@trackunit/iris-app-playwright 0.2.56 → 0.2.58

package/README.md

@@ -31,20 +31,29 @@ This creates:
 - `playwright.config.ts` wired to `createNxPreset` + `defaultPlaywrightConfig` + `setupPlugins`
 - `playwright/tsconfig.json`
 - `playwright/support/fixtures.ts` — re-exports `test`, `expect`, and `describe`
-- `playwright/fixtures/auth.json` — fill in credentials
+- `playwright/fixtures/auth.json` — name-only account fixture (fill in the username)
 - `playwright/tests/app.spec.ts` — sample login spec
 - `e2e` and `e2e-ui` targets in `project.json`
 
-### 2. Fill in credentials
+### 2. Fill in the account fixture
+
+`auth.json` is **name-only** — no password is committed. Put the E2E account's
+identifier in it:
 
 ```json
 // playwright/fixtures/auth.json
 {
-  "username": "your-test-user@example.com",
-  "password": "your-test-password"
+  "username": "your-test-user@example.com"
 }
 ```
 
+At `login()` time the password is resolved by account name — the
+`E2E_PW_<SLUG>` environment variable first (set by the CircleCI context in CI),
+otherwise from Vault on a developer machine (needs `vault login` on the VPN,
+`E2E_VAULT_ENDPOINT` / `E2E_VAULT_PATH`, and the optional `node-vault` peer).
+A full `{ "username", "password" }` fixture, or explicit `login({ credentials })`,
+are also honoured.
+
 ### 3. Write a test
 
 ```typescript
@@ -86,7 +95,7 @@ Authenticates a user against the Trackunit platform.
 login(options?: LoginOptions): Promise<void>
 ```
 
-Reads credentials from `playwright/fixtures/auth.json` by default, or from `PLAYWRIGHT_USERNAME` / `PLAYWRIGHT_PASSWORD` environment variables. Navigates to `/auth/manager-classic` and waits for the host layout to be visible.
+Reads the account from `playwright/fixtures/auth.json` by default. When the fixture is name-only, the password is resolved at run time — env-first (`E2E_PW_<SLUG>`, the CircleCI context in CI) then Vault locally. A full `{ username, password }` fixture or an explicit `login({ credentials })` are also honoured. Resolution happens inside the fixture (no Playwright `globalSetup`), so it works in `e2e-ui` mode too. Navigates to `/auth/manager-classic` and waits for the host layout to be visible.
 
 #### Per-worker storage state cache
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trackunit/iris-app-playwright",
-  "version": "0.2.56",
+  "version": "0.2.58",
   "repository": "https://github.com/Trackunit/manager",
   "license": "SEE LICENSE IN LICENSE.txt",
   "generators": "./generators.json",

package/src/credentials/resolveE2EPassword.d.ts

@@ -1,4 +1,3 @@
-export type VaultKvVersion = 1 | 2;
 /**
  * Minimal structural view of the `node-vault` client's KV read: it returns
  * `{ data: ... }` (KV v1) or `{ data: { data: ... } }` (KV v2). Kept as an
@@ -19,6 +18,13 @@ export interface ResolveE2EPasswordOptions {
      */
     createVault?: (env: NodeJS.ProcessEnv) => Promise<VaultReader | undefined>;
 }
+/**
+ * Clears the in-memory resolved-password cache. The cache is a module-level
+ * singleton that lives for the whole process, so a resolved value would
+ * otherwise leak across calls (and across test cases). Call this between tests
+ * to keep each `resolveE2EPassword` call independent.
+ */
+export declare const resetE2EPasswordCache: () => void;
 /**
  * Resolves an account's E2E password by name.
  *

package/src/credentials/resolveE2EPassword.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveE2EPassword = void 0;
+exports.resolveE2EPassword = exports.resetE2EPasswordCache = void 0;
 const tslib_1 = require("tslib");
 const fs_1 = require("fs");
 const os = tslib_1.__importStar(require("os"));
@@ -8,14 +8,6 @@ const path = tslib_1.__importStar(require("path"));
 const redactSensitive_1 = require("../plugins/redactSensitive");
 const guards_1 = require("./guards");
 const keys_1 = require("./keys");
-/** Logical KV path the publish side writes to (see devtools/e2e-okta-rotation). */
-const DEFAULT_VAULT_PATH = "secret/manager/e2e-playwright";
-/** KV v2 stores secrets at `mount/data/rest`; KV v1 uses the logical path verbatim. */
-const toKvV2DataPath = (logicalPath) => {
-    const segments = logicalPath.replace(/^\/+|\/+$/g, "").split("/");
-    const [mount, ...rest] = segments;
-    return [mount, "data", ...rest].join("/");
-};
 /**
  * Reads a field from a node-vault KV read result. KV v2 nests the fields under
  * `data.data`; KV v1 puts them directly on `data`. Narrows structurally.
@@ -66,13 +58,74 @@ const defaultCreateVault = async (env) => {
         return fail("E2E credentials: install the optional `node-vault` peer dependency for local Vault lookup, " +
             "or set the E2E_PW_<SLUG> env variable.");
     }
-    const client = nodeVault.default({ endpoint, token, requestOptions: { strictSSL: true } });
+    // `timeout` bounds the whole request so an off-VPN endpoint that black-holes
+    // the connection fails fast (~10s) instead of hanging until the test times out.
+    const client = nodeVault.default({
+        endpoint,
+        token,
+        requestOptions: { strictSSL: true, timeout: 10000 },
+    });
     return { read: secretPath => client.read(secretPath) };
 };
+/**
+ * Node/socket error codes that mean the Vault host could not be reached at all —
+ * as opposed to a reachable Vault answering with a 403/404. Off-VPN, the internal
+ * Vault hostname either fails DNS (`ENOTFOUND`/`EAI_AGAIN`) or the connection is
+ * refused/timed out, so these map to an actionable "connect to the VPN" hint.
+ */
+const VAULT_UNREACHABLE_CODES = new Set([
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "ECONNREFUSED",
+    "ECONNRESET",
+    "ETIMEDOUT",
+    "ESOCKETTIMEDOUT",
+    "EHOSTUNREACH",
+    "ENETUNREACH",
+]);
+/** True when a thrown Vault-read error is a transport failure (host unreachable), not an HTTP response. */
+const isVaultUnreachableError = (error) => {
+    if (!(0, guards_1.isRecord)(error)) {
+        return false;
+    }
+    const code = error.code;
+    return typeof code === "string" && VAULT_UNREACHABLE_CODES.has(code);
+};
+/**
+ * HTTP statuses a *reachable* Vault returns when the caller's token is missing,
+ * invalid, or expired — i.e. "not logged in / not authenticated" (as opposed to a
+ * 404 for a real missing path). `node-vault` attaches the HTTP response to the
+ * thrown error as `error.response.statusCode`, so we narrow to it structurally
+ * rather than making an extra `tokenLookupSelf` round-trip.
+ */
+const VAULT_UNAUTHENTICATED_STATUS = new Set([401, 403]);
+/** Extracts the HTTP status code from a thrown `node-vault` read error, if present. */
+const getVaultErrorStatus = (error) => {
+    if (!(0, guards_1.isRecord)(error)) {
+        return undefined;
+    }
+    const response = error.response;
+    if (!(0, guards_1.isRecord)(response)) {
+        return undefined;
+    }
+    const statusCode = response.statusCode;
+    return typeof statusCode === "number" ? statusCode : undefined;
+};
 /** Throws an error whose message is routed through `redactSensitive` (defence in depth). */
 const fail = (message) => {
     throw new Error((0, redactSensitive_1.redactSensitive)(message));
 };
+const passwordCache = new Map();
+/**
+ * Clears the in-memory resolved-password cache. The cache is a module-level
+ * singleton that lives for the whole process, so a resolved value would
+ * otherwise leak across calls (and across test cases). Call this between tests
+ * to keep each `resolveE2EPassword` call independent.
+ */
+const resetE2EPasswordCache = () => {
+    passwordCache.clear();
+};
+exports.resetE2EPasswordCache = resetE2EPasswordCache;
 /**
  * Resolves an account's E2E password by name.
  *
@@ -90,11 +143,16 @@ const resolveE2EPassword = async (username, options = {}) => {
     if (username === "" || username === "REPLACE_ME") {
         return fail(`E2E credentials: fixture account name is unresolved ("${username}").`);
     }
+    const cached = passwordCache.get(username);
+    if (cached !== undefined) {
+        return cached;
+    }
     const env = options.env ?? process.env;
     const key = (0, keys_1.deriveEnvKey)(username);
     // CI path: an injected env variable wins and Vault is never contacted.
     const fromEnv = env[key];
     if (fromEnv !== undefined && fromEnv !== "") {
+        passwordCache.set(username, fromEnv);
         return fromEnv;
     }
     // Local path: read the password from Vault by the same key.
@@ -102,22 +160,36 @@ const resolveE2EPassword = async (username, options = {}) => {
     const vault = await createVault(env);
     if (vault === undefined) {
         return fail(`E2E credentials for "${username}": no env variable (${key}) and Vault is unavailable ` +
-            `(not authenticated / not on VPN). Run \`vault login -method=oidc -path=okta\` on VPN, or set the env variable.`);
+            `(not authenticated / not on VPN). Run \`vault login -address=${env.E2E_VAULT_ENDPOINT} -method=oidc -path=okta\` on VPN, or set the env variable.`);
     }
-    const kvVersion = env.E2E_VAULT_KV_VERSION === "1" ? 1 : 2;
-    const logicalPath = env.E2E_VAULT_PATH ?? DEFAULT_VAULT_PATH;
-    const readPath = kvVersion === 2 ? toKvV2DataPath(logicalPath) : logicalPath;
+    const logicalPath = env.E2E_VAULT_PATH;
+    if (!logicalPath) {
+        return fail("E2E_VAULT_PATH is not set");
+    }
+    const readPath = logicalPath;
     let result;
     try {
         result = await vault.read(readPath);
     }
-    catch {
-        return fail(`E2E credentials for "${username}": Vault read of "${readPath}" failed.`);
+    catch (error) {
+        if (isVaultUnreachableError(error)) {
+            return fail(`E2E credentials for "${username}": Vault endpoint is unreachable ` +
+                `(likely not on VPN, or E2E_VAULT_ENDPOINT is misconfigured). ` +
+                `Connect to the VPN and retry, or set the ${key} env variable, right now vault is trying to connect to ${env.E2E_VAULT_ENDPOINT}.`);
+        }
+        const status = getVaultErrorStatus(error);
+        if (status !== undefined && VAULT_UNAUTHENTICATED_STATUS.has(status)) {
+            return fail(`E2E credentials for "${username}": Vault rejected the request (HTTP ${status}) — ` +
+                `your Vault token is missing or expired. ` +
+                `Run something like \`vault login -address=${env.E2E_VAULT_ENDPOINT} -method=oidc -path=okta\` on VPN, or set the ${key} env variable, right now vault is trying to connect to a logged in vault at ${env.E2E_VAULT_ENDPOINT}.`);
+        }
+        return fail(`E2E credentials for "${username}": Vault read of "${readPath}" failed on host ${env.E2E_VAULT_ENDPOINT}.`);
     }
     const fromVault = readVaultField(result, (0, keys_1.deriveVaultField)(username));
     if (fromVault === undefined) {
         return fail(`E2E credentials for "${username}": no field "${(0, keys_1.deriveVaultField)(username)}" at Vault path "${readPath}".`);
     }
+    passwordCache.set(username, fromVault);
     return fromVault;
 };
 exports.resolveE2EPassword = resolveE2EPassword;

package/src/fixtures/login.fixture.js

@@ -20,7 +20,7 @@ exports.test = test_1.test.extend({
     ],
     login: async ({ page, baseURL, _loginCache }, provide) => {
         const loginFn = async (options) => {
-            const credentials = (0, resolveCredentials_1.resolveCredentials)(options);
+            const credentials = await (0, resolveCredentials_1.resolveCredentials)(options);
             const cacheKey = (0, loginCacheKey_1.buildLoginCacheKey)(baseURL, credentials);
             const cached = _loginCache.get(cacheKey);
             if (cached !== undefined) {

package/src/fixtures/resolveCredentials.d.ts

@@ -4,13 +4,27 @@ export interface AuthCredentials {
 }
 export interface ResolveCredentialsOptions {
     credentials?: AuthCredentials;
-    /** Path to a JSON file with `{ username, password }`. Defaults to `playwright/fixtures/auth.json` relative to cwd. */
+    /**
+     * Path to a JSON fixture identifying the account. Either name-only
+     * (`{ username }`, password resolved at run time) or a full
+     * `{ username, password }`. Defaults to `playwright/fixtures/auth.json`
+     * relative to cwd.
+     */
     fixturePath?: string;
 }
 /**
- * Resolves auth credentials from (in order): explicit options, a full JSON
- * fixture (`{ username, password }`), a **name-only** fixture whose password
- * comes from its `E2E_PW_<SLUG>` env var, then `PLAYWRIGHT_USERNAME`/`PLAYWRIGHT_PASSWORD`.
- * Throws if none yield a complete credential pair.
+ * Resolves auth credentials for a **single** account (one `login()` call logs in
+ * as one user), from the first source that yields a complete pair, tried in
+ * order:
+ *
+ * 1. explicit `options.credentials`;
+ * 2. a full JSON fixture (`{ username, password }`);
+ * 3. a **name-only** fixture (`{ username }`), whose password is resolved at
+ *    `login()` time by {@link resolveE2EPassword} — env-first (`E2E_PW_<SLUG>`,
+ *    set by the CircleCI context in CI) then Vault locally. No `globalSetup` is
+ *    involved, so this works in `e2e-ui` mode too.
+ *
+ * Throws if none yield a complete pair. Async because the name-only path (step 3)
+ * may reach out to Vault.
  */
-export declare const resolveCredentials: (options?: ResolveCredentialsOptions) => AuthCredentials;
+export declare const resolveCredentials: (options?: ResolveCredentialsOptions) => Promise<AuthCredentials>;

package/src/fixtures/resolveCredentials.js

@@ -4,7 +4,7 @@ exports.resolveCredentials = void 0;
 const tslib_1 = require("tslib");
 const fs_1 = require("fs");
 const path = tslib_1.__importStar(require("path"));
-const keys_1 = require("../credentials/keys");
+const resolveE2EPassword_1 = require("../credentials/resolveE2EPassword");
 const isAuthCredentials = (value) => {
     if (typeof value !== "object" || value === null) {
         return false;
@@ -46,21 +46,21 @@ const readFixtureUsername = (fixturePath) => {
     return username;
 };
 /**
- * Resolves the password for a name-only fixture from the per-account env var set
- * by the credential `globalSetup` (locally, from Vault) or by the CircleCI
- * context (CI): `E2E_PW_<SLUG>`. Returns `undefined` when it is not set.
+ * Resolves auth credentials for a **single** account (one `login()` call logs in
+ * as one user), from the first source that yields a complete pair, tried in
+ * order:
+ *
+ * 1. explicit `options.credentials`;
+ * 2. a full JSON fixture (`{ username, password }`);
+ * 3. a **name-only** fixture (`{ username }`), whose password is resolved at
+ *    `login()` time by {@link resolveE2EPassword} — env-first (`E2E_PW_<SLUG>`,
+ *    set by the CircleCI context in CI) then Vault locally. No `globalSetup` is
+ *    involved, so this works in `e2e-ui` mode too.
+ *
+ * Throws if none yield a complete pair. Async because the name-only path (step 3)
+ * may reach out to Vault.
  */
-const resolvePasswordFromEnv = (username) => {
-    const password = process.env[(0, keys_1.deriveEnvKey)(username)];
-    return password !== undefined && password !== "" ? password : undefined;
-};
-/**
- * Resolves auth credentials from (in order): explicit options, a full JSON
- * fixture (`{ username, password }`), a **name-only** fixture whose password
- * comes from its `E2E_PW_<SLUG>` env var, then `PLAYWRIGHT_USERNAME`/`PLAYWRIGHT_PASSWORD`.
- * Throws if none yield a complete credential pair.
- */
-const resolveCredentials = (options) => {
+const resolveCredentials = async (options) => {
     if (options?.credentials !== undefined) {
         return options.credentials;
     }
@@ -69,22 +69,16 @@ const resolveCredentials = (options) => {
     if (fromFixture !== undefined) {
         return fromFixture;
     }
-    // Name-only fixture: the password lives in the per-account env var.
+    // Name-only fixture: resolve this one account's password on demand. Throws a
+    // clear, account-named error when neither env var nor Vault yields a value.
     const username = readFixtureUsername(fixturePath);
     if (username !== undefined) {
-        const password = resolvePasswordFromEnv(username);
-        if (password !== undefined) {
-            return { username, password };
-        }
-    }
-    const envUsername = process.env.PLAYWRIGHT_USERNAME;
-    const envPassword = process.env.PLAYWRIGHT_PASSWORD;
-    if (envUsername !== undefined && envUsername !== "" && envPassword !== undefined && envPassword !== "") {
-        return { username: envUsername, password: envPassword };
+        const password = await (0, resolveE2EPassword_1.resolveE2EPassword)(username);
+        return { username, password };
     }
-    throw new Error(`No credentials provided to login(). Tried: options.credentials, ${fixturePath} ` +
-        `(incl. its E2E_PW_<slug> env var for a name-only fixture), PLAYWRIGHT_USERNAME/PLAYWRIGHT_PASSWORD env vars. ` +
-        `Fill in the fixture, set the env vars, or pass credentials to login().`);
+    throw new Error(`No credentials provided to login(). Tried: options.credentials and ${fixturePath} ` +
+        `(a full { username, password } fixture, or a name-only { username } fixture resolved via its ` +
+        `E2E_PW_<slug> env var / Vault). Fill in the fixture or pass credentials to login().`);
 };
 exports.resolveCredentials = resolveCredentials;
 //# sourceMappingURL=resolveCredentials.js.map

package/src/generators/playwright-configuration/files/root/playwright/fixtures/auth.json__tmpl__

@@ -1,4 +1,3 @@
 {
-  "username": "REPLACE_ME",
-  "password": "REPLACE_ME"
+  "username": "REPLACE_ME"
 }

package/src/generators/playwright-configuration/files/root/playwright.config.ts__tmpl__

@@ -2,7 +2,10 @@ import { createNxPreset, defaultPlaywrightConfig, setupPlugins } from "@trackuni
 import { format, resolveConfig } from "prettier";
 
 const nxPreset = createNxPreset(__filename);
-const config = defaultPlaywrightConfig({ configDir: __dirname, projectConfig: { testDir: "./playwright/tests" } });
+const config = defaultPlaywrightConfig({
+  configDir: __dirname,
+  projectConfig: { testDir: "./playwright/tests" },
+});
 
 export default setupPlugins(
   {

package/src/generators/playwright-configuration/generator.js

@@ -99,8 +99,9 @@ async function playwrightConfigurationGenerator(tree, options) {
     addPlaywrightTsConfigReference(tree, projectRoot);
     await (0, devkit_1.formatFiles)(tree);
     return () => {
-        devkit_1.logger.info(`\n\n✅ 🚀 \nPlease update credentials in: 
+        devkit_1.logger.info(`\n\n✅ 🚀 \nSet the E2E account username in: 
   ${(0, devkit_1.joinPathFragments)(projectRoot, "playwright/fixtures/auth.json")}
+(the password is resolved at run time from E2E_PW_<SLUG> — the CircleCI context in CI, Vault locally)
 and open this file to get started writing tests:
   ${(0, devkit_1.joinPathFragments)(projectRoot, "playwright/tests/app.spec.ts")}`);
     };

package/src/index.d.ts

@@ -8,9 +8,6 @@ export * from "./plugins/writeFileWithPrettier";
 export * from "./utils/Codeowner";
 export * from "./utils/fileNameBuilder";
 export * from "./utils/fileUpdater";
-export * from "./credentials/fixtureAccounts";
-export * from "./credentials/globalSetup";
-export { default as e2eCredentialsGlobalSetup } from "./credentials/globalSetup";
 export * from "./credentials/keys";
 export * from "./credentials/resolveE2EPassword";
 export type { FeatureFlag, FeatureFlagFixtures } from "./fixtures/featureFlags.fixture";

package/src/index.js

@@ -1,6 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.e2eCredentialsGlobalSetup = void 0;
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./plugins/createLogFile"), exports);
 tslib_1.__exportStar(require("./plugins/defaultPlaywrightConfig"), exports);
@@ -12,14 +11,10 @@ tslib_1.__exportStar(require("./plugins/writeFileWithPrettier"), exports);
 tslib_1.__exportStar(require("./utils/Codeowner"), exports);
 tslib_1.__exportStar(require("./utils/fileNameBuilder"), exports);
 tslib_1.__exportStar(require("./utils/fileUpdater"), exports);
-// Opt-in E2E credential resolution: resolve an account's password at runtime by
-// name (env-var first, then Vault). Vault access uses the optional `node-vault`
-// peer and an env-supplied endpoint — never hardcoded — so any consumer can wire
-// their own Vault. See ./credentials.
-tslib_1.__exportStar(require("./credentials/fixtureAccounts"), exports);
-tslib_1.__exportStar(require("./credentials/globalSetup"), exports);
-var globalSetup_1 = require("./credentials/globalSetup");
-Object.defineProperty(exports, "e2eCredentialsGlobalSetup", { enumerable: true, get: function () { return tslib_1.__importDefault(globalSetup_1).default; } });
+// E2E credential resolution: resolve an account's password at runtime by name
+// (env-var first, then Vault) inside the `login()` fixture — no `globalSetup`.
+// Vault access uses the optional `node-vault` peer and an env-supplied endpoint —
+// never hardcoded — so any consumer can wire their own Vault. See ./credentials.
 tslib_1.__exportStar(require("./credentials/keys"), exports);
 tslib_1.__exportStar(require("./credentials/resolveE2EPassword"), exports);
 //# sourceMappingURL=index.js.map

package/src/credentials/fixtureAccounts.d.ts

@@ -1,19 +0,0 @@
-/**
- * Returns a fixture's `username` when the file is a **credential** fixture — a
- * JSON object with a non-blank string `username` that is not the `REPLACE_ME`
- * placeholder. Data fixtures (no `username`) and unparseable files yield
- * `undefined`. The `password` field is intentionally NOT required, so this keeps
- * working after passwords are removed from the repo.
- */
-export declare const readFixtureAccount: (fixturePath: string) => string | undefined;
-/** Lists the `*.json` files directly under a fixtures directory (non-recursive, sorted). */
-export declare const listFixtureFiles: (fixturesDir: string) => Array<string>;
-/**
- * Discovers the **distinct** account identifiers referenced by **all** credential
- * fixtures directly under `fixturesDir` — every `*.json` with a `username`, not
- * just `auth.json`. A project's `playwright/fixtures/` can hold many credential
- * files (`managere2e.json`, `managere2e-admin.json`, `reporte2e.json`, …), each
- * a different account; this returns one entry per distinct account so every one
- * can be resolved.
- */
-export declare const discoverFixtureAccounts: (fixturesDir: string) => Array<string>;

package/src/credentials/fixtureAccounts.js

@@ -1,69 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.discoverFixtureAccounts = exports.listFixtureFiles = exports.readFixtureAccount = void 0;
-const tslib_1 = require("tslib");
-const fs_1 = require("fs");
-const path = tslib_1.__importStar(require("path"));
-const guards_1 = require("./guards");
-/** Fixtures still holding this placeholder are unconfigured and ignored. */
-const PLACEHOLDER = "REPLACE_ME";
-/**
- * Returns a fixture's `username` when the file is a **credential** fixture — a
- * JSON object with a non-blank string `username` that is not the `REPLACE_ME`
- * placeholder. Data fixtures (no `username`) and unparseable files yield
- * `undefined`. The `password` field is intentionally NOT required, so this keeps
- * working after passwords are removed from the repo.
- */
-const readFixtureAccount = (fixturePath) => {
-    let parsed;
-    try {
-        parsed = JSON.parse((0, fs_1.readFileSync)(fixturePath, "utf-8"));
-    }
-    catch {
-        return undefined;
-    }
-    if (!(0, guards_1.isRecord)(parsed)) {
-        return undefined;
-    }
-    const username = parsed.username;
-    if (typeof username !== "string" || username.trim() === "" || username === PLACEHOLDER) {
-        return undefined;
-    }
-    return username;
-};
-exports.readFixtureAccount = readFixtureAccount;
-/** Lists the `*.json` files directly under a fixtures directory (non-recursive, sorted). */
-const listFixtureFiles = (fixturesDir) => {
-    let entries;
-    try {
-        entries = (0, fs_1.readdirSync)(fixturesDir);
-    }
-    catch {
-        return [];
-    }
-    return entries
-        .filter(name => name.endsWith(".json"))
-        .map(name => path.join(fixturesDir, name))
-        .sort();
-};
-exports.listFixtureFiles = listFixtureFiles;
-/**
- * Discovers the **distinct** account identifiers referenced by **all** credential
- * fixtures directly under `fixturesDir` — every `*.json` with a `username`, not
- * just `auth.json`. A project's `playwright/fixtures/` can hold many credential
- * files (`managere2e.json`, `managere2e-admin.json`, `reporte2e.json`, …), each
- * a different account; this returns one entry per distinct account so every one
- * can be resolved.
- */
-const discoverFixtureAccounts = (fixturesDir) => {
-    const seen = new Set();
-    for (const file of (0, exports.listFixtureFiles)(fixturesDir)) {
-        const username = (0, exports.readFixtureAccount)(file);
-        if (username !== undefined) {
-            seen.add(username);
-        }
-    }
-    return [...seen];
-};
-exports.discoverFixtureAccounts = discoverFixtureAccounts;
-//# sourceMappingURL=fixtureAccounts.js.map

package/src/credentials/globalSetup.d.ts

@@ -1,68 +0,0 @@
-/**
- * Reads the account name from a name-only `auth.json` fixture (`{ "username": ... }`).
- * The password field has been removed from the repo; only the identifier remains.
- */
-export declare const readFixtureUsername: (fixturePath: string) => string;
-export interface InjectE2ECredentialsOptions {
-    fixturePath: string;
-    env?: NodeJS.ProcessEnv;
-    /** Password resolver seam (defaults to the real `resolveE2EPassword`). */
-    resolve?: (username: string, options: {
-        env: NodeJS.ProcessEnv;
-    }) => Promise<string>;
-}
-/**
- * Resolves the fixture account's password (env-first, else Vault) and injects
- * `PLAYWRIGHT_USERNAME`/`PLAYWRIGHT_PASSWORD` into the process env. Playwright
- * spawns workers after `globalSetup`, so the published `resolveCredentials`
- * env-var path picks these up unchanged — no change to the login fixture or the
- * `await login()` call sites.
- */
-export declare const injectE2ECredentials: (options: InjectE2ECredentialsOptions) => Promise<void>;
-export interface InjectAllE2ECredentialsOptions {
-    /**
-     * Directory holding the project's credential fixtures. **Every** `*.json` with
-     * a `username` is loaded (not just `auth.json`). Ignored when `usernames` is given.
-     */
-    fixturesDir?: string;
-    /** Explicit account list, overriding the directory scan. */
-    usernames?: ReadonlyArray<string>;
-    env?: NodeJS.ProcessEnv;
-    /** Password resolver seam (defaults to the real `resolveE2EPassword`). */
-    resolve?: (username: string, options: {
-        env: NodeJS.ProcessEnv;
-    }) => Promise<string>;
-}
-/**
- * Resolves **every** account referenced by the project's credential fixtures and
- * injects one env var per account: `E2E_PW_<SLUG> = password`.
- *
- * A project's `playwright/fixtures/` can reference many accounts across many
- * files (e.g. `apps/manager/playwright/fixtures`), and a single test can log in
- * as more than one. A single `PLAYWRIGHT_USERNAME`/`PLAYWRIGHT_PASSWORD` pair
- * can't carry those, so we set a per-account variable instead; the published
- * `resolveCredentials` then resolves each fixture's `username` to its
- * `E2E_PW_<SLUG>` value at `login()` time. In CI the variables are already
- * present (the CircleCI context), so `resolveE2EPassword` returns them without
- * touching Vault; locally they are resolved from Vault.
- */
-export declare const injectAllE2ECredentials: (options: InjectAllE2ECredentialsOptions) => Promise<void>;
-/**
- * Minimal shape of the Playwright `FullConfig` fields we use — avoids a runtime
- * dependency on `@playwright/test` in this lib. `rootDir` is the config's base
- * directory (the project directory, e.g. `libs/auth/main`), so the fixture sits
- * at `<rootDir>/playwright/fixtures/auth.json`.
- */
-interface PlaywrightConfigLike {
-    rootDir?: string;
-}
-/**
- * Playwright `globalSetup` entry point. Resolves credentials for **all** account
- * fixtures under the running project's `playwright/fixtures/` (every `*.json`,
- * not just `auth.json`), located relative to the config's `rootDir`.
- * `process.cwd()` is NOT used as the base: when the `e2e` target runs
- * `playwright test --config=<project>`, cwd is the nx workspace root, not the
- * project.
- */
-declare const globalSetup: (config?: PlaywrightConfigLike) => Promise<void>;
-export default globalSetup;

package/src/credentials/globalSetup.js

@@ -1,91 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.injectAllE2ECredentials = exports.injectE2ECredentials = exports.readFixtureUsername = void 0;
-const tslib_1 = require("tslib");
-const fs_1 = require("fs");
-const path = tslib_1.__importStar(require("path"));
-const fixtureAccounts_1 = require("./fixtureAccounts");
-const guards_1 = require("./guards");
-const keys_1 = require("./keys");
-const resolveE2EPassword_1 = require("./resolveE2EPassword");
-/**
- * Reads the account name from a name-only `auth.json` fixture (`{ "username": ... }`).
- * The password field has been removed from the repo; only the identifier remains.
- */
-const readFixtureUsername = (fixturePath) => {
-    if (!(0, fs_1.existsSync)(fixturePath)) {
-        throw new Error(`E2E credentials: fixture not found at "${fixturePath}".`);
-    }
-    const parsed = JSON.parse((0, fs_1.readFileSync)(fixturePath, "utf-8"));
-    if (!(0, guards_1.isRecord)(parsed) || typeof parsed.username !== "string" || parsed.username === "") {
-        throw new Error(`E2E credentials: fixture "${fixturePath}" has no "username".`);
-    }
-    return parsed.username;
-};
-exports.readFixtureUsername = readFixtureUsername;
-/**
- * Resolves the fixture account's password (env-first, else Vault) and injects
- * `PLAYWRIGHT_USERNAME`/`PLAYWRIGHT_PASSWORD` into the process env. Playwright
- * spawns workers after `globalSetup`, so the published `resolveCredentials`
- * env-var path picks these up unchanged — no change to the login fixture or the
- * `await login()` call sites.
- */
-const injectE2ECredentials = async (options) => {
-    const env = options.env ?? process.env;
-    const resolve = options.resolve ?? resolveE2EPassword_1.resolveE2EPassword;
-    const username = (0, exports.readFixtureUsername)(options.fixturePath);
-    const password = await resolve(username, { env });
-    env.PLAYWRIGHT_USERNAME = username;
-    env.PLAYWRIGHT_PASSWORD = password;
-};
-exports.injectE2ECredentials = injectE2ECredentials;
-/**
- * Resolves **every** account referenced by the project's credential fixtures and
- * injects one env var per account: `E2E_PW_<SLUG> = password`.
- *
- * A project's `playwright/fixtures/` can reference many accounts across many
- * files (e.g. `apps/manager/playwright/fixtures`), and a single test can log in
- * as more than one. A single `PLAYWRIGHT_USERNAME`/`PLAYWRIGHT_PASSWORD` pair
- * can't carry those, so we set a per-account variable instead; the published
- * `resolveCredentials` then resolves each fixture's `username` to its
- * `E2E_PW_<SLUG>` value at `login()` time. In CI the variables are already
- * present (the CircleCI context), so `resolveE2EPassword` returns them without
- * touching Vault; locally they are resolved from Vault.
- */
-const injectAllE2ECredentials = async (options) => {
-    const env = options.env ?? process.env;
-    const resolve = options.resolve ?? resolveE2EPassword_1.resolveE2EPassword;
-    const usernames = options.usernames ?? (options.fixturesDir !== undefined ? (0, fixtureAccounts_1.discoverFixtureAccounts)(options.fixturesDir) : []);
-    // Resolve every account before mutating `env`. Two distinct accounts can slug
-    // to the same `E2E_PW_<SLUG>` key; silently overwriting would run tests with
-    // the wrong account's password, so reject the collision (mirrors the publish
-    // side's `buildFields`). Resolving up front also keeps injection atomic: a
-    // late resolver failure never leaves a partially-injected environment.
-    const resolved = new Map();
-    for (const username of usernames) {
-        const key = (0, keys_1.deriveEnvKey)(username);
-        const existing = resolved.get(key);
-        if (existing !== undefined) {
-            throw new Error(`E2E credentials: accounts "${existing.username}" and "${username}" both map to ${key} — cannot inject both.`);
-        }
-        resolved.set(key, { username, password: await resolve(username, { env }) });
-    }
-    for (const [key, { password }] of resolved) {
-        env[key] = password;
-    }
-};
-exports.injectAllE2ECredentials = injectAllE2ECredentials;
-/**
- * Playwright `globalSetup` entry point. Resolves credentials for **all** account
- * fixtures under the running project's `playwright/fixtures/` (every `*.json`,
- * not just `auth.json`), located relative to the config's `rootDir`.
- * `process.cwd()` is NOT used as the base: when the `e2e` target runs
- * `playwright test --config=<project>`, cwd is the nx workspace root, not the
- * project.
- */
-const globalSetup = async (config) => {
-    const baseDir = config?.rootDir ?? process.cwd();
-    await (0, exports.injectAllE2ECredentials)({ fixturesDir: path.join(baseDir, "playwright", "fixtures") });
-};
-exports.default = globalSetup;
-//# sourceMappingURL=globalSetup.js.map