Artifacts & File Uploads

Supported Artifact Types

The following artifact types are supported for upload, either automatically through the Reporter SDK or manually via the API.

Automatic Upload (Reporter SDK)

The @euriqa/euriqa-playwright reporter automatically captures and uploads artifacts based on your Playwright configuration. No additional code is required.

Configuration

Enable artifact uploads in your playwright.config.ts:

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  use: {
    screenshot: 'only-on-failure',
    video: 'retain-on-failure',
    trace: 'on-first-retry',
  },
  retries: 2,
  reporter: [
    ['@euriqa/euriqa-playwright', {
      apiKey: process.env.EURIQA_API_KEY,
      projectId: process.env.EURIQA_PROJECT_ID,
      uploadScreenshots: true,
      uploadVideos: true,
      uploadTraces: true,
      uploadHtmlReport: true,
      htmlReportPath: 'playwright-report',
    }],
  ],
});

What Gets Uploaded

• Screenshots -- Captured automatically by Playwright on failure (or always, depending on your config).
• Videos -- Recorded when video is enabled in Playwright config. Uploaded after the run completes.
• Traces -- Captured when tracing is enabled. Includes DOM snapshots, network requests, and console logs.
• HTML Reports -- Opt-in via uploadHtmlReport: true. The entire report directory is zipped and uploaded.

File Size Handling

Files that exceed the configured size limit are not uploaded. Instead, the reporter logs a warning with the file name and size. This ensures that oversized artifacts never block or fail your CI pipeline. Small attachments (under 10 KB) are inline-encoded directly in the test result payload.

Manual Upload (API)

You can upload artifacts directly via the REST API. This is useful for custom CI integrations, scripts, or when you need to attach files outside of the Playwright reporter flow.

Upload Request

curl -X POST https://app.euriqa.dev/api/upload \
  -H "X-API-Key: your-api-key" \
  -F "file=@screenshot.png" \
  -F "type=screenshot" \
  -F "runId=run_abc123" \
  -F "testId=test_xyz789"

The upload endpoint accepts multipart/form-data with the file and metadata fields.

Form Fields

MIME Type Validation

The API validates MIME types against allowed extensions for each artifact type. Mismatched or disallowed types are rejected.

Response

{
  "success": true,
  "artifact": {
    "id": "art_abc123",
    "type": "screenshot",
    "fileName": "screenshot.png",
    "fileSize": 245760,
    "url": "https://app.euriqa.dev/storage/v1/object/sign/artifacts/...",
    "createdAt": "2026-01-15T10:30:00Z"
  }
}

Secure Access

All artifacts are served through secure, time-limited signed URLs. There is no public access to any stored file.

• Signed URLs -- Every artifact URL includes a cryptographic signature and expires after 1 hour by default.
• Time-Limited -- URLs are generated on demand when you view an artifact. They are not stored permanently.
• Private Storage -- Artifacts are stored in private buckets and are never accessible without authentication.
• Project-Scoped -- Only team members with access to the project can request signed URLs for its artifacts.

Storage Organization

Artifacts are organized in a structured path hierarchy that keeps files isolated and manageable:

/{project_id}/{run_id}/{artifact_type}/{test_id}/{filename}

# Example:
/proj_abc123/run_def456/screenshots/test_ghi789/failure-screenshot.png
/proj_abc123/run_def456/videos/test_ghi789/test-recording.webm
/proj_abc123/run_def456/traces/test_ghi789/trace.zip
/proj_abc123/run_def456/reports/html-report.zip

This structure supports data retention policies. When a retention window expires, entire run directories are cleaned up automatically. The default retention period is 90 days, configurable per project.

HTML Report Upload Flow

When uploadHtmlReport is enabled, the reporter follows this process:

1. The reporter locates the HTML report directory at the configured htmlReportPath (default: playwright-report).
2. The entire directory is compressed into a ZIP archive.
3. The ZIP is validated against the size limit (default: 200 MB).
4. The archive is uploaded to POST https://app.euriqa.dev/api/upload with type report.
5. The server extracts and stores the report files.
6. A signed URL is generated and linked to the test run in the dashboard.
7. Team members can view the full HTML report directly in the browser via the dashboard.

Security

The artifact upload pipeline includes multiple layers of security validation to prevent misuse.

• Path Traversal Prevention -- File names are sanitized to prevent directory traversal attacks. Characters like .., /, and null bytes are rejected.
• Extension Whitelisting -- Only files with explicitly allowed extensions are accepted. The allowed set varies by artifact type (see the Supported Artifact Types table above).
• Directory Confinement-- All uploaded files are stored within the project's scoped storage directory. There is no way to write outside the designated path.
• MIME Type Validation-- The file's MIME type is checked against the expected types for the declared artifact category. Mismatches are rejected with a 400 error.