The shared Playwright config passes --unsafely-treat-insecure-origin-as-secure
for every .onion origin in the environment, but Playwright's default
chrome-headless-shell ignores that switch. On the tor axis the odoo origin
therefore stayed an insecure context: navigator.clipboard was undefined and
Odoo 20's onboarding tour crashed with "Cannot read properties of undefined
(reading 'writeText')" and "Cannot destructure property 'TourInteractive'",
opening error dialogs that the addon specs read as a missing module (odoo#2,
swarm tor, main run 38038541631).
When ODOO_BASE_URL is an onion URL the odoo specs now use channel "chromium",
the full Chromium build in the Playwright image, and block service workers;
clearnet runs keep every option unchanged. The worker is blocked because a
secure context lets Odoo register /web/service-worker.js, whose fetch handler
answers a failed navigation with a cached page or /odoo/offline: gotoOnion
would get a 200 instead of the transport error it retries on. The switch stays
in the role: a use.channel in the shared config would also reach the Firefox
launch of onion-test.js, which rejects it with "Unsupported firefox channel",
and would move every other role's onion run to a browser none of them was
tested on.
Verified with Playwright 1.63 in the runner's staging layout and the real
odoo specs: an onion ODOO_BASE_URL resolves channel "chromium" and
serviceWorkers "block", also for the contexts _shared.js creates itself, and
launches chromium-<rev>/chrome-linux64/chrome; a clearnet one, and HEAD's
specs on onion, keep the headless shell and "allow". All spec files stay on
one worker, which the suite's one-worker test requires. Against Odoo 20's
service worker with a dropped connection, full Chromium returned the cached
/odoo page with status 200, while with the worker blocked page.goto threw
net::ERR_CONNECTION_FAILED as the headless shell does. In the v1.64.0 image
full Chromium made no :443 attempt to an onion host and the onion origin
reported isSecureContext with crypto.subtle, which the headless shell did not.
A local deploy of web-app-odoo variant 2 over Tor ran the odoo suite on
/ms-playwright/chromium-1248/chrome-linux64/chrome and passed all seven addon
specs, the one-worker test and the guest flow without a retry; in the variant
0 round the suites of the other roles kept chrome-headless-shell.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Each of the seven addon specs opened a fresh context and ran the full SSO
round-trip. Over Tor that is roughly twelve minutes apiece, and odoo 0 of run
31340965955 died on 'Test timeout of 600000ms exceeded' inside
gotoOnion -> loginToOdoo -> contacts.spec.js:13.
authenticatedContext caches the storage state after the first login and restores
it for later callers. A restored state that no longer renders the web client is
discarded and the full login runs, so an expired session degrades to today's
behaviour rather than failing the spec.
Coverage is not reduced: the SSO flow keeps its own dedicated tests in
playwright.spec.js:98 and :160 (admin and biber, log in / verify ui / log out),
which this change does not touch. The seven addon logins were repetition of an
already-covered path, and no addon spec asserts anything about the login or
needs an anonymous session. What does change is isolation -- the specs now share
one restored session instead of each starting clean.
The TEST_E2E_PLAYWRIGHT_ONION_TEST_TIMEOUT bump belongs in this commit: four
specs lost their own test.setTimeout(resolveTimeout(180_000)), which resolved to
900s on an onion. Without the bump those four would regress from 900s to 600s.
Cause B is untouched: the global ONION_RUN_TIMEOUT of 5400s left eight tests
unstarted. The cache should relieve it, but that is arithmetic on measured
single-login times, not an observed run, and raising a timeout that spans every
onion role needs its own measurement.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Over Tor the redirect chain behind a login/logout/OIDC click routinely exceeds Playwright's fixed 30s action timeout, so the click throws before the flow's scaled waits run. Sweep all role Playwright suites and the shared persona helpers: give every navigation/auth-transition click an onion-scaled timeout (.click({ timeout: resolveTimeout(30_000) })) and route the remaining raw millisecond literals (timeout options, waitForTimeout, sleep-promise setTimeout, positional wait args) through resolveTimeout. Local UI clicks (menus, toggles, modal dismissals, DOM clicks inside evaluate) stay untouched.
Two new lints keep it that way: test_no_raw_timeout_literals forbids raw numeric timeout literals in Playwright specs (opt-out: nocheck: raw-timeout), test_persona_clicks_scaled requires every click in the shared persona auth flows to carry a resolveTimeout timeout (opt-out: nocheck: unscaled-click).
Verified: node --check on all 133 changed JS files, all 13 playwright lints green, make autoformat clean, make test green (2745+196+163+4 tests OK).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
New lint test_no_raw_goto.py forbids raw `page.goto(...)` in role playwright specs + persona flows (the gotoOnion wrapper in personas/utils is exempt) so navigation retries transient Tor-transport errors over onion. Migrates every raw call across ~75 roles (343 sites) to `gotoOnion(page, ...)` and teaches gotoOnion to detect relative onion URLs (`isOnionCanonical`). gotoOnion is a behaviour-identical drop-in on clearnet (single attempt, same return). Verified: no-raw-goto lint green, eslint 0 errors, make test green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add the global TIMEOUT_FACTOR and a shared timeouts.js helper: resolveTimeout(base) scales by TIMEOUT_FACTOR and, over a .onion target, an extra multiplier, so Tor's per-request latency no longer trips hard-coded timeouts. Migrate every raw timeout in the specs (timeout:/timeout=/setTimeout/waitForTimeout) to resolveTimeout, stage the helper in all three staging paths, and add test_no_raw_timeouts to forbid raw numeric timeouts. Clearnet behaviour is unchanged (factor 1: resolveTimeout(N) === N).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The OIDC/LDAP provisioning writes ir.config_parameter rows (web.base.url,
its freeze flag, signup scope) via direct SQL, which the four running
workers never observe: get_param() is ormcached per worker, so a worker
that auto-detected its base url keeps building OAuth redirect_uris that
Keycloak rejects ("Invalid parameter: redirect_uri") while other workers
serve correct links — the partial addon-spec failures in CI. Restart the
container once after provisioning so every worker boots with the frozen
values, and give the web client the same 120s first-render budget that
openModule already documents for cold asset compilation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Playwright native-login helper clicked the first match of a broad 'form button[type=submit]' selector, which on the website login page non-deterministically resolved to the navbar search button (oe_search_button, type=submit) instead of the Log in button — an unstable element the click waited on until the 180s timeout, making the admin-login addon specs (account/contacts/crm/project/sale_management) flaky. Scope the selector to the login form (form:has(input[name=login])) and target the Log in button by role (getByRole button, name /log in/i).
Diagnosed from the CI error-context page snapshot (navbar search button before the login form) and the run's flaky pass/fail pattern with all failures at the login step; not yet re-run against a live Odoo deploy.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
In the SSO-disabled matrix variant, loginToOdoo waited for the auth_oauth SSO button (which never renders), so every addon spec timed out in clickOdooSsoButton — the run's actual failure (the earlier stock.spec union fix was a no-op there, since stock is addon-gated off in that variant). Branch loginToOdoo on the sso service flag: when SSO is disabled, log in natively via the Odoo /web/login form (input[name=login]/[name=password] with the provisioned administrator credentials, scoped .oe_login_form submit), so the native admin login is genuinely exercised and the addon specs run instead of skipping. When SSO is enabled the existing OIDC/Keycloak flow is unchanged.
Selectors verified against the deployed Odoo 19 login form captured in the CI trace (name=login/password, .oe_login_form button[type=submit]). Admin creds are the same lookup('users','administrator') values provisioned into res_users by tasks/05_admin.yml.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
loginToOdoo treated the OAuth round-trip's URL as proof of login, but the implicit-token round-trip can land back on Odoo without an established session (false positive), and an existing Keycloak realm session bounces straight to an authenticated Odoo without ever showing the login form. Rework: race the issuer URL against the web-client locator, fill the Keycloak form only when it actually appears, then confirm the authenticated desk by waiting for the web client to render (waitFor — the non-waiting isVisible check raced the SPA bootstrap and flaked). Retry twice, then fail loudly. Verified in-container: odoo 10 passed / 0 failed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Odoo bootstraps a per-module web-client asset bundle on first access; under serial Playwright load the first render can exceed a minute. openModule now waits up to 120s for the app shell (90s for navigation) instead of 60s, so the module-UI coupling assertion is not a false negative on a busy instance.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add tests/lint/ansible/services/test_addons_playwright_spec.py requiring roles/<role>/files/playwright/addons/<id>.spec.js for EVERY addon of EVERY role — no mechanism auto-exempt and no # nocheck escape. Ship the 87 per-addon specs (gated via skipUnlessAddonEnabled so they skip cleanly when the addon is disabled in the current variant), the test-e2e-playwright addon-gating harness (addon-gating.js, playwright.config.js, recursive 02_run_one.yml), the shared odoo helper, and the ADDON_<ID>_ENABLED flags in the six playwright.env.j2 templates. Relax test_env_file_schema to skip Jinja-templated keys in the ADDON loop. Doc updates (suppression.md, requirements/026) follow in a separate commit.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5.5