }
+    }
     getResultTracePath(result) {
         const attachment = result.attachments.find(a => a.name === "trace" && a.path !== undefined);
         return attachment?.path;

package/src/plugins/redactPatterns.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Redaction/detection primitives shared by the redactor (`redactSensitive`) and
+ * the structural scanner (`scanArtifactsForUnredactedSecrets`) so the two
+ * recognise the same shapes and cannot drift. In particular, browser-cookie
+ * detection is centralised here: it must be property-order independent (a
+ * value-last cookie is still a cookie) and must not misfire on ordinary
+ * `{ name, value, path }` structures.
+ */
+/**
+ * Matches any run of backslashes preceding a quote. A JSON string nested inside
+ * another escapes its quotes once per level of nesting (`"` → `\"` → `\\\"` →
+ * …), so the escape prefix grows without bound; matching an arbitrary run makes
+ * the patterns escape-depth agnostic.
+ */
+export declare const ESC = "(?:\\\\)*";
+/** A JSON double-quote at any escape depth. */
+export declare const QUOTE = "(?:\\\\)*\"";
+/** The marker a redacted value is reduced to. */
+export declare const REDACTED = "***";
+/** Redacts the `value` of every browser-cookie object found in `text`. */
+export declare const redactCookieValues: (text: string) => string;
+/**
+ * The `value` of every browser-cookie object in `text` (after any redaction has
+ * run). The structural scanner treats a cookie whose value is not `REDACTED` as
+ * a leak.
+ *
+ * @param text - Text to inspect (a trace stream, resource body, or plain file).
+ * @returns {Array<string>} One entry per cookie `value` found.
+ */
+export declare const cookieValues: (text: string) => Array<string>;

package/src/plugins/redactPatterns.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * Redaction/detection primitives shared by the redactor (`redactSensitive`) and
+ * the structural scanner (`scanArtifactsForUnredactedSecrets`) so the two
+ * recognise the same shapes and cannot drift. In particular, browser-cookie
+ * detection is centralised here: it must be property-order independent (a
+ * value-last cookie is still a cookie) and must not misfire on ordinary
+ * `{ name, value, path }` structures.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cookieValues = exports.redactCookieValues = exports.REDACTED = exports.QUOTE = exports.ESC = void 0;
+/**
+ * Matches any run of backslashes preceding a quote. A JSON string nested inside
+ * another escapes its quotes once per level of nesting (`"` → `\"` → `\\\"` →
+ * …), so the escape prefix grows without bound; matching an arbitrary run makes
+ * the patterns escape-depth agnostic.
+ */
+exports.ESC = "(?:\\\\)*";
+/** A JSON double-quote at any escape depth. */
+exports.QUOTE = `${exports.ESC}"`;
+/** The marker a redacted value is reduced to. */
+exports.REDACTED = "***";
+/**
+ * Strong, cookie-specific marker keys. A Playwright `storageState` cookie always
+ * carries these; generic keys like `path`/`expires` are deliberately excluded so
+ * an ordinary `{ name, value, path }` object is not mistaken for a cookie
+ * (which would redact useful debugging data and produce false positives).
+ */
+const COOKIE_MARKERS = ["domain", "httpOnly", "sameSite", "secure"];
+/**
+ * Matches a flat JSON object literal (no nested braces) — one `addCookies`
+ * entry. JSON only escapes `"` and `\`, never braces, so this still isolates a
+ * cookie object at any escape depth.
+ */
+const flatObjectPattern = () => /\{[^{}]*\}/g;
+const valueFieldPattern = new RegExp(`${exports.QUOTE}value${exports.QUOTE}\\s*:\\s*${exports.QUOTE}`, "i");
+const cookieMarkerPattern = new RegExp(`${exports.QUOTE}(?:${COOKIE_MARKERS.join("|")})${exports.QUOTE}\\s*:`, "i");
+/** Captures the `value` string of an object (group 2), for redaction or inspection. */
+const cookieValuePattern = () => new RegExp(`(${exports.QUOTE}value${exports.QUOTE}\\s*:\\s*${exports.QUOTE})(.*?)(${exports.QUOTE})`, "gi");
+/**
+ * A flat JSON object is treated as a browser cookie when it carries a `value`
+ * field together with a strong cookie marker — evaluated over the whole object,
+ * so property order does not matter and a value-last cookie is still detected.
+ */
+const isCookieObject = (flatObject) => valueFieldPattern.test(flatObject) && cookieMarkerPattern.test(flatObject);
+/** Redacts the `value` of every browser-cookie object found in `text`. */
+const redactCookieValues = (text) => text.replace(flatObjectPattern(), flatObject => isCookieObject(flatObject) ? flatObject.replace(cookieValuePattern(), `$1${exports.REDACTED}$3`) : flatObject);
+exports.redactCookieValues = redactCookieValues;
+/**
+ * The `value` of every browser-cookie object in `text` (after any redaction has
+ * run). The structural scanner treats a cookie whose value is not `REDACTED` as
+ * a leak.
+ *
+ * @param text - Text to inspect (a trace stream, resource body, or plain file).
+ * @returns {Array<string>} One entry per cookie `value` found.
+ */
+const cookieValues = (text) => {
+    const values = [];
+    for (const objectMatch of text.matchAll(flatObjectPattern())) {
+        const flatObject = objectMatch[0];
+        if (!isCookieObject(flatObject)) {
+            continue;
+        }
+        for (const valueMatch of flatObject.matchAll(cookieValuePattern())) {
+            values.push(valueMatch[2] ?? "");
+        }
+    }
+    return values;
+};
+exports.cookieValues = cookieValues;
+//# sourceMappingURL=redactPatterns.js.map

package/src/plugins/redactSensitive.d.ts

@@ -15,13 +15,16 @@ export declare const SENSITIVE_KEYS: string[];
 export declare const SENSITIVE_HEADERS: string[];
 /**
  * Redacts sensitive key-value pairs from a string in JSON, escaped-JSON,
- * URL-encoded, and `Header: value` formats.
+ * URL-encoded, cookie, and `Header: value` formats.
  *
  * Replaces:
- * - `"key": "<anything>"` → `"key": "***"` (case-insensitive)
- * - `\"key\": \"<anything>\"` → `\"key\": \"***\"` (case-insensitive — JSON
- *   string embedded inside another JSON string, e.g. a request body field in
- *   a Playwright trace entry)
+ * - `"key": "<anything>"` → `"key": "***"` (case-insensitive), at any JSON
+ *   escape depth — `"key":"v"`, `\"key\":\"v\"`, `\\\"key\\\":\\\"v\\\"`, … —
+ *   which covers request/response bodies and doubly-nested localStorage values
+ *   stored in Playwright trace entries.
+ * - `"value": "<anything>"` → `"value": "***"` when the enclosing object is a
+ *   browser cookie (see `redactCookieValues` — property-order independent),
+ *   e.g. `addCookies` params carrying an Okta session cookie.
  * - `key=<anything>` → `key=***` (URL-encoded, value terminates at `&`/whitespace/`"`)
  * - `Header-Name: <rest-of-line>` → `Header-Name: ***` (case-insensitive, line-scoped)
  *

package/src/plugins/redactSensitive.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.redactSensitive = exports.SENSITIVE_HEADERS = exports.SENSITIVE_KEYS = void 0;
+const redactPatterns_1 = require("./redactPatterns");
 /**
  * Keys whose values must be redacted when they appear as JSON properties
  * (`"key": "value"`) or URL-encoded params (`key=value`). Both camelCase and
@@ -38,13 +39,16 @@ exports.SENSITIVE_HEADERS = [
 ];
 /**
  * Redacts sensitive key-value pairs from a string in JSON, escaped-JSON,
- * URL-encoded, and `Header: value` formats.
+ * URL-encoded, cookie, and `Header: value` formats.
  *
  * Replaces:
- * - `"key": "<anything>"` → `"key": "***"` (case-insensitive)
- * - `\"key\": \"<anything>\"` → `\"key\": \"***\"` (case-insensitive — JSON
- *   string embedded inside another JSON string, e.g. a request body field in
- *   a Playwright trace entry)
+ * - `"key": "<anything>"` → `"key": "***"` (case-insensitive), at any JSON
+ *   escape depth — `"key":"v"`, `\"key\":\"v\"`, `\\\"key\\\":\\\"v\\\"`, … —
+ *   which covers request/response bodies and doubly-nested localStorage values
+ *   stored in Playwright trace entries.
+ * - `"value": "<anything>"` → `"value": "***"` when the enclosing object is a
+ *   browser cookie (see `redactCookieValues` — property-order independent),
+ *   e.g. `addCookies` params carrying an Okta session cookie.
  * - `key=<anything>` → `key=***` (URL-encoded, value terminates at `&`/whitespace/`"`)
  * - `Header-Name: <rest-of-line>` → `Header-Name: ***` (case-insensitive, line-scoped)
  *
@@ -54,15 +58,16 @@ exports.SENSITIVE_HEADERS = [
 const redactSensitive = (message) => {
     let redacted = message;
     for (const key of exports.SENSITIVE_KEYS) {
-        // Direct JSON: "key": "value"
-        redacted = redacted.replace(new RegExp(`("${key}"\\s*:\\s*)"[^"]*"`, "gi"), `$1"***"`);
-        // Escaped JSON (one level): \"key\": \"value\" — appears when a JSON
-        // object is serialized as a string field of another JSON object, which
-        // is exactly what Playwright traces store for request/response bodies.
-        redacted = redacted.replace(new RegExp(`(\\\\"${key}\\\\"\\s*:\\s*)\\\\"[^"\\\\]*\\\\"`, "gi"), `$1\\"***\\"`);
+        // JSON string value at any escape depth: "key":"v" / \"key\":\"v\" / … .
+        // The value is matched lazily up to the next (equally escaped) quote.
+        redacted = redacted.replace(new RegExp(`(${redactPatterns_1.QUOTE}${key}${redactPatterns_1.QUOTE}\\s*:\\s*${redactPatterns_1.QUOTE}).*?(${redactPatterns_1.QUOTE})`, "gi"), "$1***$2");
         // URL-encoded: key=value (value terminates at &, whitespace, or quote)
         redacted = redacted.replace(new RegExp(`(${key}=)[^&\\s"]+`, "gi"), "$1***");
     }
+    // Cookie value under the generic `value` key (the cached Okta session cookie
+    // replayed by `addCookies`). Handled via the shared, order-independent
+    // cookie-shape helper so redaction and the structural scanner cannot drift.
+    redacted = (0, redactPatterns_1.redactCookieValues)(redacted);
     for (const header of exports.SENSITIVE_HEADERS) {
         redacted = redacted.replace(new RegExp(`(^|[\\r\\n])(${header}\\s*:\\s*)[^\\r\\n]*`, "gim"), "$1$2***");
     }

package/src/plugins/redactTrace.d.ts

@@ -1,12 +1,26 @@
 /**
- * Rewrites a Playwright trace.zip in place with sensitive values stripped from
- * the action/network metadata. The `login()` fixture issues a `page.goto`
- * against `/auth/manager-classic#session_token=...`; Playwright records the
- * full URL as the action argument, so without this pass a retained trace zip
- * would carry a live Okta session token alongside the test artifacts.
+ * Rewrites a Playwright trace.zip in place with sensitive values stripped.
  *
- * The fragment is client-side only — it never reaches the HTTP server, and
- * HAR/log redaction already covers everything that does — so this pass is the
- * defense-in-depth layer that scrubs the remaining surface.
+ * Two surfaces carry secrets in a retained trace:
+ *
+ * 1. The `.trace`/`.network`/`.stacks` JSONL streams — e.g. the `page.goto`
+ *    against `/auth/manager-classic#session_token=...` records the full URL as
+ *    the action argument, and API-call params are inlined as `jsonData`. The
+ *    `login()` cache-hit path also replays the cached storageState here via
+ *    `addCookies` (the Okta session cookie, under the generic `value` key) and
+ *    `addInitScript` (the `okta-token-storage` access/id/refresh tokens, nested
+ *    two escape levels deep) — both handled by `redactSensitive`'s cookie and
+ *    escape-depth-agnostic rules.
+ * 2. The hashed `resources/<sha1>` entries — Playwright stores network
+ *    request/response *bodies* here. The `login()` slow path POSTs the account
+ *    password to `/api/v1/authn`, so that body — carrying the cleartext
+ *    password — is retained as a resource and rendered verbatim in the Trace
+ *    Viewer's request panel. Redacting only the streams (the previous behaviour)
+ *    left this copy readable.
+ *
+ * Streams are always redacted as text. Resource entries are redacted only when
+ * they are lossless UTF-8 text (see `asLosslessUtf8`), so binary resources
+ * (screenshots, fonts) are never touched. Entries with no sensitive substring
+ * are left as-is to avoid needless rewrites.
  */
 export declare const redactTraceFile: (filePath: string) => Promise<void>;

package/src/plugins/redactTrace.js

@@ -8,23 +8,73 @@ const redactSensitive_1 = require("./redactSensitive");
 /**
  * File suffixes inside a Playwright trace.zip whose contents are JSON Lines
  * with action/network metadata — i.e. the places where a `page.goto(url)`
- * call's URL argument is recorded verbatim. Other entries (binary resources,
- * screenshots, network bodies under `sha1/`) are left alone; their content is
- * referenced by hash so redacting the metadata is sufficient to suppress the
- * sensitive string from any human-readable trace view.
+ * call's URL argument is recorded verbatim.
  */
 const TEXT_TRACE_SUFFIXES = [".trace", ".network", ".stacks"];
 const isTextTraceEntry = (relPath) => TEXT_TRACE_SUFFIXES.some(s => relPath.endsWith(s));
 /**
- * Rewrites a Playwright trace.zip in place with sensitive values stripped from
- * the action/network metadata. The `login()` fixture issues a `page.goto`
- * against `/auth/manager-classic#session_token=...`; Playwright records the
- * full URL as the action argument, so without this pass a retained trace zip
- * would carry a live Okta session token alongside the test artifacts.
+ * Lower-cased substrings whose presence is a necessary precondition for
+ * `redactSensitive` to alter a buffer: it only rewrites JSON/URL matches keyed
+ * on a `SENSITIVE_KEYS`/`SENSITIVE_HEADERS` name, or a cookie `value`. Keep this
+ * a superset of `redactSensitive`'s triggers so the prefilter never skips an
+ * entry it would change.
+ */
+const SENSITIVE_MARKERS = [
+    ...new Set([...redactSensitive_1.SENSITIVE_KEYS, ...redactSensitive_1.SENSITIVE_HEADERS, "value"].map(s => s.toLowerCase())),
+];
+/**
+ * True when `buf` may contain a value `redactSensitive` would redact, decided by
+ * a case-insensitive byte scan — no UTF-8 decode. A `false` result guarantees
+ * redaction is a no-op, letting the caller skip the decode/round-trip on the
+ * binary bulk of a trace (screencast frames, screenshots, fonts) that dominates
+ * a real `trace.zip`, with byte-identical output.
+ */
+const mightContainSensitive = (buf) => {
+    const lower = Buffer.from(buf);
+    for (let i = 0; i < lower.length; i++) {
+        const byte = lower[i];
+        if (byte !== undefined && byte >= 0x41 && byte <= 0x5a) {
+            lower[i] = byte + 0x20; // ASCII upper-case → lower-case
+        }
+    }
+    return SENSITIVE_MARKERS.some(marker => lower.includes(marker));
+};
+/**
+ * Returns the UTF-8 decoding of `buf` only when it round-trips losslessly (the
+ * re-encoded text is byte-identical to the input). This is how we tell a textual
+ * resource body (a network request/response the Trace Viewer renders) from a
+ * binary one (screenshot, font): a JPEG/PNG/woff decodes to replacement chars
+ * and fails the round-trip, so we never re-encode — and therefore never corrupt —
+ * a binary resource. Returns `undefined` for binary content.
+ */
+const asLosslessUtf8 = (buf) => {
+    const text = buf.toString("utf8");
+    return Buffer.from(text, "utf8").equals(buf) ? text : undefined;
+};
+/**
+ * Rewrites a Playwright trace.zip in place with sensitive values stripped.
+ *
+ * Two surfaces carry secrets in a retained trace:
  *
- * The fragment is client-side only — it never reaches the HTTP server, and
- * HAR/log redaction already covers everything that does — so this pass is the
- * defense-in-depth layer that scrubs the remaining surface.
+ * 1. The `.trace`/`.network`/`.stacks` JSONL streams — e.g. the `page.goto`
+ *    against `/auth/manager-classic#session_token=...` records the full URL as
+ *    the action argument, and API-call params are inlined as `jsonData`. The
+ *    `login()` cache-hit path also replays the cached storageState here via
+ *    `addCookies` (the Okta session cookie, under the generic `value` key) and
+ *    `addInitScript` (the `okta-token-storage` access/id/refresh tokens, nested
+ *    two escape levels deep) — both handled by `redactSensitive`'s cookie and
+ *    escape-depth-agnostic rules.
+ * 2. The hashed `resources/<sha1>` entries — Playwright stores network
+ *    request/response *bodies* here. The `login()` slow path POSTs the account
+ *    password to `/api/v1/authn`, so that body — carrying the cleartext
+ *    password — is retained as a resource and rendered verbatim in the Trace
+ *    Viewer's request panel. Redacting only the streams (the previous behaviour)
+ *    left this copy readable.
+ *
+ * Streams are always redacted as text. Resource entries are redacted only when
+ * they are lossless UTF-8 text (see `asLosslessUtf8`), so binary resources
+ * (screenshots, fonts) are never touched. Entries with no sensitive substring
+ * are left as-is to avoid needless rewrites.
  */
 const redactTraceFile = async (filePath) => {
     const buf = (0, fs_1.readFileSync)(filePath);
@@ -33,11 +83,26 @@ const redactTraceFile = async (filePath) => {
     zip.forEach((relPath, file) => {
         if (file.dir)
             return;
-        if (!isTextTraceEntry(relPath))
-            return;
         rewrites.push((async () => {
-            const text = await file.async("text");
-            zip.file(relPath, (0, redactSensitive_1.redactSensitive)(text));
+            if (isTextTraceEntry(relPath)) {
+                const text = await file.async("text");
+                zip.file(relPath, (0, redactSensitive_1.redactSensitive)(text));
+                return;
+            }
+            // Any other entry is a resource. Redact it only when it is textual, and
+            // only when redaction actually changes it — binary bytes are preserved.
+            const bytes = await file.async("nodebuffer");
+            // Skip the UTF-8 round-trip for the binary bulk that cannot carry a
+            // redactable value; `redactSensitive` would be a no-op on it anyway.
+            if (!mightContainSensitive(bytes))
+                return;
+            const decoded = asLosslessUtf8(bytes);
+            if (decoded === undefined)
+                return;
+            const redacted = (0, redactSensitive_1.redactSensitive)(decoded);
+            if (redacted !== decoded) {
+                zip.file(relPath, redacted);
+            }
         })());
     });
     await Promise.all(rewrites);

package/src/plugins/scanArtifactsForSecrets.d.ts

@@ -0,0 +1,51 @@
+/**
+ * A cleartext-secret occurrence found while scanning produced test artifacts.
+ * `entry` is set when the hit is inside a zip (e.g. a Playwright `trace.zip`
+ * resource body); otherwise the secret was found directly in `file`.
+ */
+export interface ArtifactSecretHit {
+    readonly file: string;
+    readonly entry?: string;
+    readonly secret: string;
+}
+/**
+ * Recursively scans a produced-artifacts directory for cleartext `secrets`,
+ * looking *inside* `trace.zip` archives (including their hashed `resources/*`
+ * network-body entries) as well as plain files (logs, HAR, `error-context.md`,
+ * screenshots, video). Intended as a regression guard: after redaction the
+ * returned list must be empty for both passing and failing runs.
+ *
+ * Only catches secrets known verbatim (e.g. the account password from config).
+ * For per-run-minted credentials whose value is not known in advance (the Okta
+ * session cookie, `okta-token-storage` tokens) use
+ * {@link scanArtifactsForUnredactedSecrets}.
+ *
+ * @param dir - Root artifacts directory to walk.
+ * @param secrets - Cleartext values that must not appear anywhere.
+ * @returns {Promise<Array<ArtifactSecretHit>>} Every occurrence found.
+ */
+export declare const scanArtifactsForSecrets: (dir: string, secrets: ReadonlyArray<string>) => Promise<Array<ArtifactSecretHit>>;
+/**
+ * A *structural* leak: a value that should have been redacted (it sits under a
+ * sensitive JSON key, a URL-encoded sensitive param, or a browser cookie
+ * `value`) but is not `***`. Needs no verbatim secret, so it catches
+ * per-run-minted credentials whose value CI cannot know in advance.
+ */
+export interface StructuralSecretHit {
+    readonly file: string;
+    readonly entry?: string;
+    readonly key: string;
+    readonly kind: "json" | "url" | "cookie";
+}
+/**
+ * Recursively scans a produced-artifacts directory for *structural* leaks —
+ * sensitive values that were not reduced to `***`. Unlike
+ * {@link scanArtifactsForSecrets} it needs no verbatim secret, so it catches the
+ * Okta session cookie and `okta-token-storage` tokens replayed on the `login()`
+ * cache-hit path, whose values are minted per run. Intended as a CI guard
+ * alongside the verbatim scan: the returned list must be empty after redaction.
+ *
+ * @param dir - Root artifacts directory to walk.
+ * @returns {Promise<Array<StructuralSecretHit>>} Every unredacted sensitive value found.
+ */
+export declare const scanArtifactsForUnredactedSecrets: (dir: string) => Promise<Array<StructuralSecretHit>>;

package/src/plugins/scanArtifactsForSecrets.js

@@ -0,0 +1,178 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanArtifactsForUnredactedSecrets = exports.scanArtifactsForSecrets = void 0;
+const tslib_1 = require("tslib");
+const fs_1 = require("fs");
+const jszip_1 = tslib_1.__importDefault(require("jszip"));
+const path = tslib_1.__importStar(require("path"));
+const redactPatterns_1 = require("./redactPatterns");
+const redactSensitive_1 = require("./redactSensitive");
+/**
+ * Searches `buf`'s raw bytes for each secret. `Buffer.prototype.includes`
+ * matches the UTF-8 bytes of the (ASCII) secret directly, so we never decode
+ * the buffer to a string: binary artifacts (video, screenshots) simply yield no
+ * hits, and an oversized artifact can't trip `Cannot create a string longer
+ * than 0x1fffffe8 characters` and abort the scan.
+ */
+const findSecrets = (buf, secrets) => secrets.filter(secret => secret.length > 0 && buf.includes(secret));
+const scanZip = async (zipPath, secrets) => {
+    const zip = await jszip_1.default.loadAsync((0, fs_1.readFileSync)(zipPath));
+    const entries = [];
+    zip.forEach((relPath, file) => {
+        if (!file.dir) {
+            entries.push([relPath, file]);
+        }
+    });
+    const hits = [];
+    for (const [relPath, file] of entries) {
+        for (const secret of findSecrets(await file.async("nodebuffer"), secrets)) {
+            hits.push({ file: zipPath, entry: relPath, secret });
+        }
+    }
+    return hits;
+};
+/**
+ * Recursively scans a produced-artifacts directory for cleartext `secrets`,
+ * looking *inside* `trace.zip` archives (including their hashed `resources/*`
+ * network-body entries) as well as plain files (logs, HAR, `error-context.md`,
+ * screenshots, video). Intended as a regression guard: after redaction the
+ * returned list must be empty for both passing and failing runs.
+ *
+ * Only catches secrets known verbatim (e.g. the account password from config).
+ * For per-run-minted credentials whose value is not known in advance (the Okta
+ * session cookie, `okta-token-storage` tokens) use
+ * {@link scanArtifactsForUnredactedSecrets}.
+ *
+ * @param dir - Root artifacts directory to walk.
+ * @param secrets - Cleartext values that must not appear anywhere.
+ * @returns {Promise<Array<ArtifactSecretHit>>} Every occurrence found.
+ */
+const scanArtifactsForSecrets = async (dir, secrets) => {
+    const hits = [];
+    const walk = async (current) => {
+        // `withFileTypes` gives the entry type without a per-entry `statSync` — and
+        // without following symlinks, so a dangling link can't throw and abort the
+        // walk. Only descend directories and read regular files.
+        for (const dirent of (0, fs_1.readdirSync)(current, { withFileTypes: true })) {
+            const full = path.join(current, dirent.name);
+            if (dirent.isDirectory()) {
+                await walk(full);
+                continue;
+            }
+            if (!dirent.isFile()) {
+                continue;
+            }
+            if (full.endsWith(".zip")) {
+                hits.push(...(await scanZip(full, secrets)));
+                continue;
+            }
+            for (const secret of findSecrets((0, fs_1.readFileSync)(full), secrets)) {
+                hits.push({ file: full, secret });
+            }
+        }
+    };
+    await walk(dir);
+    return hits;
+};
+exports.scanArtifactsForSecrets = scanArtifactsForSecrets;
+/**
+ * Text artifacts that carry redactable structure (trace streams, `error-context`,
+ * HAR, logs) are small; media (video, screenshots) is large binary that would
+ * waste work and risk the `Cannot create a string longer than 0x1fffffe8
+ * characters` throw. Cap the bytes we decode for structural scanning.
+ */
+const MAX_STRUCTURAL_SCAN_BYTES = 32 * 1024 * 1024;
+/**
+ * Decodes `buf` as UTF-8 only when it round-trips losslessly (so binary
+ * resources are skipped) and is within the size cap. Returns `undefined`
+ * otherwise.
+ */
+const asScannableText = (buf) => {
+    if (buf.length > MAX_STRUCTURAL_SCAN_BYTES) {
+        return undefined;
+    }
+    const text = buf.toString("utf8");
+    return Buffer.from(text, "utf8").equals(buf) ? text : undefined;
+};
+const findStructuralLeaks = (text) => {
+    const leaks = [];
+    for (const key of redactSensitive_1.SENSITIVE_KEYS) {
+        for (const match of text.matchAll(new RegExp(`${redactPatterns_1.QUOTE}${key}${redactPatterns_1.QUOTE}\\s*:\\s*${redactPatterns_1.QUOTE}(.*?)${redactPatterns_1.QUOTE}`, "gi"))) {
+            if (match[1] !== redactPatterns_1.REDACTED) {
+                leaks.push({ key, kind: "json" });
+            }
+        }
+        for (const match of text.matchAll(new RegExp(`${key}=([^&\\s"]+)`, "gi"))) {
+            if (match[1] !== redactPatterns_1.REDACTED) {
+                leaks.push({ key, kind: "url" });
+            }
+        }
+    }
+    // Cookie detection uses the same order-independent shape helper as redaction,
+    // so a value-last cookie cannot be leaked by the redactor yet reported clean.
+    for (const value of (0, redactPatterns_1.cookieValues)(text)) {
+        if (value !== redactPatterns_1.REDACTED) {
+            leaks.push({ key: "value", kind: "cookie" });
+        }
+    }
+    return leaks;
+};
+/**
+ * Recursively scans a produced-artifacts directory for *structural* leaks —
+ * sensitive values that were not reduced to `***`. Unlike
+ * {@link scanArtifactsForSecrets} it needs no verbatim secret, so it catches the
+ * Okta session cookie and `okta-token-storage` tokens replayed on the `login()`
+ * cache-hit path, whose values are minted per run. Intended as a CI guard
+ * alongside the verbatim scan: the returned list must be empty after redaction.
+ *
+ * @param dir - Root artifacts directory to walk.
+ * @returns {Promise<Array<StructuralSecretHit>>} Every unredacted sensitive value found.
+ */
+const scanArtifactsForUnredactedSecrets = async (dir) => {
+    const hits = [];
+    const scanZipStructural = async (zipPath) => {
+        const zip = await jszip_1.default.loadAsync((0, fs_1.readFileSync)(zipPath));
+        const entries = [];
+        zip.forEach((relPath, file) => {
+            if (!file.dir) {
+                entries.push([relPath, file]);
+            }
+        });
+        for (const [relPath, file] of entries) {
+            const text = asScannableText(await file.async("nodebuffer"));
+            if (text === undefined) {
+                continue;
+            }
+            for (const leak of findStructuralLeaks(text)) {
+                hits.push({ file: zipPath, entry: relPath, ...leak });
+            }
+        }
+    };
+    const walk = async (current) => {
+        for (const dirent of (0, fs_1.readdirSync)(current, { withFileTypes: true })) {
+            const full = path.join(current, dirent.name);
+            if (dirent.isDirectory()) {
+                await walk(full);
+                continue;
+            }
+            if (!dirent.isFile()) {
+                continue;
+            }
+            if (full.endsWith(".zip")) {
+                await scanZipStructural(full);
+                continue;
+            }
+            const text = asScannableText((0, fs_1.readFileSync)(full));
+            if (text === undefined) {
+                continue;
+            }
+            for (const leak of findStructuralLeaks(text)) {
+                hits.push({ file: full, ...leak });
+            }
+        }
+    };
+    await walk(dir);
+    return hits;
+};
+exports.scanArtifactsForUnredactedSecrets = scanArtifactsForUnredactedSecrets;
+//# sourceMappingURL=scanArtifactsForSecrets.js.map