chore: Add Vault Mode CI setup for E2E tests and tests for second-factor authentication

[kavitagautam]

Description

This PR adds CI configuration to run Vault Mode E2E tests with Keycloak and MFA enabled.

Changes

• Added vault-storage to the Playwright E2E CI matrix.
• Enabled Keycloak and MFA/TOTP for Vault Mode tests.
• Added Vault-specific OIDC acr scope configuration.
• Enabled OCIS_ENABLE_VAULT_MODE and FRONTEND_ENABLE_VAULT_MODE.
• Added and started the dedicated storage-users-vault service in CI.
• Configured a dedicated Vault storage data directory for CI.
• Added Vault-specific CSP configuration.
• Added Vault Mode to partitioned Playwright E2E runs.
• Added/updated the Vault E2E test for second-factor authentication and Vault Mode access.
• Skiped storeKeycloakGroups() during vault-mode tests, where Keycloak group synchronization is not required.
• Used a new OIDC authorization-code login for OCIS token

Related Issue

• [QA] Add e2e tests for Vault mode web#13864

Motivation and Context

How Has This Been Tested?

• test environment:
• test case 1:
• test case 2:
• ...

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised:

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[mklos-kw]

Heads up. I'm working on CI pipeline using composite action here: #12609 In case it will be merged first I'll help you how to port this test to GHA too. No need to wait for #12609 - it's lower priority. Please continue

[Copilot]

Pull request overview

This PR extends the oCIS acceptance/E2E setup to run Playwright tests in Vault Mode (with Keycloak + MFA/TOTP), including CI matrix wiring and a new Vault-specific E2E spec plus supporting page objects/utilities.

Changes:

• Adds a new vault-storage Playwright suite to the GitHub Actions acceptance workflow and propagates the VAULT_STORAGE_NEEDED flag into the acceptance runner.
• Extends the acceptance E2E runner to enable Vault Mode + MFA/OIDC acr scope and start a dedicated storage-users-vault service with its own data directory.
• Introduces Vault Mode Playwright test coverage (steps/spec) plus a QR→OTP helper for authenticating into Vault.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
web/tests/e2e/support/utils/mfa.ts	Adds helper to generate OTP from a QR screenshot buffer.
web/tests/e2e/support/objects/vault/index.ts	Adds Vault page locators for mode switching and MFA flow elements.
web/tests/e2e/support/objects/vault/action.ts	Adds Vault interaction helpers (enter vault, screenshot QR, submit OTP, wait for redirect).
web/tests/e2e/steps/ui/vault.ts	Adds step definitions for switching Drive↔Vault and handling MFA authentication.
web/tests/e2e/steps/ui/index.ts	Exposes the new Vault UI steps via the UI steps barrel export.
web/tests/e2e/specs/vault-storage/vault.spec.ts	Adds a Vault Mode E2E spec exercising MFA and mode switching.
web/tests/e2e/environment/test.ts	Skips storeKeycloakGroups() during vault-mode tests via new config flag.
web/tests/e2e/config.js	Adds vaultMode config flag from VAULT_MODE env.
tests/acceptance/run-e2e.py	Enables Vault Mode + Keycloak/MFA plumbing and starts storage-users-vault for Vault E2E runs.
.github/workflows/acceptance-tests.yml	Adds vault-storage suite to the CI matrix and ensures Keycloak setup runs for it.

Suppressed comments (2)

web/tests/e2e/steps/ui/vault.ts:41

• captureQrCodeScreenshot() and userAuthenticatesWithOTP() are implemented on VaultActions (support/objects/vault/action.ts), not on VaultPage, so userAuthenticatesToVault will fail at compile time.

  const qrBuffer = await vaultPage.captureQrCodeScreenshot()
  const otp = await generateOtpFromScreenshot(qrBuffer)
  await vaultPage.userAuthenticatesWithOTP(otp)

web/tests/e2e/steps/ui/vault.ts:63

• userEntersDriveMode() is implemented on VaultActions (support/objects/vault/action.ts), not on VaultPage, so userSwitchesToDriveMode currently won't compile.

  await vaultPage.userEntersDriveMode()

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

Suppressed comments (2)

tests/acceptance/run-e2e.py:530

• KEYCLOAK_HOST is set in the base playwright_env even when keycloak_needed is false, and then set again inside the if keycloak_needed: block. This is redundant and can be confusing for non-Keycloak runs (it implies a Keycloak endpoint even when Keycloak isn't started). Consider only setting KEYCLOAK_HOST when keycloak_needed is true.

            "BROWSER": "chromium",
            "KEYCLOAK_HOST": "localhost:8443",
        }

web/tests/e2e/specs/vault-storage/vault.spec.ts:27

• ui.userAuthenticatesWithOTP() ultimately screenshots the QR code to a fixed qr.png path (see web/tests/e2e/support/objects/app-admin-settings/general/actions.ts). With Playwright running tests in parallel, this shared filename can cause races/corruption if more than one OTP test runs concurrently (e.g., when running multiple suites locally). Consider updating the OTP helper to write to a per-test/per-worker output path (e.g., testInfo.outputPath(...) or a worker-specific temp path) to avoid cross-test interference.

    await ui.userAuthenticatesWithOTP({ stepUser: 'Alice', deviceName: 'test' })