feat: custom HTML test report + AM-org scan, 2FA login and personalize coverage

Custom report (target/custom-report/index.html, JS-suite mochawesome parity):
- TestReporter JUnit extension (auto-registered): per-test result, duration,
  expected-vs-actual on failure, and every SDK HTTP call with status, timing,
  masked copy-paste cURL, truncated response body and detected SDK method
- AuthInterceptor gains a minimal RequestObserver seam (the SDK has no
  JS-style plugins API yet; this is its smallest form) - inert unless set
- Pipeline serves the custom report as the primary artifact

Follow-ups (all skip gracefully when env is absent):
- AssetScanAMAPITest: scan tests on a second stack created in the
  Asset-Management org (AM_ORG_UID) - JS suite Part-2 parity
- TfaLoginAPITest: 2FA/TOTP login coverage (TFA_EMAIL/TFA_PASSWORD/MFA_SECRET),
  including TOTP generation via mfaSecret and ambiguous-input rejection
- TestStackContext creates/deletes an AM-org stack and a Personalize project
  (PERSONALIZE_HOST) alongside the main dynamic stack

Verified: dynamic suite 252 tests / 0 failures / 2 skipped; stack, AM stack
and personalize project all cleaned up after the run.

Author: aniket-shikhare-cstk

src/main/java/com/contentstack/cms/core/AuthInterceptor.java

@@ -97,7 +97,41 @@ public Response intercept(Chain chain) throws IOException {
             String commaSeparated = String.join(", ", earlyAccess);
             request.addHeader(Util.EARLY_ACCESS_HEADER, commaSeparated);
         }
-        return executeRequest(chain, request.build(), 0);
+        Request finalRequest = request.build();
+        long startedAt = System.currentTimeMillis();
+        Response response = executeRequest(chain, finalRequest, 0);
+        RequestObserver localObserver = observer;
+        if (localObserver != null) {
+            try {
+                localObserver.onCall(finalRequest, response, System.currentTimeMillis() - startedAt);
+            } catch (Exception ignored) {
+                // observers must never break real requests
+            }
+        }
+        return response;
+    }
+
+    /**
+     * Observer for outgoing requests/responses. Intended for test harnesses
+     * and diagnostics (e.g. capturing cURL commands for test reports);
+     * not part of the public API surface.
+     */
+    public interface RequestObserver {
+        void onCall(Request request, Response response, long durationMs);
+    }
+
+    private static volatile RequestObserver observer;
+
+    /**
+     * Registers a JVM-wide request observer (pass null to remove). The observer
+     * is invoked after each request completes, with the final request (including
+     * interceptor-added headers) and the response. Exceptions thrown by the
+     * observer are swallowed.
+     *
+     * @param requestObserver the observer, or null to unregister
+     */
+    public static void setRequestObserver(RequestObserver requestObserver) {
+        observer = requestObserver;
     }
 
     /**

src/test/java/com/contentstack/cms/TestReporter.java

@@ -65,6 +65,19 @@ public final class TestStackContext {
     private static String managementToken;
     private static String managementTokenUid;
 
+    // Optional: second stack inside the Asset-Management org (AM_ORG_UID) for
+    // DAM / Contentstack Assets scan tests - mirrors the JS suite's Part 2.
+    private static final String AM_ORG_UID = getEnv("AM_ORG_UID", "amOrgUid", null);
+    private static String amStackApiKey;
+    private static String amStackName;
+    private static boolean amStackCreated = false;
+
+    // Optional: Personalize project linked to the test stack (JS suite parity)
+    private static final String PERSONALIZE_HOST =
+            getEnv("PERSONALIZE_HOST", "personalizeHost", "personalize-api.contentstack.com").trim();
+    private static String personalizeProjectUid;
+    private static boolean personalizeCreated = false;
+
     private static boolean setupAttempted = false;
     private static boolean stackCreated = false;
     private static boolean tornDown = false;
@@ -131,10 +144,16 @@ public static synchronized void ensureSetup() {
                 new FixtureSeeder(HOST, stackApiKey, authtoken).seedAll();
             }
 
+            // Optional extras (both non-fatal; skipped when env not configured)
+            createAmStack();
+            createPersonalizeProject();
+
             System.out.println("============================================================");
             System.out.println("[TestStackContext] Dynamic setup complete");
             System.out.println("[TestStackContext]   Stack: " + stackName + " (" + stackApiKey + ")");
             System.out.println("[TestStackContext]   Management token: " + (managementToken != null ? "created" : "NOT created (tests fall back to authtoken)"));
+            System.out.println("[TestStackContext]   AM stack: " + (amStackCreated ? amStackName + " (" + amStackApiKey + ")" : "not created (AM_ORG_UID unset or failed)"));
+            System.out.println("[TestStackContext]   Personalize project: " + (personalizeCreated ? personalizeProjectUid : "not created"));
             System.out.println("============================================================");
         } catch (Exception e) {
             System.err.println("[TestStackContext] Dynamic setup FAILED: " + e.getMessage());
@@ -159,11 +178,21 @@ public static synchronized void teardown() {
             System.out.println("[TestStackContext]   Stack: " + stackName);
             System.out.println("[TestStackContext]   API key: " + stackApiKey);
             System.out.println("[TestStackContext]   Management token: " + managementToken);
-            System.out.println("[TestStackContext]   Remember to delete it manually when done!");
+            if (amStackCreated) {
+                System.out.println("[TestStackContext]   AM stack: " + amStackName + " (" + amStackApiKey + ")");
+            }
+            if (personalizeCreated) {
+                System.out.println("[TestStackContext]   Personalize project: " + personalizeProjectUid);
+            }
+            System.out.println("[TestStackContext]   Remember to delete them manually when done!");
             writeStatusFile("preserved " + stackName + " " + stackApiKey);
             return;
         }
 
+        // Linked/secondary resources first, then the main stack
+        deletePersonalizeProject();
+        deleteAmStack();
+
         try {
             Request request = new Request.Builder()
                     .url("https://" + HOST + "/v3/stacks")
@@ -232,6 +261,21 @@ public static boolean isStackCreated() {
         return stackCreated;
     }
 
+    /** @return api key of the AM-org test stack, or null when not created */
+    public static String getAmStackApiKey() {
+        return amStackApiKey;
+    }
+
+    /** @return true when the optional AM-org stack exists (AM_ORG_UID configured) */
+    public static boolean isAmStackCreated() {
+        return amStackCreated;
+    }
+
+    /** @return uid of the Personalize project linked to the test stack, or null */
+    public static String getPersonalizeProjectUid() {
+        return personalizeProjectUid;
+    }
+
     // =============================================================================
     // Setup steps
     // =============================================================================
@@ -376,6 +420,150 @@ private static boolean createManagementTokenWithScope(String tokenName, String[]
         }
     }
 
+    /**
+     * Creates a second stack inside the Asset-Management org (AM_ORG_UID) for
+     * DAM / Contentstack Assets scan tests - the JS suite's "Part 2" pattern.
+     * Skipped silently when AM_ORG_UID is not configured; failures are non-fatal
+     * (AM tests skip themselves when the stack is absent).
+     */
+    @SuppressWarnings("unchecked")
+    private static void createAmStack() {
+        if (AM_ORG_UID == null || AM_ORG_UID.trim().isEmpty()) {
+            return;
+        }
+        amStackName = "SDK_Test_Java_AM_" + shortId();
+        System.out.println("[TestStackContext] Creating AM-org test stack: " + amStackName + " ...");
+        try {
+            JSONObject stack = new JSONObject();
+            stack.put("name", amStackName);
+            stack.put("description", "Automated Java CMA SDK AM-org test stack");
+            stack.put("master_locale", "en-us");
+            JSONObject body = new JSONObject();
+            body.put("stack", stack);
+            Request request = new Request.Builder()
+                    .url("https://" + HOST + "/v3/stacks")
+                    .header("authtoken", authtoken)
+                    .header("organization_uid", AM_ORG_UID.trim())
+                    .post(RequestBody.create(body.toJSONString(), JSON_MEDIA))
+                    .build();
+            try (Response response = http.newCall(request).execute()) {
+                String responseBody = response.body() != null ? response.body().string() : "";
+                if (!response.isSuccessful()) {
+                    System.err.println("[TestStackContext] AM stack creation failed (" + response.code() + "): "
+                            + responseBody + " - AM scan tests will be skipped");
+                    return;
+                }
+                JSONObject json = (JSONObject) parser.parse(responseBody);
+                JSONObject stackObj = (JSONObject) json.get("stack");
+                amStackApiKey = (String) stackObj.get("api_key");
+                amStackCreated = true;
+            }
+            System.out.println("[TestStackContext] Created AM stack " + amStackName + " (api_key: " + amStackApiKey + ")");
+            Thread.sleep(5000); // same provisioning wait as the main stack
+        } catch (Exception e) {
+            System.err.println("[TestStackContext] AM stack creation error: " + e.getMessage()
+                    + " - AM scan tests will be skipped");
+        }
+    }
+
+    /**
+     * Creates a Personalize project linked to the test stack (JS suite parity).
+     * Non-fatal: personalize-dependent tests skip when the project is absent.
+     */
+    @SuppressWarnings("unchecked")
+    private static void createPersonalizeProject() {
+        if (PERSONALIZE_HOST == null || PERSONALIZE_HOST.isEmpty()) {
+            return;
+        }
+        String projectName = "SDK_Test_Java_Proj_" + shortId();
+        System.out.println("[TestStackContext] Creating personalize project: " + projectName + " ...");
+        try {
+            JSONObject body = new JSONObject();
+            body.put("name", projectName);
+            body.put("description", "Automated Java CMA SDK test project");
+            body.put("connectedStackApiKey", stackApiKey);
+            Request request = new Request.Builder()
+                    .url("https://" + PERSONALIZE_HOST + "/projects")
+                    .header("authtoken", authtoken)
+                    .header("organization_uid", ORGANIZATION)
+                    .post(RequestBody.create(body.toJSONString(), JSON_MEDIA))
+                    .build();
+            try (Response response = http.newCall(request).execute()) {
+                String responseBody = response.body() != null ? response.body().string() : "";
+                if (!response.isSuccessful()) {
+                    System.err.println("[TestStackContext] Personalize project creation failed ("
+                            + response.code() + "): " + truncate(responseBody) + " - personalize tests will be skipped");
+                    return;
+                }
+                JSONObject json = (JSONObject) parser.parse(responseBody);
+                Object uid = json.get("uid") != null ? json.get("uid")
+                        : json.get("project_uid") != null ? json.get("project_uid") : json.get("_id");
+                personalizeProjectUid = uid != null ? uid.toString() : null;
+                personalizeCreated = personalizeProjectUid != null;
+            }
+            if (personalizeCreated) {
+                System.out.println("[TestStackContext] Created personalize project: " + personalizeProjectUid);
+            }
+        } catch (Exception e) {
+            System.err.println("[TestStackContext] Personalize project creation error: " + e.getMessage());
+        }
+    }
+
+    private static void deleteAmStack() {
+        if (!amStackCreated) {
+            return;
+        }
+        try {
+            Request request = new Request.Builder()
+                    .url("https://" + HOST + "/v3/stacks")
+                    .header("api_key", amStackApiKey)
+                    .header("authtoken", authtoken)
+                    .delete()
+                    .build();
+            try (Response response = http.newCall(request).execute()) {
+                if (response.isSuccessful()) {
+                    System.out.println("[TestStackContext] Deleted AM test stack: " + amStackName);
+                    amStackCreated = false;
+                } else {
+                    System.err.println("[TestStackContext] AM stack deletion failed with " + response.code()
+                            + " - delete manually: " + amStackName + " (" + amStackApiKey + ")");
+                }
+            }
+        } catch (Exception e) {
+            System.err.println("[TestStackContext] AM stack deletion error: " + e.getMessage()
+                    + " - delete manually: " + amStackName + " (" + amStackApiKey + ")");
+        }
+    }
+
+    private static void deletePersonalizeProject() {
+        if (!personalizeCreated) {
+            return;
+        }
+        try {
+            Request request = new Request.Builder()
+                    .url("https://" + PERSONALIZE_HOST + "/projects/" + personalizeProjectUid)
+                    .header("authtoken", authtoken)
+                    .header("organization_uid", ORGANIZATION)
+                    .delete()
+                    .build();
+            try (Response response = http.newCall(request).execute()) {
+                if (response.isSuccessful()) {
+                    System.out.println("[TestStackContext] Deleted personalize project: " + personalizeProjectUid);
+                    personalizeCreated = false;
+                } else {
+                    System.err.println("[TestStackContext] Personalize project deletion failed with " + response.code()
+                            + " - delete manually: " + personalizeProjectUid);
+                }
+            }
+        } catch (Exception e) {
+            System.err.println("[TestStackContext] Personalize project deletion error: " + e.getMessage());
+        }
+    }
+
+    private static String truncate(String s) {
+        return s != null && s.length() > 160 ? s.substring(0, 160) + "..." : String.valueOf(s);
+    }
+
     /**
      * Freshly created management tokens are propagated asynchronously on some
      * environments (observed on dev11: intermittent 412s when the token is used

src/test/java/com/contentstack/cms/TestStackContext.java

@@ -33,7 +33,10 @@ public void launcherSessionOpened(LauncherSession session) {
 
     @Override
     public void launcherSessionClosed(LauncherSession session) {
-        // Intentionally empty - see class javadoc. Teardown runs in the JVM
-        // shutdown hook so nested launcher sessions can't kill the stack early.
+        // Stack teardown deliberately does NOT happen here - see class javadoc;
+        // it runs in the JVM shutdown hook so nested launcher sessions can't
+        // kill the stack early. Refreshing the custom report here is safe:
+        // it just overwrites a file, and the shutdown hook writes the final one.
+        TestReporter.writeReport();
     }
 }

src/test/java/com/contentstack/cms/TestSuiteLifecycle.java

@@ -1,6 +1,7 @@
 package com.contentstack.cms.stack;
 
 import com.contentstack.cms.organization.OrgApiTests;
+import com.contentstack.cms.user.TfaLoginAPITest;
 import org.junit.platform.runner.JUnitPlatform;
 import org.junit.platform.suite.api.SelectClasses;
 import org.junit.runner.RunWith;
@@ -29,6 +30,7 @@
         LocaleAPITest.class,
         EnvironmentAPITest.class,
         AssetAPITest.class,
+        AssetScanAMAPITest.class,
         TaxonomyAPITest.class,
         // Phase C: schema (global fields before content types)
         GlobalFieldAPITest.class,
@@ -47,8 +49,9 @@
         RoleAPITest.class,
         TokenAPITest.class,
         ReleaseAPITest.class,
-        // Phase G: org-level
-        OrgApiTests.class
+        // Phase G: org/user-level (2FA login last - it creates its own sessions)
+        OrgApiTests.class,
+        TfaLoginAPITest.class
 })
 public class APISanityTestSuite {