test(e2e): add HTTP, cookie, environment and template-tag specs [2/6]

[bobqiu-kong]

Summary

Adds HTTP request, cookie, environment and template-tag E2E specs on top of the framework.

Stack

Part of a stacked E2E suite. Merge in order:

0. fix(project-modal): close modal on redirect by comparing pathname #10593 fix/project-modal-close-on-redirect — app fix (independent, based on develop)
1. test(e2e): add insomnia-test Playwright framework, CI workflow and skill [1/6] #10594 test/e2e-1-framework — framework + CI + skill
2. test(e2e): add HTTP, cookie, environment and template-tag specs [2/6] #10595 test/e2e-2-http-cookie-env — HTTP, cookie, environment, template-tag
3. test(e2e): add GraphQL, gRPC, WebSocket, Socket.IO, SSE and MCP specs [3/6] #10596 test/e2e-3-protocols — GraphQL, gRPC, WebSocket, Socket.IO, SSE, MCP
4. test(e2e): add workspace, document, runner, mock-server, app and preferences specs [4/6] #10597 test/e2e-4-workspace — workspace, document, runner, mock-server, app, preferences
5. test(e2e): add git-sync, cloud-sync, organization and konnect specs [5/6] #10598 test/e2e-5-sync — git-sync, cloud-sync, organization, konnect
6. test(e2e): add data, migration and plugin specs [6/6] #10599 test/e2e-6-data — data, migration, plugin

This PR: test/e2e-2-http-cookie-env (based on test/e2e-1-framework). Adds specs and the mock servers/fixtures they need; no framework or app changes.

What's added

• tests/http-request (body types, auth, scripts, generate-code, certificates, cancel/in-flight, …), tests/cookie, tests/environment, tests/template-tag
• misc/oauth2-server.js (:4080) and misc/fixtures/upload-sample.txt
• playwright.config.ts / package.json: register the OAuth2 server

Test plan

• npx playwright test --list in packages/insomnia-test lists 76 tests cumulatively (verified locally)
• Insomnia Test workflow: new specs pass across shards
• No changes outside packages/insomnia-test/

🤖 Generated with Claude Code

[github-actions]

✅ KSAI Review: Finished

1. 09:14 UTC Tracing how changed code uses existing helpers and fixtures
2. 09:16 UTC Reading test helpers and config to assess coverage
3. 09:18 UTC Auditing test helper patterns against the pull request changes

---

Run report (federated) · 1 paid run · $0.7022 total

#	Engine	Result	Model	Turns	Cost
1	opencode	success	glm-5.3/high	37	$0.7019

Reviewing cost $0.7019; deciding how to run it cost $0.0003

[github-actions]

Check	Result
Scope	New Playwright E2E suite under packages/insomnia-test: OAuth2 mock server, config wiring, and 65 spec files.
Mandate	typescript-code-reviewer (adversarial, read-only)
Findings	4 Low
Findings audit	Subagent audit: 4 findings kept at Low; 1 reworded, 1 comment location corrected.

The suite matches the base-branch flow and page framework; every method the specs call exists with matching signatures. The OAuth2 mock and its fixture constants agree. No Critical or High issues found.

Additional Risk pass: no leaked secrets, only dummy test credentials matching the existing mock-server convention. No resource or memory leak outlives a test run. One Low finding covers the OAuth2 mock binding all interfaces. No other security concerns found.

This review read aeb1587. The pull request has moved to 2d50b71 since, so a comment on a line changed after that commit shows as outdated.

[github-actions]

🔵 Low risk

The header comment at lines 14-15 claims "a loopback-only mock", but app.listen(PORT) without a host binds every interface. The CSRF justification leans on that claim. Bind 127.0.0.1 explicitly, or reword the comment. The other mock servers share this bind pattern, but none makes the loopback claim.

Suggested change

	app.listen(PORT, () => {
	app.listen(PORT, "127.0.0.1", () => {

React 👍 if this finding helped, 👎 if it did not.

[bobqiu-kong]

Not applicable: app.listen(PORT, '127.0.0.1', ...) is already at line 318 (unchanged since the e2e-1 baseline), so the server is loopback-only and the header comment is accurate.