ocom-verify package changes

.snyk

@@ -96,4 +96,3 @@ ignore:
         reason: 'Requires upgrade of @opentelemetry/sdk-node to 0.217.0, which has type errors that break compilation. Created task to upgrade OTEL service to 2.x and resolve vulnerability that way.'
         expires: '2026-07-28T00:00:00.000Z'
         created: '2026-06-01T10:00:00.000Z'
-

apps/api/start-dev.mjs

@@ -18,7 +18,10 @@ const childEnv = {
 	NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ''} --use-system-ca`.trim(),
 };
 
-const child = spawn('func', ['start', '--typescript', '--script-root', 'deploy/', '--port', envPort], {
+// `--cors '*'` matches Host.CORS in local.settings.json but does not depend on
+// that file existing — local.settings.json is gitignored, so CI has no CORS
+// allowance otherwise and the UI's cross-origin GraphQL requests are blocked.
+const child = spawn('func', ['start', '--typescript', '--script-root', 'deploy/', '--port', envPort, '--cors', '*'], {
 	stdio: 'inherit',
 	env: childEnv,
 });

build-pipeline/core/monorepo-build-stage.yml

@@ -243,7 +243,7 @@ stages:
             echo "Testing affected packages only (PR/branch build)..."
             export TURBO_SCM_BASE="origin/$(System.PullRequest.TargetBranch)"
             export TURBO_CONCURRENCY=4
-            pnpm run test:coverage --affected
+            pnpm run test:coverage:affected
             pnpm run merge-lcov-reports
           else
             echo "Testing all packages (main branch build)..."
@@ -281,6 +281,22 @@ stages:
         ${{ each pair in parameters.buildEnvSettings }}:
           ${{ pair.key }}: ${{ pair.value }}
 
+    # Run E2E tests
+    - task: Bash@3
+      displayName: 'Run E2E tests'
+      inputs:
+        targetType: 'inline'
+        script: |
+          set -euo pipefail
+          export NODE_OPTIONS=--max_old_space_size=16384
+          export PLAYWRIGHT_BROWSERS_PATH="$(PLAYWRIGHT_BROWSERS_PATH)"
+          echo "Running E2E tests..."
+          pnpm run test:e2e:ci
+        workingDirectory: ''
+      env:
+        TURBO_TELEMETRY_DISABLED: 1
+        PLAYWRIGHT_BROWSERS_PATH: $(PLAYWRIGHT_BROWSERS_PATH)
+
     # Audit unused dependencies with knip (after packages are built)
     - task: Bash@3
       displayName: 'Audit unused dependencies with knip'

build-pipeline/scripts/merge-coverage.js

@@ -11,105 +11,104 @@ const __dirname = dirname(__filename);
  * Simple LCOV merger that combines multiple lcov.info files
  */
 function processLcovContent(content, packagePath) {
-  const lines = content.split('\n');
-  const processedLines = [];
-  
-  for (const line of lines) {
-    if (line.startsWith('SF:')) {
-      // Extract the file path after 'SF:'
-      const filePath = line.substring(3);
-      // Prefix with package path, ensuring no double slashes
-      const prefixedPath = path.join(packagePath, filePath).replaceAll('\\', '/');
-      processedLines.push(`SF:${prefixedPath}`);
-    } else {
-      processedLines.push(line);
-    }
-  }
-  
-  return processedLines.join('\n');
+	const lines = content.split('\n');
+	const processedLines = [];
+
+	for (const line of lines) {
+		if (line.startsWith('SF:')) {
+			// Extract the file path after 'SF:'
+			const filePath = line.substring(3);
+			// Prefix with package path, ensuring no double slashes
+			const prefixedPath = path.join(packagePath, filePath).replaceAll('\\', '/');
+			processedLines.push(`SF:${prefixedPath}`);
+		} else {
+			processedLines.push(line);
+		}
+	}
+
+	return processedLines.join('\n');
 }
 
 function mergeLcovFiles() {
-  const rootDir = process.cwd();
-  const outputFile = path.join(rootDir, 'coverage', 'lcov.info');
-
-  // Create output directory
-  const outputDir = path.dirname(outputFile);
-  if (!fs.existsSync(outputDir)) {
-    fs.mkdirSync(outputDir, { recursive: true });
-  }
-
-  // Find all lcov.info files
-  const lcovFiles = [];
-
-  function findLcovFiles(dir) {
-    const entries = fs.readdirSync(dir, { withFileTypes: true });
-
-    for (const entry of entries) {
-      const fullPath = path.join(dir, entry.name);
-
-      if (entry.isDirectory()) {
-        if (entry.name !== 'node_modules' && entry.name !== '.git') {
-          findLcovFiles(fullPath);
-        }
-      } else if (entry.name === 'lcov.info' && fullPath.includes('/coverage/')) {
-        lcovFiles.push(fullPath);
-      }
-    }
-  }
-
-  // Search in apps and packages directories
-  const searchDirs = ['apps', 'packages'].filter(dir => 
-    fs.existsSync(path.join(rootDir, dir))
-  );
-
-  for (const dir of searchDirs) {
-    findLcovFiles(path.join(rootDir, dir));
-  }
-
-  console.log(`Found ${lcovFiles.length} LCOV files:`);
-  lcovFiles.forEach(file => console.log(`  - ${file}`));
-
-  if (lcovFiles.length === 0) {
-    console.log('No LCOV files found. Creating empty coverage file.');
-    fs.writeFileSync(outputFile, '');
-    return;
-  }
-
-  // Merge all LCOV files
-  let mergedContent = '';
-
-  for (const lcovFile of lcovFiles) {
-    try {
-      const content = fs.readFileSync(lcovFile, 'utf8');
-      if (content.trim()) {
-        // Compute the package path relative to monorepo root
-        const packageDir = path.dirname(path.dirname(lcovFile)); // Go up from coverage/ to package/
-        const packagePath = path.relative(rootDir, packageDir);
-
-        // Process the LCOV content to prefix SF: paths
-        const processedContent = processLcovContent(content, packagePath);
-
-        mergedContent += processedContent;
-        if (!processedContent.endsWith('\n')) {
-          mergedContent += '\n';
-        }
-      }
-    } catch (error) {
-      console.warn(`Warning: Could not read ${lcovFile}: ${error.message}`);
-    }
-  }
-
-  // Write merged content
-  fs.writeFileSync(outputFile, mergedContent);
-
-  console.log(`Merged coverage report written to: ${outputFile}`);
-  console.log(`Total size: ${mergedContent.length} characters`);
-
-  // Count records
-  const records = (mergedContent.match(/end_of_record/g) || []).length;
-  console.log(`Coverage records: ${records}`);
+	const rootDir = process.cwd();
+	const outputFile = path.join(rootDir, 'coverage', 'lcov.info');
+
+	// Create output directory
+	const outputDir = path.dirname(outputFile);
+	if (!fs.existsSync(outputDir)) {
+		fs.mkdirSync(outputDir, { recursive: true });
+	}
+
+	// Find all lcov.info files
+	const lcovFiles = [];
+
+	function findLcovFiles(dir) {
+		const entries = fs.readdirSync(dir, { withFileTypes: true });
+
+		for (const entry of entries) {
+			const fullPath = path.join(dir, entry.name);
+
+			if (entry.isDirectory()) {
+				if (!['node_modules', '.git', '.turbo', 'dist', 'build'].includes(entry.name)) {
+					findLcovFiles(fullPath);
+				}
+			} else if (entry.name === 'lcov.info' && fullPath.replaceAll('\\', '/').includes('/coverage/')) {
+				if (fullPath !== outputFile) {
+					lcovFiles.push(fullPath);
+				}
+			}
+		}
+	}
+
+	const searchDirs = ['apps', 'packages'].filter((dir) => fs.existsSync(path.join(rootDir, dir)));
+
+	for (const dir of searchDirs) {
+		findLcovFiles(path.join(rootDir, dir));
+	}
+
+	console.log(`Found ${lcovFiles.length} LCOV files:`);
+	lcovFiles.forEach((file) => console.log(`  - ${file}`));
+
+	if (lcovFiles.length === 0) {
+		console.log('No LCOV files found. Creating empty coverage file.');
+		fs.writeFileSync(outputFile, '');
+		return;
+	}
+
+	// Merge all LCOV files
+	let mergedContent = '';
+
+	for (const lcovFile of lcovFiles) {
+		try {
+			const content = fs.readFileSync(lcovFile, 'utf8');
+			if (content.trim()) {
+				// Compute the package path relative to monorepo root
+				const packageDir = path.dirname(path.dirname(lcovFile)); // Go up from coverage/ to package/
+				const packagePath = path.relative(rootDir, packageDir);
+
+				// Process the LCOV content to prefix SF: paths
+				const processedContent = processLcovContent(content, packagePath);
+
+				mergedContent += processedContent;
+				if (!processedContent.endsWith('\n')) {
+					mergedContent += '\n';
+				}
+			}
+		} catch (error) {
+			console.warn(`Warning: Could not read ${lcovFile}: ${error.message}`);
+		}
+	}
+
+	// Write merged content
+	fs.writeFileSync(outputFile, mergedContent);
+
+	console.log(`Merged coverage report written to: ${outputFile}`);
+	console.log(`Total size: ${mergedContent.length} characters`);
+
+	// Count records
+	const records = (mergedContent.match(/end_of_record/g) || []).length;
+	console.log(`Coverage records: ${records}`);
 }
 
 // Run the merger
-mergeLcovFiles();
+mergeLcovFiles();

package.json

@@ -28,10 +28,12 @@
 		"start-emulator:auth-server": "pnpm --filter @cellix/mock-oauth2-server start",
 		"test:all": "turbo run test:all",
 		"test:arch": "turbo run test:arch",
-		"test:coverage": "turbo run test:coverage",
+		"test:coverage": "turbo run test:coverage test:coverage:acceptance",
+		"test:coverage:affected": "turbo run test:coverage test:coverage:acceptance --affected",
 		"test:coverage:merge": "pnpm run test:coverage && pnpm run merge-lcov-reports",
 		"test:e2e": "turbo run test:e2e --filter=@ocom-verification/e2e-tests",
-		"test:acceptance": "turbo run test:acceptance --filter=@ocom-verification/acceptance-api --filter=@ocom-verification/acceptance-ui",
+		"test:e2e:ci": "turbo run test:e2e:ci --filter=@ocom-verification/e2e-tests",
+		"test:acceptance": "turbo run test:acceptance",
 		"merge-lcov-reports": "node build-pipeline/scripts/merge-coverage.js",
 		"test:integration": "turbo run test:integration",
 		"test:serenity": "turbo run test:serenity",
@@ -46,7 +48,7 @@
 		"sonar:pr": "export PR_NUMBER=$(node build-pipeline/scripts/get-pr-number.cjs) && sonar-scanner -Dsonar.pullrequest.key=$PR_NUMBER -Dsonar.pullrequest.branch=$(git branch --show-current) -Dsonar.pullrequest.base=main",
 		"sonar:pr-windows": "for /f %i in ('node build-pipeline/scripts/get-pr-number.cjs') do set PR_NUMBER=%i && sonar-scanner -Dsonar.pullrequest.key=%PR_NUMBER% -Dsonar.pullrequest.branch=%BRANCH_NAME% -Dsonar.pullrequest.base=main",
 		"check-sonar": "node build-pipeline/scripts/check-sonar-quality-gate.cjs",
-		"verify": "pnpm run format:check && pnpm run test:arch && pnpm run test:coverage:merge && pnpm run knip && pnpm run audit && pnpm run snyk && pnpm run sonar:pr && pnpm run check-sonar",
+		"verify": "pnpm run format:check && pnpm run test:arch && pnpm run test:coverage:merge && pnpm run test:e2e && pnpm run knip && pnpm run audit && pnpm run snyk && pnpm run sonar:pr && pnpm run check-sonar",
 		"knip": "knip",
 		"snyk": "pnpm run snyk:test && pnpm run snyk:code",
 		"snyk:report": "pnpm run snyk:monitor && pnpm run snyk:code:report",

packages/cellix/archunit-tests/package.json

@@ -43,8 +43,8 @@
 	},
 	"scripts": {
 		"prebuild": "biome lint",
-		"build": "tsgo --build",
-		"watch": "tsgo --watch",
+		"build": "tsc --build",
+		"watch": "tsc --watch",
 		"test": "vitest run",
 		"test:arch": "vitest run",
 		"test:coverage": "pnpm run test",

packages/cellix/server-mongodb-memory-mock-seedwork/src/index.ts

@@ -25,7 +25,12 @@ export async function startMongoMemoryReplicaSet(config: MongoMemoryReplicaSetCo
 			count: 1,
 			storageEngine: 'wiredTiger',
 		},
-		instanceOpts: [{ port: config.port }],
+		instanceOpts: [
+			{
+				port: config.port,
+				args: ['--setParameter', 'maxTransactionLockRequestTimeoutMillis=5000'],
+			},
+		],
 	});
 
 	const uri = replicaSet.getUri(config.dbName);

packages/cellix/server-oauth2-mock-seedwork/package.json

@@ -18,7 +18,7 @@
 		"test:watch": "vitest"
 	},
 	"dependencies": {
-		"express": "^4.22.0",
+		"express": "^4.22.2",
 		"express-rate-limit": "^8.5.1",
 		"jose": "^5.9.6"
 	},

packages/ocom-verification/acceptance-api/.c8rc.json

@@ -1,7 +1,7 @@
 {
-	"all": true,
-	"include": ["src/**/*.ts"],
-	"exclude": ["node_modules", "dist"],
+	"allowExternal": true,
+	"include": ["**/ocom/application-services/dist/**", "**/ocom/domain/dist/**", "**/ocom/graphql/dist/**", "**/ocom/persistence/dist/**", "**/ocom/data-sources-mongoose-models/dist/**"],
+	"exclude": ["**/node_modules/**"],
 	"reporter": ["text", "lcovonly"],
 	"report-dir": "coverage"
 }

packages/ocom-verification/acceptance-api/package.json

@@ -7,6 +7,7 @@
 	"scripts": {
 		"test:acceptance": "LOG_LEVEL=warn NODE_OPTIONS='--import tsx/esm' cucumber-js --format json:./reports/cucumber-report-api.json",
 		"test:acceptance:coverage": "LOG_LEVEL=warn NODE_OPTIONS='--import tsx/esm' c8 --allowExternal -- cucumber-js --format json:./reports/cucumber-report-api.json",
+		"test:coverage:acceptance": "LOG_LEVEL=warn NODE_OPTIONS='--import tsx/esm' c8 -- cucumber-js --format json:./reports/cucumber-report-api.json",
 		"verification:test:coverage:report": "c8 report --allowExternal",
 		"clean": "rimraf dist reports target coverage coverage-c8 coverage-vitest .c8-output"
 	},

packages/ocom-verification/acceptance-api/src/contexts/authentication/step-definitions/header-login.steps.ts

@@ -0,0 +1,53 @@
+import { Given, Then, When } from '@cucumber/cucumber';
+import { actorCalled, notes } from '@serenity-js/core';
+
+interface HeaderApiNotes {
+	identityProviderUnreachable: boolean;
+	signinRedirectInvoked: boolean;
+	fallbackTriggered: boolean;
+}
+
+let lastActorName = 'Alex';
+
+// Header sign-in is a UI-only concern. These step bindings keep the shared
+// feature in sync across layers without exercising any API behaviour.
+
+Given('{word} visits the community site', async (actorName: string) => {
+	lastActorName = actorName;
+	const actor = actorCalled(actorName);
+	await actor.attemptsTo(notes<HeaderApiNotes>().set('identityProviderUnreachable', false), notes<HeaderApiNotes>().set('signinRedirectInvoked', false), notes<HeaderApiNotes>().set('fallbackTriggered', false));
+});
+
+Given('{word} visits the staff site', async (actorName: string) => {
+	lastActorName = actorName;
+	const actor = actorCalled(actorName);
+	await actor.attemptsTo(notes<HeaderApiNotes>().set('identityProviderUnreachable', false), notes<HeaderApiNotes>().set('signinRedirectInvoked', false), notes<HeaderApiNotes>().set('fallbackTriggered', false));
+});
+
+Given('the identity provider is unreachable', async () => {
+	const actor = actorCalled(lastActorName);
+	await actor.attemptsTo(notes<HeaderApiNotes>().set('identityProviderUnreachable', true));
+});
+
+When('{word} chooses to sign in', async (actorName: string) => {
+	lastActorName = actorName;
+	const actor = actorCalled(actorName);
+	const unreachable = await actor.answer(notes<HeaderApiNotes>().get('identityProviderUnreachable'));
+	await actor.attemptsTo(notes<HeaderApiNotes>().set('signinRedirectInvoked', !unreachable), notes<HeaderApiNotes>().set('fallbackTriggered', unreachable));
+});
+
+Then('{word} is taken to the sign-in flow', async (actorName: string) => {
+	const actor = actorCalled(actorName);
+	const invoked = await actor.answer(notes<HeaderApiNotes>().get('signinRedirectInvoked'));
+	if (!invoked) {
+		throw new Error(`Expected ${actorName} to be taken to the sign-in flow, but the sign-in handler was not invoked`);
+	}
+});
+
+Then('{word} can still reach the sign-in page', async (actorName: string) => {
+	const actor = actorCalled(actorName);
+	const fallback = await actor.answer(notes<HeaderApiNotes>().get('fallbackTriggered'));
+	if (!fallback) {
+		throw new Error(`Expected ${actorName} to reach the sign-in page via the fallback path, but the fallback was not triggered`);
+	}
+});

packages/ocom-verification/acceptance-api/src/contexts/authentication/step-definitions/index.ts

@@ -0,0 +1,2 @@
+// Authentication context step definitions
+import './header-login.steps.ts';

packages/ocom-verification/acceptance-api/src/shared/support/application-services/mock-application-services.ts

@@ -33,7 +33,7 @@ function createNoOpApolloServerService(): ServiceApolloServer<Record<string, nev
 		get service(): never {
 			return notImplemented() as never;
 		},
-	} as unknown as ServiceApolloServer<BaseContext>;
+	} as unknown as ServiceApolloServer<Record<string, never>>;
 }
 
 export function createMockApplicationServicesFactory(serviceMongoose: ServiceMongoose): ApplicationServicesFactory {