test(web): live e2e for admin, users, roles, backups, registries

[ValgulNecron]

Before: the live Playwright suite had no coverage for notification sinks, users and roles, role bindings, backup and restore, or mod registries. Those flows were only tested against mocks.

After: five new live specs run in e2e web live against the real API. Each one checks that its change survives a reload and hits one real-API error path. Before Playwright starts, the live job warms the restic repo with a new TestE2E_ResticRepoReady test.

How: this covers Spec 013 US2 (T037–T043).

• TestE2E_ResticRepoReady is registered in bucket_operator and also runs as a step after "bootstrap admin" in the live job.
• _seed.ts gains user, role, backup-destination and cleanup helpers.
• users-and-roles and role-bindings each add exactly one extra login, from a fresh context.
• No spec uses page.route or msw.

Five places where the code differs from the task text. Each is noted in a comment in its spec:

• admin-notifications: a sink's URL can't be edited or read back, so the edit step toggles the enabled switch instead. The API accepts 169.254.169.254 on save and blocks it only at delivery, so the error path asserts the inline SSRF result after "Send test".
• users-and-roles: a role change on a deleted user returns 500, not 404. The 404 ("user not found") comes from adding a namespace grant, so that is the error path.
• role-bindings: the forbidden page is drawn client-side, so the spec also makes one API call from the restricted session to show the real 403.
• backup-restore: the success phase is "Succeeded", not "Completed". Restoring onto a deleted server shows no toast; it shows as a Failed restore with "target server … not found".
• mod-registries: there are three fixed providers, and a duplicate returns 422. The 409 comes from an unmanaged Secret with the provider's name, so that is the error path.

T044 (login count, duration, flipping G-07 to G-11) follows after the first green live run.

🤖 Generated with Claude Code

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI Report - ab74289

run 38498792723 - attempt 1

1 failed - 24 passed - 0 skipped - 6 cancelled - 24m20s elapsed

Failing

Job	Log
e2e-web-live-arm64	logs

Coverage

Module	Measured	Gate	Margin
web	L95.53 S94.07 B88.79 F91.78	L92 S92 B82 F76	+2.07

Changed

Area	Files	+/-
web/	6	+877/-1
test/	2	+22/-0
.github/	1	+8/-0

Slowest jobs

Job	Duration
build e2e images	14m15s
e2e telemetry / arm64 (kind)	14m4s
e2e web live / arm64 (kind)	11m39s
build e2e images (arm64)	9m54s
e2e multicluster / arm64 (kind x2)	9m6s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, bot-fast, multicluster, operator, ratelimit, telemetry, upgrade

[ValgulNecron]

e2e web live / amd64 failed on 367e53c. The new live specs from this PR all passed. The three failures are all in the existing share-links.spec.ts (lines 190, 207 and 229), which this PR does not touch.

Cause, from the Playwright error context: openCreateDialog clicks getByRole('main').getByRole('button', { name: 'Create link' }). When the server has no links, ShareLinks.tsx renders two buttons with that name, one in the header (line 551) and one in the empty state (line 570). Playwright's strict mode then fails the click. Whether the list is empty when those tests run depends on test order, which is why the same spec passed in this PR's earlier arm64 runs.

The fix would be a one-line selector change in share-links.spec.ts. That file is an existing test, so I've asked the maintainer to sign off before I change it. I'll re-run the job once after the run finishes.

---

Generated by Claude Code