@checkstack/ui 1.10.0 → 1.12.0

package/src/components/DynamicForm/utils.ts

@@ -69,6 +69,38 @@ export function isValueEmpty(
   return false;
 }
 
+/**
+ * Locate the value of the secret→env mapping field within an object's
+ * properties by the `x-secret-env` annotation (NOT by a hard-coded field
+ * name), and return it. Used to feed the inline script-test panel the same
+ * `secretEnv` the sibling action declares, so a test injects placeholders /
+ * overrides for those secrets. Returns `undefined` when no `x-secret-env`
+ * field exists or its value isn't a record.
+ */
+export function findSecretEnvSibling({
+  properties,
+  values,
+}: {
+  properties: Record<string, JsonSchemaProperty> | undefined;
+  values: Record<string, unknown> | undefined;
+}): Record<string, string> | undefined {
+  if (!properties || !values) return undefined;
+  for (const [key, propSchema] of Object.entries(properties)) {
+    if (propSchema["x-secret-env"] === true) {
+      const value = values[key];
+      if (value && typeof value === "object" && !Array.isArray(value)) {
+        const record: Record<string, string> = {};
+        for (const [k, v] of Object.entries(value)) {
+          if (typeof v === "string") record[k] = v;
+        }
+        return record;
+      }
+      return undefined;
+    }
+  }
+  return undefined;
+}
+
 /** Sentinel value used to represent "None" selection in Select components */
 export const NONE_SENTINEL = "__none__";
 

package/src/components/Popover.tsx

@@ -2,6 +2,7 @@ import * as React from "react";
 import * as PopoverPrimitive from "@radix-ui/react-popover";
 import { cn } from "../utils";
 import { usePerformance } from "./PerformanceProvider";
+import { usePortalContainer } from "./portalContainer";
 
 const Popover = PopoverPrimitive.Root;
 const PopoverTrigger = PopoverPrimitive.Trigger;
@@ -17,8 +18,12 @@ const PopoverContent = React.forwardRef<
   PopoverContentProps
 >(({ className, align = "end", sideOffset = 8, ...props }, ref) => {
   const { isLowPower } = usePerformance();
+  // When inside a modal Sheet/Dialog, portal into its content so the dialog's
+  // scroll-lock doesn't block this popover's internal scroll. Outside a
+  // Sheet/Dialog the container is null and Radix portals to `body` as usual.
+  const portalContainer = usePortalContainer();
   return (
-    <PopoverPrimitive.Portal>
+    <PopoverPrimitive.Portal container={portalContainer ?? undefined}>
       <PopoverPrimitive.Content
         ref={ref}
         align={align}

package/src/components/ScriptTestPanel.logic.test.ts

@@ -0,0 +1,139 @@
+import { describe, expect, test } from "bun:test";
+import {
+  buildSecretOverrides,
+  distinctSecretNames,
+  formatReturnValue,
+  hasNoOutput,
+  isFailedResult,
+  rejectionResult,
+  validateSampleContextJson,
+  type ScriptTestPanelResult,
+} from "./ScriptTestPanel.logic";
+
+const base: ScriptTestPanelResult = {
+  stdout: "",
+  stderr: "",
+  durationMs: 10,
+  timedOut: false,
+};
+
+describe("isFailedResult", () => {
+  test("a clean result is not a failure", () => {
+    expect(isFailedResult({ ...base, result: { ok: true } })).toBe(false);
+  });
+  test("an error result is a failure", () => {
+    expect(isFailedResult({ ...base, error: "boom" })).toBe(true);
+  });
+  test("a timed-out result is a failure", () => {
+    expect(isFailedResult({ ...base, timedOut: true })).toBe(true);
+  });
+});
+
+describe("formatReturnValue", () => {
+  test("pretty-prints an object", () => {
+    expect(formatReturnValue({ a: 1 })).toBe('{\n  "a": 1\n}');
+  });
+  test("renders undefined explicitly", () => {
+    expect(formatReturnValue(undefined)).toBe("undefined");
+  });
+  test("falls back to String() for non-serialisable values", () => {
+    const circular: Record<string, unknown> = {};
+    circular.self = circular;
+    expect(formatReturnValue(circular)).toBe("[object Object]");
+  });
+});
+
+describe("hasNoOutput", () => {
+  test("true when nothing was produced", () => {
+    expect(hasNoOutput(base)).toBe(true);
+  });
+  test("false when there is a return value", () => {
+    expect(hasNoOutput({ ...base, result: null })).toBe(false);
+  });
+  test("false when there is stdout", () => {
+    expect(hasNoOutput({ ...base, stdout: "hi" })).toBe(false);
+  });
+  test("false when there is an error", () => {
+    expect(hasNoOutput({ ...base, error: "x" })).toBe(false);
+  });
+});
+
+describe("validateSampleContextJson", () => {
+  test("empty value is valid (null)", () => {
+    expect(validateSampleContextJson("   ")).toBeNull();
+  });
+  test("valid JSON is valid (null)", () => {
+    expect(validateSampleContextJson('{"a":1}')).toBeNull();
+  });
+  test("malformed JSON returns a message", () => {
+    expect(validateSampleContextJson("{ not json")).not.toBeNull();
+  });
+});
+
+describe("rejectionResult", () => {
+  test("wraps a thrown Error into a failure result", () => {
+    const r = rejectionResult(new Error("network down"));
+    expect(r.error).toBe("network down");
+    expect(isFailedResult(r)).toBe(true);
+    expect(r.timedOut).toBe(false);
+  });
+});
+
+describe("distinctSecretNames", () => {
+  test("returns [] for an absent or empty mapping", () => {
+    expect(distinctSecretNames(undefined)).toEqual([]);
+    expect(distinctSecretNames({})).toEqual([]);
+  });
+
+  test("extracts distinct secret names from templates, first-seen order", () => {
+    expect(
+      distinctSecretNames({
+        API_TOKEN: "${{ secrets.jira_token }}",
+        DB: "${{ secrets.db_pass }}",
+        ALSO: "${{ secrets.jira_token }}",
+      }),
+    ).toEqual(["jira_token", "db_pass"]);
+  });
+
+  test("tolerates a legacy bare secret name as a value", () => {
+    expect(distinctSecretNames({ secret: "SECRET" })).toEqual(["SECRET"]);
+  });
+
+  test("ignores values that are neither a template nor a bare name", () => {
+    expect(distinctSecretNames({ X: "not a name" })).toEqual([]);
+  });
+});
+
+describe("buildSecretOverrides", () => {
+  const secretEnv = {
+    API_TOKEN: "${{ secrets.jira_token }}",
+    DB: "${{ secrets.db_pass }}",
+  };
+
+  test("returns undefined when no draft is filled", () => {
+    expect(
+      buildSecretOverrides({ secretEnv, drafts: {} }),
+    ).toBeUndefined();
+    expect(
+      buildSecretOverrides({ secretEnv, drafts: { jira_token: "" } }),
+    ).toBeUndefined();
+  });
+
+  test("keeps only filled drafts for referenced names", () => {
+    expect(
+      buildSecretOverrides({
+        secretEnv,
+        drafts: { jira_token: "abc", db_pass: "" },
+      }),
+    ).toEqual({ jira_token: "abc" });
+  });
+
+  test("drops drafts for names not referenced by the mapping", () => {
+    expect(
+      buildSecretOverrides({
+        secretEnv,
+        drafts: { jira_token: "abc", stale: "leak" },
+      }),
+    ).toEqual({ jira_token: "abc" });
+  });
+});

package/src/components/ScriptTestPanel.logic.ts

@@ -0,0 +1,137 @@
+import { extractErrorMessage } from "@checkstack/common";
+
+/**
+ * Pure logic for the script-test panel, extracted so it can be unit-tested
+ * without rendering Monaco. The React component in `ScriptTestPanel.tsx`
+ * consumes these.
+ */
+
+/** Result of a single in-UI script test run (UI-side shape). */
+export interface ScriptTestPanelResult {
+  result?: unknown;
+  stdout: string;
+  stderr: string;
+  exitCode?: number;
+  durationMs: number;
+  timedOut: boolean;
+  error?: string;
+}
+
+/** A run is a failure if it errored or timed out. */
+export function isFailedResult(result: ScriptTestPanelResult): boolean {
+  return result.error !== undefined || result.timedOut;
+}
+
+/** Pretty-print a script's return value for display. */
+export function formatReturnValue(value: unknown): string {
+  if (value === undefined) return "undefined";
+  try {
+    return JSON.stringify(value, null, 2);
+  } catch {
+    return String(value);
+  }
+}
+
+/**
+ * True when a result has nothing to show in the detail body (no error,
+ * no return value, no stdout/stderr) - the panel shows "No output." then.
+ */
+export function hasNoOutput(result: ScriptTestPanelResult): boolean {
+  return (
+    result.error === undefined &&
+    result.result === undefined &&
+    result.stdout.length === 0 &&
+    result.stderr.length === 0
+  );
+}
+
+/**
+ * Validate the editable sample-context JSON. Returns the parse error
+ * message, or `null` when the value is empty or valid JSON.
+ */
+export function validateSampleContextJson(value: string): string | null {
+  if (value.trim().length === 0) return null;
+  try {
+    JSON.parse(value);
+    return null;
+  } catch (error) {
+    return extractErrorMessage(error, "Invalid JSON");
+  }
+}
+
+/** Build the failure result the panel shows when `onRun` rejects. */
+export function rejectionResult(error: unknown): ScriptTestPanelResult {
+  return {
+    stdout: "",
+    stderr: "",
+    durationMs: 0,
+    timedOut: false,
+    error: extractErrorMessage(error),
+  };
+}
+
+// ─── Secret-env test overrides ──────────────────────────────────────────────
+
+const SECRET_TEMPLATE_RE = /\$\{\{\s*secrets\.([a-zA-Z0-9_-]+)\s*\}\}/g;
+// A mapping value may legacy-carry a bare secret name instead of a template.
+const BARE_SECRET_NAME_RE = /^\s*([a-zA-Z][a-zA-Z0-9_-]*)\s*$/;
+
+/**
+ * Derive the set of distinct secret NAMES referenced by a `secretEnv`
+ * mapping (`{ ENV_NAME: "${{ secrets.NAME }}" }`). Tolerates a legacy bare
+ * secret name as a value too. Order-stable (first-seen) so the override UI
+ * renders deterministically. Returns `[]` when the mapping is absent/empty.
+ */
+export function distinctSecretNames(
+  secretEnv: Record<string, string> | undefined,
+): string[] {
+  if (!secretEnv) return [];
+  const seen = new Set<string>();
+  const out: string[] = [];
+  const add = (name: string) => {
+    if (!seen.has(name)) {
+      seen.add(name);
+      out.push(name);
+    }
+  };
+  for (const value of Object.values(secretEnv)) {
+    SECRET_TEMPLATE_RE.lastIndex = 0;
+    let matched = false;
+    let match: RegExpExecArray | null;
+    while ((match = SECRET_TEMPLATE_RE.exec(value)) !== null) {
+      matched = true;
+      add(match[1]);
+    }
+    if (!matched) {
+      const bare = BARE_SECRET_NAME_RE.exec(value);
+      if (bare) add(bare[1]);
+    }
+  }
+  return out;
+}
+
+/**
+ * Build the `secretOverrides` payload sent to the test endpoint from the
+ * user's per-secret-NAME draft inputs. Drops blank entries (an empty
+ * override means "use the placeholder") and keeps only names actually
+ * referenced by the mapping, so a stale draft can't inject an unreferenced
+ * value. Returns `undefined` when nothing is overridden so the wire stays
+ * clean.
+ */
+export function buildSecretOverrides({
+  secretEnv,
+  drafts,
+}: {
+  secretEnv: Record<string, string> | undefined;
+  drafts: Record<string, string>;
+}): Record<string, string> | undefined {
+  const names = distinctSecretNames(secretEnv);
+  const out: Record<string, string> = {};
+  for (const name of names) {
+    const value = drafts[name];
+    if (value !== undefined && value.length > 0) {
+      out[name] = value;
+    }
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}