sapl/tests

UAT / Environment Acceptance Test Suites

Reusable acceptance suites for the SAPL environments (uat, dev; extendable to prod-read-only). Verified 2026-08-13 against uat (34/35 API + 15/15 UI PASS; evidence: Gitea wiki page UAT-Acceptance-2026-08-13).

Files

File	What it does
uat-api-suite.py	API evidence: health, login matrix (4 roles + nav_priority + calendar perms), org-chart RBAC (admin 251 nodes; merchant designed 403/404s), calendar (sync-status/people/events), TNA line (created_at + workflow cards), plans/no-tna/people, rule-template CRUD round-trip (restores Default), constitutional LIST 422-fix, backfill, in-container escalation probe. Writes JSON evidence.
uat-ui-suite.cjs	Playwright UI suite: admin pages (/tna search+sort+created date, /to-plan, /admin TNA Rules, /org-chart 5 tabs, /calendar) + merchant/designer nav-order + calendar view; screenshots to a dir.
uat-create-test-users.py	Creates multi-role test users (test.merchandiser@, test.planner@, test.designer@saplind.com, password Test@1234 by default) via the admin API; resolves department ids by name; skips existing.
uat-google-enable-verify.py	Post-deploy verifier for the Google Directory/Calendar enablement: container env (backend+worker, incl. MAIL_ALLOWLIST), DB counts (org_nodes, calendar_events, tna_email_log), org-chart/calendar API checks, mail-safety grep.

Prerequisites

• Run on the VPS (needs docker exec access to the stack's postgres/backend/worker containers) — not from a laptop.
• Python 3.11 + urllib (stdlib only). Node 22 for the UI suite, with Playwright available:
  • Host path used by Hermes: /root/.npm/_npx/e41f203b7505f1fb/node_modules/playwright (override via PLAYWRIGHT_MODULE)
  • Chromium in /root/.cache/ms-playwright (the script picks chromium-*, excluding chromium_headless_shell-*)
• Test users: run uat-create-test-users.py first if they don't exist on the target env.
• Email safety (MANDATORY): UAT is MAIL_DRY_RUN=false with a 4-user allowlist — the suites never trigger mail, but if you extend them toward the trigger path, first verify MAIL_DRY_RUN/MAIL_ALLOWLIST via docker exec <stack>-backend-1 python3 -c "from config import settings; ...".

Run

# 1. test users (idempotent)
python3 tests/uat-create-test-users.py

# 2. API suite (evidence → /tmp/sapl_uat_api_evidence.json)
python3 tests/uat-api-suite.py

# 3. UI suite (screenshots → /tmp/sapl-uat-tests/)
node tests/uat-ui-suite.cjs

Env overrides (all optional)

Var	Default	Used by
UAT_BASE	https://uat.ai-automation-hub.tech	api/ui/create/verify (point at dev: https://dev.ai-automation-hub.tech)
SAPL_ADMIN_EMAIL / SAPL_ADMIN_PW	pratik@sonalapparels.in / atelier2026	api/create/verify
SAPL_STACK	sapl-sapl-uat	api/verify (container name prefix for docker exec)
EVIDENCE_OUT	/tmp/sapl_uat_api_evidence.json	api
PLAYWRIGHT_MODULE	npx cache path above	ui
SHOT_DIR	/tmp/sapl-uat-tests	ui
TEST_PASSWORD	Test@1234	create

Evidence → wiki

After a run, publish results to the Gitea wiki (repo sapl/sapl, wiki clone, assets/<run>/ for screenshots) — pattern in wiki page UAT-Acceptance-2026-08-13 and Test-Cases index.

Notes

• The API suite intentionally asserts the DESIGNED RBAC matrix: merchant /org-chart/tree → 403 (data/manage gate), merchant /team?email=<other> → 403 (scope guard), merchant own email not in Directory → 404. These are passes, not bugs.
• Rule-template round-trip ORDER matters: create → activate → deactivate → duplicate → delete, then re-activate Default (deactivate leaves zero active templates by design), then rule-edit tests (set_rule 422s without an active template).
• /auth/me returns {"user": {...}}; login returns {"token": ...} (not access_token).
• Calendar events endpoint takes YYYY-MM-DD date params (not ISO datetimes).