ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 12:31:54 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
renovate/docker
prowler/ui/tests/runtime-config/runtime-config.md
T
Pablo Fernandez Guerra (PFE) 80c5363649 refactor(ui): rename integration enable flags to past tense (#11917) 
Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com>
2026-07-09 13:09:35 +02:00

3.1 KiB
Raw Permalink Blame History

E2E Tests: Runtime Public-Config Data Island

Suite ID: RUNTIME-CONFIG-E2E Feature: Runtime resolution of public client config via an inert JSON data island injected into <head> (Sentry, GTM, API base/docs URL, and reserved keys). Each third-party integration resolves to a value only when its UI_*_ENABLED flag is "true", so a disabled integration is exposed as null.

Test Case: RUNTIME-CONFIG-E2E-001 - Island rendered in <head> before the client bundle

Priority: critical Tags: @e2e, @runtime-config

Preconditions:

  • UI server running with UI_API_BASE_URL set (the playwright webServer provides it).

Flow Steps

  1. Navigate to /sign-in (unauthenticated; the island renders on every route).
  2. Locate script#__PROWLER_RUNTIME_CONFIG__.

Expected Result

  • The island exists, is type="application/json" (inert), and lives in <head>.
  • The island appears before the first ordered (non-async) bundle <script src> — Next.js's async chunk-preloads in <head> don't execute in order and are excluded.
  • It parses as JSON exposing exactly the allowlisted keys and a truthy apiBaseUrl.

Key Verification Points

  • In-<head>-before-bundle ordering guarantee (not provable in jsdom).
  • Only the allowlisted shape is exposed (no other env leaks).

Test Case: RUNTIME-CONFIG-E2E-002 - Browser Sentry init matches the island DSN

Priority: high Tags: @e2e, @runtime-config

Preconditions:

  • UI server running. Sentry may be enabled (UI_SENTRY_ENABLED=true with UI_SENTRY_DSN) or off.

Flow Steps

  1. Navigate to /sign-in.
  2. Read sentryDsn from the island.
  3. Read the DSN the browser Sentry client initialized with.

Expected Result

  • If the island carries a DSN, the browser Sentry client initialized with that exact runtime DSN (proving the island feeds Sentry.init race-free).
  • If the island has no DSN, Sentry is not initialized (zero egress — the default).

Key Verification Points

  • The runtime DSN reaches module-load Sentry init via the island.
  • Unset DSN ⇒ no Sentry initialization (privacy guarantee).

Test Case: RUNTIME-CONFIG-E2E-003 - Zero third-party telemetry when Sentry and GTM are unset

Priority: critical Tags: @e2e, @runtime-config

Preconditions:

  • UI server running with Sentry and Google Tag Manager disabled — their UI_SENTRY_ENABLED and UI_GOOGLE_TAG_MANAGER_ENABLED flags unset, the Enterprise default — so the island exposes both as null (the test skips when either is enabled and configured).

Flow Steps

  1. Navigate to /sign-in and read the island config.
  2. Reload while recording requests to googletagmanager.com, google-analytics.com, and sentry.io.
  3. Inspect the DOM for a Google Tag Manager script.

Expected Result

  • No request is sent to any Google or Sentry host.
  • The GoogleTagManager component is not rendered (no gtm.js script).

Key Verification Points

  • Enterprise default sends zero error/analytics telemetry to any third party.
  • Empty/unset GTM id ⇒ component not mounted (an empty id is NOT inert).
Reference in New Issue View Git Blame Copy Permalink