Open Playwright traces directly from any report mode

Author: baev

allure-commandline/src/main/java/io/qameta/allure/LocalReportServer.java

@@ -74,6 +74,7 @@ final class LocalReportServer {
     private static final String CSP_BASE_URI_NONE = "base-uri 'none'; ";
     private static final String CSP_FORM_ACTION_NONE = "form-action 'none'; ";
     private static final String LOCALHOST = "localhost";
+    private static final String PLAYWRIGHT_TRACE_VIEWER_ORIGIN = "https://trace.playwright.dev";
     private static final String ATTACHMENTS_REQUEST_PATH = "/data/attachments/";
     private static final Set<String> LOCAL_SERVER_HOSTS = Collections.unmodifiableSet(
             new HashSet<>(Arrays.asList(LOCALHOST, "127.0.0.1", "::1"))
@@ -87,9 +88,11 @@ final class LocalReportServer {
             + "media-src 'self' data: blob: https:; "
             + "font-src 'self' data: https:; "
             + "connect-src 'self'; "
-            + "frame-src 'self' blob:; "
+            + "frame-src 'self' blob: " + PLAYWRIGHT_TRACE_VIEWER_ORIGIN + "; "
             + "worker-src 'self' blob:; "
-            + "script-src 'self' 'unsafe-inline' https:; "
+            // data: scripts are required by single-file reports, which inline their bundle through
+            // <script src="data:...">.
+            + "script-src 'self' 'unsafe-inline' https: data:; "
             + "style-src 'self' 'unsafe-inline' https:";
     private static final String ATTACHMENT_CONTENT_SECURITY_POLICY = "sandbox; default-src 'none'";
     private static final String HTML_ATTACHMENT_CONTENT_SECURITY_POLICY = "sandbox; default-src 'none'; "

allure-commandline/src/test/java/io/qameta/allure/LocalReportServerTest.java

@@ -127,7 +127,8 @@ void shouldSetSecurityHeadersWhenServingReport(@TempDir final Path temp) throws
                     .contains("img-src 'self' data: blob: https:")
                     .contains("media-src 'self' data: blob: https:")
                     .contains("font-src 'self' data: https:")
-                    .contains("script-src 'self' 'unsafe-inline' https:")
+                    .contains("frame-src 'self' blob: https://trace.playwright.dev")
+                    .contains("script-src 'self' 'unsafe-inline' https: data:")
                     .contains("style-src 'self' 'unsafe-inline' https:");
             assertThat(reportRequest.getHeaderField("X-Content-Type-Options")).isEqualTo("nosniff");
             assertThat(reportRequest.getHeaderField("Referrer-Policy")).isEqualTo("no-referrer");

allure-generator/src/main/java/io/qameta/allure/ConfigurationBuilder.java

@@ -27,7 +27,6 @@
 import io.qameta.allure.core.AttachmentsPlugin;
 import io.qameta.allure.core.Configuration;
 import io.qameta.allure.core.MarkdownDescriptionsPlugin;
-import io.qameta.allure.core.PlaywrightTraceViewerPlugin;
 import io.qameta.allure.core.Plugin;
 import io.qameta.allure.core.TestsResultsPlugin;
 import io.qameta.allure.duration.DurationPlugin;
@@ -97,7 +96,6 @@ public class ConfigurationBuilder {
             new SuitesPlugin(),
             new TestsResultsPlugin(),
             new AttachmentsPlugin(),
-            new PlaywrightTraceViewerPlugin(),
             new MailPlugin(),
             new InfluxDbExportPlugin(),
             new PrometheusExportPlugin(),

allure-generator/src/main/java/io/qameta/allure/core/PlaywrightTraceViewerPlugin.java

@@ -183,6 +183,37 @@ const assertOk = (response: Response, url = response.url): Response => {
   return response;
 };
 
+const decodeBase64ToBytes = (base64: string) => {
+  const binary = atob(base64);
+  const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+};
+
+const dataUrlToBlob = (dataUrl: string): Blob => {
+  const commaIndex = dataUrl.indexOf(",");
+  if (commaIndex < 0) {
+    throw new ReportDataError({
+      message: defaultReportErrorMessage(),
+      status: DEFAULT_REPORT_ERROR_STATUS,
+      url: dataUrl,
+    });
+  }
+
+  const meta = dataUrl.slice("data:".length, commaIndex);
+  const data = dataUrl.slice(commaIndex + 1);
+  const isBase64 = /;base64$/iu.test(meta);
+  const mediaType = meta.replace(/;base64$/iu, "") || "text/plain;charset=US-ASCII";
+
+  // A base64 payload decodes to raw bytes; a plain payload is percent-encoded
+  // text that Blob will re-encode as UTF-8 on its own.
+  return isBase64
+    ? new Blob([decodeBase64ToBytes(data)], { type: mediaType })
+    : new Blob([decodeURIComponent(data)], { type: mediaType });
+};
+
 const fetchReportData = async (
   url: string,
   { contentType = "application/octet-stream", ...options }: ReportFetchOptions = {},
@@ -192,6 +223,21 @@ const fetchReportData = async (
       ? url
       : await reportDataUrl(url, contentType);
 
+  // Embedded (single-file) report data resolves to data: URLs. Decode them
+  // directly instead of fetch()-ing: under a strict connect-src CSP (such as the
+  // one `allure open`/`allure serve` sends) the browser rejects fetch(data:...),
+  // which would otherwise break every embedded attachment, including traces.
+  if (fetchUrl.startsWith("data:")) {
+    try {
+      return new Response(dataUrlToBlob(fetchUrl), { status: 200 });
+    } catch (error: unknown) {
+      throw normalizeReportDataError(error, {
+        status: DEFAULT_REPORT_ERROR_STATUS,
+        url,
+      });
+    }
+  }
+
   try {
     return await fetch(fetchUrl, options).then((response) => assertOk(response, url));
   } catch (error: unknown) {

allure-generator/src/main/java/io/qameta/allure/core/StaticAssetManifest.java

@@ -1,6 +1 @@
 export const PLAYWRIGHT_TRACE_MIME = "application/vnd.allure.playwright-trace";
-export const PLAYWRIGHT_TRACE_VIEWER_INFO_URL = "data/playwright-trace-viewer.json";
-
-export type PlaywrightTraceViewerInfo = {
-  url: string;
-};