test(desec): end-to-end Playwright coverage against a local mock

- desec-mock.mjs: a dependency-free Node mock of the deSEC API endpoints the code
  uses, with the real status-code semantics (202 on account creation, 403 until
  verified then 200 + token, 201/409 on domain creation) plus /__control hooks to
  verify and reset state.
- desec-register.spec.js / desec-existing.spec.js drive the real AIO UI through
  the register -> verify -> domain flow and the existing-account login flow;
  desec-helpers.js holds the shared login helper. Each scenario ends by setting a
  domain, so they run as separate CI steps with a re-seed in between.
- seed-desec-mock-config.php points desec_api_base / desec_update_url at the mock
  (config key only, no env override, so production is unaffected) and seeds a
  known master password, since seeding configuration.json makes AIO consider
  itself already installed and /setup no longer shows a generated password.
- Both Playwright workflows start the mock, mount ./community-containers so the
  caddy/dnsmasq definitions enabled by the flow are present, seed the config, and
  run the two deSEC specs with a re-seed between them.

Co-Authored-By: szaimen <42591237+szaimen@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>

.github/workflows/playwright-on-push.yml

@@ -20,6 +20,10 @@ concurrency:
 
 env:
   BASE_URL: https://localhost:8080
+  # Master password seeded into configuration.json for the deSEC test. Seeding the config
+  # makes AIO consider itself already installed, so /setup no longer generates/shows a
+  # password; the seed helper writes this one and the test logs in with it directly.
+  AIO_TEST_PASSWORD: correct horse battery staple aircraft
 
 jobs:
   test:
@@ -116,7 +120,7 @@ jobs:
 
       - name: Run Playwright tests for backup restore
         run: |
-          cd php/tests 
+          cd php/tests
           export DEBUG=pw:api
           if ! npx playwright test tests/restore-instance.spec.js; then
             docker logs nextcloud-aio-mastercontainer
@@ -124,6 +128,66 @@ jobs:
             exit 1
           fi
 
+      - name: Start deSEC mock and fresh development server
+        run: |
+          # The deSEC flow must not touch the real deSEC API, so point it at a local mock.
+          node php/tests/desec-mock.mjs 8090 > desec-mock.log 2>&1 &
+          echo $! > desec-mock.pid
+          docker rm --force nextcloud-aio-{mastercontainer,apache,notify-push,nextcloud,redis,database,domaincheck,whiteboard,imaginary,talk,collabora,borgbackup,caddy,dnsmasq} || true
+          docker volume rm nextcloud_aio_{mastercontainer,apache,database,database_dump,nextcloud,nextcloud_data,redis,backup_cache,elasticsearch} || true
+          # SKIP_DOMAIN_VALIDATION=false so the deSEC registration form is rendered; the deSEC
+          # flow sets the domain with validation skipped internally regardless of this.
+          docker run \
+            -d \
+            --init \
+            --name nextcloud-aio-mastercontainer \
+            --restart always \
+            --publish 8080:8080 \
+            --add-host host.docker.internal:host-gateway \
+            --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
+            --volume ./php:/var/www/docker-aio/php \
+            --volume ./community-containers:/var/www/docker-aio/community-containers \
+            --volume ./Containers/mastercontainer/internal.Caddyfile:/internal.Caddyfile \
+            --volume ./Containers/mastercontainer/headers.Caddyfile:/headers.Caddyfile \
+            --volume ./Containers/mastercontainer/start.sh:/start.sh \
+            --volume /var/run/docker.sock:/var/run/docker.sock:ro \
+            --env SKIP_DOMAIN_VALIDATION=false \
+            --env APACHE_PORT=11000 \
+            ghcr.io/nextcloud-releases/all-in-one:develop
+          echo Waiting for 10 seconds for the development container to start ...
+          sleep 10
+          # Point the running interface at the deSEC mock via configuration.json (config-only,
+          # no env override). The container runs PHP and has ./php mounted, so use the helper.
+          # AIO_TEST_PASSWORD is forwarded so the helper can seed the master password too.
+          docker exec --env AIO_TEST_PASSWORD="$AIO_TEST_PASSWORD" nextcloud-aio-mastercontainer \
+            php /var/www/docker-aio/php/tests/seed-desec-mock-config.php \
+            http://host.docker.internal:8090/api/v1 http://host.docker.internal:8090/update
+
+      - name: Run Playwright tests for deSEC domain registration
+        run: |
+          export DEBUG=pw:api
+          export DESEC_MOCK_URL=http://localhost:8090
+
+          # Each deSEC scenario ends by registering a domain, which persists in
+          # configuration.json and would hide the registration UI for the next scenario.
+          # Run each spec as its own step and re-seed (reset the deSEC state) in between.
+          reseed() {
+            docker exec --env AIO_TEST_PASSWORD="$AIO_TEST_PASSWORD" nextcloud-aio-mastercontainer \
+              php /var/www/docker-aio/php/tests/seed-desec-mock-config.php \
+              http://host.docker.internal:8090/api/v1 http://host.docker.internal:8090/update
+          }
+          dump_logs() {
+            docker logs nextcloud-aio-mastercontainer
+            echo "--- deSEC mock log ---"
+            cat "$GITHUB_WORKSPACE/desec-mock.log" || true
+          }
+
+          cd php/tests
+          if ! npx playwright test tests/desec-register.spec.js; then dump_logs; exit 1; fi
+          reseed
+          if ! npx playwright test tests/desec-existing.spec.js; then dump_logs; exit 1; fi
+          kill "$(cat "$GITHUB_WORKSPACE/desec-mock.pid")" || true
+
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ !cancelled() }}
         with:

.github/workflows/playwright-on-workflow-dispatch.yml

@@ -5,6 +5,10 @@ on:
 
 env:
   BASE_URL: https://localhost:8080
+  # Master password seeded into configuration.json for the deSEC test. Seeding the config
+  # makes AIO consider itself already installed, so /setup no longer generates/shows a
+  # password; the seed helper writes this one and the test logs in with it directly.
+  AIO_TEST_PASSWORD: correct horse battery staple aircraft
 
 jobs:
   test:
@@ -74,7 +78,7 @@ jobs:
 
       - name: Run Playwright tests for backup restore
         run: |
-          cd php/tests 
+          cd php/tests
           export DEBUG=pw:api
           if ! npx playwright test tests/restore-instance.spec.js; then
             docker logs nextcloud-aio-mastercontainer
@@ -82,6 +86,63 @@ jobs:
             exit 1
           fi
 
+      - name: Start deSEC mock and fresh development server
+        run: |
+          # The deSEC flow must not touch the real deSEC API, so point it at a local mock.
+          node php/tests/desec-mock.mjs 8090 > desec-mock.log 2>&1 &
+          echo $! > desec-mock.pid
+          docker rm --force nextcloud-aio-{mastercontainer,apache,notify-push,nextcloud,redis,database,domaincheck,whiteboard,imaginary,talk,collabora,borgbackup,caddy,dnsmasq} || true
+          docker volume rm nextcloud_aio_{mastercontainer,apache,database,database_dump,nextcloud,nextcloud_data,redis,backup_cache,elasticsearch} || true
+          # SKIP_DOMAIN_VALIDATION=false so the deSEC registration form is rendered; the deSEC
+          # flow sets the domain with validation skipped internally regardless of this.
+          # Mount ./php/tests so the locally-checked-out DesecManager is exercised.
+          docker run \
+            -d \
+            --init \
+            --name nextcloud-aio-mastercontainer \
+            --restart always \
+            --publish 8080:8080 \
+            --add-host host.docker.internal:host-gateway \
+            --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
+            --volume ./php/tests:/var/www/docker-aio/php/tests \
+            --volume /var/run/docker.sock:/var/run/docker.sock:ro \
+            --env SKIP_DOMAIN_VALIDATION=false \
+            --env APACHE_PORT=11000 \
+            ghcr.io/nextcloud-releases/all-in-one:develop
+          echo Waiting for 10 seconds for the development container to start ...
+          sleep 10
+          # Point the running interface at the deSEC mock via configuration.json (config-only,
+          # no env override). The container runs PHP and has ./php mounted, so use the helper.
+          # AIO_TEST_PASSWORD is forwarded so the helper can seed the master password too.
+          docker exec --env AIO_TEST_PASSWORD="$AIO_TEST_PASSWORD" nextcloud-aio-mastercontainer \
+            php /var/www/docker-aio/php/tests/seed-desec-mock-config.php \
+            http://host.docker.internal:8090/api/v1 http://host.docker.internal:8090/update
+
+      - name: Run Playwright tests for deSEC domain registration
+        run: |
+          export DEBUG=pw:api
+          export DESEC_MOCK_URL=http://localhost:8090
+
+          # Each deSEC scenario ends by registering a domain, which persists in
+          # configuration.json and would hide the registration UI for the next scenario.
+          # Run each spec as its own step and re-seed (reset the deSEC state) in between.
+          reseed() {
+            docker exec --env AIO_TEST_PASSWORD="$AIO_TEST_PASSWORD" nextcloud-aio-mastercontainer \
+              php /var/www/docker-aio/php/tests/seed-desec-mock-config.php \
+              http://host.docker.internal:8090/api/v1 http://host.docker.internal:8090/update
+          }
+          dump_logs() {
+            docker logs nextcloud-aio-mastercontainer
+            echo "--- deSEC mock log ---"
+            cat "$GITHUB_WORKSPACE/desec-mock.log" || true
+          }
+
+          cd php/tests
+          if ! npx playwright test tests/desec-register.spec.js; then dump_logs; exit 1; fi
+          reseed
+          if ! npx playwright test tests/desec-existing.spec.js; then dump_logs; exit 1; fi
+          kill "$(cat "$GITHUB_WORKSPACE/desec-mock.pid")" || true
+
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ !cancelled() }}
         with: