fix(integration): bypass flaky LXD SSO button click

Author: terion-labs

tests/integration/assertions/browser.test.ts

@@ -10,7 +10,8 @@ import {
   isRetryableBlankNavigationError,
   isLoginOrOauthCallbackPlumbingPath,
   isTargetApplicationPage,
-  isTargetLoginOrOauthPlumbingPage
+  isTargetLoginOrOauthPlumbingPage,
+  lxdOidcLoginUrlForSsoPage
 } from "./browser";
 
 describe("browser assertion helpers", () => {
@@ -49,6 +50,24 @@ describe("browser assertion helpers", () => {
     expect(isIdentityLoginInputPage("https://app.example.test/protected", "app.example.test")).toBe(true);
   });
 
+  test("derives the direct LXD OIDC login endpoint from the SSO page", () => {
+    expect(
+      lxdOidcLoginUrlForSsoPage(
+        "https://lxd.example.test/ui/login",
+        "Canonical LXD\nLogin with SSO\nSet up TLS login",
+        "lxd.example.test"
+      )
+    ).toBe("https://lxd.example.test/oidc/login");
+    expect(lxdOidcLoginUrlForSsoPage("https://lxd.example.test/ui/login", "Canonical LXD", "lxd.example.test")).toBeUndefined();
+    expect(
+      lxdOidcLoginUrlForSsoPage(
+        "https://auth.example.test/ui/v2/login/loginname",
+        "Canonical LXD\nLogin with SSO",
+        "lxd.example.test"
+      )
+    ).toBeUndefined();
+  });
+
   test("makes browser artifact names distinct by URL, expectation, user, and outcome", () => {
     const allowPath = browserScreenshotPath("/tmp/out", "https://app.example.test/protected", "allowed@example.test", "allow", "success");
     const denyPath = browserScreenshotPath("/tmp/out", "https://app.example.test/protected", "denied@example.test", "deny", "success");

tests/integration/assertions/browser.ts

@@ -157,6 +157,43 @@ async function inputVisible(page: Page, selectors: readonly string[]): Promise<b
   return false;
 }
 
+async function firstIdentityInput(page: Page, selectors: readonly string[], targetHost: string): Promise<string> {
+  const deadline = Date.now() + BROWSER_WAIT_TIMEOUT_MS;
+  let lastBody = "";
+
+  while (Date.now() < deadline) {
+    const currentUrl = page.url();
+    if (isTargetLoginOrOauthPlumbingPage(currentUrl, targetHost)) {
+      await clickOidcStartIfNeeded(page, targetHost);
+    }
+
+    if (isIdentityLoginInputPage(page.url(), targetHost)) {
+      for (const selector of selectors) {
+        const locator = page.locator(selector).first();
+        if (await locatorVisible(locator)) {
+          return selector;
+        }
+      }
+    }
+
+    if (await reloadBlankLoginDocumentIfNeeded(page)) {
+      await page.waitForTimeout(1000);
+      continue;
+    }
+
+    lastBody = (await maybeWithTimeout(page.locator("body").innerText({ timeout: 1000 }).catch(() => ""), 2000)) ?? "";
+    await page.waitForTimeout(500);
+  }
+
+  throw new Error(
+    [
+      `none of the identity selectors were visible: ${selectors.join(", ")}`,
+      `current URL: ${page.url()}`,
+      `body:\n${bodySnippetForError(lastBody) || "<empty>"}`
+    ].join("\n")
+  );
+}
+
 async function clickOidcStartIfNeeded(page: Page, targetHost: string): Promise<void> {
   const deadline = Date.now() + BROWSER_OIDC_START_TIMEOUT_MS;
   let reloadedBlankTargetLoginPage = false;
@@ -184,6 +221,14 @@ async function clickOidcStartIfNeeded(page: Page, targetHost: string): Promise<v
       continue;
     }
 
+    const lxdOidcLoginUrl = lxdOidcLoginUrlForSsoPage(page.url(), lastBody, targetHost);
+    if (lxdOidcLoginUrl && Date.now() - lastStartClick > BROWSER_OIDC_RECLICK_INTERVAL_MS) {
+      lastStartClick = Date.now();
+      await maybeWithTimeout(page.goto(lxdOidcLoginUrl, { waitUntil: "commit", timeout: BROWSER_CLICK_TIMEOUT_MS }).catch(() => undefined), 12000);
+      await waitForOidcStartHandoff(page, targetHost);
+      continue;
+    }
+
     const startSelectors = [
       'button:has-text("Login with SSO")',
       'a:has-text("Login with SSO")',
@@ -801,7 +846,7 @@ async function loginThroughZitadelWithBrowser(
         stage = "waiting for identity login document";
         await waitForIdentityLoginDocument(page, targetHost);
         stage = "waiting for username input";
-        const emailSelector = await firstVisible(page, [...USERNAME_INPUT_SELECTORS]);
+        const emailSelector = await firstIdentityInput(page, USERNAME_INPUT_SELECTORS, targetHost);
         stage = "entering username";
         await typeInto(page, emailSelector, user.email);
         stage = "waiting for username submit";
@@ -1180,6 +1225,20 @@ export function isIdentityLoginInputPage(currentUrl: string, targetHost: string)
   return Boolean(parsed && !(parsed.host === targetHost && isLoginOrOauthCallbackPlumbingPath(parsed.pathname)));
 }
 
+export function lxdOidcLoginUrlForSsoPage(currentUrl: string, body: string, targetHost: string): string | undefined {
+  const parsed = parseBrowserUrl(currentUrl);
+  if (!parsed || parsed.host !== targetHost || !parsed.pathname.toLowerCase().startsWith("/ui/login")) {
+    return undefined;
+  }
+
+  const normalizedBody = body.toLowerCase();
+  if (!normalizedBody.includes("login with sso") || !normalizedBody.includes("canonical lxd")) {
+    return undefined;
+  }
+
+  return `${parsed.origin}/oidc/login`;
+}
+
 export function formatDeniedTargetRouteFailure(finalUrl: string, body: string): string {
   return [
     "expected denied protected route to show a denial page, but the browser reached the target host without denial text",