From 9234d0af159bf6d75fb83c18e3f0dc47f75696a0 Mon Sep 17 00:00:00 2001 From: cesnimda Date: Tue, 20 Oct 2026 09:35:15 +0200 Subject: [PATCH] fix(ci): size shared browser login fixture for full suite --- .../2026-10-20-browser-auth-fixture-capacity.md | 7 +++++++ job-tracker-ui/playwright.config.ts | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 docs/infrastructure/2026-10-20-browser-auth-fixture-capacity.md diff --git a/docs/infrastructure/2026-10-20-browser-auth-fixture-capacity.md b/docs/infrastructure/2026-10-20-browser-auth-fixture-capacity.md new file mode 100644 index 0000000..1431c86 --- /dev/null +++ b/docs/infrastructure/2026-10-20-browser-auth-fixture-capacity.md @@ -0,0 +1,7 @@ +# Shared browser authentication fixture — 20 October 2026 + +The instrumented Linux suite returned HTTP 429 from fixture logins in Companies, correspondence and preservation journeys. The general browser fixture configured 100 authentication permits per five-minute window. Every test and retry shares the same loopback address and backend process; the server partitions that limiter by remote IP. Fast fixture failures and repeated identity setup can exhaust this shared allowance before the window renews. A rejected fixture login prevents the workflow from running; it is not an application assertion failure. + +The general isolated browser fixture now allows 1,000 login permits per window. This is test-only environment configuration; the application default remains ten. The separate `playwright.rate-limits.config.ts` explicitly retains ten permits and zero retries for real middleware/rate-limit contracts. No production config, auth implementation, login assertion, permission requirement or dedicated throttle expectation is changed. The allowance supplies headroom for the current 331-case full suite, repeated identities and its existing one retry. + +The dedicated real-HTTP throttle suite passed all nine cases at 07:34:38–07:34:50 UTC, zero skips/retries/flaky outcomes, with its unchanged ten-permit configuration. Browser TypeScript and lint pass. The subsequent full Linux run must prove the shared-fixture correction; focused workflow passes alone cannot prove cumulative capacity. The original 429 traces remain evidence. This correction does not establish deployment or Phase 7 acceptance. diff --git a/job-tracker-ui/playwright.config.ts b/job-tracker-ui/playwright.config.ts index f15f1d6..58bbed3 100644 --- a/job-tracker-ui/playwright.config.ts +++ b/job-tracker-ui/playwright.config.ts @@ -42,7 +42,8 @@ export default defineConfig({ Auth__AdminEmail: "e2e@example.test", Auth__AdminPassword: "E2ePassword123!", Auth__AllowRegistration: "false", - RateLimits__AuthLoginPermitLimit: "100", + // The full browser suite shares one loopback IP. Real throttle contracts use the separate 10-permit fixture. + RateLimits__AuthLoginPermitLimit: "1000", App__Version: "e2e-verification", App__CommitSha: "e2e1234", Cors__Origins__0: appUrl,