Merge pull request #142 from entur/fix/issue141

fix(#141): clear search filters on route change (import filter leak)

Author: dynnamitt

.claude/skills/e2e_runner/SKILL.md

@@ -71,8 +71,11 @@ curl -s -o /dev/null -w '%{http_code}\n' -X POST \
 ```
 
 Interpret:
-- **Sobek down** → live mode is impossible; tell the user to start it (`sobek`: `docker compose up`
-  then `mvn -pl sobek-app spring-boot:run`).
+- **Sobek down** → live mode is impossible; bring it up (`sobek`: `docker compose up` then
+  `mvn -pl sobek-app spring-boot:run`). For the **Autosys import** flow you also need **Shepet** on
+  :37998. Both are Java-21 apps with non-obvious snags (JDK-26 default breaks the build, Sobek↔Shepet
+  `sobek-common` API drift, Shepet's half-configured OAuth2 `internal` client) — full recipe + fixes
+  in `references/bringing-up-backends.md`.
 - **401 from Sobek** → live mode needs a real token. You MUST do the login handoff (next section);
   `config-no-auth.json` sends no token and will 401 against a secured Sobek.
 - **A dev server already on :5000 from another checkout** → Playwright reuses it
@@ -133,15 +136,17 @@ session token. This is the **proven recipe** (verified end-to-end):
    ⚠️ Playwright's `storageState` persists cookies + **localStorage only, not sessionStorage** — so
    you cannot rely on `storageState`. Capture the `oidc.user:*` entry explicitly and re-seed it via
    `addInitScript` for the serial run (snippet in harness-internals).
-5. **Verify the token before running — make-or-break.** Decode the JWT payload and confirm a
-   **`roles` claim exists**. A `partner.dev` token with only `scope: openid` and **no `roles`
-   claim** makes `organisations(onlyUserAuthorized:true)` return `INTERNAL_ERROR` (confirmed live) →
-   the org dropdown throws → `currentOrganisation` null → the "Loading data…" stall. That's a
-   token/permissions problem (roles not provisioned) or a Sobek bug — **not** a hathor query bug;
-   hathor's org query shape is correct. The non-authorized `organisations` path returns all orgs
-   fine, so use it to sanity-check connectivity. Fix paths: provision the login with role
-   assignments, guard Sobek's `getRoleAssignmentsForUser`, or have hathor stop sending
-   `onlyUserAuthorized: true` (dev-only — shows all orgs).
+5. **Verify the token before running — make-or-break.** The JWT does **not** need a `roles` claim —
+   Sobek resolves role assignments **backend-side** (from the token's `organisationID` claim via the
+   permission store), so a partner.dev token with only `scope: openid` is fine. Verify the *effect*,
+   not the claim: call `organisations(onlyUserAuthorized:true)` (filter type `OrganisationsFilter`)
+   and confirm it returns the user's authorized orgs. Empirically (2026-06-22) a no-roles-claim
+   partner.dev token returned 2 orgs (AtB + Agder) here. If that query **errors or comes back empty**,
+   the account has **no role assignments provisioned backend-side** (or the permission-store lookup
+   failed) → the org dropdown can't populate → `currentOrganisation` null → the "Loading data…"
+   stall. That's a backend role-provisioning/permission issue, **not** a missing-JWT-claim or hathor
+   query-shape problem (hathor's org query is correct). The non-authorized `organisations` path (no
+   filter) returns all orgs regardless — use it only to sanity-check connectivity, not authorization.
 
 Never paste the JWT into chat or commit it. Keep it in a gitignored file for the run only; short-lived.
 
@@ -203,3 +208,6 @@ per-entity reality rather than pretending a uniform create exists.
   vehicle-list trio, `waitForVehicleInList`), fixtures, serial config. Read before editing helpers.
 - `references/surfaces-and-testids.md` — per-entity create/edit surfaces, the full `data-testid`
   inventory, and which row-count assertions are hardcoded. Read before writing or auditing a spec.
+- `references/bringing-up-backends.md` — build + run recipes for Sobek (:37999) and Shepet (:37998)
+  under JDK 21, health checks, and the three startup snags (JDK version, `sobek-common` cross-repo
+  drift, Shepet's OAuth2 `internal` client). Read before starting the live backends.

.claude/skills/e2e_runner/references/bringing-up-backends.md

@@ -0,0 +1,90 @@
+# Bringing up the live backends (Sobek :37999 + Shepet :37998)
+
+Live mode needs **Sobek** for GraphQL/CRUD. The **Autosys import** flow additionally needs
+**Shepet** on :37998 (hathor's import dialog fetches `…/services/autosys?registrationNumber=…`
+from Shepet). PostGIS (:37433, Sobek's DB) comes up via `docker compose up` in `sobek/`.
+
+Both are **Java 21** Spring Boot apps. Build under JDK 21, run in the background, then confirm a
+`401` on the secured endpoints (= up + serving; the live e2e supplies a real partner JWT via the
+login handoff). Recipes below were verified end-to-end on 2026-06-22.
+
+## Recipe
+
+```bash
+J=~/.sdkman/candidates/java/21.0.10-oracle          # NOT the default 26 — see snag 1
+MVN=~/.sdkman/candidates/maven/current/bin/mvn       # `mvn` is a shell-fn alias; use the real binary
+
+# 0. PostGIS (if not already on :37433)
+( cd ~/entur/sobek && docker compose up -d )
+
+# 1. Build Sobek FIRST — it installs sobek-common into .m2 that Shepet compiles against
+( cd ~/entur/sobek   && JAVA_HOME=$J $MVN clean install -DskipTests )
+( cd ~/entur/shepet  && JAVA_HOME=$J $MVN clean install -DskipTests )   # AFTER sobek — see snag 2
+
+# 2. Run Sobek (3 local profiles), background
+( cd ~/entur/sobek && JAVA_HOME=$J $MVN -pl sobek-app spring-boot:run \
+    -Dspring-boot.run.profiles=local,local-blobstore,local-changelog )
+
+# 3. Run Shepet (local profile), background — env mapping + completed internal client, see snag 3
+( cd ~/entur/shepet && JAVA_HOME=$J \
+    AUTOSYS_API_APIKEY="$AUTOSYS_API_API_KEY" \
+    SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_INTERNAL_PROVIDER=internal \
+    SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_INTERNAL_AUTHORIZATION_GRANT_TYPE=client_credentials \
+    SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_INTERNAL_TOKEN_URI=https://partner.dev.entur.org/oauth/token \
+    $MVN -pl shepet-app spring-boot:run -Dspring-boot.run.profiles=local )
+```
+
+Verify (don't trust "Started … in Ns" alone — check the ports answer):
+
+```bash
+ss -ltn | grep -E ':37999|:37998'                                              # both listening
+curl -so/dev/null -w '%{http_code}\n' -XPOST localhost:37999/services/vehicles/graphql \
+  -H 'Content-Type: application/json' -d '{"query":"{__typename}"}'            # 401 = up, secured
+curl -so/dev/null -w '%{http_code}\n' 'localhost:37998/services/autosys?registrationNumber=A-1'  # 401 = up, secured
+curl -so/dev/null -w '%{http_code}\n' localhost:37998/health/ready             # 200 = permitAll health
+```
+
+`401` is the **healthy** state — both apps require a Bearer token. `000`/connection-refused = not up.
+
+## Snags (each cost real time the first time)
+
+1. **JDK 26 default breaks the build.** SDKMAN default is `26-oracle`; both projects need 21
+   (`<java.version>21</java.version>`). Under 26 the superpom's JaCoCo 0.8.13 dies with
+   `Unsupported class file major version 70`. Force `JAVA_HOME=~/.sdkman/candidates/java/21.0.10-oracle`
+   for every build/run. Also: `mvn` is a zsh shell-function alias (`mvn-or-mvnw`) that won't resolve
+   in non-interactive bash — call `~/.sdkman/candidates/maven/current/bin/mvn` directly.
+
+2. **Sobek ↔ Shepet cross-repo API drift.** Both pin `sobek.version=1.0.1-SNAPSHOT` (a *local*
+   SNAPSHOT), and Sobek `main` evolves independently. On 2026-06-22 Sobek had renamed
+   `KeyValuesHelper.AddToKeyValues` → `SetToKeyValues` (commit "Move functions used in Autosys to
+   sobek-common" + "Support mapping keyvalues both ways"); Shepet's HEAD still called the old name at
+   3 sites in `shepet-app/.../mapping/MapperService.java`. Building Sobek installs the renamed API
+   into `.m2`, so Shepet then fails to compile (`cannot find symbol AddToKeyValues`). The new
+   `SetToKeyValues(DataManagedObjectStructure,…)` is a type-safe, semantics-preserving superset
+   (upsert; `VehicleType extends DataManagedObjectStructure`), so the local unblock is a mechanical
+   rename of those call sites. **This is a real drift that wants a Shepet PR — do NOT commit the
+   rename from a hathor session; treat it as an uncommitted local workaround and flag it.** When the
+   build breaks on a `sobek-common` symbol, suspect this first; build Sobek *before* Shepet so Shepet
+   compiles against the fresh jar.
+
+3. **Shepet's OAuth2 `internal` client fails startup with partial config.** The env supplies the
+   client *credentials* (`SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_INTERNAL_CLIENT_ID` / `…_SECRET`)
+   but not the provider/token-uri, so Boot's oauth2-**client** autoconfig builds a registration named
+   `internal` with no provider → `Provider ID must be specified for client registration 'internal'`
+   at startup. That client is only used by the **baba** role-extractor path
+   (`@ConditionalOnProperty shepet.security.role.assignment.extractor=baba`); the default is `jwt`,
+   so it's never used at runtime — it just has to *construct*. Supply the three missing
+   `…INTERNAL_PROVIDER` / `…INTERNAL_AUTHORIZATION_GRANT_TYPE` / `…PROVIDER_INTERNAL_TOKEN_URI` env
+   vars (recipe above) and it boots. Also note the Autosys key env var name mismatch: the env holds
+   `AUTOSYS_API_API_KEY` but the property reads `${AUTOSYS_API_APIKEY}` — remap on launch.
+
+4. **These are session-scoped background processes.** Started via the agent's background Bash, they
+   die when the session/processes are killed. Re-run steps 2–3 (build artifacts persist in `.m2`) to
+   bring them back; no rebuild needed unless source changed.
+
+## Secrets
+
+The three Shepet secrets are already exported in the shell env (`AUTOSYS_API_API_KEY`, partner
+`SHEPET_OAUTH2_RESOURCESERVER_AUTH0_ENTUR_PARTNER_JWT_{ISSUER_URI,AUDIENCE}`, plus the internal
+client id/secret). **Never echo their values into chat, commits, or this file** — reference them by
+env-var name only.

.claude/skills/e2e_runner/references/harness-internals.md

@@ -33,7 +33,7 @@ Three skip flavours exist in the suite:
 - `test.skip(E2E_BACKEND === 'true', 'mock-bound assertions')` — mock-only specs
   (e.g. `vehicle-type-sidebar.spec.ts` save block, `vehicle-slider-form.spec.ts`).
 - `test.skip(() => E2E_BACKEND !== 'true', 'needs local Sobek')` — live-only specs
-  (`vehicle-type-save-live.spec.ts`, `import-to-detail.spec.ts`).
+  (`vehicle-type-save-live.spec.ts`).
 
 The conformance goal is to shrink categories 2 and 3 — most specs should be one body that works in
 both modes (relative assertions + read-back), reserving skips for genuinely mode-specific checks.
@@ -102,18 +102,25 @@ console.log('CAPTURED ' + user.k); await browser.close();
 
 ```bash
 TOK=$(jq -r '.v.access_token' playwright/.auth/oidc-user.json)
-# decode payload — MUST contain a `roles` claim
+# decode payload — just confirm it's a partner.dev token and not expired. It need NOT carry a
+# `roles` claim: Sobek resolves role assignments backend-side from the `organisationID` claim.
 echo "$TOK" | cut -d. -f2 | sed 's/-/+/g;s/_/\//g' | base64 -d 2>/dev/null | jq 'keys'
-# live: this throws INTERNAL_ERROR if the token has no roles claim
+# the REAL precondition — this returns the user's AUTHORIZED orgs (empty/error ⇒ no roles
+# provisioned backend-side, not a JWT-claim gap). filter type is OrganisationsFilter.
 curl -s -X POST http://localhost:37999/services/vehicles/graphql -H "Authorization: Bearer $TOK" \
   -H 'Content-Type: application/json' \
   -d '{"query":"query($f:OrganisationsFilter){organisations(filter:$f,size:3){totalElements}}","variables":{"f":{"onlyUserAuthorized":true}}}'
-# sanity (always works): the non-authorized path returns all orgs (~339)
+# sanity (works on any valid token): the non-authorized path returns all orgs (~339)
 curl -s -X POST http://localhost:37999/services/vehicles/graphql -H "Authorization: Bearer $TOK" \
   -H 'Content-Type: application/json' -d '{"query":"{organisations(size:3){totalElements}}"}'
 ```
-A `partner.dev` token with `scope:openid` and **no `roles`** → `organisations(onlyUserAuthorized:true)`
-`INTERNAL_ERROR` (confirmed 2026-06-05). That's the role-claim gap, not a hathor bug.
+The JWT needs **no `roles` claim** — Sobek resolves role assignments backend-side from the
+`organisationID` claim (permission store). Empirically (2026-06-22) a `scope:openid`, no-roles
+partner.dev token returned the user's 2 authorized orgs (AtB + Agder) here. If
+`onlyUserAuthorized:true` instead errors/empties, the account lacks backend-provisioned roles (or
+the permission lookup failed) — a backend issue, not a missing-claim or hathor-query bug. (An
+earlier 2026-06-05 note claimed the no-roles token `INTERNAL_ERROR`s — superseded; verify the
+effect, not the claim.)
 
 ### 3. Use it in the run
 
@@ -150,5 +157,5 @@ unfiltered list up to 5×/250ms for a freshly-created id; swallows transient err
 
 `playwright.config.ts` ~L32: `workers: process.env.CI || isNoAuth ? 1 : undefined`. Serial for
 no-auth (shared `config.json`) and in CI. Multi-step / mutating specs add
-`test.describe.configure({ mode: 'serial' })` (`no-auth.spec.ts` ~L38, `import-to-detail.spec.ts`
-~L6) so a step can read what the previous one wrote.
+`test.describe.configure({ mode: 'serial' })` (`no-auth.spec.ts` ~L38, `import-state-refresh.spec.ts`
+~L114) so a step can read what the previous one wrote.

e2e-tests/no-auth/autosys-multi-import.spec.ts

@@ -17,14 +17,14 @@ import { IS_LIVE, writeConfig, seedAuth } from './live-auth-helpers';
  *   - Aggregated import summary parsed from a single REG_NR fixture (1/1/1/1).
  * Modes:
  *   - mock (E2E_SUITE=no-auth): intercepts the VehicleTypes + Autosys GraphQL queries with fixtures; full dialog flow runs offline.
- *   - live (E2E_BACKEND=true): would fetch the real Autosys data via shepet on :37998 (no query intercepts).
- *   - skip-live: skipped when IS_LIVE — needs the shepet Autosys backend (:37998), a separate app not part of this Sobek-focused live run.
+ *   - live (E2E_BACKEND=true): fetches real Autosys data via shepet on :37998 (no query intercepts).
+ *     Needs a real plate — set E2E_AUTOSYS_REG_NR (the fixture "A-1" is not a real Autosys plate);
+ *     the 1/1/1/1 summary is plate-dependent under live.
  */
 test.describe('Autosys multi-import dialog', () => {
-  // The live path fetches from the shepet Autosys backend on :37998, which is a
-  // separate app outside this Sobek-focused live run (not running). Mock mode
-  // serves the Autosys fixture and still exercises the dialog end-to-end.
-  test.skip(IS_LIVE, 'requires the shepet Autosys backend (:37998), not part of this live run');
+  // Runs in BOTH modes now that shepet (:37998) is available locally: mock serves the
+  // Autosys fixture; live fetches real Autosys via shepet. The shepet-not-running guard
+  // was a temporary skip and has been removed.
 
   // writeConfig() (not a raw config-no-auth copy) so a live run leaves
   // config-with-auth on disk for the next serial spec, even though this one