js/apps/admin-ui/test/utils/table.ts:112

• locator.count() does not auto-wait, unlike the previous click(). If the toolbar is still rendering, every count can be zero and this helper immediately throws; wait for an actionable candidate (for example with an auto-waiting combined locator) before deciding to use the overflow fallback.

  const exactButton = toolbar.getByRole("button", {
    name: itemName,
    exact: true,
  });
  if ((await exactButton.count()) > 0) {

js/apps/admin-ui/test/utils/constants.ts:6

• The environment override is not consistently applied: test/identity-providers/main.ts:4-8,99-100 still hard-codes http://localhost:8080. With KEYCLOAK_SERVER_URL set, login/admin calls target one server while those provider flows target another, so all server URL consumers need to use this constant.

export const SERVER_URL = normalizeServerUrl(
  process.env.KEYCLOAK_SERVER_URL ?? DEFAULT_SERVER_URL,
);

js/apps/admin-ui/test/clients/saml.ts:54

• Catching every error also hides missing controls, timeouts, and browser/page failures; the test can then save an unchanged form and pass on the success alert. Only skip the interaction when the control is explicitly disabled/read-only and let unexpected failures propagate.

  try {
    await switchOff(page, "#attributes\\.saml🍺force🍺post🍺binding");
  } catch {
    // Some generated SAML clients expose this setting as read-only.
  }

js/apps/admin-ui/test/autentication/flows.spec.ts:207

• The test now becomes skipped whenever all drag strategies fail, including when the product's reorder behavior has regressed. Keep the retrying helper, but fail when it returns false and retain the success-notification assertion so this behavior remains covered.

    test.skip(
      !moved,
      "Drag-and-drop reorder could not be triggered deterministically in this runtime.",
    );

js/apps/admin-ui/test/utils/table.ts:30

• These count() checks are immediate snapshots; waiting for tbody does not wait for its asynchronously filtered rows. Callers commonly press Enter and invoke this helper immediately (for example, clients/saml.spec.ts:102-103), so the helper can run through every zero count and throw before the requested row appears. Wait/poll for the candidate links or for table loading to finish before concluding that no match exists.

  if ((await exactTableLink.count()) > 0) {

js/apps/admin-ui/test/utils/table.ts:63

• These count() probes do not auto-wait for search results. Callers such as clients/saml.spec.ts invoke this immediately after pressing Enter, so a slow response can reach this branch with zero links and throw before the requested row renders; let the final locator click auto-wait instead.

  if ((await looseTableLink.count()) > 0) {
    await looseTableLink.click();
    return;
  }

  throw new Error(`Table row item "${itemName}" not found`);

js/apps/admin-ui/test/clients/saml.spec.ts:118

• This converts an unexpectedly disabled control into a skipped test, masking permission or rendering regressions. SamlConfig.tsx exposes this switch under FormAccess(role="manage-clients") and has no generated-client read-only mode, so this admin test should require the control to be enabled and fail if it is not.

    const postBindingResult = await clickPostBinding(page);
    // eslint-disable-next-line playwright/no-skipped-test -- Generated SAML clients can expose this setting as read-only.
    test.skip(
      postBindingResult === "read-only",
      "Post binding switch is read-only for this generated SAML client.",
    );

js/apps/admin-ui/test/utils/table.ts:58

• These count() checks are instantaneous. Callers commonly invoke this immediately after searchItem(), while the existing <tbody> is already visible but the filtered rows are still loading, so the helper can throw before Playwright's locator auto-waiting has a chance to find the link. Wait for the final matching locator instead of snapshotting its count.

  if ((await looseTableLink.count()) > 0) {

js/apps/admin-ui/test/utils/table.ts:30

• count() does not wait for asynchronously loaded rows. Since the table body is often rendered before its data (including immediately after searchItem), this helper can now throw before the requested link appears; wait for the matching link to become visible before deciding which fallback to use.

  if ((await exactTableLink.count()) > 0) {

js/apps/admin-ui/test/utils/table.ts:30

• These count() checks are immediate, so after searchItem() submits an asynchronous table refresh this helper can throw before the requested row is rendered. Keep Playwright's auto-waiting behavior (or explicitly wait for the target/loading state) before deciding which fallback locator to use.

  if ((await exactTableLink.count()) > 0) {

js/apps/admin-ui/test/utils/constants.ts:6

• A configured URL with a Keycloak context path is not handled consistently: for KEYCLOAK_SERVER_URL=https://host/auth, the admin client uses /auth, but navigateTo() resolves the absolute ROOT_PATH to https://host/admin/... and discards /auth. Preserve the configured pathname when constructing browser URLs so this environment option works with http-relative-path deployments.

export const SERVER_URL = normalizeServerUrl(
  process.env.KEYCLOAK_SERVER_URL ?? DEFAULT_SERVER_URL,
);

js/apps/admin-ui/test/clients/saml.spec.ts:118

• The SAML form does not make this switch read-only for generated clients (src/clients/add/SamlConfig.tsx:48-51); it is disabled only when the user lacks manage-clients access. Skipping here therefore hides a loading/authorization regression instead of testing the update—wait for the switch to be enabled and let the test fail if it never is.

    // eslint-disable-next-line playwright/no-skipped-test -- Generated SAML clients can expose this setting as read-only.
    test.skip(
      postBindingResult === "read-only",
      "Post binding switch is read-only for this generated SAML client.",
    );