Review fixes: plain depends_on merge, positive secret assertion

README.md

@@ -1119,8 +1119,8 @@ docker compose -f compose.yml -f e2e-tests/compose.oauth.yml down -v
 **Full browser flow** (`full-flow.spec.ts`) — the real Playwright UI against the live stack:
 the themed **password login** and a **mocked-SSO** login (an in-network mock OIDC provider,
 `e2e-tests/mock-oidc.ts`), **menu filtering by role**, the **users/groups/roles** admin CRUD, the
-**OAuth2-clients** admin screen (register → one-time secret → delete; Hydra is part of this
-stack for it), a permission-gated **plugin page**, and **logout**. Because the themed form posts straight to
+**OAuth2-clients** admin screen (register → one-time secret → delete; Hydra is part of this stack
+for it), a permission-gated **plugin page**, and **logout**. Because the themed form posts straight to
 Kratos and cookies are host-scoped, a tiny same-origin gateway (`e2e-tests/proxy.ts`) fronts web +
 Kratos on one host (`ory/kratos/e2e-proxy.yml` points Kratos at it) — exactly as a production
 reverse proxy would.

e2e-tests/compose.full.yml

@@ -1,25 +1,16 @@
-# Full browser E2E — the real Playwright UI flow against the live stack: password +
-# mocked-SSO login, menu filtering by role, users/groups/roles/OAuth2-clients CRUD, a plugin page,
-# logout. A tiny
-# same-origin gateway (proxy, e2e-tests/proxy.ts) fronts web + Kratos on one host so the browser's cookies
+# Full browser E2E — the real Playwright UI flow against the live stack: password + mocked-SSO
+# login, menu filtering by role, users/groups/roles/OAuth2-clients CRUD, a plugin page, logout. A
+# tiny same-origin gateway (proxy, e2e-tests/proxy.ts) fronts web + Kratos on one host so the browser's cookies
 # round-trip (ory/kratos/e2e-proxy.yml points Kratos at it); a mock OIDC provider backs the SSO test.
 #   docker compose -f compose.yml -f e2e-tests/compose.full.yml run --build --rm e2e
 #   docker compose -f compose.yml -f e2e-tests/compose.full.yml down -v   # tear down after
 services:
   web:
-    # Kratos + Keto + bootstrap back the login/role flows; Hydra backs the admin plugin's
-    # OAuth2-clients screen. SSO is enabled here only (clean clone stays password-only): the mock
-    # provider's whole array is the env-settable form Kratos offers, mapped through the committed
-    # claims jsonnet.
-    depends_on: !override
-      bootstrap:
-        condition: service_completed_successfully
-      hydra:
-        condition: service_healthy
-      kratos:
-        condition: service_healthy
-      keto:
-        condition: service_healthy
+    # The base's full depends_on applies (Hydra included — the admin plugin's OAuth2-clients
+    # screen needs it); only the reference plugin's upstream is added. SSO is enabled here only
+    # (clean clone stays password-only): the mock provider's whole array is the env-settable form
+    # Kratos offers, mapped through the committed claims jsonnet.
+    depends_on:
       shifts-upstream:
         condition: service_healthy
     environment:

e2e-tests/full-flow.spec.ts

@@ -97,7 +97,7 @@ test.describe.serial("authenticated admin journey", () => {
     await expect(page.locator("h1")).toHaveText("Client registered");
     const clientId = await page.locator("#cid").inputValue();
     expect(clientId).toBeTruthy();
-    await expect(page.locator("#csecret")).not.toHaveValue("");
+    await expect(page.locator("#csecret")).toHaveValue(/.+/);
 
     // Listed; the row header links to the plain detail, which never shows the secret again.
     await page.goto("/admin/clients");