feat(playwright): add durable settings browser test suite

[BillLeoutsakosvl346]

Summary

• establish a reusable Playwright foundation for full-stack browser coverage
• add deterministic authenticated personas spanning workspace, organization, plan, and platform authority
• cover settings navigation, authorization, entitlements, and critical workflows across account, organization, and workspace routes

Delivery plan

• Playwright foundation and hosted/billing Chromium profile
• Reusable data, Better Auth, and persona fixtures
• Settings navigation acceptance contract
• Authorization, entitlement, and unsaved-change coverage
• Secrets and API-key workflows
• Organization and enterprise workflows
• Stability validation and required CI gate

Test plan

• Existing Vitest and build checks remain green
• Settings E2E suite runs against migrated isolated pgvector/Postgres
• Playwright reports, traces, and screenshots upload on failure
• Full Chromium suite passes five consecutive runs with retries disabled

This is the draft integration PR. Each delivery step will be reviewed in a focused PR targeting e2e/settings-playwright before this PR is made ready for final review.

Made with Cursor

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 23, 2026 5:58pm

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cursor review

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e60658d. Configure here.}

[greptile-apps]

Greptile Summary

This PR establishes durable settings browser coverage and the supporting production hardening.

• Adds full-stack Playwright orchestration, deterministic personas, isolated Postgres setup, fake Stripe/MCP services, diagnostics safeguards, and a required CI job.
• Adds settings authorization, navigation, credential, organization, SSO, MCP, retention, and entitlement coverage.
• Introduces SSO domain verification, provider-management safeguards, migration preflight/auditing, and deployment configuration.
• Updates settings UI state and access behavior to support deterministic browser workflows.

Confidence Score: 5/5

The PR appears safe to merge based on the reviewed migration, authentication, realtime, CI, and diagnostics paths.

The changed paths preserve organization authorization and provider integrity, use guarded and replay-aware migration handling, isolate browser-test infrastructure, accept the configured browser origin, and gate diagnostic uploads on successful secret-leak scanning.

Important Files Changed

Filename	Overview
.github/workflows/test-build.yml	Adds the required settings E2E job with Postgres, migration rehearsal, browser installation, diagnostics gating, and artifact upload.
apps/sim/e2e/scripts/run.ts	Orchestrates isolated database creation, services, build, seeding, authentication capture, Playwright execution, leak scanning, and cleanup.
apps/sim/e2e/support/deployment-profile.ts	Defines isolated, explicit environment profiles for each full-stack E2E subprocess.
apps/sim/playwright.config.ts	Configures ordered Chromium projects and failure artifacts for the settings acceptance suite.
packages/db/migrations/0266_zippy_the_phantom.sql	Adds SSO provider integrity constraints, domain-verification state, and concurrent uniqueness indexes behind migration preflight checks.
packages/db/scripts/migrate.ts	Adds the guarded SSO migration audit while retaining migration locking, retry, and invalid-index diagnostics.
apps/sim/lib/auth/sso/management.ts	Centralizes organization authorization, provider validation, domain overlap checks, and mutation availability safeguards.
apps/sim/lib/auth/sso/provider-operation-intent.ts	Coordinates provider callbacks and domain verification with expiring operation intents.
apps/sim/app/api/auth/[...all]/route.ts	Wraps SSO callbacks with operation tracking and blocks direct access to provider mutation endpoints.
apps/realtime/src/index.ts	Adds configurable host binding needed by isolated E2E runtime startup.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  CI[Settings E2E CI job] --> PG[(Isolated pgvector/Postgres)]
  CI --> Runner[E2E orchestrator]
  Runner --> Migration[Migration and SSO rehearsal]
  Runner --> Stripe[Fake Stripe service]
  Runner --> MCP[Fake MCP service]
  Runner --> Realtime[Realtime service]
  Runner --> App[Production Next.js app]
  Runner --> Seed[Deterministic personas and scenarios]
  Seed --> PG
  Runner --> Browser[Playwright Chromium projects]
  Browser --> App
  Browser --> Realtime
  App --> PG
  App --> Stripe
  App --> MCP
  Browser --> Diagnostics[Reports, traces, screenshots]
  Diagnostics --> LeakScan[Leak-canary gate]
  LeakScan --> Artifacts[Conditional CI artifact upload]

Loading

_{Reviews (1): Last reviewed commit: "chore(ci): update API validation route b..." | Re-trigger Greptile}

[greptile-apps]

Too many files changed for review. (211 files found, 100 file limit)

Bypass the limit by tagging @greptile-apps to review.