ConusAI vendor v0.1.0-beta.114

e2e/shell.spec.ts

@@ -0,0 +1,628 @@
+// SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
+// The shell in a browser (plan item AT4.4): sign-in and its error states, the invitation link in every
+// state it can be in, the organization switcher, the workspace and project pages, the 403 and 404
+// pages (and that a stranger cannot tell a missing organization from one they are not in), the
+// language and theme controls, and the demo data `pnpm dev` writes. Each screen passes axe, in
+// English, and the ones that carry words of their own also in Lithuanian.
+
+import { type Browser, type BrowserContext, expect, type Page, test } from "@playwright/test"
+import { moduleSelected } from "../modules/inclusion"
+import { call, makeOrganization, openScope, platformState, signIn, unique, violations } from "./support/app"
+
+const base = `http://127.0.0.1:${process.env.E2E_WEB_PORT ?? 3100}`
+
+async function chooseShellOption(page: Page, label: string, option: string): Promise<void> {
+  await page.getByRole("button", { name: new RegExp(`${label}$`) }).click()
+  await page.getByRole("option", { name: option, exact: true }).click()
+}
+
+/** A browser of its own, so two people can be signed in at once. */
+async function person(browser: Browser, email: string): Promise<{ page: Page; context: BrowserContext }> {
+  const context = await browser.newContext({ baseURL: base })
+  const page = await context.newPage()
+  await signIn(page, email)
+  return { page, context }
+}
+
+/** The alerts of the page's own content, where the shell and the sign-in page put them. */
+const alerts = (page: Page) => page.getByRole("alert")
+
+const mainText = (page: Page): Promise<string> => page.locator("main").innerText()
+
+test("the sign-in page offers the way in, words each failure in the person's language, and passes axe", async ({
+  page,
+}) => {
+  await page.goto("/auth/sign-in")
+  await expect(page.getByRole("heading", { level: 1, name: "Sign in" })).toBeVisible()
+  await expect(alerts(page)).toHaveCount(0)
+  expect(await violations(page)).toEqual([])
+
+  for (const [code, words] of [
+    ["denied", /The identity provider did not let you in/],
+    ["noTransaction", /was not started in this browser/],
+    ["sessionExpired", /Your session has ended/],
+    ["provider", /could not complete the sign-in/],
+    ["failed", /Signing in did not work/],
+  ] as const) {
+    await page.goto(`/auth/sign-in?error=${code}`)
+    await expect(alerts(page)).toContainText(words)
+  }
+  expect(await violations(page)).toEqual([])
+
+  // Only the five words are ever shown: a code from a URL is not text to print.
+  await page.goto("/auth/sign-in?error=%3Cscript%3Ealert(1)%3C/script%3E")
+  await expect(alerts(page)).toHaveCount(0)
+
+  // In Lithuanian, with the same structure.
+  await page.goto("/auth/sign-in?error=denied")
+  await page.getByRole("group", { name: "Language" }).getByRole("button", { name: "Lietuvių" }).click()
+  await expect(page.getByRole("heading", { level: 1, name: "Prisijungimas" })).toBeVisible()
+  await expect(alerts(page)).toContainText("Tapatybės teikėjas jūsų neįleido")
+  expect(await violations(page)).toEqual([])
+})
+
+test("the privacy choices leave a first visit's sign-in form reachable, by pointer and by keyboard", async ({
+  browser,
+}) => {
+  for (const viewport of [
+    { width: 1280, height: 720 },
+    { width: 390, height: 844 },
+  ]) {
+    const context = await browser.newContext({ baseURL: base, viewport })
+    const page = await context.newPage()
+    await page.goto("/auth/sign-in")
+    await expect(page.getByRole("region", { name: "Privacy choices" })).toBeVisible()
+
+    // Tabbing to the field and to the button brings each out from under the choices (WCAG 2.2, 2.4.11).
+    for (const control of [
+      page.getByLabel("E-mail address"),
+      page.getByRole("main").getByRole("button", { name: "Sign in" }),
+    ]) {
+      await control.focus()
+      const hit = await control.evaluate((element) => {
+        const box = element.getBoundingClientRect()
+        return document.elementFromPoint(box.left + box.width / 2, box.top + box.height / 2) === element
+      })
+      expect(hit, `${viewport.width}x${viewport.height}`).toBe(true)
+    }
+
+    // And nobody has to answer before they sign in.
+    await page.getByLabel("E-mail address").fill("ada@example.test")
+    await page.getByRole("main").getByRole("button", { name: "Sign in" }).click()
+    await expect(page).not.toHaveURL(/\/auth\/sign-in/)
+    await context.close()
+  }
+})
+
+test("a privacy choice applies in place; only a new yes to session replay takes a new document", async ({
+  browser,
+}) => {
+  const context = await browser.newContext({ baseURL: base })
+  const page = await context.newPage()
+  await page.goto("/auth/sign-in")
+  const choices = page.getByRole("region", { name: "Privacy choices" })
+  const mark = () =>
+    page.evaluate(() => {
+      ;(window as { sameDocument?: boolean }).sameDocument = true
+    })
+  const sameDocument = () => page.evaluate(() => (window as { sameDocument?: boolean }).sameDocument === true)
+
+  // No: the observer is told at once, the banner closes, and the document stays.
+  await mark()
+  await choices.getByRole("button", { name: "Reject analytics and replay" }).click()
+  await expect(choices).toHaveCount(0)
+  expect(await sameDocument()).toBe(true)
+
+  // Yes to analytics alone: the same.
+  await page.getByRole("button", { name: "Privacy choices" }).click()
+  await choices.getByRole("button", { name: "Accept analytics" }).click()
+  await expect(choices).toHaveCount(0)
+  expect(await sameDocument()).toBe(true)
+
+  // Yes to replay, which loads only with the observer at a document's start.
+  await page.getByRole("button", { name: "Privacy choices" }).click()
+  await choices.getByRole("checkbox", { name: /Also allow session replay/ }).check()
+  await Promise.all([page.waitForEvent("load"), choices.getByRole("button", { name: "Accept analytics" }).click()])
+  expect(await sameDocument()).toBe(false)
+  await context.close()
+})
+
+test("the document says when it is interactive: the server never does, the browser does once hydrated", async ({
+  page,
+}) => {
+  // A press before React hydrates is lost (a tab stays unselected), so a test waits for this (`ready` of support/app).
+  const served = await (await page.request.get("/auth/sign-in")).text()
+  expect(served).not.toContain("data-hydrated")
+  await page.goto("/auth/sign-in")
+  await expect(page.locator("html")).toHaveAttribute("data-hydrated", "true")
+})
+
+test("a failed sign-in ends at the sign-in page with a reason, never at a 500", async ({ page }) => {
+  // The provider says no.
+  const denied = await page.request.get("/auth/callback?error=access_denied&error_description=secret+words", {
+    maxRedirects: 0,
+  })
+  expect(denied.status()).toBe(302)
+  expect(denied.headers().location).toBe("/auth/sign-in?error=denied")
+  // A callback no sign-in in this browser started.
+  const orphan = await page.request.get("/auth/callback?code=abc&state=xyz", { maxRedirects: 0 })
+  expect(orphan.status()).toBe(302)
+  // (this stack has no identity provider, so there is nothing a callback could complete)
+  expect(orphan.headers().location).toBe("/auth/sign-in?error=failed")
+  // An address the dev sign-in will not take.
+  const bad = await page.request.get("/auth/dev-login?email=nobody", { maxRedirects: 0 })
+  expect(bad.status()).toBe(302)
+  expect(bad.headers().location).toBe("/auth/sign-in?error=failed")
+})
+
+test("an address that needs a person is sent to sign in and brought back, whoever it names", async ({ page }) => {
+  await page.goto("/acme-review/general")
+  await expect(page).toHaveURL(/\/auth\/sign-in\?return_to=%2Facme-review%2Fgeneral$/)
+  await page.getByLabel("E-mail address").fill("ada@example.test")
+  await page.getByRole("button", { name: "Sign in" }).click()
+  await expect(page).toHaveURL(/\/acme-review\/general$/)
+  await expect(page.getByRole("heading", { level: 1, name: "Workspace General" })).toBeVisible()
+  // A return address outside this app is not followed.
+  const away = await page.request.get("/auth/dev-login?email=ada@example.test&return_to=https://evil.example/", {
+    maxRedirects: 0,
+  })
+  expect(away.headers().location).toBe("/")
+})
+
+test("the demo data: two organizations, one with a tenant brand, and the switcher between them", async ({
+  page,
+}, testInfo) => {
+  await signIn(page, "ada@example.test")
+  await page.goto("/")
+  await expect(page.getByRole("link", { name: "Acme Review" })).toBeVisible()
+  await expect(page.getByRole("link", { name: "Northwind Traders" })).toBeVisible()
+  await page.screenshot({ path: testInfo.outputPath("organization-chooser.png") })
+  await page.getByRole("link", { name: "Acme Review", exact: true }).press("Enter")
+  await expect(page).toHaveURL(/\/acme-review$/)
+
+  await page.goto("/acme-review")
+  await expect(page.locator("[data-tenant-brand]")).toHaveCount(0)
+  expect(await violations(page)).toEqual([])
+
+  await openScope(page)
+  await page.getByRole("menuitemradio", { name: "Northwind Traders" }).click()
+  await expect(page).toHaveURL(/\/northwind$/)
+  await expect(page.locator('[data-tenant-brand="#1a1a8c"]')).toHaveCount(1)
+  await expect(page.locator('[data-guide="frame.scope"]')).toContainText("Northwind")
+  expect(await violations(page)).toEqual([])
+
+  // A menu is a portal, and it keeps the organization's colours.
+  await openScope(page)
+  const menu = page.getByRole("menu")
+  await expect(menu).toBeVisible()
+  const primary = await menu.evaluate((element) => getComputedStyle(element).getPropertyValue("--primary"))
+  const root = await page.evaluate(() => getComputedStyle(document.documentElement).getPropertyValue("--primary"))
+  expect(primary.trim()).not.toBe(root.trim())
+  await page.keyboard.press("Escape")
+
+  // Linus is in one organization only: nothing to switch between.
+  const linus = await person(page.context().browser() as Browser, "linus@example.test")
+  await linus.page.goto("/acme-review")
+  await expect(linus.page.getByLabel("Switch organization")).toHaveCount(0)
+  await linus.context.close()
+})
+
+test("the browser can initialize MCP, list exactly the opted-in tools, and call the scoped note-list tool", async ({
+  page,
+}) => {
+  await signIn(page, "ada@example.test")
+  const scope = await makeOrganization(page, "mcp")
+  const csrf = await page.locator('meta[name="csrf-token"]').getAttribute("content")
+  const headers = {
+    "content-type": "application/json",
+    accept: "application/json, text/event-stream",
+    "x-csrf-token": csrf ?? "",
+    "sec-fetch-site": "same-origin",
+    "mcp-protocol-version": "2025-11-25",
+  }
+  const rpcBody = async (response: Awaited<ReturnType<typeof page.request.post>>) => {
+    const text = await response.text()
+    if (response.headers()["content-type"]?.includes("text/event-stream")) {
+      const data = text.split("\n").find((line) => line.startsWith("data: "))
+      if (!data) throw new Error("MCP response had no event data")
+      return JSON.parse(data.slice("data: ".length))
+    }
+    return JSON.parse(text)
+  }
+
+  const initialize = await page.request.post("/api/mcp", {
+    headers,
+    data: {
+      jsonrpc: "2.0",
+      id: 1,
+      method: "initialize",
+      params: {
+        protocolVersion: "2025-11-25",
+        capabilities: {},
+        clientInfo: { name: "app-template-browser-e2e", version: "1.0.0" },
+      },
+    },
+  })
+  expect(initialize.status()).toBe(200)
+  expect((await rpcBody(initialize)).result.protocolVersion).toBe("2025-11-25")
+
+  const listed = await page.request.post("/api/mcp", { headers, data: { jsonrpc: "2.0", id: 2, method: "tools/list" } })
+  const tools = (await rpcBody(listed)).result.tools as Array<{ name: string }>
+  expect(listed.status()).toBe(200)
+  // Exactly the procedures whose contract opts in with `.tool()` (docs/reference/app-kit.md), in registry
+  // order: the notes list, Knowledge retrieval, Agent run status and its workspace reads, and Support's
+  // project processing status (the S2.6 reference tool, selected in the e2e app), which opt in on purpose;
+  // no other read or write of any module (test/mcp.test.ts asserts the list with only Agent and Knowledge selected).
+  expect(tools.map((tool) => tool.name)).toEqual([
+    "agent.run.status",
+    "assistant.workspace.openProject",
+    "assistant.workspace.projects",
+    "knowledge.search",
+    "notes.note.list",
+    "support.projectProcessingStatus.get", // kit:support
+  ])
+
+  const called = await page.request.post("/api/mcp", {
+    headers,
+    data: {
+      jsonrpc: "2.0",
+      id: 3,
+      method: "tools/call",
+      params: { name: "notes.note.list", arguments: scope },
+    },
+  })
+  expect(called.status()).toBe(200)
+  expect((await rpcBody(called)).result).toMatchObject({
+    structuredContent: { notes: [], hasMore: false },
+  })
+
+  const refused = await page.request.post("/api/mcp", {
+    headers,
+    data: { jsonrpc: "2.0", id: 4, method: "tools/call", params: { name: "notes.note.create", arguments: {} } },
+  })
+  expect((await rpcBody(refused)).error.code).toBe(-32602)
+})
+
+test("MCP enforces the real session, CSRF token, and tenant scope at its HTTP boundary", async ({ browser }) => {
+  const owner = await person(browser, `${unique("mcp-owner")}@example.test`)
+  const foreign = await makeOrganization(owner.page, "mcp-private")
+  const secret = unique("tenant-private-note")
+  await call(owner.page, "notes.note.create", { ...foreign, title: "Private note", body: secret })
+
+  const noSession = await browser.newContext({ baseURL: base })
+  const anonymous = await noSession.newPage()
+  const requestBody = (id: number, method: string, params?: unknown) => ({
+    jsonrpc: "2.0",
+    id,
+    method,
+    ...(params === undefined ? {} : { params }),
+  })
+  const noAuth = await anonymous.request.post("/api/mcp", {
+    headers: { "content-type": "application/json", accept: "application/json, text/event-stream" },
+    data: requestBody(1, "initialize"),
+  })
+  expect(noAuth.status()).toBe(401)
+  await noSession.close()
+
+  const csrf = await owner.page.locator('meta[name="csrf-token"]').getAttribute("content")
+  const initialized = await owner.page.request.post("/api/mcp", {
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream",
+      "sec-fetch-site": "same-origin",
+      "x-csrf-token": csrf ?? "",
+      "mcp-protocol-version": "2025-11-25",
+    },
+    data: requestBody(2, "initialize", {
+      protocolVersion: "2025-11-25",
+      capabilities: {},
+      clientInfo: { name: "app-template-security-e2e", version: "1.0.0" },
+    }),
+  })
+  expect(initialized.status()).toBe(200)
+
+  const withoutCsrf = await owner.page.request.post("/api/mcp", {
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream",
+      "sec-fetch-site": "same-origin",
+      "mcp-protocol-version": "2025-11-25",
+    },
+    data: requestBody(3, "tools/list"),
+  })
+  expect(withoutCsrf.status()).toBe(403)
+
+  const stranger = await person(browser, `${unique("mcp-stranger")}@example.test`)
+  const strangerCsrf = await stranger.page.locator('meta[name="csrf-token"]').getAttribute("content")
+  const crossTenant = await stranger.page.request.post("/api/mcp", {
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream",
+      "sec-fetch-site": "same-origin",
+      "x-csrf-token": strangerCsrf ?? "",
+      "mcp-protocol-version": "2025-11-25",
+    },
+    data: requestBody(4, "tools/call", {
+      name: "notes.note.list",
+      arguments: foreign,
+    }),
+  })
+  expect(crossTenant.status()).toBe(200)
+  const responseText = await crossTenant.text()
+  const event = responseText.split("\n").find((line) => line.startsWith("data: "))
+  const rpcResponse = crossTenant.headers()["content-type"]?.includes("text/event-stream")
+    ? event?.slice("data: ".length)
+    : responseText
+  expect(rpcResponse).toBeDefined()
+  const result = JSON.parse(rpcResponse ?? "null") as {
+    result?: { isError?: boolean; content?: Array<{ text?: string }>; structuredContent?: unknown }
+  }
+  expect(result.result?.isError).toBe(true)
+  expect(JSON.stringify(result)).not.toContain(secret)
+  expect(JSON.stringify(result.result?.structuredContent ?? null)).not.toContain(secret)
+  expect(result.result?.content?.[0]?.text).toBe("The tool request was refused.")
+
+  await owner.context.close()
+  await stranger.context.close()
+})
+
+test("a stranger cannot tell an organization that is not theirs from one that does not exist", async ({ browser }) => {
+  const { page, context } = await person(browser, `${unique("stranger")}@example.test`)
+  const seen: Array<{ status: number; text: string }> = []
+  for (const path of ["/acme-review", "/no-such-organization", "/acme-review/general/demo", "/northwind/general"]) {
+    const response = await page.goto(path)
+    seen.push({ status: response?.status() ?? 0, text: await mainText(page) })
+  }
+  expect(seen.map((entry) => entry.status)).toEqual([404, 404, 404, 404])
+  expect(new Set(seen.map((entry) => entry.text)).size).toBe(1)
+  expect(seen[0]?.text).toContain("Page not found")
+  await expect(page.locator('[data-slot="app-state"] [data-slot="empty"]')).toBeVisible()
+  await expect(page.locator(".app-shell-header")).toBeHidden()
+  await expect(page.getByRole("link", { name: "Back to the start" })).toBeVisible()
+  expect(await violations(page)).toEqual([])
+  await context.close()
+})
+
+test("a member whose role does not allow a page gets a 403 and no link to it", async ({ browser }) => {
+  const { page, context } = await person(browser, "linus@example.test")
+  for (const path of ["/acme-review/settings", "/acme-review/audit"]) {
+    const response = await page.goto(path)
+    expect(response?.status(), path).toBe(403)
+    await expect(page.getByRole("heading", { level: 1, name: "You do not have access" })).toBeVisible()
+  }
+  expect(await violations(page)).toEqual([])
+  await page.goto("/acme-review")
+  await expect(page.getByRole("link", { name: "Audit" })).toHaveCount(0)
+  // The members page shows a viewer the list and none of the controls.
+  await page.goto("/acme-review/members")
+  await expect(page.getByRole("heading", { level: 2, name: "Members" })).toBeVisible()
+  await expect(page.getByRole("heading", { name: "Invite" })).toHaveCount(0)
+  await context.close()
+})
+
+test("an organization, a workspace and a project are made from the pages, and each page passes axe", async ({
+  browser,
+}) => {
+  const { page, context } = await person(browser, `${unique("founder")}@example.test`)
+  const slug = unique("studio")
+
+  await page.goto("/onboarding")
+  await page.getByLabel("Organization name", { exact: true }).fill("Studio")
+  await page.getByLabel("Address", { exact: true }).fill(slug)
+  await page.getByRole("button", { name: "Continue", exact: true }).click()
+  await expect(page).toHaveURL(new RegExp(`/${slug}/general$`))
+  expect(await violations(page)).toEqual([])
+
+  await page.goto(`/${slug}/workspaces`)
+  await expect(page.getByRole("heading", { level: 2, name: "Workspaces" })).toBeVisible()
+  await page.locator('[data-slot="app-frame"]').evaluate((frame) => {
+    ;(frame as HTMLElement & { keptDuringCreate?: boolean }).keptDuringCreate = true
+  })
+  await page.getByRole("button", { name: "Create a workspace", exact: true }).click()
+  await page.getByLabel("Name", { exact: true }).fill("Research")
+  await page.getByLabel("Short name").fill("research")
+  await page.getByRole("button", { name: "Create", exact: true }).click()
+  await expect(page.getByRole("link", { name: "Research" })).toBeVisible()
+  expect(
+    await page
+      .locator('[data-slot="app-frame"]')
+      .evaluate((frame) => (frame as HTMLElement & { keptDuringCreate?: boolean }).keptDuringCreate),
+  ).toBe(true)
+  expect(await violations(page)).toEqual([])
+
+  // A workspace cannot take the name of a page of the shell.
+  await page.getByRole("button", { name: "Create a workspace", exact: true }).click()
+  await page.getByLabel("Name", { exact: true }).fill("Members")
+  await page.getByLabel("Short name").fill("members")
+  await page.getByRole("button", { name: "Create", exact: true }).click()
+  await expect(alerts(page)).toContainText("reserved")
+
+  await page.goto(`/${slug}/research`)
+  await expect(page.getByRole("heading", { level: 1, name: "Workspace Research" })).toBeVisible()
+  await expect(page.getByText("There are no projects in this workspace yet.")).toBeVisible()
+  await page.locator('[data-slot="app-frame"]').evaluate((frame) => {
+    ;(frame as HTMLElement & { keptDuringCreate?: boolean }).keptDuringCreate = true
+  })
+  await page.getByRole("button", { name: "Create a project", exact: true }).click()
+  await page.getByLabel("Name", { exact: true }).fill("Field notes")
+  await page.getByLabel("Short name").fill("field-notes")
+  await page.getByRole("button", { name: /Module/ }).click()
+  await page.getByRole("option", { name: "notes" }).click()
+  await page.getByRole("button", { name: "Create", exact: true }).click()
+  await expect(page.locator('[data-slot="form-panel"]')).toHaveCount(0)
+  expect(
+    await page
+      .locator('[data-slot="app-frame"]')
+      .evaluate((frame) => (frame as HTMLElement & { keptDuringCreate?: boolean }).keptDuringCreate),
+  ).toBe(true)
+  await page.getByRole("link", { name: "Field notes" }).click()
+
+  await expect(page).toHaveURL(new RegExp(`/${slug}/research/field-notes$`))
+  await expect(page.getByRole("heading", { level: 1, name: "Project Field notes" })).toBeVisible()
+  // The project's sections are links in the sidebar, after the project picker.
+  const sidebar = page.getByRole("navigation", { name: "Main navigation" })
+  await expect(sidebar.getByRole("link", { name: "Notes", exact: true })).toBeVisible()
+  await expect(sidebar.getByRole("link", { name: "Notes", exact: true })).toHaveAttribute(
+    "href",
+    new RegExp(`/${slug}/research/field-notes/notes$`),
+  )
+  await expect(sidebar.getByRole("link", { name: "Documents" })).toHaveCount(moduleSelected("documents") ? 1 : 0)
+  await expect(page.getByRole("navigation", { name: "Breadcrumb" })).toBeVisible()
+  expect(await violations(page)).toEqual([])
+  await context.close()
+})
+
+test("an invitation: made from Members with a copyable link, opened signed out, joined into the workspace, and every other state worded", async ({
+  browser,
+}) => {
+  const owner = await person(browser, `${unique("owner")}@example.test`)
+  // An address of this run's own, so the case passes on a database an earlier run used.
+  const invited = `${unique("invited")}@example.test`
+  const slug = unique("guild")
+  await call(owner.page, "tenancy.org.create", { slug, name: "Guild" })
+
+  // Settings > Members: the address and the role, and the link at once, with Copy and when it stops working.
+  await owner.page.context().grantPermissions(["clipboard-read", "clipboard-write"])
+  await owner.page.goto(`/${slug}/members`)
+  await owner.page.getByLabel("E-mail address").fill(invited)
+  await owner.page.getByRole("button", { name: "Invite", exact: true }).click()
+  await expect(owner.page.getByText(`${invited} is invited. Send them this link:`)).toBeVisible()
+  await expect(owner.page.getByText(`It works once, for ${invited} only, until`, { exact: false })).toBeVisible()
+  const link = await owner.page.getByLabel("Invitation link").inputValue()
+  expect(link).toMatch(new RegExp(`/invitations/${slug}/[A-Za-z0-9_-]{20,}$`))
+  await owner.page.getByRole("button", { name: "Copy link" }).click()
+  await expect(owner.page.getByText("The link is copied.")).toBeVisible()
+  expect(await owner.page.evaluate(() => navigator.clipboard.readText())).toBe(link)
+  expect(await violations(owner.page)).toEqual([])
+  await expect(owner.page.getByRole("rowheader", { name: invited })).toBeVisible()
+  const path = new URL(link).pathname
+
+  // Signed out: the first page's layout says who it is for, as what, and until when; opening it consumed nothing.
+  const guestContext = await browser.newContext({ baseURL: base })
+  const guest = await guestContext.newPage()
+  await guest.goto(path)
+  await expect(guest.getByRole("heading", { level: 1, name: "You are invited" })).toBeVisible()
+  await expect(guest.getByText(`${invited} is invited to join Guild as Editor.`)).toBeVisible()
+  expect(await violations(guest)).toEqual([])
+
+  // Signed in as somebody else: told who the link is for, and no accept button.
+  const other = await person(browser, `${unique("other")}@example.test`)
+  await other.page.goto(path)
+  await expect(other.page.getByText(`This invitation is for ${invited}.`)).toBeVisible()
+  await expect(other.page.getByRole("button", { name: "Accept the invitation" })).toHaveCount(0)
+  await other.context.close()
+
+  // "Create your account": the sign-in starts with the invited address and lands in the workspace, as a member.
+  await guest.getByRole("button", { name: "Create your account" }).click()
+  await expect(guest.getByLabel("E-mail address")).toHaveValue(invited)
+  await guest.getByRole("button", { name: "Sign in" }).click()
+  await expect(guest).toHaveURL(new RegExp(`/${slug}/general$`))
+  const me = await call<{ organizations: Array<{ slug: string; role: string }> }>(guest, "tenancy.me.get", undefined)
+  expect(me.organizations).toEqual([{ slug, name: "Guild", role: "member" }])
+
+  // The same link again: used. In Lithuanian, too.
+  await guest.goto(path)
+  await expect(alerts(guest)).toContainText("This invitation has already been used.")
+  await guest.getByRole("group", { name: "Language" }).getByRole("button", { name: "Lietuvių" }).click()
+  await expect(alerts(guest)).toContainText("Šis kvietimas jau panaudotas.")
+  expect(await violations(guest)).toEqual([])
+  await guestContext.close()
+
+  // A new link replaces the old one, which then says it was revoked; a revoked one says so too.
+  await owner.page.getByLabel("E-mail address").fill("later@example.test")
+  await owner.page.getByRole("button", { name: "Invite", exact: true }).click()
+  await expect(owner.page.getByText("later@example.test is invited. Send them this link:")).toBeVisible()
+  const first = await owner.page.getByLabel("Invitation link").inputValue()
+  await owner.page.getByRole("button", { name: "New link for later@example.test" }).click()
+  const second = await owner.page.getByLabel("Invitation link").inputValue()
+  expect(second).not.toBe(first)
+  const stranger = await (await browser.newContext({ baseURL: base })).newPage()
+  await stranger.goto(new URL(first).pathname)
+  await expect(alerts(stranger)).toContainText("This invitation was revoked.")
+  await owner.page.getByRole("button", { name: "Revoke the invitation to later@example.test" }).click()
+  await expect(
+    owner.page.getByRole("status").filter({ hasText: "The invitation to later@example.test is revoked." }),
+  ).toBeVisible()
+  await stranger.goto(new URL(second).pathname)
+  await expect(alerts(stranger)).toContainText("This invitation was revoked.")
+  await stranger.context().close()
+  await owner.context.close()
+})
+
+test("the language is the person's own and follows them; the theme is this screen's", async ({ browser }) => {
+  const email = "ada@example.test"
+  const first = await person(browser, email)
+  await first.page.goto("/")
+  await expect(first.page.getByRole("heading", { level: 1, name: "Organizations" })).toBeVisible()
+  // The language changes in the same document: the loaders run again under the new cookie, nothing reloads.
+  await first.page.evaluate(() => {
+    ;(window as { sameDocument?: boolean }).sameDocument = true
+  })
+  await chooseShellOption(first.page, "Language", "Lietuvių")
+  await expect(first.page.getByRole("heading", { level: 1, name: "Organizacijos" })).toBeVisible()
+  await expect(first.page.locator("html")).toHaveAttribute("lang", "lt")
+  expect(await first.page.evaluate(() => (window as { sameDocument?: boolean }).sameDocument)).toBe(true)
+  expect(await violations(first.page)).toEqual([])
+  await first.context.close()
+
+  // Another browser, no cookie: the choice was saved on the user.
+  const second = await person(browser, email)
+  await second.page.goto("/")
+  await expect(second.page.getByRole("heading", { level: 1, name: "Organizacijos" })).toBeVisible()
+
+  // The theme: dark first, the root carries the class, and the server renders it back.
+  const root = second.page.locator("html")
+  await expect(root).not.toHaveClass(/light/)
+  await chooseShellOption(second.page, "Tema", "Šviesi")
+  await expect(root).toHaveClass(/light/)
+  await expect(second.page.locator(".light")).toHaveCount(1)
+  await second.page.reload()
+  await expect(root).toHaveClass(/light/)
+  expect(await violations(second.page)).toEqual([])
+  const html = await (await second.page.request.get("/")).text()
+  expect(html).toMatch(/<html[^>]*class="light"/)
+  await second.context.close()
+})
+
+test("the health and readiness endpoints answer booleans and nothing that names a reason", async ({ request }) => {
+  const health = await request.get("/api/health")
+  expect(health.status()).toBe(200)
+  expect(await health.json()).toMatchObject({ status: "ok" })
+
+  const ready = await request.get("/api/ready")
+  expect(ready.status()).toBe(200)
+  expect(await ready.json()).toEqual({
+    ready: true,
+    checks: { store: true, reader: true, migrations: true, platform: true },
+  })
+})
+
+test("a request carries its trace id into the web shell's logs and spans, and no secret leaves", async ({ page }) => {
+  await signIn(page, "ada@example.test")
+  const trace = "4bf92f3577b34da6a3ce929d0e0e4736"
+  const csrf = (await page.locator('meta[name="csrf-token"]').getAttribute("content")) ?? ""
+  const response = await page.request.post("/api/v1/tenancy.org.get", {
+    headers: {
+      "x-csrf-token": csrf,
+      "content-type": "application/json",
+      "sec-fetch-site": "same-origin",
+      traceparent: `00-${trace}-00f067aa0ba902b7-01`,
+      "x-request-id": "e2e-request-1",
+    },
+    data: { org: "acme-review" },
+  })
+  expect(response.status()).toBe(200)
+  expect(response.headers()["x-request-id"]).toBe("e2e-request-1")
+
+  await expect(async () => {
+    const { otel } = await platformState()
+    // The bodies of what the platform received: the request's own headers (the token it authenticates with) are not what is under test.
+    const logs = JSON.stringify(otel.logs.map((record) => record.body))
+    expect(logs).toContain(trace)
+    expect(logs).toContain("tenancy.org.get")
+    const traces = JSON.stringify(otel.traces.map((record) => record.body))
+    expect(traces).toContain("procedure tenancy.org.get")
+    // The deployment token, the session secret and the person's address never reach the platform's log.
+    for (const secret of ["e2e-token", "ada@example.test"]) expect(logs + traces).not.toContain(secret)
+  }).toPass({ timeout: 30_000 })
+})