MotirBuilding in public
MOTIR · moooon
onMotir
You’re viewing a public project. Anyone can view it — no account needed. Sign in to submit, upvote, or comment on requests.View-only — you can’t edit work items
MOTIR-439

6.14.9 E2E (playwright) — a public viewer expands a private epic → "not public" placeholder (tree + detail); a member sees the children; the admin toggles privacy

Done
Description

Estimate: 50m · Depends on: 6.14.5, 6.14.6, 6.14.7

Type: e2e (playwright) — the full epic-privacy loop in a browser, proving the server-side hiding + the placeholder + the member-bypass + the admin toggle end to end with a SECOND Motir account in a DIFFERENT org (the 6.12 cross-org public viewer).

The flow:

  1. As the motir project admin, on a project already made PUBLIC (6.12), mark an epic that has children private via the 6.14.7 control.
  2. Sign in as a SECOND, seeded Motir account in a DIFFERENT org with NO membership in the project. Open the public project tree → the private epic ROW is visible (title + "private" badge, NO child count / progress); EXPAND it → the "this epic is not public" placeholder renders instead of children. Open the epic’s DETAIL page → the CHILD PANEL shows the same "not public" statement.
  3. Confirm the children are absent from the public BOARD and from a SEARCH for a child’s title (as the public viewer).
  4. Sign in as a PROJECT MEMBER (second browser context) → the same epic shows its children normally in the tree-expand and the detail child-panel, with the real count / progress.
  5. As the admin, UNSET the epic’s privacy → the public viewer (re-loaded) now sees the children too (proving the toggle drives enforcement live).

Mind the prodect e2e selector + harness gotchas (combobox option = label + secondary; exact/level on heading selectors; the empty-state headings; run the dev server yourself + reuse it). Drive the real UI, not API shortcuts; use a second browser context for the second account; assert the children are absent from the network PAYLOAD for the public viewer, not just the DOM.

Acceptance criteria

  • The second (different-org) public viewer sees the private epic row (title + "private" badge, no count/progress), the "this epic is not public" placeholder on tree-expand AND in the detail child-panel, and no child match in the public board / search; the children are absent from the response payload (not just the DOM).
  • A project member sees the same epic’s children + real rollups normally (tree-expand + detail child-panel).
  • The admin set/unset toggle flips enforcement live (unsetting reveals the children to the public viewer on reload); the control is project-admin-gated.
  • The test drives the real UI (no API-only shortcuts), uses a second browser context, and follows the prodect E2E selector + run-harness conventions.

Context refs

  • 6.14.5 (tree placeholder) + 6.14.6 (detail child-panel placeholder) + 6.14.7 (the admin toggle) — the surfaces driven; 6.14.4 (the server-side enforcement) exercised through them.
  • scripts/plan-seed/data/story-6.12.ts § 6.12.10 — the cross-org public-project e2e (second-account-in-different-org harness) this builds on.
  • motir-core/e2e/ — the existing Playwright specs + the run-harness + selector conventions to mirror.