fix(rbac,testcontainers): make e2e healthcheck-require-plugins actually work

Three small fixes uncovered by running the e2e test locally:

- internal-packages/rbac/src/index.ts: attach a no-op .catch() to
  LazyController._init in the constructor. load() runs eagerly but its
  result is only awaited on the first method call. When load() rejects
  (REQUIRE_PLUGINS=1 + plugin missing), Node flags the unawaited
  rejection as unhandledRejection — newer Node versions kill the
  process before any consumer can await _init and convert the throw
  into a 500. The .catch() marks the rejection as handled at the
  global level; the actual error still re-throws when c() awaits _init.
- internal-packages/testcontainers/src/webapp.ts: when requirePlugins
  is set, explicitly override RBAC_FORCE_FALLBACK="0" so a local
  apps/webapp/.env that sets it to "1" doesn't short-circuit the loader
  past the REQUIRE_PLUGINS check. Without this, the test passes in CI
  (no .env file) but fails locally with no obvious error.
- internal-packages/testcontainers/src/webapp.ts: waitForHealthcheck
  now takes an `acceptAnyResponse` flag. When requirePlugins is set,
  /healthcheck is *expected* to return 500 (the whole point of the
  test), so the bootstrap waiter must accept any HTTP response rather
  than only 200 — otherwise startTestServer times out before the test
  can assert.

apps/webapp/test/healthcheck-require-plugins.e2e.test.ts: tidied up
the locally-linked-skip placeholder.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: matt-aitken

apps/webapp/test/healthcheck-require-plugins.e2e.test.ts

@@ -10,15 +10,32 @@
  * env can differ per case. Slow but isolated, matching api-auth.e2e.test.ts.
  *
  * Requires a pre-built webapp: pnpm run build --filter webapp
+ *
+ * The REQUIRE_PLUGINS=1 case relies on the plugin NOT being resolvable
+ * from the spawned webapp. CI satisfies this because the plugin isn't in
+ * pnpm-lock.yaml. Local devs who ran `pnpm dev:link-webapp` have the
+ * plugin symlinked into apps/webapp/node_modules — that case is detected
+ * and skipped below.
  */
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
 import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
 import type { TestServer } from "@internal/testcontainers/webapp";
 import { startTestServer } from "@internal/testcontainers/webapp";
 
+const LINKED_PLUGIN_PATH = resolve(
+  __dirname,
+  "..",
+  "node_modules",
+  "@triggerdotdev",
+  "plugins"
+);
+const pluginLocallyLinked = existsSync(LINKED_PLUGIN_PATH);
+
 vi.setConfig({ testTimeout: 180_000 });
 
 describe("/healthcheck with REQUIRE_PLUGINS", () => {
-  describe("REQUIRE_PLUGINS=1 + plugin missing", () => {
+  describe.skipIf(pluginLocallyLinked)("REQUIRE_PLUGINS=1 + plugin missing", () => {
     let server: TestServer;
 
     beforeAll(async () => {
@@ -42,6 +59,17 @@ describe("/healthcheck with REQUIRE_PLUGINS", () => {
     });
   });
 
+  // Surface the skip in dev so it doesn't go unnoticed. CI hits the real test above.
+  describe.runIf(pluginLocallyLinked)(
+    "REQUIRE_PLUGINS=1 + plugin LOCALLY LINKED (cross-repo dev setup)",
+    () => {
+      it.skip(
+        `skipped because ${LINKED_PLUGIN_PATH} exists — plugin would load successfully. Run \`pnpm dev:unlink-webapp\` to exercise this case locally; CI runs it without the link.`,
+        () => {}
+      );
+    }
+  );
+
   describe("REQUIRE_PLUGINS unset + plugin missing", () => {
     let server: TestServer;
 

internal-packages/rbac/src/index.ts

@@ -53,6 +53,13 @@ class LazyController implements RoleBaseAccessController {
 
   constructor(prisma: RbacPrismaInput, options?: RbacCreateOptions) {
     this._init = this.load(prisma, options);
+    // load() runs eagerly but the result is awaited lazily on first method
+    // call. If load() rejects (e.g. REQUIRE_PLUGINS=1 + plugin missing) and
+    // nothing awaits _init before Node ticks past, the rejection surfaces
+    // as unhandledRejection and kills the process. Attach a no-op .catch
+    // so Node sees the rejection as handled; the error is re-thrown when
+    // any consumer awaits this._init via c().
+    this._init.catch(() => {});
   }
 
   private async load(

internal-packages/testcontainers/src/webapp.ts

@@ -20,12 +20,16 @@ async function findFreePort(): Promise<number> {
   });
 }
 
-async function waitForHealthcheck(url: string, timeoutMs = 60000): Promise<void> {
+async function waitForHealthcheck(
+  url: string,
+  opts: { timeoutMs?: number; acceptAnyResponse?: boolean } = {}
+): Promise<void> {
+  const { timeoutMs = 60000, acceptAnyResponse = false } = opts;
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     try {
       const res = await fetch(url);
-      if (res.ok) return;
+      if (acceptAnyResponse || res.ok) return;
     } catch {}
     await new Promise((r) => setTimeout(r, 500));
   }
@@ -122,7 +126,10 @@ export async function startWebapp(
       // plugin is installed in the local node_modules. Set to "0" /
       // undefined to spawn a webapp that loads any installed plugin.
       ...(forceRbacFallback ? { RBAC_FORCE_FALLBACK: "1" } : {}),
-      ...(requirePlugins ? { REQUIRE_PLUGINS: "1" } : {}),
+      // When requirePlugins is set, explicitly override RBAC_FORCE_FALLBACK
+      // to "0" so a local apps/webapp/.env that sets it to "1" doesn't
+      // short-circuit the loader past the REQUIRE_PLUGINS check.
+      ...(requirePlugins ? { REQUIRE_PLUGINS: "1", RBAC_FORCE_FALLBACK: "0" } : {}),
       NODE_PATH: nodePath,
     },
     stdio: ["ignore", "pipe", "pipe"],
@@ -158,7 +165,12 @@ export async function startWebapp(
 
   try {
     if (spawnError) throw spawnError;
-    await waitForHealthcheck(`${baseUrl}/healthcheck`);
+    // When requirePlugins is set, /healthcheck is expected to respond with
+    // 500 (the whole point of those tests is to verify that). Accept any
+    // response as "the webapp is up" — the test then asserts the status.
+    await waitForHealthcheck(`${baseUrl}/healthcheck`, {
+      acceptAnyResponse: requirePlugins,
+    });
     if (spawnError) throw spawnError;
   } catch (err) {
     proc.kill("SIGTERM");