Bring master up to develop: retry-poisoning fix and the Cypress 15 toolchain

e2e-tests/.eslintrc.js

@@ -1,3 +1,6 @@
+// typescript-eslint has no TS 7 support yet; point it at the TS 6 API (see the shim).
+require('./scripts/register-typescript-eslint-compat.cjs');
+
 module.exports = {
   env: {
     browser: true,
@@ -19,6 +22,12 @@ module.exports = {
     }
   },
   rules: {
+    // @typescript-eslint 8 promotes these to errors in `recommended`. The suite predates that; keep
+    // them visible as warnings until a dedicated cleanup, so a toolchain bump does not rewrite tests.
+    '@typescript-eslint/no-explicit-any': 'warn',
+    '@typescript-eslint/no-unused-vars': ['warn', { args: 'none' }],
+    '@typescript-eslint/no-unused-expressions': 'warn',
+    '@typescript-eslint/no-require-imports': 'warn',
     'prettier/prettier': 'error',
     'import/extensions': 'off',
     'import/no-extraneous-dependencies': 'off',

e2e-tests/cypress.config.ts

@@ -1,7 +1,11 @@
+import { createRequire } from 'node:module';
 import { defineConfig } from 'cypress';
+import createBundler from '@bahmutov/cypress-esbuild-preprocessor';
 
 export default defineConfig({
   chromeWebSecurity: false,
+  // Only useful during interactive `cypress open`.
+  watchForFileChanges: false,
   experimentalMemoryManagement: true,
   numTestsKeptInMemory: 0,
   env: {
@@ -32,8 +36,14 @@ export default defineConfig({
     // We've imported your old cypress plugins here.
     // You may want to clean this up later by importing these.
     setupNodeEvents(on, config) {
-      // eslint-disable-next-line @typescript-eslint/no-var-requires,global-require
-      return require('./cypress/plugins/index.ts')(on, config);
+      // The default webpack + ts-loader preprocessor needs TypeScript's classic Program API, which
+      // TypeScript 7 does not ship. esbuild strips the TypeScript syntax without it.
+      on('file:preprocessor', createBundler({ tsconfigRaw: { compilerOptions: { target: 'es2015' } } }));
+      // Cypress 15 loads this config through tsx, possibly as ESM, where bare `require` is absent.
+      // @ts-expect-error TypeScript checks this project as CJS, but Cypress can load the config as ESM.
+      const nodeRequire = createRequire(import.meta.url);
+      nodeRequire('esbuild-register');
+      return nodeRequire('./cypress/plugins/index.ts')(on, config);
     },
     baseUrl: 'https://localhost:5601',
     videosFolder: '../results/videos',

e2e-tests/cypress/e2e/Kibana-config.cy.ts

@@ -146,7 +146,6 @@ describe.skip('Kibana-config', () => {
     // not take — and it then fails all three retries, so it is settled state and not a slow page.
     // It behaves the same with clearSessionOnEvents set and unset, so it is not that. The other
     // eight tests here are steady, so this is skipped rather than left to erode the signal.
-    // eslint-disable-next-line jest/no-disabled-tests -- see the FIXME above
     it.skip('should open correct tenancy after login when custom middleware sets defaultGroup', () => {
       Login.initialization();
 

e2e-tests/cypress/e2e/Reporting.cy.ts

@@ -26,6 +26,12 @@ if (semver.gte(getKibanaVersion(), '8.15.0')) {
       let oldFormatReportingName: string;
 
       beforeEach(() => {
+        // verifySavedReport counts every listed report, so this suite needs an empty report store
+        // plus exactly the one fixture doc it adds below. afterEach cannot promise that on its own:
+        // a failed hook skips the rest of the cleanup and the next retry then counts the previous
+        // attempt's reports too. Prune first, then add the fixture - the prune also clears
+        // `.reporting*` docs, so the two steps must stay in this order.
+        esApiAdvancedClient.pruneAllReportingIndicesUntilEmpty();
         cy.fixture('old_format_reporting_doc.json').then(oldFormatReportingDoc => {
           oldFormatReportingName = oldFormatReportingDoc.payload.title;
           esApiClient.addDocument(oldFormatReportingIndex, oldFormatReportingDoc.id, oldFormatReportingDoc);
@@ -80,12 +86,24 @@ if (semver.gte(getKibanaVersion(), '8.15.0')) {
   testData.forEach(({ username, password, index }) => {
     const reportingName = `report for ${index} index`;
 
-    afterEach(() => {
-      kbnApiAdvancedClient.deleteSavedObjects(`${username}:${password}`);
-      esApiAdvancedClient.pruneAllReportingIndices();
-      esApiClient.deleteIndex(reportingSampleIndex);
-    });
     describe(`Reporting tests for ${username}`, () => {
+      // Inside the describe, not beside it. A hook registered outside attaches to the spec's ROOT
+      // suite, so testData's two entries give two copies that run before and after EVERY test in
+      // the file, including the >=8.15 suite, which does its own pruning.
+      //
+      // Same reason as the >=8.15 suite above: give every attempt its own empty report store,
+      // because a skipped afterEach otherwise makes each retry fail on the leftovers instead of
+      // the real error.
+      beforeEach(() => {
+        esApiAdvancedClient.pruneAllReportingIndicesUntilEmpty();
+      });
+
+      afterEach(() => {
+        kbnApiAdvancedClient.deleteSavedObjects(`${username}:${password}`);
+        esApiAdvancedClient.pruneAllReportingIndices();
+        esApiClient.deleteIndex(reportingSampleIndex);
+      });
+
       it('should correctly display all reporting data', () => {
         Login.initialization({ credentials: { username, password } });
         SampleData.createSampleData(reportingSampleIndex, 1);

e2e-tests/cypress/e2e/Sanity-check.cy.ts

@@ -14,6 +14,14 @@ import { Tenancy } from '../support/page-objects/Tenancy';
 
 describe('sanity check', () => {
   beforeEach(() => {
+    // The report assertions below count every row the reporting page lists, so the test needs an
+    // empty report store to start from. afterEach alone cannot promise that: when a hook fails, the
+    // rest of it is skipped, and a retry then starts with the previous attempt's report still there
+    // and fails with "Too many elements found" instead of the real error.
+    //
+    // UntilEmpty, not the bare prune: attempt 1 can leave a report queued but not yet written, and
+    // the bare prune would return before it lands.
+    esApiAdvancedClient.pruneAllReportingIndicesUntilEmpty();
     SampleData.createSampleData('sample_index', 1);
     Login.initialization();
   });

e2e-tests/cypress/plugins/index.ts

@@ -40,7 +40,7 @@ module.exports = (on: Cypress.PluginEvents, config: Cypress.PluginConfigOptions)
       });
 
       try {
-        const response: Response = await fetch(url, { method, headers, body, agent });
+        const response: Response = await fetch(url, { method, headers, body: body ?? undefined, agent });
 
         if (!response.ok && failOnStatusCode) {
           throw new Error(
@@ -164,22 +164,28 @@ module.exports = (on: Cypress.PluginEvents, config: Cypress.PluginConfigOptions)
 
       return new Promise((resolve, reject) => {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        embeddedServer = (https.createServer as any)(sslOptions, (_req: any, res: any) => {
-          const jwt = generateJwt({ sub: 'admin', group: ['administrators', 'infosec', 'template'], iat: Math.floor(Date.now() / 1000) });
+        const server = (https.createServer as any)(sslOptions, (_req: any, res: any) => {
+          const jwt = generateJwt({
+            sub: 'admin',
+            group: ['administrators', 'infosec', 'template'],
+            iat: Math.floor(Date.now() / 1000)
+          });
           const htmlWithJwt = html.toString().replace(/jwt=[^&"#\s]+/, `jwt=${jwt}`);
           res.writeHead(200, { 'Content-Type': 'text/html' });
           res.end(htmlWithJwt);
         });
 
-        embeddedServer.listen(EMBEDDED_SERVER_PORT, () => {
+        // Take ownership only after the port is ours. If listen() fails we keep
+        // embeddedServer null, so the next call tries again instead of trusting a dead server.
+        server.listen(EMBEDDED_SERVER_PORT, () => {
+          embeddedServer = server;
           console.log(`Embedded server started at https://localhost:${EMBEDDED_SERVER_PORT}`);
           resolve(EMBEDDED_SERVER_PORT);
         });
 
-        embeddedServer.on('error', (err: NodeJS.ErrnoException) => {
+        server.on('error', (err: NodeJS.ErrnoException) => {
           if (err.code === 'EADDRINUSE') {
             console.log(`Port ${EMBEDDED_SERVER_PORT} already in use — assuming server is running`);
-            embeddedServer = null;
             resolve(EMBEDDED_SERVER_PORT);
           } else {
             reject(err);
@@ -243,10 +249,7 @@ module.exports = (on: Cypress.PluginEvents, config: Cypress.PluginConfigOptions)
     // specs and the failure video was wrongly deleted before upload.
     const failures =
       (results.stats && results.stats.failures > 0) ||
-      (results.tests || []).some((t) =>
-        t.state === 'failed' ||
-        (t.attempts || []).some((a) => a.state === 'failed')
-      );
+      (results.tests || []).some(t => t.state === 'failed' || (t.attempts || []).some(a => a.state === 'failed'));
     if (failures) return;
     try {
       await fs.promises.unlink(results.video);

e2e-tests/cypress/support/clipboardCapture.ts

@@ -0,0 +1,91 @@
+/**
+ * Records what the application under test copies, without depending on the OS clipboard.
+ *
+ * Chromium 138 (the Electron bundled with Cypress 15) requires transient user activation for both
+ * `navigator.clipboard.writeText()` and `document.execCommand('copy')`, and a Cypress-synthesized
+ * click provides none. So Kibana's copy buttons no longer reach the real clipboard and
+ * `readText()` resolves to an empty string. Both copy paths are therefore intercepted here, and
+ * `cy.getValueFromClipboard()` reads what was captured.
+ *
+ * Kibana's share panel copies through EUI's `copyToClipboard`, which never calls `writeText`: it
+ * stages the text in a hidden element, selects it, and calls `execCommand('copy')`. When Chromium
+ * suppresses that command it also stops dispatching the `copy` event — and that event is where
+ * ROR's own ClipboardInterception (proxy/preKibanaProxy/injection/scripts/tenancyContext) appends
+ * the tenancy parameter. Simply reading the staged selection would therefore bypass the very
+ * feature the tenancy specs assert on, so a synthetic copy event is dispatched instead: it bubbles
+ * through ROR's genuine handler, which enriches onto it, and the enriched value is what we record.
+ */
+
+/**
+ * Holds the text most recently copied by the application under test.
+ *
+ * Exported as a live object rather than a value on purpose: `cy.wrap(capture).its('text')` re-reads
+ * the property on every retry, so an assertion still passes when the copy lands a moment after the
+ * command was queued. Wrapping a plain string would freeze it at queue time.
+ */
+export const capture = { text: '' };
+
+/** A test must never pass on a value some earlier test copied. */
+export const resetClipboardCapture = (): void => {
+  capture.text = '';
+};
+
+/** Records every `navigator.clipboard.writeText`, whether or not the real write is permitted. */
+const wrapWriteText = (win: Cypress.AUTWindow): void => {
+  const { clipboard } = win.navigator;
+  const originalWriteText = clipboard.writeText.bind(clipboard);
+
+  clipboard.writeText = (text: string) => {
+    capture.text = String(text);
+    return originalWriteText(text).catch(() => undefined);
+  };
+};
+
+/** The text an `execCommand('copy')` would have put on the clipboard, had it been permitted. */
+const stagedSelection = (win: Cypress.AUTWindow): string => {
+  const active = win.document.activeElement as HTMLInputElement | HTMLTextAreaElement | null;
+  const isTextEntry = active !== null && (active.tagName === 'TEXTAREA' || active.tagName === 'INPUT');
+  const inputSelection = isTextEntry
+    ? (active.value ?? '').substring(active.selectionStart ?? 0, active.selectionEnd ?? active.value.length)
+    : '';
+
+  return inputSelection || (win.getSelection()?.toString() ?? '');
+};
+
+/** Runs the page's own `copy` handlers, and returns whatever they wrote to the event. */
+const enrichedByPageHandlers = (win: Cypress.AUTWindow): string => {
+  const dataTransfer = new win.DataTransfer();
+  const syntheticCopy = new win.ClipboardEvent('copy', {
+    clipboardData: dataTransfer,
+    bubbles: true,
+    cancelable: true
+  });
+
+  (win.document.activeElement ?? win.document).dispatchEvent(syntheticCopy);
+
+  return dataTransfer.getData('text/plain');
+};
+
+/** Records every `execCommand('copy')`, preferring what the page's own handlers produced. */
+const wrapExecCommandCopy = (win: Cypress.AUTWindow): void => {
+  const doc = win.document;
+  const originalExecCommand = doc.execCommand.bind(doc);
+
+  doc.execCommand = (commandId: string, showUI?: boolean, value?: string) => {
+    const result = originalExecCommand(commandId, showUI, value);
+
+    if (commandId === 'copy') {
+      const copied = enrichedByPageHandlers(win) || stagedSelection(win);
+      if (copied) {
+        capture.text = copied;
+      }
+    }
+
+    return result;
+  };
+};
+
+export const installClipboardCapture = (win: Cypress.AUTWindow): void => {
+  wrapWriteText(win);
+  wrapExecCommandCopy(win);
+};

e2e-tests/cypress/support/commands.ts

@@ -1,5 +1,6 @@
 import '@testing-library/cypress/add-commands';
 import 'cypress-network-idle';
+import { capture as clipboardCapture } from './clipboardCapture';
 
 Cypress.Commands.add(
   'kbnPost',
@@ -61,15 +62,17 @@ Cypress.Commands.add(
       impersonating,
       failOnStatusCode,
       headers
-    })
+    }) as Cypress.Chainable<unknown>
 );
 
-Cypress.Commands.add('esGet', ({ endpoint, credentials }, ...args) =>
-  cy.esRequest({
-    method: 'GET',
-    endpoint,
-    credentials
-  })
+Cypress.Commands.add(
+  'esGet',
+  ({ endpoint, credentials }, ...args) =>
+    cy.esRequest({
+      method: 'GET',
+      endpoint,
+      credentials
+    }) as Cypress.Chainable<unknown>
 );
 
 Cypress.Commands.add(
@@ -82,16 +85,18 @@ Cypress.Commands.add(
       currentGroupHeader,
       impersonating,
       failOnStatusCode
-    })
+    }) as Cypress.Chainable<unknown>
 );
 
-Cypress.Commands.add('esDelete', ({ endpoint, credentials, failOnStatusCode }, ...args) =>
-  cy.esRequest({
-    method: 'DELETE',
-    endpoint,
-    credentials,
-    failOnStatusCode
-  })
+Cypress.Commands.add(
+  'esDelete',
+  ({ endpoint, credentials, failOnStatusCode }, ...args) =>
+    cy.esRequest({
+      method: 'DELETE',
+      endpoint,
+      credentials,
+      failOnStatusCode
+    }) as Cypress.Chainable<unknown>
 );
 
 Cypress.Commands.add(
@@ -198,9 +203,36 @@ Cypress.Commands.add('urlShouldMatch', (urlPattern: string) => {
   return cy.url().should('match', new RegExp(`${baseUrl}${escapedPath}${suffix}$`));
 });
 
-Cypress.Commands.add('getValueFromClipboard', () => cy.window().then(win => win.navigator.clipboard.readText()));
+// .its() re-reads the property on every retry, which .then() would not - see clipboardCapture.ts.
+Cypress.Commands.add('getValueFromClipboard', () => cy.wrap(clipboardCapture, { log: false }).its('text'));
+
+// Cypress 15 types cy.wait's alias parameter as `@${string}`; mirroring it here means a forgotten
+// '@' prefix is a compile error instead of a silent numeric wait.
+Cypress.Commands.add(
+  'waitForResponse',
+  (alias: `@${string}`) =>
+    cy.wait(alias).then(({ response }) => {
+      if (!response) throw new Error(`Expected a response for ${alias}`);
+      return response;
+    }) as unknown as Cypress.Chainable<{ statusCode: number }>
+);
+
+Cypress.on('uncaught:exception', (err, runnable, promise) => {
+  /**
+   * Kibana keeps polling in the background (task manager, alerting, telemetry) while a test tears
+   * down. When the previous attempt's page is being logged out, one of those fetches can answer
+   * with a gateway status. Nothing in the app awaits that promise, so it surfaces as an unhandled
+   * rejection and fails whichever hook is running - usually an afterEach, which then skips the rest
+   * of the cleanup and poisons every following retry (RORDEV: Sanity-check "Too many elements
+   * found. Found '2', expected '1'").
+   *
+   * Only unhandled rejections are ignored here, never an error a test action waits on: `promise` is
+   * set only for a rejection no application code handled.
+   */
+  if (promise && /\b(Bad Gateway|Gateway Timeout|Service Unavailable)\b/.test(err.message)) {
+    return false;
+  }
 
-Cypress.on('uncaught:exception', (err, runnable) => {
   /**
    * Don't fail test when these specific errors from kibana platform
    */

e2e-tests/cypress/support/e2e.ts

@@ -15,9 +15,15 @@
 
 // Import commands.js using ES2015 syntax:
 import './commands';
+import { installClipboardCapture, resetClipboardCapture } from './clipboardCapture';
 
 // Alternatively you can use CommonJS syntax:
 // require('./commands')
+// Record what the app copies, so the specs never depend on the OS clipboard - see
+// clipboardCapture.ts for why Chromium 138 makes that necessary.
+Cypress.on('window:before:load', installClipboardCapture);
+beforeEach(resetClipboardCapture);
+
 /// <reference types="cypress" />
 
 declare global {
@@ -147,6 +153,7 @@ declare global {
       findByDataTestSubj(value: string, options?: any): Chainable<JQuery<HTMLElement>>;
       getValueFromClipboard(): Chainable<string>;
       urlShouldMatch(urlPattern: string): Chainable<string>;
+      waitForResponse(alias: `@${string}`): Chainable<{ statusCode: number }>;
     }
 
     type Payload = string | object;