Playwright declares the timeout option on locator.isVisible() and isHidden() as deprecated and ignored: both return immediately and never wait. Passing resolveTimeout(10_000) to one therefore changes nothing at runtime and only tells the reader a wait happened that never did. That reading is what let 7538b8a0b conclude two genuine call sites were fine, and what hid the false negative b97cf8888 had to fix.
Sixty call sites across fifty-eight role-local specs lose the argument and nothing else. Every added line in this commit is a bare isVisible(); a grep for added lines that are not one returns zero, so a behaviour change cannot have entered here. Files whose diff also alters waiting semantics are deliberately not part of this commit.
A repository lint added in b97cf8888 keeps the construct out. It matches isVisible and isHidden only, because isChecked, isDisabled, isEditable and isEnabled take a real timeout.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Over Tor the redirect chain behind a login/logout/OIDC click routinely exceeds Playwright's fixed 30s action timeout, so the click throws before the flow's scaled waits run. Sweep all role Playwright suites and the shared persona helpers: give every navigation/auth-transition click an onion-scaled timeout (.click({ timeout: resolveTimeout(30_000) })) and route the remaining raw millisecond literals (timeout options, waitForTimeout, sleep-promise setTimeout, positional wait args) through resolveTimeout. Local UI clicks (menus, toggles, modal dismissals, DOM clicks inside evaluate) stay untouched.
Two new lints keep it that way: test_no_raw_timeout_literals forbids raw numeric timeout literals in Playwright specs (opt-out: nocheck: raw-timeout), test_persona_clicks_scaled requires every click in the shared persona auth flows to carry a resolveTimeout timeout (opt-out: nocheck: unscaled-click).
Verified: node --check on all 133 changed JS files, all 13 playwright lints green, make autoformat clean, make test green (2745+196+163+4 tests OK).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
New lint test_no_raw_goto.py forbids raw `page.goto(...)` in role playwright specs + persona flows (the gotoOnion wrapper in personas/utils is exempt) so navigation retries transient Tor-transport errors over onion. Migrates every raw call across ~75 roles (343 sites) to `gotoOnion(page, ...)` and teaches gotoOnion to detect relative onion URLs (`isOnionCanonical`). gotoOnion is a behaviour-identical drop-in on clearnet (single attempt, same return). Verified: no-raw-goto lint green, eslint 0 errors, make test green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add the global TIMEOUT_FACTOR and a shared timeouts.js helper: resolveTimeout(base) scales by TIMEOUT_FACTOR and, over a .onion target, an extra multiplier, so Tor's per-request latency no longer trips hard-coded timeouts. Migrate every raw timeout in the specs (timeout:/timeout=/setTimeout/waitForTimeout) to resolveTimeout, stage the helper in all three staging paths, and add test_no_raw_timeouts to forbid raw numeric timeouts. Clearnet behaviour is unchanged (factor 1: resolveTimeout(N) === N).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Five interacting bugs kept `test-lam-writethrough.js` red across
all retries on the live stack:
- URLs hit `/templates/...` but LAM is mounted at the Apache alias
`/lam/`, so the post-Keycloak goto landed on a 404.
- Password fill used `LAM_PASSWORD` (LAM master), but LAM with
`loginMethod=list` expects the selected admin's LDAP bind cred.
Adds `LDAP_ADMIN_PASSWORD` to `playwright.env.j2` (gated behind the
existing LAM service-enabled `{% if %}`) and prefers it over the
master password.
- Login-form input selector also accepts `name='passwd'` (LAM's
actual HTML), not only `name='password'` / `id='passwd'`.
- User-list filter selector restricted to `input[type='text']` so it
no longer matches the `apply_filter` submit button.
- biber-row locator targets the LAM Edit anchor (the username cell
is a plain `<td>`, not a link), then the assertion checks the
`input[name='initials']` value via `toHaveValue` instead of the
body's textContent (the probe lives in the input value).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace the LAM_OAUTH2_FRONTED skip predicate with a branched login
flow: when LAM is fronted by oauth2-proxy/Keycloak, click through the
Keycloak login form with the administrator credentials (already in
LAM's allowed_groups via meta/services.yml), then fall back to LAM's
own admin form only if it still appears post-SSO. Native path
(LAM_OAUTH2_FRONTED=false, lam-public profile with LDAP-bind auth) is
unchanged.
Move adminUsername/adminPassword from _shared.js module scope into
shared.env so the LAM verifier can read them (previously single-
consumer to beforeEach, now multi-consumer).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mirror the nextcloud playwright layout: orchestrator + _shared.js for
multi-consumer logic, one test-*.js per scenario (baseline, ldap-variant,
profile-readonly, keycloak-scope, lam-writethrough, administrator-persona,
guest-persona). Extract the duplicated Account REST middleName-write
into setMiddleNameViaAccountRest in _shared.js, parametrized by
withRestore so keycloak-scope drives the round-trip+restore path and
lam-writethrough drives the write-only path.
Add LAM_OAUTH2_FRONTED to playwright.env.j2 and gate the LAM UI verifier
on it. With web-app-keycloak deployed, LAM is fronted by oauth2-proxy,
its native /templates/login.php is replaced by the Keycloak login page,
and the LDAP-bind admin password is unusable. The Keycloak-side write
is still verified end-to-end by keycloak-scope's main test.
Net diff -20 lines vs. the original monolith despite the new helper.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5