feat: additional end to end tests

.github/CODEOWNERS

@@ -1,4 +1,4 @@
 # This is a managed file. Manual changes will be overwritten.
 # https://github.com/FusionAuth/fusionauth-public-repos/
 
-.github/ @fusionauth/owners @fusionauth/platform
+.github/ @fusionauth/owners @fusionauth/platform @fusionauth/sdk-owners

.github/workflows/lint-and-format.yml

@@ -2,7 +2,6 @@ name: Lint and Format
 
 on:
   pull_request:
-    branches: [main]
 
 jobs:
   check:

.github/workflows/run-tests.yml

@@ -2,7 +2,6 @@ name: Run Tests
 
 on:
   pull_request:
-    branches: [main]
 
 jobs:
   test:

AGENTS.md

@@ -0,0 +1,64 @@
+# AGENTS.md — fusionauth-javascript-sdk
+
+## Repo Layout
+
+Yarn workspace monorepo:
+
+- `packages/core` — `@fusionauth-sdk/core`, shared logic for React/Angular/Vue SDKs
+- `packages/lexicon` — `@fusionauth-sdk/lexicon`, shared utility types (Path, GUID, etc.)
+- `packages/sdk-react` — `@fusionauth/react-sdk`
+- `packages/sdk-angular` — Angular SDK (`sdk-angular-workspace`)
+- `packages/sdk-vue` — `@fusionauth/vue-sdk`
+
+## Package Manager
+
+- **Yarn 1.22.x** via Corepack, not npm. `yarn` may not be on `PATH` directly —
+  use `corepack yarn <cmd>` if plain `yarn` isn't found.
+- Root scripts: `yarn build:core`, `yarn build:sdk-react`, etc. Per-workspace:
+  `yarn workspace @fusionauth-sdk/core test`.
+
+## Node Version Constraint
+
+- **Angular SDK requires Node ^22.22.3 / ^24.15.0 / >=26.0.0.** If the active
+  Node is v20.x, `yarn workspace sdk-angular-workspace test` (and the root
+  `yarn test` which runs it) will fail with an engine/CLI version error.
+  This is an environment limitation, not a code issue — don't try to "fix" it
+  by changing the Angular config.
+- If `yarn install` complains about the Angular engine mismatch, use
+  `yarn install --ignore-engines`.
+
+## Testing
+
+- Vitest, `environment: 'jsdom'` (see each package's `vite.config.ts`).
+- `packages/core` tests needing `indexedDB` must polyfill it with
+  `fake-indexeddb`'s `IDBFactory` (jsdom has no native IndexedDB).
+- Husky's `.husky/pre-commit` hook runs `yarn test` across **all** workspaces
+  plus `lint-staged`. In environments without Node 22+, this hook will fail
+  on the Angular workspace even when your actual changes are fine — verify
+  the specific package's tests pass, note that the Angular failure is
+  environmental, and use `git commit --no-verify` if needed (call this out
+  explicitly to the user rather than silently bypassing).
+
+## Lint / Format
+
+- ESLint config: root `.eslintrc.json` (`@typescript-eslint`, warns on unused
+  vars, `prefer-const`).
+- Prettier: root `.prettierrc` (single quotes, semi, trailing commas, 80 print
+  width). Run `npx prettier --check <paths>` / `--write` before committing.
+
+## Code Conventions
+
+- Each module lives in its own folder with `X.ts`, `X.test.ts`, and an
+  `index.ts` barrel export (see `UrlHelper/`, `CookieHelpers/`, `DPoP/`).
+- Constructors that take more than one argument use a config object (e.g.
+  `DPoPStorageConfig`, `UrlHelperConfig`) rather than positional parameters.
+- Browser-only APIs (`localStorage`, `indexedDB`, etc.) should degrade
+  gracefully for non-browser/SSR consumers — see `RedirectHelper.ts`'s
+  try/catch fallback pattern.
+- Doc comments (`/** ... */`) on all public `SDKConfig` fields and public
+  class methods, matching existing style.
+- **IndexedDB `dbVersion`**: IndexedDB versions can only increase. Never pass
+  a `dbVersion` lower than one already persisted in a browser — doing so
+  produces a `VersionError` and the database will not open. Only increment
+  `dbVersion` when a structural schema change (e.g. new object store) is also
+  being made inside `onupgradeneeded`.

README.md

@@ -89,6 +89,14 @@ The e2e tests are structured to use the Page Object Model (POM) design pattern.
     Example: In common.page.ts, methods for navigation and authentication are defined.
 Tests import these page objects to perform actions, ensuring that if the UI changes, only the page object needs updating, not all the tests.
 
+### DPoP E2E tests
+
+`e2e/tests/dpop-endpoints.test.ts` — mirrors `endpoints.test.ts`, but drives a consuming quickstart application configured with `useDpop: true` through its UI. Since DPoP mode has no hosted backend mode (`SDKCore` talks directly to FusionAuth), this validates the *direct* calls to `/oauth2/authorize`, `/oauth2/token` (both the authorization code exchange and the refresh token grant), `/oauth2/userinfo`, and `/oauth2/logout`:
+  ```
+  SERVER_COMMAND="your-dpop-quickstart-start-command" PORT=your-port-number npx playwright test e2e/tests/dpop-endpoints.test.ts --config playwright.dpop-endpoints.config.ts
+  ```
+  This must be run on its own — it cannot be combined with `endpoints.test.ts` / `cookies.test.ts` in the same invocation, since those require a hosted backend mode quickstart instance instead.
+
 ## Architecture
 
 We use a monorepo because our SDKs share core functionality, which is contained in the @fusionauth-sdk/core package. This private module is bundled into the distributed SDK packages, allowing us to maintain core logic in a single place.

e2e/pages/common.page.ts

@@ -40,10 +40,8 @@ export class quickstartPage {
     await this.locators.passwordInput.clear();
     await this.locators.passwordInput.fill('password');
     await this.locators.submitBtn.click();
-    // Wait for the full OAuth callback chain to complete (form POST → /app/callback
-    // code exchange → redirect back to the app). Without this, webkit doesn't finish
-    // committing the session cookies before the test body reads them.
     await expect(this.locators.logOutBtn).toBeVisible();
+    await this.page.waitForLoadState('load');
   }
 
   async navToRegister() {
@@ -52,7 +50,16 @@ export class quickstartPage {
   }
 
   async logOut() {
+    const logoutNavigationPromise = this.page.waitForURL(
+      url => /\/(oauth2|app)\/logout/.test(url.pathname),
+      { timeout: 10_000 },
+    );
+
     await this.locators.logOutBtn.click();
+    await logoutNavigationPromise;
+
     await expect(this.locators.logInBtn.nth(0)).toBeVisible();
+    // See the comment in authenticate() above.
+    await this.page.waitForLoadState('load');
   }
 }