From 25b593ec3edaeef85f10af1d548d0095fe6c3ed5 Mon Sep 17 00:00:00 2001 From: Niek Otten Date: Wed, 22 Jul 2026 18:05:33 +0200 Subject: [PATCH] test(e2e): isolate the self-service specs with dedicated DigiD users (refs #111) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Resume-on-load (S-26) restores any open registration for the logged-in bsn, so on the shared verify stack the specs can no longer share jan-burger: verify-domain submits as jan-burger (123456782) before the e2e, and that open registration was being resumed on login. Each self-service spec now uses its own citizen — registration→emma-burger, resume→sanne-burger, withdrawal→lars-burger — none touched by the verify-* checks or each other. jan-burger stays the documented citizen for the API-level verify checks. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/synthetic-data.md | 1 + infra/keycloak/realms/digid-realm.json | 30 ++++++++++++++++++++++++++ tests/e2e/registration.spec.ts | 7 ++++-- tests/e2e/resume.spec.ts | 5 ++++- tests/e2e/withdrawal.spec.ts | 4 +++- 5 files changed, 43 insertions(+), 4 deletions(-) diff --git a/docs/synthetic-data.md b/docs/synthetic-data.md index c145825..ccdd538 100644 --- a/docs/synthetic-data.md +++ b/docs/synthetic-data.md @@ -14,6 +14,7 @@ All test users share the password **`test123`**. | Realm | Mimics | User | Identifying claim | |---|---|---|---| | `digid` | DigiD (burgers) | `jan-burger` | `bsn` = `123456782` | +| `digid` | DigiD (burgers) | `sanne-burger` | `bsn` = `231477813` (S-26 resume e2e — its own user so it can leave an open registration) | | `eherkenning` | eHerkenning (bedrijven) | `acme-ondernemer` | `kvk` = `12345678` | | `eidas` | eIDAS (EU) | `pierre-dupont` | `eidas_id` = `FR/NL/AB-1234-5678` | | `medewerker` | Internal staff | `merel-behandelaar` | role `behandelaar` | diff --git a/infra/keycloak/realms/digid-realm.json b/infra/keycloak/realms/digid-realm.json index 28f1c51..1dd6336 100644 --- a/infra/keycloak/realms/digid-realm.json +++ b/infra/keycloak/realms/digid-realm.json @@ -38,6 +38,36 @@ "emailVerified": true, "credentials": [{ "type": "password", "value": "test123", "temporary": false }], "attributes": { "bsn": ["123456782"] } + }, + { + "username": "sanne-burger", + "enabled": true, + "firstName": "Sanne", + "lastName": "Burger", + "email": "sanne.burger@example.nl", + "emailVerified": true, + "credentials": [{ "type": "password", "value": "test123", "temporary": false }], + "attributes": { "bsn": ["231477813"] } + }, + { + "username": "emma-burger", + "enabled": true, + "firstName": "Emma", + "lastName": "Burger", + "email": "emma.burger@example.nl", + "emailVerified": true, + "credentials": [{ "type": "password", "value": "test123", "temporary": false }], + "attributes": { "bsn": ["231477805"] } + }, + { + "username": "lars-burger", + "enabled": true, + "firstName": "Lars", + "lastName": "Burger", + "email": "lars.burger@example.nl", + "emailVerified": true, + "credentials": [{ "type": "password", "value": "test123", "temporary": false }], + "attributes": { "bsn": ["231477821"] } } ] } diff --git a/tests/e2e/registration.spec.ts b/tests/e2e/registration.spec.ts index 8274ecb..5a767bf 100644 --- a/tests/e2e/registration.spec.ts +++ b/tests/e2e/registration.spec.ts @@ -13,8 +13,11 @@ test('DigiD submit → public INGEDIEND → documenten → behandelaar goedkeurt // Visiting the guarded page redirects to the Keycloak (mock DigiD) login. await page.goto('/'); - // Keycloak's default login form (stable ids across themes). - await page.locator('#username').fill('jan-burger'); + // Keycloak's default login form (stable ids across themes). Its own DigiD user: the verify-* API + // checks submit as jan-burger (bsn 123456782) before the e2e runs on the shared stack, and + // resume-on-load (S-26) would otherwise restore one of those on login — so each self-service spec + // uses a dedicated citizen no other actor touches. + await page.locator('#username').fill('emma-burger'); await page.locator('#password').fill('test123'); await page.locator('#kc-login').click(); diff --git a/tests/e2e/resume.spec.ts b/tests/e2e/resume.spec.ts index a5f279d..cf749e0 100644 --- a/tests/e2e/resume.spec.ts +++ b/tests/e2e/resume.spec.ts @@ -6,7 +6,10 @@ import { expect, test } from '@playwright/test'; test('DigiD submit → reload → self-service restores the existing registration', async ({ page }) => { await page.goto('/'); - await page.locator('#username').fill('jan-burger'); + // Its own DigiD user (like every self-service spec): on the shared verify stack, resume-on-load + // (S-26) restores any open registration for the bsn, so each spec uses a dedicated citizen that no + // other spec or verify-* check touches. This one in particular leaves an open registration. + await page.locator('#username').fill('sanne-burger'); await page.locator('#password').fill('test123'); await page.locator('#kc-login').click(); diff --git a/tests/e2e/withdrawal.spec.ts b/tests/e2e/withdrawal.spec.ts index 7b8336f..a13d8f1 100644 --- a/tests/e2e/withdrawal.spec.ts +++ b/tests/e2e/withdrawal.spec.ts @@ -8,7 +8,9 @@ test('DigiD submit → trek aanvraag in → self-service confirms ingetrokken', // Visiting the guarded page redirects to the Keycloak (mock DigiD) login. await page.goto('/'); - await page.locator('#username').fill('jan-burger'); + // Its own DigiD user — isolated from the verify-* checks (jan-burger/123456782) so resume-on-load + // (S-26) can't restore someone else's registration on the shared stack. + await page.locator('#username').fill('lars-burger'); await page.locator('#password').fill('test123'); await page.locator('#kc-login').click();