From 52975bd7156c09528f0750e7326c3b318d0e4403 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Thu, 22 Oct 2026 04:45:29 +0200
Subject: [PATCH] ci: test the webmail hand-off with a webmail session left in
 the browser

---
 .maestro/signin/07-webmail-totp.yaml    |  6 ++-
 .maestro/signin/20-webmail-session.yaml | 52 +++++++++++++++++++++++++
 scripts/e2e/run-flows.sh                |  1 +
 3 files changed, 57 insertions(+), 2 deletions(-)
 create mode 100644 .maestro/signin/20-webmail-session.yaml

diff --git a/.maestro/signin/07-webmail-totp.yaml b/.maestro/signin/07-webmail-totp.yaml
index 604bc9f7..a0d3e579 100644
--- a/.maestro/signin/07-webmail-totp.yaml
+++ b/.maestro/signin/07-webmail-totp.yaml
@@ -1,5 +1,7 @@
 # Webmail hand-off for a TOTP account: the webmail asks for the code; if it
-# hands back the password, the app finishes with a code of its own.
+# hands back the password, the app finishes with a code of its own. Uses the
+# beta webmail: the stable one still has 06's session in the browser, which
+# strands the hand-off (see 20-webmail-session.yaml).
 appId: org.bulwarkmail.mobile
 name: Webmail hand-off with TOTP
 tags:
@@ -9,7 +11,7 @@ tags:
 - runFlow:
     file: ../subflows/manual-server.yaml
     env:
-      HOST: ${WEBMAIL}
+      HOST: ${WEBMAIL_BETA}
 - tapOn: "Continue"
 - runFlow: ../subflows/allow-auth-session.yaml
 - runFlow:
diff --git a/.maestro/signin/20-webmail-session.yaml b/.maestro/signin/20-webmail-session.yaml
new file mode 100644
index 00000000..e2238aee
--- /dev/null
+++ b/.maestro/signin/20-webmail-session.yaml
@@ -0,0 +1,52 @@
+# Sign in via webmail while the browser still has a webmail session (from
+# 06-webmail, or from using the webmail in Safari): the hand-off must still
+# reach the app. Before the fix, the webmail's login page redirected an
+# existing session to its own inbox inside the sign-in sheet, and the app
+# never got the sign-in.
+appId: org.bulwarkmail.mobile
+name: Webmail hand-off with an existing webmail session
+tags:
+  - signin
+---
+# Leaves a webmail session in the shared browser cookies.
+- runFlow: ../subflows/start.yaml
+- runFlow:
+    file: ../subflows/manual-server.yaml
+    env:
+      HOST: ${WEBMAIL}
+- tapOn: "Continue"
+- runFlow: ../subflows/allow-auth-session.yaml
+- extendedWaitUntil:
+    visible: "user@example.com|Hand over to the app|.*Inbox.*"
+    timeout: 60000
+- runFlow:
+    when:
+      visible: "user@example.com"
+    commands:
+      - runFlow:
+          file: ../subflows/webmail-login-page.yaml
+          env:
+            LOGIN: ${ACCOUNT}@example.org
+- runFlow:
+    when:
+      visible: "Hand over to the app"
+    commands:
+      - tapOn: "Hand over to the app"
+- runFlow: ../subflows/inbox.yaml
+- runFlow: ../subflows/sign-out.yaml
+
+# Again: the webmail now knows the user.
+- extendedWaitUntil:
+    visible: "Enter server details manually"
+    timeout: 30000
+- runFlow:
+    file: ../subflows/manual-server.yaml
+    env:
+      HOST: ${WEBMAIL}
+- tapOn: "Continue"
+- runFlow: ../subflows/allow-auth-session.yaml
+- extendedWaitUntil:
+    visible: "user@example.com|Hand over to the app|Search mail.*"
+    timeout: 60000
+- takeScreenshot: webmail-session-01-second-visit
+- assertNotVisible: "Search mail.*"
diff --git a/scripts/e2e/run-flows.sh b/scripts/e2e/run-flows.sh
index 111d5695..e4b8b9ea 100644
--- a/scripts/e2e/run-flows.sh
+++ b/scripts/e2e/run-flows.sh
@@ -54,6 +54,7 @@ if [ $STATUS -eq 0 ]; then
     -e "ACCOUNT2=${E2E_ACCOUNT2:-}"
     -e "TOTP_ACCOUNT=${E2E_TOTP_ACCOUNT:-}"
     -e "WEBMAIL=${E2E_WEBMAIL:-}"
+    -e "WEBMAIL_BETA=${E2E_WEBMAIL_BETA:-https://bulwark-beta.internal.bulwarkmail.org}"
     -e "HELPER=http://127.0.0.1:${HELPER_PORT:-8787}"
     -e "ORIENTATION=${ORIENTATION:-portrait}"
     -e "DEVICE=${DEVICE:-phone}"