From bd48de69ee9f4f9f6d89ff20a3fa881c9d692757 Mon Sep 17 00:00:00 2001
From: iven <iven_h@qq.com>
Date: Fri, 10 Apr 2026 21:34:07 +0800
Subject: [PATCH] =?UTF-8?q?fix(test):=20P2-03=20rate=20limit=20=E2=80=94?=
 =?UTF-8?q?=20share=20auth=20token=20across=20cross-system=20smoke=20tests?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

6 tests each called saasLogin() → 6 login requests in <60s → hit 5/min/IP
rate limit on the 6th test. Now login once per worker, reuse token for all
6 tests. Reduces login API calls from 6 to 1.
---
 desktop/tests/e2e/specs/smoke_cross.spec.ts | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/desktop/tests/e2e/specs/smoke_cross.spec.ts b/desktop/tests/e2e/specs/smoke_cross.spec.ts
index 859cddf..616330e 100644
--- a/desktop/tests/e2e/specs/smoke_cross.spec.ts
+++ b/desktop/tests/e2e/specs/smoke_cross.spec.ts
@@ -21,7 +21,12 @@ const SaaS_BASE = 'http://localhost:8080/api/v1';
 const ADMIN_USER = 'admin';
 const ADMIN_PASS = 'admin123';
 
-async function saasLogin(page: Page): Promise<string> {
+// Shared token — login once per worker to avoid rate limiting (5 req/min/IP).
+// Workers are isolated processes, so this is safe for parallel execution.
+let _sharedToken: string | null = null;
+
+async function getSharedToken(page: Page): Promise<string> {
+  if (_sharedToken) return _sharedToken;
   const res = await page.request.post(`${SaaS_BASE}/auth/login`, {
     data: { username: ADMIN_USER, password: ADMIN_PASS },
   });
@@ -31,7 +36,13 @@ async function saasLogin(page: Page): Promise<string> {
   }
   expect(res.ok()).toBeTruthy();
   const json = await res.json();
-  return json.token;
+  _sharedToken = json.token;
+  return _sharedToken;
+}
+
+// Keep saasLogin as alias for individual test clarity
+async function saasLogin(page: Page): Promise<string> {
+  return getSharedToken(page);
 }
 
 async function waitForDesktopReady(page: Page) {