@lightdash/cli 2.228.1 → 2.229.0

package/dist/handlers/apps/pathContainment.test.js

@@ -1,66 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const tslib_1 = require("tslib");
-const common_1 = require("@lightdash/common");
-const fs_1 = require("fs");
-const os = tslib_1.__importStar(require("os"));
-const path = tslib_1.__importStar(require("path"));
-const pathContainment_1 = require("./pathContainment");
-const describePosix = process.platform === 'win32' ? describe.skip : describe;
-const mkTmpDir = (prefix) => fs_1.promises.mkdtemp(path.join(os.tmpdir(), prefix));
-describePosix('canonicalizeForContainment', () => {
-    it('returns the realpath of an existing directory unchanged when there are no symlinks', async () => {
-        const dir = await mkTmpDir('ld-canon-plain-');
-        await expect((0, pathContainment_1.canonicalizeForContainment)(dir)).resolves.toBe(await fs_1.promises.realpath(dir));
-    });
-    it('resolves a symlinked existing directory to its real target', async () => {
-        const target = await mkTmpDir('ld-canon-target-');
-        const linkParent = await mkTmpDir('ld-canon-linkparent-');
-        const link = path.join(linkParent, 'link');
-        await fs_1.promises.symlink(target, link);
-        await expect((0, pathContainment_1.canonicalizeForContainment)(link)).resolves.toBe(await fs_1.promises.realpath(target));
-    });
-    it('walks up to the nearest existing ancestor and rejoins non-existent segments', async () => {
-        const target = await mkTmpDir('ld-canon-target-');
-        const linkParent = await mkTmpDir('ld-canon-linkparent-');
-        const link = path.join(linkParent, 'link');
-        await fs_1.promises.symlink(target, link);
-        const nonExistent = path.join(link, 'not', 'yet', 'created');
-        await expect((0, pathContainment_1.canonicalizeForContainment)(nonExistent)).resolves.toBe(path.join(await fs_1.promises.realpath(target), 'not', 'yet', 'created'));
-    });
-    it('rethrows a non-ENOENT realpath failure instead of treating it as non-existent', async () => {
-        const dir = await mkTmpDir('ld-canon-notdir-');
-        const filePath = path.join(dir, 'a-file');
-        await fs_1.promises.writeFile(filePath, 'not a directory');
-        const impossiblePath = path.join(filePath, 'nested', 'more');
-        await expect((0, pathContainment_1.canonicalizeForContainment)(impossiblePath)).rejects.toMatchObject({ code: 'ENOTDIR' });
-    });
-});
-describePosix('assertOutDirSafeToClear', () => {
-    it('is a no-op when outDir does not exist yet', async () => {
-        const appDir = await mkTmpDir('ld-safeclear-app-');
-        const outDirParent = await mkTmpDir('ld-safeclear-outparent-');
-        const outDir = path.join(outDirParent, 'dist');
-        await expect((0, pathContainment_1.assertOutDirSafeToClear)(appDir, outDir)).resolves.toBeUndefined();
-    });
-    it('does not throw for a disjoint existing outDir', async () => {
-        const appDir = await mkTmpDir('ld-safeclear-app-');
-        const outDir = await mkTmpDir('ld-safeclear-outdir-');
-        await expect((0, pathContainment_1.assertOutDirSafeToClear)(appDir, outDir)).resolves.toBeUndefined();
-    });
-    it('throws ParameterError when an existing outDir canonically contains appDir', async () => {
-        const outDir = await mkTmpDir('ld-safeclear-container-');
-        const appDir = path.join(outDir, 'app');
-        await fs_1.promises.mkdir(appDir);
-        await expect((0, pathContainment_1.assertOutDirSafeToClear)(appDir, outDir)).rejects.toThrow(common_1.ParameterError);
-    });
-    it('throws ParameterError when outDir is reached via a symlinked ancestor that contains appDir', async () => {
-        const parentDir = await mkTmpDir('ld-safeclear-parent-');
-        const appDir = path.join(parentDir, 'app');
-        await fs_1.promises.mkdir(appDir);
-        const linkParent = await mkTmpDir('ld-safeclear-linkparent-');
-        const link = path.join(linkParent, 'link-to-parent');
-        await fs_1.promises.symlink(parentDir, link);
-        await expect((0, pathContainment_1.assertOutDirSafeToClear)(appDir, link)).rejects.toThrow(common_1.ParameterError);
-    });
-});

package/dist/handlers/apps/preview.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=preview.test.d.ts.map

package/dist/handlers/apps/preview.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"preview.test.d.ts","sourceRoot":"","sources":["../../../src/handlers/apps/preview.test.ts"],"names":[],"mappings":""}

package/dist/handlers/apps/preview.test.js

@@ -1,353 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const tslib_1 = require("tslib");
-const execa_1 = tslib_1.__importDefault(require("execa"));
-const fs_1 = require("fs");
-const inquirer_1 = tslib_1.__importDefault(require("inquirer"));
-const os = tslib_1.__importStar(require("os"));
-const path = tslib_1.__importStar(require("path"));
-const globalState_1 = tslib_1.__importDefault(require("../../globalState"));
-const utils_1 = require("../utils");
-const appCodeFiles_1 = require("./appCodeFiles");
-const preview_1 = require("./preview");
-vi.mock('execa');
-vi.mock('inquirer', () => ({ default: { prompt: vi.fn() } }));
-const previewBundle = {
-    manifest: {
-        codeVersion: 1,
-        appUuid: 'app-uuid-1',
-        projectUuid: 'proj-uuid-1',
-        version: 2,
-        name: 'Preview App',
-        description: '',
-        template: null,
-        downloadedAt: '2026-07-01T00:00:00.000Z',
-    },
-    files: [],
-};
-describe('getAuthHeader', () => {
-    it('uses ApiKey authentication for personal access tokens', () => {
-        expect((0, utils_1.getAuthHeader)('ldpat_secret')).toBe('ApiKey ldpat_secret');
-    });
-    it('uses Bearer authentication for service-account tokens', () => {
-        expect((0, utils_1.getAuthHeader)('ldsvc_secret')).toBe('Bearer ldsvc_secret');
-    });
-});
-describe('buildPreviewChildEnv', () => {
-    it('passes through only required host variables and no parent secrets', () => {
-        const env = (0, preview_1.buildPreviewChildEnv)({
-            serverUrl: 'http://localhost:3000',
-            projectUuid: 'proj-uuid-1',
-            proxyPort: 45678,
-            proxyNonce: 'nonce-abc',
-            browserImageOrigins: ['https://tiles.example.com'],
-            parentEnv: {
-                HOME: '/home/developer',
-                PATH: '/usr/bin',
-                LIGHTDASH_API_KEY: 'ldpat_parent_secret',
-                LIGHTDASH_PROXY_AUTHORIZATION: 'Basic parent-secret',
-                NPM_TOKEN: 'npm_parent_secret',
-                VITE_LIGHTDASH_API_KEY: 'ldpat_browser_secret',
-            },
-        });
-        expect(env).toEqual({
-            HOME: '/home/developer',
-            PATH: '/usr/bin',
-            VITE_LIGHTDASH_URL: 'http://localhost:3000',
-            VITE_LIGHTDASH_API_KEY: 'nonce-abc',
-            VITE_LIGHTDASH_PROJECT_UUID: 'proj-uuid-1',
-            LIGHTDASH_PREVIEW_PROXY_TARGET: 'http://127.0.0.1:45678',
-            LIGHTDASH_PREVIEW_PROXY_NONCE: 'nonce-abc',
-            LIGHTDASH_PREVIEW_BROWSER_IMAGE_ORIGINS: '["https://tiles.example.com"]',
-        });
-        expect(env).not.toHaveProperty('LIGHTDASH_API_KEY');
-        expect(env).not.toHaveProperty('LIGHTDASH_PROXY_AUTHORIZATION');
-        expect(env).not.toHaveProperty('NPM_TOKEN');
-        for (const value of Object.values(env)) {
-            expect(value).not.toMatch(/^ld(pat|svc)_/);
-        }
-    });
-    it('strips a trailing slash from the server url', () => {
-        const env = (0, preview_1.buildPreviewChildEnv)({
-            serverUrl: 'http://localhost:3000/',
-            projectUuid: 'p',
-            proxyPort: 1,
-            proxyNonce: 'n',
-        });
-        expect(env.VITE_LIGHTDASH_URL).toBe('http://localhost:3000');
-    });
-});
-describe('fetchBrowserImageOrigins', () => {
-    it('returns opted-in no-auth origins linked by manifest slug', async () => {
-        const connection = {
-            slug: 'public-tiles',
-            type: 'none',
-            origin: 'https://tiles.example.com',
-            allowBrowserImages: true,
-        };
-        const origins = await (0, preview_1.fetchBrowserImageOrigins)({
-            manifest: {
-                ...previewBundle.manifest,
-                externalConnections: [
-                    { alias: 'tiles', connectionSlug: 'public-tiles' },
-                ],
-            },
-            projectUuid: 'proj-uuid-1',
-            serverUrl: 'https://lightdash.example.com',
-            authorization: 'ApiKey token',
-            fetchFn: vi.fn().mockResolvedValue({
-                ok: true,
-                json: async () => ({ results: [connection] }),
-            }),
-        });
-        expect(origins).toEqual(['https://tiles.example.com']);
-    });
-    it('fails closed for malformed response shapes', async () => {
-        const origins = await (0, preview_1.fetchBrowserImageOrigins)({
-            manifest: {
-                ...previewBundle.manifest,
-                externalConnections: [
-                    { alias: 'tiles', connectionSlug: 'public-tiles' },
-                ],
-            },
-            projectUuid: 'proj-uuid-1',
-            serverUrl: 'https://lightdash.example.com',
-            authorization: 'ApiKey token',
-            fetchFn: vi.fn().mockResolvedValue({
-                ok: true,
-                json: async () => ({ results: 'not-an-array' }),
-            }),
-        });
-        expect(origins).toEqual([]);
-    });
-    it('ignores malformed connections and unsafe origins', async () => {
-        const origins = await (0, preview_1.fetchBrowserImageOrigins)({
-            manifest: {
-                ...previewBundle.manifest,
-                externalConnections: [
-                    { alias: 'tiles', connectionSlug: 'public-tiles' },
-                ],
-            },
-            projectUuid: 'proj-uuid-1',
-            serverUrl: 'https://lightdash.example.com',
-            authorization: 'ApiKey token',
-            fetchFn: vi.fn().mockResolvedValue({
-                ok: true,
-                json: async () => ({
-                    results: [
-                        null,
-                        {
-                            slug: 'public-tiles',
-                            type: 'none',
-                            origin: 'not-a-url',
-                            allowBrowserImages: true,
-                        },
-                        {
-                            slug: 'public-tiles',
-                            type: 'none',
-                            origin: 'https://tiles.example.com/path',
-                            allowBrowserImages: true,
-                        },
-                        {
-                            slug: 'public-tiles',
-                            type: 'none',
-                            origin: 'https://tiles.example.com',
-                            allowBrowserImages: true,
-                        },
-                    ],
-                }),
-            }),
-        });
-        expect(origins).toEqual(['https://tiles.example.com']);
-    });
-});
-describe('assertScaffoldingSupportsPreviewProxy', () => {
-    it('passes when vite.config.js reads the proxy target', async () => {
-        const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-prev-'));
-        await fs_1.promises.writeFile(path.join(dir, 'vite.config.js'), 'const t = env.LIGHTDASH_PREVIEW_PROXY_TARGET;');
-        await expect((0, preview_1.assertScaffoldingSupportsPreviewProxy)(dir)).resolves.toBeUndefined();
-    });
-    it('rejects pre-proxy scaffolding with a re-download instruction', async () => {
-        const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-prev-'));
-        await fs_1.promises.writeFile(path.join(dir, 'vite.config.js'), 'const k = env.LIGHTDASH_PREVIEW_API_KEY;');
-        await expect((0, preview_1.assertScaffoldingSupportsPreviewProxy)(dir)).rejects.toThrow(/Re-download the app/);
-    });
-});
-describe('resolvePreviewTarget', () => {
-    it('defaults appDir to cwd and project to the current CLI project', async () => {
-        const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-prev-'));
-        await (0, appCodeFiles_1.writeBundleToDir)(dir, previewBundle);
-        const target = await (0, preview_1.resolvePreviewTarget)({
-            cwd: dir,
-            currentProjectUuid: 'current-proj',
-        });
-        expect(target.appDir).toBe(dir);
-        expect(target.projectUuid).toBe('current-proj');
-    });
-    it('resolves a relative path arg and prefers --project over the current project', async () => {
-        const parent = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-prev-'));
-        const appDir = path.join(parent, 'apps', 'my-app');
-        await (0, appCodeFiles_1.writeBundleToDir)(appDir, previewBundle);
-        const target = await (0, preview_1.resolvePreviewTarget)({
-            pathArg: 'apps/my-app',
-            projectFlag: 'other-proj',
-            currentProjectUuid: 'current-proj',
-            cwd: parent,
-        });
-        expect(target.appDir).toBe(appDir);
-        expect(target.projectUuid).toBe('other-proj');
-    });
-    it('requires --project when the CLI has no current project', async () => {
-        const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-prev-'));
-        await (0, appCodeFiles_1.writeBundleToDir)(dir, previewBundle);
-        await expect((0, preview_1.resolvePreviewTarget)({ cwd: dir })).rejects.toThrow(/Pass '--project <uuid or slug>'/);
-    });
-    it('errors clearly when the folder has no manifest', async () => {
-        const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-prev-'));
-        await expect((0, preview_1.resolvePreviewTarget)({ cwd: dir })).rejects.toThrow(/No lightdash-app\.yml found in/);
-    });
-});
-describe('assertNodeModulesPresent', () => {
-    it('passes when node_modules exists', async () => {
-        const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-prev-'));
-        await fs_1.promises.mkdir(path.join(dir, 'node_modules'));
-        await expect((0, preview_1.assertNodeModulesPresent)(dir)).resolves.toBeUndefined();
-    });
-    it('errors telling the user to npm install, without installing', async () => {
-        const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-prev-'));
-        await expect((0, preview_1.assertNodeModulesPresent)(dir)).rejects.toThrow(/Run 'npm install' in .*, or rerun with --assume-yes/);
-    });
-});
-describe('resolvePreviewPort', () => {
-    it('returns undefined when no port is given', () => {
-        expect((0, preview_1.resolvePreviewPort)(undefined)).toBeUndefined();
-    });
-    it('parses a valid port', () => {
-        expect((0, preview_1.resolvePreviewPort)('4000')).toBe(4000);
-    });
-    it.each(['0', '-1', '65536', 'abc', '1.5'])('rejects invalid port %s', (raw) => {
-        expect(() => (0, preview_1.resolvePreviewPort)(raw)).toThrow(/--port must be an integer/);
-    });
-});
-describe('ensureNodeModules', () => {
-    const promptMock = inquirer_1.default.prompt;
-    let dir;
-    beforeEach(async () => {
-        dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-prev-'));
-        vi.mocked(execa_1.default).mockReset();
-        promptMock.mockReset();
-        vi.spyOn(globalState_1.default, 'log').mockImplementation(() => { });
-        vi.spyOn(globalState_1.default, 'isNonInteractive').mockReturnValue(false);
-    });
-    afterEach(async () => {
-        vi.restoreAllMocks();
-        await fs_1.promises.rm(dir, { recursive: true, force: true });
-    });
-    it('does nothing when node_modules exists', async () => {
-        await fs_1.promises.mkdir(path.join(dir, 'node_modules'));
-        await (0, preview_1.ensureNodeModules)({ appDir: dir, assumeYes: false });
-        expect(execa_1.default).not.toHaveBeenCalled();
-        expect(promptMock).not.toHaveBeenCalled();
-    });
-    it('fails fast without installing when not interactive', async () => {
-        vi.spyOn(globalState_1.default, 'isNonInteractive').mockReturnValue(true);
-        await expect((0, preview_1.ensureNodeModules)({ appDir: dir, assumeYes: false })).rejects.toThrow(/Run 'npm install'/);
-        expect(execa_1.default).not.toHaveBeenCalled();
-        expect(promptMock).not.toHaveBeenCalled();
-    });
-    it('installs without prompting with --assume-yes', async () => {
-        await (0, preview_1.ensureNodeModules)({ appDir: dir, assumeYes: true });
-        expect(promptMock).not.toHaveBeenCalled();
-        expect(execa_1.default).toHaveBeenCalledWith('npm', [
-            'install',
-            '--include=dev',
-            '--ignore-scripts',
-            '--no-package-lock',
-        ], expect.objectContaining({ cwd: dir }));
-    });
-    it('cancels without installing when the warning prompt is declined', async () => {
-        const stdinTty = process.stdin.isTTY;
-        const stdoutTty = process.stdout.isTTY;
-        process.stdin.isTTY = true;
-        process.stdout.isTTY = true;
-        promptMock.mockResolvedValueOnce({ confirmed: false });
-        try {
-            await expect((0, preview_1.ensureNodeModules)({ appDir: dir, assumeYes: false })).rejects.toThrow('Preview cancelled.');
-        }
-        finally {
-            process.stdin.isTTY = stdinTty;
-            process.stdout.isTTY = stdoutTty;
-        }
-        expect(promptMock).toHaveBeenCalledTimes(1);
-        expect(execa_1.default).not.toHaveBeenCalled();
-    });
-});
-describe('projectNotFoundMessage', () => {
-    it('names the project, the server, and both remedies', () => {
-        const msg = (0, preview_1.projectNotFoundMessage)({
-            projectUuid: 'proj-uuid-1',
-            serverUrl: 'https://cloud.example.com',
-        });
-        expect(msg).toContain('proj-uuid-1');
-        expect(msg).toContain('https://cloud.example.com');
-        expect(msg).toMatch(/lightdash login/);
-        expect(msg).toMatch(/--project/);
-    });
-});
-describe('preflightPreviewRequest', () => {
-    it('reports network failures separately from rejected credentials', async () => {
-        const fetchFn = vi
-            .fn()
-            .mockRejectedValue(new Error('connection refused'));
-        await expect((0, preview_1.preflightPreviewRequest)({
-            apiPath: '/api/v1/user',
-            serverUrl: 'http://localhost:8080',
-            authorization: 'ApiKey test',
-            fetchFn,
-        })).rejects.toThrow('Could not connect to http://localhost:8080 while starting preview: connection refused');
-    });
-    it('returns false for an HTTP rejection', async () => {
-        const fetchFn = vi
-            .fn()
-            .mockResolvedValue({ ok: false });
-        await expect((0, preview_1.preflightPreviewRequest)({
-            apiPath: '/api/v1/user',
-            serverUrl: 'http://localhost:8080',
-            authorization: 'ApiKey test',
-            fetchFn,
-        })).resolves.toBe(false);
-    });
-});
-describe('removeLegacyPreviewCredential', () => {
-    it('removes only the obsolete credential and preserves other settings', async () => {
-        const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-prev-'));
-        const envPath = path.join(dir, '.env.local');
-        await fs_1.promises.writeFile(envPath, [
-            'VITE_CUSTOM_SETTING=keep-me',
-            'LIGHTDASH_PREVIEW_API_KEY=ldpat_remove_me',
-            '# LIGHTDASH_PREVIEW_API_KEY=commented-out',
-            'ANOTHER_SETTING=also-keep-me',
-            '',
-        ].join('\n'));
-        await expect((0, preview_1.removeLegacyPreviewCredential)(dir)).resolves.toBe(true);
-        await expect(fs_1.promises.readFile(envPath, 'utf-8')).resolves.toBe([
-            'VITE_CUSTOM_SETTING=keep-me',
-            '# LIGHTDASH_PREVIEW_API_KEY=commented-out',
-            'ANOTHER_SETTING=also-keep-me',
-            '',
-        ].join('\n'));
-    });
-    it('deletes an env file that contains only the obsolete credential', async () => {
-        const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-prev-'));
-        const envPath = path.join(dir, '.env.local');
-        await fs_1.promises.writeFile(envPath, 'export LIGHTDASH_PREVIEW_API_KEY=ldpat_remove_me\n');
-        await expect((0, preview_1.removeLegacyPreviewCredential)(dir)).resolves.toBe(true);
-        await expect(fs_1.promises.stat(envPath)).rejects.toMatchObject({
-            code: 'ENOENT',
-        });
-    });
-    it('does nothing when there is no legacy credential', async () => {
-        const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-prev-'));
-        await expect((0, preview_1.removeLegacyPreviewCredential)(dir)).resolves.toBe(false);
-    });
-});

package/dist/handlers/apps/previewProxy.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=previewProxy.test.d.ts.map

package/dist/handlers/apps/previewProxy.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"previewProxy.test.d.ts","sourceRoot":"","sources":["../../../src/handlers/apps/previewProxy.test.ts"],"names":[],"mappings":""}

package/dist/handlers/apps/previewProxy.test.js

@@ -1,178 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const tslib_1 = require("tslib");
-const common_1 = require("@lightdash/common");
-const http = tslib_1.__importStar(require("http"));
-const previewProxy_1 = require("./previewProxy");
-const PROJECT_UUID = 'proj-uuid-1';
-const NONCE = 'test-nonce';
-const API_KEY = 'ldpat_secret';
-const AUTHORIZATION = `ApiKey ${API_KEY}`;
-/** Records every request and replies 200 with a JSON echo. */
-const startFakeUpstream = () => {
-    const seen = [];
-    const server = http.createServer((req, res) => {
-        const chunks = [];
-        req.on('data', (chunk) => chunks.push(chunk));
-        req.on('end', () => {
-            seen.push({
-                method: req.method ?? '',
-                url: req.url ?? '',
-                headers: req.headers,
-                body: Buffer.concat(chunks).toString('utf-8'),
-            });
-            res.writeHead(200, {
-                'content-type': 'application/json',
-                'set-cookie': 'upstream=1',
-            });
-            res.end(JSON.stringify({ status: 'ok' }));
-        });
-    });
-    return new Promise((resolve) => {
-        server.listen(0, '127.0.0.1', () => {
-            const { port } = server.address();
-            resolve({
-                url: `http://127.0.0.1:${port}`,
-                seen,
-                close: () => new Promise((r) => {
-                    server.close(() => r());
-                    server.closeAllConnections();
-                }),
-            });
-        });
-    });
-};
-describe('startPreviewProxy', () => {
-    let upstream;
-    let proxy;
-    const proxyFetch = (path, init = {}) => {
-        const { nonce = NONCE, authorization = `ApiKey ${NONCE}`, ...rest } = init;
-        const headers = new Headers(rest.headers);
-        if (nonce !== null)
-            headers.set(previewProxy_1.PREVIEW_PROXY_NONCE_HEADER, nonce);
-        if (authorization !== null) {
-            headers.set('authorization', authorization);
-        }
-        return fetch(`http://127.0.0.1:${proxy.port}${path}`, {
-            ...rest,
-            headers,
-        });
-    };
-    beforeEach(async () => {
-        upstream = await startFakeUpstream();
-        proxy = await (0, previewProxy_1.startPreviewProxy)({
-            upstreamUrl: upstream.url,
-            authorization: AUTHORIZATION,
-            projectUuid: PROJECT_UUID,
-            nonce: NONCE,
-        });
-    });
-    afterEach(async () => {
-        await proxy.close();
-        await upstream.close();
-    });
-    it('forwards an allowlisted route with the credential attached', async () => {
-        const res = await proxyFetch(`/api/v2/projects/${PROJECT_UUID}/query/metric-query`, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                authorization: `ApiKey ${NONCE}`,
-            },
-            body: JSON.stringify({ exploreName: 'orders' }),
-        });
-        expect(res.status).toBe(200);
-        expect(upstream.seen).toHaveLength(1);
-        const forwarded = upstream.seen[0];
-        expect(forwarded.method).toBe('POST');
-        expect(forwarded.body).toBe('{"exploreName":"orders"}');
-        // The browser-side scoped capability is replaced by the real credential…
-        expect(forwarded.headers.authorization).toBe(AUTHORIZATION);
-        // …and the run-scoped nonce never travels upstream.
-        expect(forwarded.headers[previewProxy_1.PREVIEW_PROXY_NONCE_HEADER]).toBeUndefined();
-    });
-    it('stamps the signed-download header on schedule-download and nothing else', async () => {
-        await proxyFetch(`/api/v2/projects/${PROJECT_UUID}/query/some-query-uuid/schedule-download`, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                authorization: `ApiKey ${NONCE}`,
-            },
-            body: JSON.stringify({ type: 'csv' }),
-        });
-        await proxyFetch(`/api/v2/projects/${PROJECT_UUID}/query/some-query-uuid`);
-        expect(upstream.seen).toHaveLength(2);
-        expect(upstream.seen[0].headers[common_1.LightdashSignedDownloadHeader.toLowerCase()]).toBe('true');
-        expect(upstream.seen[1].headers[common_1.LightdashSignedDownloadHeader.toLowerCase()]).toBeUndefined();
-    });
-    it('preserves the query string on result polling', async () => {
-        const res = await proxyFetch(`/api/v2/projects/${PROJECT_UUID}/query/some-query-uuid?page=2&pageSize=500`);
-        expect(res.status).toBe(200);
-        expect(upstream.seen[0].url).toBe(`/api/v2/projects/${PROJECT_UUID}/query/some-query-uuid?page=2&pageSize=500`);
-    });
-    it('rejects non-SDK routes without contacting upstream', async () => {
-        const res = await proxyFetch('/api/v1/org/projects');
-        expect(res.status).toBe(403);
-        const body = (await res.json());
-        expect(body.message).toMatch(/not a data-app SDK route/);
-        expect(upstream.seen).toHaveLength(0);
-    });
-    it('rejects allowlisted routes aimed at a different project', async () => {
-        const res = await proxyFetch('/api/v2/projects/other-project/query/metric-query', { method: 'POST' });
-        expect(res.status).toBe(403);
-        const body = (await res.json());
-        expect(body.message).toMatch(/pinned to proj-uuid-1/);
-        expect(upstream.seen).toHaveLength(0);
-    });
-    it('rejects allowlisted paths with the wrong method', async () => {
-        const res = await proxyFetch('/api/v1/user', { method: 'POST' });
-        expect(res.status).toBe(403);
-        expect(upstream.seen).toHaveLength(0);
-    });
-    it('rejects requests without the per-run nonce', async () => {
-        const missing = await proxyFetch('/api/v1/user', { nonce: null });
-        expect(missing.status).toBe(401);
-        const wrong = await proxyFetch('/api/v1/user', { nonce: 'guessed' });
-        expect(wrong.status).toBe(401);
-        expect(upstream.seen).toHaveLength(0);
-    });
-    it('rejects requests without the browser-side scoped capability', async () => {
-        const missing = await proxyFetch('/api/v1/user', {
-            authorization: null,
-        });
-        expect(missing.status).toBe(401);
-        const wrong = await proxyFetch('/api/v1/user', {
-            authorization: 'ApiKey guessed',
-        });
-        expect(wrong.status).toBe(401);
-        expect(upstream.seen).toHaveLength(0);
-    });
-    it('does not pass upstream cookies back to the page', async () => {
-        const res = await proxyFetch('/api/v1/user');
-        expect(res.status).toBe(200);
-        expect(res.headers.get('set-cookie')).toBeNull();
-    });
-    it('forwards service-account and reverse-proxy authorization', async () => {
-        const serviceProxy = await (0, previewProxy_1.startPreviewProxy)({
-            upstreamUrl: upstream.url,
-            authorization: 'Bearer ldsvc_secret',
-            proxyAuthorization: 'Basic reverse-proxy-secret',
-            projectUuid: PROJECT_UUID,
-            nonce: 'service-nonce',
-        });
-        try {
-            const res = await fetch(`http://127.0.0.1:${serviceProxy.port}/api/v1/user`, {
-                headers: {
-                    [previewProxy_1.PREVIEW_PROXY_NONCE_HEADER]: 'service-nonce',
-                    authorization: 'ApiKey service-nonce',
-                },
-            });
-            expect(res.status).toBe(200);
-            const forwarded = upstream.seen.at(-1);
-            expect(forwarded?.headers.authorization).toBe('Bearer ldsvc_secret');
-            expect(forwarded?.headers['proxy-authorization']).toBe('Basic reverse-proxy-secret');
-        }
-        finally {
-            await serviceProxy.close();
-        }
-    });
-});

package/dist/handlers/apps/scaffolding.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=scaffolding.test.d.ts.map

package/dist/handlers/apps/scaffolding.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scaffolding.test.d.ts","sourceRoot":"","sources":["../../../src/handlers/apps/scaffolding.test.ts"],"names":[],"mappings":""}