first commit

packages/testing/playwright/tests/e2e/api/webhook-external.spec.ts

@@ -0,0 +1,41 @@
+import { test, expect } from '../../../fixtures/base';
+
+test.describe('External Webhook Triggering', {
+	annotation: [
+		{ type: 'owner', description: 'Catalysts' },
+	],
+}, () => {
+	test('should create workflow via API, activate it, trigger webhook externally, and verify execution', async ({
+		api,
+	}) => {
+		const { webhookPath, workflowId } = await api.workflows.importWorkflowFromFile(
+			'simple-webhook-test.json',
+		);
+
+		const testPayload = { message: 'Hello from Playwright test' };
+
+		const webhookResponse = await api.webhooks.trigger(`/webhook/${webhookPath}`, {
+			method: 'POST',
+			data: testPayload,
+		});
+
+		expect(webhookResponse.ok()).toBe(true);
+
+		const execution = await api.workflows.waitForExecution(workflowId, 5000);
+		expect(execution.status).toBe('success');
+
+		const executionDetails = await api.workflows.getExecution(execution.id);
+		expect(executionDetails.data).toContain('Hello from Playwright test');
+	});
+
+	test('should surface workflow configuration errors to the caller', async ({ api }) => {
+		const { webhookPath } = await api.workflows.importWorkflowFromFile(
+			'webhook-misconfiguration-test.json',
+		);
+
+		const webhookResponse = await api.webhooks.trigger(`/webhook/${webhookPath}`);
+
+		expect(webhookResponse.ok()).toBe(false);
+		expect(await webhookResponse.text()).toContain('Unused Respond to Webhook node');
+	});
+});

packages/testing/playwright/tests/e2e/api/webhook-isolation.spec.ts

@@ -0,0 +1,45 @@
+import { test, expect } from '../../../fixtures/base';
+
+test.describe('Webhook Origin Isolation', {
+	annotation: [
+		{ type: 'owner', description: 'Catalysts' },
+	],
+}, () => {
+	test.beforeAll(async ({ api }) => {
+		await api.workflows.importWorkflowFromFile('webhook-origin-isolation.json', {
+			makeUnique: false,
+		});
+	});
+
+	const webhookPaths = [
+		'webhook-response-data-text-html',
+		'webhook-response-data-wo-content-type',
+		'webhook-last-node-no-content-type-header',
+		'webhook-last-node-text-html-header',
+		'webhook-last-node-text-html-content-type',
+		'webhook-response-data-csp-header',
+		'webhook-last-node-csp-header',
+		'webhook-last-node-binary-text-html',
+		'webhook-last-node-binary-no-content-type',
+		'webhook-last-node-binary-csp-header',
+		'respond-to-webhook-text-no-content-type',
+		'respond-to-webhook-text-content-type-text-html',
+		'respond-to-webhook-text-csp-header',
+		'respond-to-webhook-json-as-text-html',
+	];
+
+	const expectedCSP =
+		'sandbox allow-downloads allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-presentation allow-scripts allow-top-navigation allow-top-navigation-by-user-activation allow-top-navigation-to-custom-protocols';
+
+	for (const webhookPath of webhookPaths) {
+		test(`Webhook responses should include the correct response headers for ${webhookPath}`, async ({
+			api,
+		}) => {
+			const webhookResponse = await api.webhooks.trigger(`/webhook/${webhookPath}`);
+			expect(webhookResponse.ok()).toBe(true);
+
+			const headers = webhookResponse.headers();
+			expect(headers['content-security-policy']).toBe(expectedCSP);
+		});
+	}
+});