Simplify providing e2e tests credentials

[wzieba]

Related: AINFRA-1703: E2E test site credentials leak (there was no leak in this project)

Description

This PR simplifies how we pass credentials for e2e tests. As these are not secrets, we don't need to juggle with secrets.properties and default.properties. This is for:

• lower maintanance
• lack of potential security reports

Testing instructions

As we decided to not use e2e tests for this project for now, we don't need to actually run any tests. You can clean-build the app, e.g.

./gradlew clean assembleWordpressWasabiDebug

and browse generated BuildConfig.java file - it shouldn't have any E2E credentials.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[wpmobilebot]

📲 You can test the changes from this Pull Request in Jetpack by scanning the QR code below to install the corresponding build.

	App Name	Jetpack
	Flavor	Jalapeno
	Build Type	Debug
	Version	pr22467-4591a35
	Commit	4591a35
	Direct Download	jetpack-prototype-build-pr22467-4591a35.apk

Note: Google Login is not supported on these builds.

[wpmobilebot]

📲 You can test the changes from this Pull Request in WordPress by scanning the QR code below to install the corresponding build.

	App Name	WordPress
	Flavor	Jalapeno
	Build Type	Debug
	Version	pr22467-4591a35
	Commit	4591a35
	Direct Download	wordpress-prototype-build-pr22467-4591a35.apk

Note: Google Login is not supported on these builds.

[adalpari]

@claude

[claude]

Claude finished @adalpari's task in 1m 40s —— View job

---

Code Review Completed ✓

I've reviewed the PR changes that simplify E2E test credential management by moving them from build configuration to a dedicated Kotlin object. Here's my comprehensive feedback:

---

✅ Positive Aspects

1. Excellent Security Improvement: Moving non-secret test credentials out of secrets.properties and defaults.properties correctly reduces maintenance burden and eliminates false-positive security reports.

2. Clean Refactoring: The new E2ECredentials.kt object provides a centralized, type-safe location for test credentials with clear naming conventions.

3. Consistent Migration: All test files have been properly updated to use the new E2ECredentials object, maintaining functional equivalence.

4. Proper Packaging: The E2ECredentials object is correctly placed in the org.wordpress.android.support package alongside other test infrastructure.

---

🔍 Code Quality Observations

WordPress/src/androidTest/java/org/wordpress/android/support/E2ECredentials.kt:4-18

Minor: Consider adding KDoc comments

While the constant names are self-documenting, adding a brief KDoc comment to the object would improve discoverability and explain the purpose:

/**
 * Centralized container for E2E test credentials.
 * These are non-secret, mock credentials used exclusively for automated testing.
 */
object E2ECredentials {
    // ...
}

---

WordPress/src/androidTest/java/org/wordpress/android/e2e/flows/LoginFlow.kt:51-54

Observation: Hardcoded credentials in confirmLogin()

The confirmLogin() method has hardcoded references to E2ECredentials.WP_COM_USER_USERNAME and E2ECredentials.WP_COM_USER_PASSWORD. This creates an implicit coupling where the method assumes WordPress.com credentials will always work as a fallback. Consider if this assumption is correct for all test scenarios, particularly for self-hosted login flows.

Current code:

if (WPSupportUtils.atLeastOneElementWithIdIsDisplayed(LoginR.id.login_password_row)) {
    enterUsernameAndPassword(
        E2ECredentials.WP_COM_USER_USERNAME,
        E2ECredentials.WP_COM_USER_PASSWORD
    )
}

This isn't introduced by your PR (pre-existing pattern), but worth noting as it could cause issues if self-hosted tests hit this code path.

---

WordPress/src/androidTest/java/org/wordpress/android/e2e/flows/LoginFlow.kt:108-117

Minor: Inconsistent string formatting

The enterUsernameAndPassword() method uses trimIndent() with explicit newlines:

WPSupportUtils.populateTextField(
    usernameElement, """
     $username

     """.trimIndent()
)

This pattern seems unusual. If the extra whitespace is intentional for UI interaction, consider adding a comment explaining why. If not, this could be simplified to just username and password.

---

🎯 Testing & Documentation

PR Description Accuracy: The testing instructions are appropriate given that E2E tests are not currently being run for this project. The suggestion to check BuildConfig.java for absence of E2E credentials is a good validation approach.

Test Coverage: All existing E2E test files have been properly updated:

• ✅ LoginTests.kt (5 tests updated)
• ✅ SignUpTests.kt (1 test updated)
• ✅ ContactUsTests.kt (1 test updated)
• ✅ BaseTest.java (helper method updated)
• ✅ LoginFlow.kt (flow helper updated)

---

🔒 Security Assessment

No Security Concerns: The credentials being moved are clearly mock/test credentials:

• Usernames like e2eflowtestingmobile
• Passwords like mocked_password
• Example email addresses (@example.com)
• Local addresses (127.0.0.1:8080)

These are non-functional credentials intended solely for test scaffolding. Moving them out of the build configuration is the correct decision.

---

⚡ Performance & Architecture

No Performance Impact: This change is purely organizational and has zero runtime impact since E2E tests are compiled into test APKs only.

Architecture: The approach aligns well with Android testing best practices by:

• Keeping test data in the test source set
• Using Kotlin object for singleton constants
• Avoiding BuildConfig bloat

---

📋 Suggestions Summary

1. Optional: Add KDoc comment to E2ECredentials object
2. Consider: Review the hardcoded credential fallback in LoginFlow.confirmLogin() (pre-existing, not blocking)
3. Optional: Clarify or simplify the string formatting in enterUsernameAndPassword() (pre-existing, not blocking)

---

✅ Final Verdict

This PR successfully achieves its stated goals:

• ✅ Simplifies credential management for E2E tests
• ✅ Removes unnecessary coupling to secrets.properties
• ✅ Reduces maintenance overhead
• ✅ All test files properly migrated
• ✅ No security issues introduced
• ✅ Clean, readable implementation

Recommendation: Approve and merge. The suggestions above are minor enhancements that could be addressed in follow-up work if desired, but should not block this PR.

---

[adalpari]

LGTM and I dono't see any concern in Claude's review either. So