Merge branch 'per-15315/vitest-event-based-tests' into per-15317/comprehensive-sdk-tests

* per-15315/vitest-event-based-tests:
  test: make rbac useOpa checks opt-in and widen rebac CI budget

Author: zeevmoney

src/tests/e2e/rbac.e2e.spec.ts

@@ -5,6 +5,11 @@ import { UserRead } from '../../openapi';
 import { createTestClient, printBreak } from '../fixtures';
 import { waitForCheck } from '../helpers/wait-for';
 
+// Direct-OPA (`useOpa`) checks require a reachable standalone OPA (port 8181),
+// which the dockerized PDP in CI does not expose. Opt in by setting
+// PERMIT_RUN_OPA_E2E=true when running against an OPA-exposed setup.
+const RUN_OPA_E2E = process.env.PERMIT_RUN_OPA_E2E === 'true';
+
 let permit: IPermitClient;
 let logger: pino.Logger;
 
@@ -199,51 +204,55 @@ it('Permission check e2e test', async () => {
 
     printBreak();
 
-    // use opa directly
-    expect(
-      await permit.check(
-        'auth0|elon',
-        'read',
-        // a 'document' belonging to 'tesla' (ownership based on tenant)
-        { type: 'document', tenant: 'tesla', attributes: resourceAttributes },
-        {},
-        { useOpa: true },
-      ),
-    ).toBe(true);
-
-    printBreak();
-
-    expect(
-      await permit.check(
-        'auth0|elon',
-        'control the usa',
-        // a 'document' belonging to 'tesla' (ownership based on tenant)
-        { type: 'document', tenant: 'tesla', attributes: resourceAttributes },
-        {},
-        { useOpa: true },
-      ),
-    ).toBe(false);
-
-    printBreak();
+    if (RUN_OPA_E2E) {
+      // use opa directly
+      expect(
+        await permit.check(
+          'auth0|elon',
+          'read',
+          // a 'document' belonging to 'tesla' (ownership based on tenant)
+          { type: 'document', tenant: 'tesla', attributes: resourceAttributes },
+          {},
+          { useOpa: true },
+        ),
+      ).toBe(true);
+
+      printBreak();
+
+      expect(
+        await permit.check(
+          'auth0|elon',
+          'control the usa',
+          // a 'document' belonging to 'tesla' (ownership based on tenant)
+          { type: 'document', tenant: 'tesla', attributes: resourceAttributes },
+          {},
+          { useOpa: true },
+        ),
+      ).toBe(false);
+
+      printBreak();
+    }
 
     logger.info('testing positive permission check with complete user object');
     expect(await permit.check(user, 'read', { type: document.key, tenant: tenant.key })).toBe(true);
 
     printBreak();
 
-    // use opa directly
-    logger.info('testing positive permission check with complete user object');
-    expect(
-      await permit.check(
-        user,
-        'read',
-        { type: document.key, tenant: tenant.key },
-        {},
-        { useOpa: true },
-      ),
-    ).toBe(true);
-
-    printBreak();
+    if (RUN_OPA_E2E) {
+      // use opa directly
+      logger.info('testing positive permission check with complete user object');
+      expect(
+        await permit.check(
+          user,
+          'read',
+          { type: document.key, tenant: tenant.key },
+          {},
+          { useOpa: true },
+        ),
+      ).toBe(true);
+
+      printBreak();
+    }
 
     // negative permission check (will be false because a viewer cannot create a document)
     logger.info('testing negative permission check');
@@ -303,18 +312,20 @@ it('Permission check e2e test', async () => {
     expect(await permit.check(user, 'create', { type: document.key, tenant: tenant.key })).toBe(
       true,
     );
-    //use opa directly
-    expect(
-      await permit.check(
-        user,
-        'create',
-        { type: document.key, tenant: tenant.key },
-        {},
-        { useOpa: true },
-      ),
-    ).toBe(true);
-
-    printBreak();
+    if (RUN_OPA_E2E) {
+      //use opa directly
+      expect(
+        await permit.check(
+          user,
+          'create',
+          { type: document.key, tenant: tenant.key },
+          {},
+          { useOpa: true },
+        ),
+      ).toBe(true);
+
+      printBreak();
+    }
   } finally {
     // Leave the shared env empty for the next spec. Each delete is tolerant so a
     // missing entity (e.g. the body threw before creating it) neither throws nor

src/tests/e2e/rebac.e2e.spec.ts

@@ -581,7 +581,7 @@ it('Permission check e2e test', async () => {
           );
           return results.every((res, i) => res === testStep.assertions[i].result);
         },
-        { timeoutMs: 60_000, intervalMs: 1_000, message: 'rebac step did not converge' },
+        { timeoutMs: 150_000, intervalMs: 1_000, message: 'rebac step did not converge' },
       );
       for (const assertion of testStep.assertions) {
         await assertPermitCheck(permit, assertion, testStep.assignments);

vitest.config.ts

@@ -21,8 +21,8 @@ const serialBackend = {
   pool: 'forks' as const,
   maxWorkers: 1,
   isolate: true,
-  testTimeout: 120_000,
-  hookTimeout: 120_000,
+  testTimeout: 300_000,
+  hookTimeout: 300_000,
 };
 
 export default defineConfig({