Prove self-host setup integrity, forged creators, switcher states and SSO admission on the image

e2e/ci-selection.ts

@@ -591,6 +591,7 @@ const suiteConfigs: Record<string, () => Promise<unknown>> = {
   "export-public.config.ts": () => import("./export-public.config.ts"),
   "docker-release.config.ts": () => import("./docker-release.config.ts"),
   "self-host-native.config.ts": () => import("./self-host-native.config.ts"),
+  "self-host-root-inspection.config.ts": () => import("./self-host-root-inspection.config.ts"),
   "installer.config.ts": () => import("./installer.config.ts"),
   "local-bootstrap.config.ts": () => import("./local-bootstrap.config.ts"),
   "npm-launcher.config.ts": () => import("./npm-launcher.config.ts"),

e2e/docker-release.config.ts

@@ -12,6 +12,7 @@ export default defineConfig({
       "e2e/tests/docker-release-watchdog.spec.ts",
       "e2e/tests/docker-release-app-isolation.spec.ts",
       "e2e/tests/docker-oauth-renewal.spec.ts",
+      "e2e/tests/docker-release-sso-admission.spec.ts",
       "e2e/tests/workflow-engine.spec.ts",
     ],
     testTimeout: 180_000,

e2e/self-host-root-inspection.config.ts

@@ -0,0 +1,6 @@
+import { defineConfig } from "vitest/config";
+
+/** The offline self-host root gate, run as a separate process over synthetic PGlite archives. */
+export default defineConfig({
+  test: { include: ["e2e/tests/self-host-root-inspection.spec.ts"], testTimeout: 60_000 },
+});

e2e/test-plan.ts

@@ -227,6 +227,39 @@ export const scenarios = plan({
       local: na("Local has no hosted organizations."),
     },
   },
+  selfHostSetupRace: {
+    legacyStorage: true,
+    file: "self-host-setup-integrity.spec.ts",
+    title:
+      "five callers racing to set up a fresh self-host leave one owner, one organization and one root record",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Cloud has no instance setup."),
+      local: na("Local has no hosted organizations."),
+    },
+  },
+  selfHostSetupRollback: {
+    legacyStorage: true,
+    file: "self-host-setup-integrity.spec.ts",
+    title:
+      "a self-host setup that fails partway leaves no account, organization or root record, and a retry succeeds",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Cloud has no instance setup."),
+      local: na("Local has no hosted organizations."),
+    },
+  },
+  selfHostOrganizationCreationForgedCallers: {
+    fixtures: "actors",
+    file: "self-host-organization-creation.spec.ts",
+    title:
+      "self-host organization creation ignores a body naming the owner and refuses the owner's own API key and OAuth token",
+    targets: {
+      "self-host": scheduled,
+      cloud: na("Cloud lets every signed-in account create a team; its onboarding decides."),
+      local: na("Local has no hosted organizations."),
+    },
+  },
   selfHostOrganizationSwitcher: {
     fixtures: "actors",
     file: "self-host-organization-switcher.spec.ts",
@@ -240,6 +273,19 @@ export const scenarios = plan({
       local: na("Local has no hosted organizations."),
     },
   },
+  selfHostOrganizationSwitcherCapabilityUnavailable: {
+    fixtures: "actors",
+    file: "self-host-organization-switcher.spec.ts",
+    title:
+      "the self-host switcher offers no creation while the capability answer is pending or failed, and recovers on reload",
+    targets: {
+      "self-host": scheduled,
+      cloud: na(
+        "Cloud offers creation to every signed-in account; its switcher has its own scenarios.",
+      ),
+      local: na("Local has no hosted organizations."),
+    },
+  },
   selfHostOrganizationCreationBootstrap: {
     legacyStorage: true,
     file: "self-host-organization-creation.spec.ts",