add retries to api data token setup and xsrf token fallback

e2e/utils/api.ts

@@ -21,15 +21,16 @@ export interface TestContext {
  *
  * The browser's native fetch includes the laravel_token cookie (set by
  * CreateFreshApiToken during the dashboard page load), so authentication
- * is handled by the browser's own cookie jar — no Playwright cookie sync
+ * is handled by the browser's own cookie jar. The returned Bearer token is
- * issues. The returned Bearer token is then used for all subsequent API
+ * then used for all subsequent API calls, making them independent of cookie state.
- * calls, making them completely independent of cookie state.
+ *
+ * If the first attempt returns 401 (Octane hasn't fully committed the session yet),
+ * we reload the page to trigger a fresh CreateFreshApiToken and retry once.
  */
 async function createApiToken(page: Page): Promise<string> {
+    for (let attempt = 0; attempt < 2; attempt++) {
         const result = await page.evaluate(async (baseUrl) => {
-        const xsrfCookie = document.cookie
+            const xsrfCookie = document.cookie.split('; ').find((c) => c.startsWith('XSRF-TOKEN='));
-            .split('; ')
-            .find((c) => c.startsWith('XSRF-TOKEN='));
             const xsrfToken = xsrfCookie
                 ? decodeURIComponent(xsrfCookie.split('=').slice(1).join('='))
                 : '';
@@ -45,20 +46,31 @@ async function createApiToken(page: Page): Promise<string> {
             });
 
             if (!res.ok) {
-            throw new Error(`Failed to create API token: ${res.status} ${await res.text()}`);
+                return null;
             }
 
             const body = await res.json();
             return body.data.access_token as string;
         }, PLAYWRIGHT_BASE_URL);
 
+        if (result) {
             return result;
         }
 
-function bearerHeaders(token: string): Record<string, string> {
+        // Reload to get a fresh laravel_token cookie and retry
+        await page.reload({ waitUntil: 'domcontentloaded' });
+    }
+
+    throw new Error('Failed to create API token after retry');
+}
+
+function buildAuthHeaders(token: string, xsrfToken: string): Record<string, string> {
     return {
         Accept: 'application/json',
         Authorization: `Bearer ${token}`,
+        // XSRF header is needed for web routes (e.g. PUT /teams) that go through
+        // VerifyCsrfToken middleware. API routes ignore it but it doesn't hurt.
+        ...(xsrfToken ? { 'X-XSRF-TOKEN': xsrfToken } : {}),
     };
 }
 
@@ -69,7 +81,11 @@ function bearerHeaders(token: string): Record<string, string> {
 export async function setupTestContext(page: Page): Promise<TestContext> {
     const token = await createApiToken(page);
     const request = page.request;
-    const headers = bearerHeaders(token);
+
+    const cookies = await page.context().cookies();
+    const xsrfCookie = cookies.find((c) => c.name === 'XSRF-TOKEN');
+    const xsrfToken = xsrfCookie ? decodeURIComponent(xsrfCookie.value) : '';
+    const headers = buildAuthHeaders(token, xsrfToken);
 
     const orgId = await getOrganizationId(request, headers);
     const memberId = await getCurrentMemberId(request, orgId, headers);