Separate authentication from test setup

Author: BeltranBulbarellaDD

.gitlab-ci.yml

@@ -254,7 +254,6 @@ e2e:
     - yarn build:apps
     # Browsers are pre-installed in the CI image. If playwright (current or pinned 1.40.1)
     # is upgraded without rebuilding the image, this job will crash — rebuild the image to fix it.
-    - if [ "$BROWSER" = "chromium" ]; then node scripts/salesforce-lwc-app.ts auth; fi
     - FORCE_COLOR=1 PW_BROWSER=$BROWSER yarn test:e2e --project=$BROWSER
   after_script:
     - node ./scripts/test/export-test-result.ts e2e

package.json

@@ -15,7 +15,6 @@
     "build": "yarn workspaces foreach --all --parallel --topological-dev run build",
     "build:bundle": "yarn workspaces foreach --all --parallel run build:bundle",
     "build:apps": "node scripts/build/build-test-apps.ts",
-    "salesforce:auth": "node scripts/salesforce-lwc-app.ts auth",
     "salesforce:deploy-app": "yarn workspace @datadog/browser-rum-slim build:bundle && node scripts/salesforce-lwc-app.ts deploy-app",
     "salesforce:get-url": "node scripts/salesforce-lwc-app.ts get-url",
     "build:docs:json": "typedoc --logLevel Verbose --json ./generated-docs.json",

scripts/lib/buildSalesforceLwcUrl.ts

@@ -7,10 +7,10 @@ import { parseArgs } from 'node:util'
 import { printLog, runMain } from './lib/executionUtils.ts'
 import { getSfLwcClientId, getSfLwcInstanceUrl, getSfLwcJwtPrivateKey, getSfLwcUsername } from './lib/secrets.ts'
 import { command } from './lib/command.ts'
-import { buildSalesforceLwcUrl } from './lib/buildSalesforceLwcUrl.ts'
 
 const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..')
 const salesforceAppDir = resolve(repositoryRoot, 'test/apps/sf-lwc-app')
+const salesforceHomePath = '/lightning/app/c__SF_LWC_App/page/home'
 const defaultTargetOrg = 'sf-lwc-ci'
 
 runMain(() => {
@@ -21,9 +21,6 @@ runMain(() => {
         type: 'boolean',
         short: 'h',
       },
-      proxy: {
-        type: 'string',
-      },
     },
   })
 
@@ -32,31 +29,27 @@ runMain(() => {
   }
 
   if (positionals.length !== 1) {
-    throw new Error('Usage: node scripts/salesforce-lwc-app.ts <auth|deploy-app|get-url>')
+    throw new Error('Usage: node scripts/salesforce-lwc-app.ts <deploy-app|get-url>')
   }
 
   const commandName = positionals[0]
 
   switch (commandName) {
-    // Authenticate in the Salesforce CLI.
-    case 'auth':
-      authenticate()
-      break
     // Deploy the app to the Salesforce org. To be done only when the app is updated.
     case 'deploy-app':
       deployApp()
       break
-    // Get the authenticated URL of the app with the RUM configuration.
+    // Get the authenticated URL of the app.
     case 'get-url':
-      process.stdout.write(`with the following URL: ${buildSalesforceLwcUrl(values.proxy)}\n`)
+      process.stdout.write(`${buildSalesforceLwcUrl()}\n`)
       break
     default:
-      throw new Error(`Unknown command "${commandName ?? ''}". Expected: auth|deploy-app|get-url`)
+      throw new Error(`Unknown command "${commandName ?? ''}". Expected: deploy-app|get-url`)
   }
 })
 
 function showUsageAndExit() {
-  console.log('Usage: node scripts/salesforce-lwc-app.ts <auth|deploy-app|get-url> [--proxy <url>]')
+  console.log('Usage: node scripts/salesforce-lwc-app.ts <deploy-app|get-url>')
   process.exit(0)
 }
 
@@ -85,10 +78,41 @@ function authenticate() {
 function deployApp() {
   const targetOrg = process.env.SF_TARGET_ORG ?? defaultTargetOrg
 
+  if (!isOrgAuthenticated(targetOrg)) {
+    authenticate()
+  }
+
   printLog(`Deploying Salesforce LWC app to ${targetOrg}...`)
   command`sf project deploy start --target-org ${targetOrg} --source-dir force-app --ignore-conflicts --concise`
     .withCurrentWorkingDirectory(salesforceAppDir)
     .withLogs()
     .run()
   printLog('Salesforce LWC app deployed.')
 }
+
+function isOrgAuthenticated(targetOrg: string): boolean {
+  try {
+    command`sf org display --target-org ${targetOrg}`.withCurrentWorkingDirectory(salesforceAppDir).run()
+    return true
+  } catch {
+    return false
+  }
+}
+
+function buildSalesforceLwcUrl(): string {
+  const targetOrg = process.env.SF_TARGET_ORG ?? defaultTargetOrg
+  const path = new URL(salesforceHomePath, 'https://salesforce.local')
+
+  const output = command`sf org open --target-org ${targetOrg} --path ${path.pathname}${path.search} --url-only`
+    .withCurrentWorkingDirectory(salesforceAppDir)
+    .run()
+
+  // The sf CLI appends ANSI reset codes (\x1b[39m etc.) directly to the URL on stdout.
+  // Excluding control characters (0x00–0x1f, which includes ESC/0x1b) strips them cleanly.
+  // eslint-disable-next-line no-control-regex
+  const url = output.match(/https:\/\/[^\s\x00-\x1f]+/g)?.at(-1)
+  if (!url) {
+    throw new Error(`Unable to find Salesforce URL in command output:\n${output}`)
+  }
+  return url
+}

scripts/salesforce-lwc-app.ts

@@ -63,16 +63,12 @@ export default class DatadogInit extends NavigationMixin(LightningElement) {
 
   getInitConfiguration(searchParams) {
     return {
-      applicationId: searchParams.get('c__applicationId'),
-      clientToken: searchParams.get('c__clientToken'),
-      env: searchParams.get('c__env'),
-      service: searchParams.get('c__service'),
-      site: searchParams.get('c__site'),
       trackViewsManually: true,
       trackEarlyRequests: true,
       trackLongTasks: true,
       trackResources: true,
       trackUserInteractions: true,
+      ...window.dd_RUM_CONFIGURATION,
       ...this.getQueryInitConfiguration(searchParams),
     }
   }

test/apps/sf-lwc-app/force-app/main/default/lwc/datadogInit/datadogInit.js

@@ -0,0 +1,82 @@
+import { createSign } from 'node:crypto'
+
+import {
+  getSfLwcClientId,
+  getSfLwcInstanceUrl,
+  getSfLwcJwtPrivateKey,
+  getSfLwcUsername,
+} from '../../../../scripts/lib/secrets.ts'
+
+const salesforceHomePath = '/lightning/app/c__SF_LWC_App/page/home'
+
+// The frontdoor.jsp OTP expires in ~1 minute, so the URL must be generated at test time —
+// not at suite startup — to guarantee a valid token when the test actually navigates.
+export async function buildSalesforceLwcUrl(): Promise<string> {
+  const instanceUrl = getSfLwcInstanceUrl()
+  const privateKey = Buffer.from(getSfLwcJwtPrivateKey(), 'base64').toString('utf8')
+  const accessToken = await getAccessToken(getSfLwcClientId(), getSfLwcUsername(), instanceUrl, privateKey)
+
+  const path = new URL(salesforceHomePath, 'https://salesforce.local')
+
+  const response = await fetch(`${instanceUrl}/services/oauth2/singleaccess`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      access_token: accessToken,
+      redirect_uri: `${path.pathname}${path.search}`,
+    }),
+  })
+
+  if (!response.ok) {
+    throw new Error(`UI Bridge API failed (${response.status}): ${await response.text()}`)
+  }
+
+  const json = (await response.json()) as Record<string, string>
+  const frontdoorUri = json['frontdoor_uri']
+  if (!frontdoorUri) {
+    throw new Error('UI Bridge API response missing frontdoor_uri')
+  }
+  return frontdoorUri
+}
+
+async function getAccessToken(
+  clientId: string,
+  username: string,
+  instanceUrl: string,
+  privateKey: string
+): Promise<string> {
+  const header = Buffer.from(JSON.stringify({ alg: 'RS256' })).toString('base64url')
+  const payload = Buffer.from(
+    JSON.stringify({
+      iss: clientId,
+      sub: username,
+      aud: instanceUrl,
+      // JWT expiry is set to 3 minutes — enough to complete the token exchange.
+      exp: Math.floor(Date.now() / 1000) + 180,
+    })
+  ).toString('base64url')
+
+  const sign = createSign('RSA-SHA256')
+  sign.update(`${header}.${payload}`)
+  const jwt = `${header}.${payload}.${sign.sign(privateKey, 'base64url')}`
+
+  const response = await fetch(`${instanceUrl}/services/oauth2/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+      assertion: jwt,
+    }),
+  })
+
+  if (!response.ok) {
+    throw new Error(`Salesforce token request failed (${response.status}): ${await response.text()}`)
+  }
+
+  const json = (await response.json()) as Record<string, string>
+  const accessToken = json['access_token']
+  if (!accessToken) {
+    throw new Error('Salesforce token response missing access_token')
+  }
+  return accessToken
+}

test/e2e/lib/framework/buildSalesforceLwcUrl.ts

@@ -16,14 +16,14 @@ import {
 } from '../helpers/configuration'
 import { validateRumFormat } from '../helpers/validation'
 import type { BrowserConfiguration } from '../../../browsers.conf'
-import { buildSalesforceLwcUrl } from '../../../../scripts/lib/buildSalesforceLwcUrl'
 import {
   NEXTJS_APP_ROUTER_PORT,
   NUXT_APP_PORT,
   NUXT_VUE_ROUTER_V4_APP_PORT,
   VUE_ROUTER_APP_PORT,
   VUE_ROUTER_V4_APP_PORT,
 } from '../helpers/playwright'
+import { buildSalesforceLwcUrl } from './buildSalesforceLwcUrl'
 import { IntakeRegistry } from './intakeRegistry'
 import { flushEvents } from './flushEvents'
 import type { Servers } from './httpServers'
@@ -280,8 +280,8 @@ class TestBuilder {
   withSalesforceApp() {
     this.salesforceApp = true
     this.setups = [{ factory: () => '' }]
-    this.baseUrlHooks.push((baseUrl, servers) => {
-      baseUrl.href = buildSalesforceLwcUrl(servers.datadogHttpApi.origin)
+    this.baseUrlHooks.push(async (baseUrl) => {
+      baseUrl.href = await buildSalesforceLwcUrl()
     })
     return this
   }
@@ -422,7 +422,9 @@ function declareTest(title: string, setupOptions: SetupOptions, factory: SetupFa
 
     const servers = await getTestServers()
     const baseUrl = new URL(servers.base.origin)
-    setupOptions.baseUrlHooks.forEach((hook) => hook(baseUrl, servers, setupOptions))
+    for (const hook of setupOptions.baseUrlHooks) {
+      await hook(baseUrl, servers, setupOptions)
+    }
 
     test.skip(
       baseUrl.hostname.endsWith('.localhost') && isBrowserStack,
@@ -469,6 +471,13 @@ function declareTest(title: string, setupOptions: SetupOptions, factory: SetupFa
           contentType: 'application/javascript',
         })
       })
+
+      await page.addInitScript(
+        `window.dd_RUM_CONFIGURATION = ${JSON.stringify({
+          ...DEFAULT_RUM_CONFIGURATION,
+          proxy: servers.datadogHttpApi.origin,
+        })}`
+      )
     }
 
     await setUpTest(browserLogs, setupOptions, testContext)

test/e2e/lib/framework/createTest.ts

@@ -51,7 +51,7 @@ export interface EventBridgeOptions {
 }
 
 export type SetupFactory = (options: SetupOptions, servers: Servers) => string
-export type UrlHook = (baseUrl: URL, servers: Servers, options: SetupOptions) => void
+export type UrlHook = (baseUrl: URL, servers: Servers, options: SetupOptions) => void | Promise<void>
 
 // By default, run tests only with the 'bundle' setup outside of the CI (to run faster on the
 // developer laptop) or with Browser Stack (to limit flakiness).

test/e2e/lib/framework/pageSetups.ts

@@ -12,7 +12,11 @@ test.use({
 
 createTest('salesforce')
   .withSalesforceApp()
-  .run(async ({ page, intakeRegistry, flushEvents }) => {
+  .run(async ({ page, intakeRegistry, flushEvents, browserName }) => {
+    if (browserName !== 'chromium') {
+      return
+    }
+
     await expect(page.getByTestId('home-custom-actions')).toBeVisible({ timeout: 30000 })
 
     await page.getByTestId('custom-action-1').click()