test(platform): prove a self-hosted deployment boots with /o and no zone

Every live run was hosted Enterprise. The no-zone job now also runs its image as
a self-hoster would: not on a Sim hostname, billing off, no rollout flag.

The two live jobs cannot read each other's reports, so the parity check takes
--job and each job holds its own rows to its own run.

Author: waleedlatif1

.github/scripts/http-e2e.sh

@@ -555,14 +555,25 @@ JS
     ;;
 
   # No zone at all: built without SIM_PLATFORM_ORIGIN, so even with the flag on nothing may change.
+  # Then that image as a self-hoster runs it: not on a Sim hostname, billing off, no rollout flag.
+  # Both report, whichever fails.
   platform-live-flag-off)
     platform_live_environment
     export PLATFORM_ORG_UI=true
+    export ALLOWED_ORIGINS=http://127.0.0.1:3027
     start_browser_install platform-live --only-shell chromium
     start_app platform-live-flag-off 3027 'Main, no zone' record-http-status
     start_realtime platform-live-flag-off 3030
     wait_for_browsers
-    run_platform_live flag-off platform-live-flag-off
+    live_status=0
+    run_platform_live flag-off platform-live-flag-off || live_status=$?
+    stop_app
+    unset PLATFORM_ORG_UI BILLING_ENABLED NEXT_PUBLIC_BILLING_ENABLED
+    unset ENTERPRISE_ENABLED NEXT_PUBLIC_ENTERPRISE_ENABLED
+    export E2E_APP_PUBLIC_URL=http://127.0.0.1:3027 PLATFORM_LIVE_ORIGIN=http://127.0.0.1:3027
+    start_app platform-live-self-hosted 3027 'Main, self-hosted' record-http-status
+    run_platform_live self-hosted platform-live-self-hosted || live_status=$?
+    exit "$live_status"
     ;;
 
   *)

.github/workflows/platform-design.yml

@@ -112,7 +112,8 @@ jobs:
 
   # The Platform against the real stack: Postgres, Redis, migrations, the production main app and
   # the production Platform. `zone` is the deployed topology, and then that same build with the flag
-  # off. `flag-off` builds with no zone at all, so it is the only proof /org is truly absent.
+  # off. `flag-off` builds with no zone at all, so it is the only proof /org is truly absent, and
+  # then runs that build self-hosted.
   # Group environment and seed: `.github/scripts/http-e2e.sh`.
   live:
     name: live (${{ matrix.topology }})
@@ -189,12 +190,20 @@ jobs:
         if: always() && matrix.topology == 'zone'
         run: >-
           bun run check:platform-parity
+          --job zone
           --report "$RUNNER_TEMP/e2e/platform-live/report.json"
           --report "$RUNNER_TEMP/e2e/platform-live-zone-down/report.json"
           --report "$RUNNER_TEMP/e2e/platform-live-zone-5xx/report.json"
           --report "$RUNNER_TEMP/e2e/platform-live-zone-recovered/report.json"
           --report "$RUNNER_TEMP/e2e/platform-live-flag-off/report.json"
           --report "$RUNNER_TEMP/e2e/platform-live-rollout/report.json"
+      - name: Hold the parity ledger's flag-off rows to this run
+        if: always() && matrix.topology == 'flag-off'
+        run: >-
+          bun run check:platform-parity
+          --job flag-off
+          --report "$RUNNER_TEMP/e2e/platform-live-flag-off/report.json"
+          --report "$RUNNER_TEMP/e2e/platform-live-self-hosted/report.json"
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:

apps/sim/platform/checks/live/playwright.config.ts

@@ -4,7 +4,7 @@ import { defineConfig } from '@playwright/test'
 const report = process.env.PLATFORM_LIVE_REPORT_PATH ?? 'test-results/platform-live/report.json'
 
 /** Each needs its own stack, so each is its own folder and never part of the `zone` run. */
-const TOPOLOGIES = ['flag-off', 'zone-down', 'zone-recovered', 'rollout'] as const
+const TOPOLOGIES = ['flag-off', 'zone-down', 'zone-recovered', 'rollout', 'self-hosted'] as const
 
 /**
  * Runs against a real main app, Platform zone and database you have already started; it starts no
@@ -16,6 +16,7 @@ const TOPOLOGIES = ['flag-off', 'zone-down', 'zone-recovered', 'rollout'] as con
  * - `zone-down`: the flag is on and the zone is gone or answers 5xx to everything.
  * - `zone-recovered`: the flag is on and the zone has just come back.
  * - `rollout`: flags read from AppConfig (`support/appconfig-service.ts`), targeting one organization.
+ * - `self-hosted`: no zone, not on a Sim hostname, billing off.
  */
 export default defineConfig({
   testDir: __dirname,

apps/sim/platform/checks/live/self-hosted/boot.spec.ts

@@ -0,0 +1,44 @@
+import { expect, test } from '@playwright/test'
+import { organizationId, signInAsAdmin } from '@/platform/checks/live/session'
+import { expectMainAppSurface, recordZoneRequests } from '@/platform/checks/live/support/surfaces'
+
+/**
+ * The image a self-hoster runs: no `SIM_PLATFORM_ORIGIN`, so no zone and no rewrite, on a hostname
+ * that is not Sim's, with billing off and no rollout flag. Every other live run is hosted Enterprise.
+ */
+test('a self-hosted deployment with no zone boots', async ({ request }) => {
+  const health = await request.get('/api/health')
+  expect(health.status()).toBe(200)
+})
+
+test('a self-hosted organization is served by the main app', async ({ page }) => {
+  const home = `/o/${organizationId()}/home`
+  await signInAsAdmin(page, home)
+  const surfaceResponse = await page.request.get('/api/organizations/surface')
+  expect(surfaceResponse.status()).toBe(200)
+  const surface = (await surfaceResponse.json()) as {
+    platformOrgUi: boolean
+    deployment: { hosted: boolean; billingEnabled: boolean }
+  }
+  expect(surface.platformOrgUi).toBe(false)
+  expect(surface.deployment.hosted).toBe(false)
+  expect(surface.deployment.billingEnabled).toBe(false)
+
+  const zoneRequests = recordZoneRequests(page)
+  for (const route of [home, `/o/${organizationId()}/settings/members`]) {
+    const response = await page.goto(route)
+    expect(response?.status(), route).toBe(200)
+    expect(response?.request().redirectedFrom(), route).toBeNull()
+    await expect(page).toHaveURL(new RegExp(`${route}(?:\\?|$)`))
+    await expectMainAppSurface(page)
+  }
+  expect(zoneRequests).toEqual([])
+})
+
+test('a self-hosted deployment has no /org', async ({ page }) => {
+  await signInAsAdmin(page, `/o/${organizationId()}/home`)
+  for (const path of ['/org', '/org/home']) {
+    const response = await page.goto(path)
+    expect(response?.status(), path).toBe(404)
+  }
+})

apps/sim/platform/docs/org-parity.md

@@ -377,3 +377,4 @@ The shell lane's rows, one per row of its audit. `shell.spec` is `checks/live/sh
 | A zone that recovers takes its organizations back | `lib/platform/zone-availability.ts` | Done | "a zone that comes back takes its organizations back" |
 | Per-organization rollout: `platform-org-ui` reaches a targeted organization by id and no other, on the same deployment, through the real AppConfig client against a fixture of its service | `lib/platform/rollout.ts`, `lib/core/config/feature-flags.ts` | Done | "a targeted organization is handed to the Platform", "an organization outside the rollout stays on /o". No real AppConfig deployment has been read |
 | A rollback under an open tab: a client navigation keeps working, because the rollout gate lives in a layout that does not re-render, and a reload's 404 offers a way off the zone | `live-shell.tsx`, `lib/data/landing.ts` | Done | "a rollback under an open tab"; `landing.test.ts` for the root's decision. The 404's home button used to loop back to it |
+| Self-hosted, no zone, no flag: boots, `/o` is served by the main app, `/org` is absent | `next.config.ts`, `lib/platform/rollout.ts` | Done | "a self-hosted deployment with no zone boots", "a self-hosted organization is served by the main app", "a self-hosted deployment has no /org", in the `live (flag-off)` job |

scripts/check-platform-parity.test.ts

@@ -4,12 +4,13 @@ import { auditLedger } from './check-platform-parity'
 const HEADER =
   '| Capability | Legacy source | Status | Proof or reason |\n| --- | --- | --- | --- |\n'
 
-function audit(rows: string, run?: Map<string, string>) {
+function audit(rows: string, run?: Map<string, string>, job?: 'zone' | 'flag-off') {
   return auditLedger({
     ledger: `${HEADER}${rows}`,
     testFiles: new Set(['home.spec.ts', 'home-model.test.ts']),
     liveTitles: ['a role change persists and a failed one is reported'],
     run,
+    job,
   })
 }
 
@@ -43,4 +44,24 @@ describe('auditLedger', () => {
     expect(audit(row, new Map([[title, 'skipped']]))[0]).toContain('skipped in this run')
     expect(audit(row, new Map())[0]).toContain('did not run')
   })
+
+  it('holds each live job to its own rows, and neither to the other', () => {
+    const title = 'a role change persists and a failed one is reported'
+    const zoneRow = '| Role | x | Done | "a role change persists" |\n'
+    const flagOffRow =
+      '| Role | x | Done | "a role change persists", in the `live (flag-off)` job |\n'
+
+    expect(audit(flagOffRow, new Map(), 'zone')).toEqual([])
+    expect(audit(zoneRow, new Map(), 'flag-off')).toEqual([])
+
+    expect(audit(zoneRow, new Map(), 'zone')[0]).toContain('did not run')
+    expect(audit(flagOffRow, new Map(), 'flag-off')[0]).toContain('did not run')
+    expect(audit(flagOffRow, new Map([[title, 'failed']]), 'flag-off')[0]).toContain('failed')
+    expect(audit(flagOffRow, new Map([[title, 'passed']]), 'flag-off')).toEqual([])
+  })
+
+  it('still refuses a row in another job when its test does not exist', () => {
+    const row = '| Role | x | Done | "nothing like this", in the `live (flag-off)` job |\n'
+    expect(audit(row, new Map(), 'zone')[0]).toContain('does not exist')
+  })
 })

scripts/check-platform-parity.ts

@@ -6,7 +6,10 @@
  * data without such a check is `Unverified`, and says why.
  *
  * With `--report <playwright.json>` (repeatable) it also reads what that run did: a row whose
- * proving test failed or was skipped is not Done, whatever the ledger says.
+ * proving test failed or was skipped is not Done, whatever the ledger says. The two live jobs build
+ * different apps and cannot read each other's reports, so `--job` holds each to its own rows: a row
+ * saying it is proved in the `live (flag-off)` job answers to that job's run, and every other row
+ * answers to `zone`'s.
  */
 import { readdirSync, readFileSync } from 'node:fs'
 import path from 'node:path'
@@ -19,6 +22,9 @@ const HEADERS = new Set([
 ])
 const FILE_PROOF = /[\w./-]+\.(?:integration\.ts|test\.tsx?|spec\.ts)/g
 const TITLE_PROOF = /"([^"]+)"/g
+const FLAG_OFF_JOB_PROOF = 'in the `live (flag-off)` job'
+const LIVE_JOBS = ['zone', 'flag-off'] as const
+type LiveJob = (typeof LIVE_JOBS)[number]
 
 /** Test title to its worst status in a run. */
 type RunOutcome = Map<string, string>
@@ -30,6 +36,8 @@ interface LedgerInputs {
   /** Titles of every test in the live specs. */
   liveTitles: readonly string[]
   run?: RunOutcome
+  /** Which job's run this is. Without it, the run answers for every row. */
+  job?: LiveJob
 }
 
 function cells(line: string): string[] {
@@ -48,7 +56,7 @@ function isLiveSpec(file: string): boolean {
   return file.endsWith('.spec.ts') && file.includes('checks/')
 }
 
-export function auditLedger({ ledger, testFiles, liveTitles, run }: LedgerInputs): string[] {
+export function auditLedger({ ledger, testFiles, liveTitles, run, job }: LedgerInputs): string[] {
   const findings: string[] = []
   let columns: number | null = null
   ledger.split('\n').forEach((line, index) => {
@@ -81,6 +89,7 @@ export function auditLedger({ ledger, testFiles, liveTitles, run }: LedgerInputs
     }
     if (!status.startsWith('Done')) return
 
+    const answersToThisRun = !job || proof.includes(FLAG_OFF_JOB_PROOF) === (job === 'flag-off')
     const quoted = [...proof.matchAll(TITLE_PROOF)].map((match) => match[1] as string)
     if (quoted.length === 0 && files.every(isLiveSpec)) {
       findings.push(
@@ -92,7 +101,7 @@ export function auditLedger({ ledger, testFiles, liveTitles, run }: LedgerInputs
         findings.push(`${at}: "${capability}" quotes a test that does not exist: "${title}"`)
         continue
       }
-      if (!run) continue
+      if (!run || !answersToThisRun) continue
       const outcomes = matchingTitles(title, run.keys()).map((match) => run.get(match))
       if (!outcomes.includes('passed')) {
         findings.push(
@@ -145,12 +154,17 @@ function main() {
       liveTitles.push(title as string)
     }
   }
-  const { values } = parseArgs({ options: { report: { type: 'string', multiple: true } } })
+  const { values } = parseArgs({
+    options: { report: { type: 'string', multiple: true }, job: { type: 'string' } },
+  })
+  const job = LIVE_JOBS.find((candidate) => candidate === values.job)
+  if (values.job && !job) throw new Error(`--job must be one of ${LIVE_JOBS.join(', ')}`)
   const findings = auditLedger({
     ledger: readFileSync(path.join(app, 'platform/docs/org-parity.md'), 'utf8'),
     testFiles,
     liveTitles,
     run: values.report ? readRunOutcome(values.report) : undefined,
+    job,
   })
   if (findings.length > 0) {
     console.error(`check:platform-parity: ${findings.length} finding(s)\n`)