playwright.config.js collects `**/*.@(spec|test).js`, so a module named
test-<something>.js runs only when its role's playwright.spec.js requires it.
Three roles wrote theirs as standalone specs with a top-level test() instead:
the MCP guest guards of n8n and wordpress, and the OIDC login of hermes. All
three have been dead files since they were added, so every MCP surface was
believed to be probed by a hostile guest and hermes' oauth2-proxy round trip
to be covered while none of those assertions had ever executed.
Each moves to the exports.register shape its siblings use and is appended to
its aggregator. Nothing else changes: `git diff -w` on this commit is the
test.use line becoming the register wrapper plus one require per aggregator,
and no assertion is touched. The module-level
test.use({ignoreHTTPSErrors: true}) goes away because all three aggregators
already set it for the tests they register, and a test.use inside register()
would not apply anyway. registerMcpDisabledState moves inside register() so
the switched-off case comes with it, which the addon specs do not cover since
they skip when the addon is off.
Registering them also subjects them to test.beforeEach(shared.beforeEach).
That is safe here: wordpress sets a viewport and asserts env presence, n8n
does the same and clears cookies, hermes is a no-op. None authenticates, so
the guest guards stay guests.
wordpress is the only one of the three with a green job to lose, and its
status assertion is already proven there: addons/mcp-adapter.spec.js posts to
the same endpoint with maxRedirects 0 and asserts >= 400, it matches the
collector glob, and WordPress#1 passes. The permission callback runs at the
transport before the JSON-RPC method is parsed, so initialize is refused
exactly like tools/list.
A fourth dead module, openwebui's test-ollama-chat.js, gates on a service no
role renders and follows separately.
The monolithic spec mixed a CSP baseline, an OIDC round-trip, an RBAC-by-group loop, a Multisite placeholder, a WP→Discourse round-trip, and three persona shims behind ~500 lines of shared Keycloak / WordPress / Discourse helpers. Splits the surface into per-test modules around a `_shared.js` that owns the env asserts, the helper library, and the `beforeEach` setup; the orchestrator is now a 15-line `playwright.spec.js`.
Carries the `test.skip(\!discourseApiKey, …)` gate from the previous commit so a `mode=update apps=<other>` run skips the WP→Discourse test with a self-describing reason instead of racing into a teardown failure.
`lint-playwright` confirms Playwright discovers all 10 tests across 8 files; ESLint clean (only the pre-existing playwright/expect-expect warnings on persona shims, identical to other roles).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
WP 6.3+ renders the block editor inside an `<iframe name="editor-canvas">`,
so the existing top-level `getByRole("textbox", { name: /add title/i })`
no longer reached the title field on freshly-deployed instances and the
Discourse round-trip spec timed out. Now probes the iframe first and
falls back to the top-level locator for older WP versions.
Also pins `wordpress.version` to `7.0.0` so the spec assertion targets
a known compatible editor revision.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
kevinveenbirkenbach
