fix(e2e): isolate the OIDC consent drive and guard the re-save

Claude-Run commented

2026-08-01 00:33:38 +02:00

Member

The setup project failed in e2e run #2175 at global.setup.ts:207 with browserContext.storageState: Target page, context or browser has been closed and a navigating to <redirect_uri> call log, taking all 11 dependent specs with it. The consent drive had just followed /oauth2/authorize straight through to the registered redirect_uri (a mokosh app callback we neither control nor need: the OP records the grant server-side before it 302s, and the code is worthless to setup), and loading that foreign page killed the browser. It is the same BUNYIP-148 chromium death signature the config already documents, now on a page we never needed to render.

Two guards. First, drive consent on a throwaway page in the SAME context: cookies are context-scoped so the grant still lands on the session setup persists, but a renderer death on the callback can no longer reach the page the rest of setup depends on. Verified locally against a fake OP: the Allow POST fires once, crashing the throwaway page's renderer leaves the main page and the context alive, and the post-consent storageState still carries the cookies set during consent. Second, wrap the post-consent re-save: it is best-effort by design (both .auth/ artifacts are written before the consent drive, and consent grants live server-side), so a dead context must warn rather than fail setup. A local repro confirms the exact run #2175 error is catchable.

Stubbing the callback away with page.route was tried and rejected: Playwright 1.60 applies route handlers only to the request that starts a chain, not to the target of a server redirect, so the foreign page loads regardless. That finding is recorded in the code comment and in docs/e2e.md, which also stated that the redirect_uri "is never loaded" - true for the request-context specs, false for the browser-driven setup project.

#BUNYIP-402

The `setup` project failed in e2e run #2175 at `global.setup.ts:207` with `browserContext.storageState: Target page, context or browser has been closed` and a `navigating to <redirect_uri>` call log, taking all 11 dependent specs with it. The consent drive had just followed `/oauth2/authorize` straight through to the registered redirect_uri (a mokosh app callback we neither control nor need: the OP records the grant server-side before it 302s, and the `code` is worthless to setup), and loading that foreign page killed the browser. It is the same BUNYIP-148 chromium death signature the config already documents, now on a page we never needed to render. Two guards. First, drive consent on a throwaway page in the SAME context: cookies are context-scoped so the grant still lands on the session setup persists, but a renderer death on the callback can no longer reach the page the rest of setup depends on. Verified locally against a fake OP: the Allow POST fires once, crashing the throwaway page's renderer leaves the main page and the context alive, and the post-consent `storageState` still carries the cookies set during consent. Second, wrap the post-consent re-save: it is best-effort by design (both `.auth/` artifacts are written before the consent drive, and consent grants live server-side), so a dead context must warn rather than fail setup. A local repro confirms the exact run #2175 error is catchable. Stubbing the callback away with `page.route` was tried and rejected: Playwright 1.60 applies route handlers only to the request that starts a chain, not to the target of a server redirect, so the foreign page loads regardless. That finding is recorded in the code comment and in docs/e2e.md, which also stated that the redirect_uri "is never loaded" - true for the request-context specs, false for the browser-driven setup project. #BUNYIP-402

Claude-Run added 1 commit

2026-08-01 00:33:38 +02:00

fix(e2e): isolate the OIDC consent drive and guard the re-save

E2E PR gate / Install + reachability (no deployment secrets) (pull_request) Successful in 30s

Details

Check / fmt + clippy + build + tests (pull_request) Has been cancelled

Details

b3c580bc45

The `setup` project failed in e2e run #2175 at `global.setup.ts:207` with `browserContext.storageState: Target page, context or browser has been closed` and a `navigating to <redirect_uri>` call log, taking all 11 dependent specs with it. The consent drive had just followed `/oauth2/authorize` straight through to the registered redirect_uri (a mokosh app callback we neither control nor need: the OP records the grant server-side before it 302s, and the `code` is worthless to setup), and loading that foreign page killed the browser. It is the same BUNYIP-148 chromium death signature the config already documents, now on a page we never needed to render.

Two guards. First, drive consent on a throwaway page in the SAME context: cookies are context-scoped so the grant still lands on the session setup persists, but a renderer death on the callback can no longer reach the page the rest of setup depends on. Verified locally against a fake OP: the Allow POST fires once, crashing the throwaway page's renderer leaves the main page and the context alive, and the post-consent `storageState` still carries the cookies set during consent. Second, wrap the post-consent re-save: it is best-effort by design (both `.auth/` artifacts are written before the consent drive, and consent grants live server-side), so a dead context must warn rather than fail setup. A local repro confirms the exact run #2175 error is catchable.

Stubbing the callback away with `page.route` was tried and rejected: Playwright 1.60 applies route handlers only to the request that starts a chain, not to the target of a server redirect, so the foreign page loads regardless. That finding is recorded in the code comment and in docs/e2e.md, which also stated that the redirect_uri "is never loaded" - true for the request-context specs, false for the browser-driven setup project.

#BUNYIP-402

David added 1 commit

2026-08-01 00:57:08 +02:00

Merge branch 'main' into fix/BUNYIP-402-e2e-setup-post-consent-resave

E2E PR gate / Install + reachability (no deployment secrets) (pull_request) Successful in 36s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 24m47s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

bf86b71db0