@lowdefy/server-dev 6.1.0 → 7.1.0

package/src/websocket/devWebSocket.test.mjs

@@ -0,0 +1,157 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+const mockCreateWebSocketConnection = jest.fn(() => ({
+  close: jest.fn(),
+  handleMessage: jest.fn(),
+}));
+// The route's origin rule has its own tests (src/routes/websocket.test.mjs);
+// these requests carry no Origin, which it allows.
+jest.unstable_mockModule('@lowdefy/api', () => ({
+  createChannelRegistry: jest.fn(() => ({})),
+  createWebSocketConnection: mockCreateWebSocketConnection,
+  isWebSocketOriginAllowed: () => true,
+}));
+const mockStrategies = [];
+jest.unstable_mockModule('../../lib/server/auth/getStrategies.js', () => ({
+  default: () => mockStrategies,
+}));
+const mockLogger = { warn: jest.fn(), debug: jest.fn() };
+jest.unstable_mockModule('../../lib/server/log/createLogger.js', () => ({
+  default: () => mockLogger,
+}));
+
+const { handleWebSocketUpgrade } = await import('./devWebSocket.js');
+const { default: websocketHandler } = await import('../routes/websocket.js');
+
+// Mirrors the dev app: middleware builds the request context, then the
+// websocket route runs. `status` stands in for the auth middleware refusing.
+function createApp({ status } = {}) {
+  const app = new Hono();
+  app.use('/api/*', async (c, next) => {
+    if (status) {
+      return c.json({ message: 'Unauthorized.' }, status);
+    }
+    c.set('lowdefyContext', { rid: 'request-1', logger: mockLogger });
+    return next();
+  });
+  app.get('/api/websocket', websocketHandler);
+  return app;
+}
+
+function createUpgrade() {
+  const socket = { end: jest.fn() };
+  const ws = { close: jest.fn(), on: jest.fn(), send: jest.fn() };
+  const wss = {
+    handleUpgrade: jest.fn((request, socket, head, callback) => {
+      callback(ws);
+      return ws;
+    }),
+  };
+  const request = {
+    headers: { host: 'localhost:3000', cookie: 'session=1' },
+    url: '/api/websocket',
+  };
+  return { request, socket, wss, head: Buffer.alloc(0) };
+}
+
+test('an upgrade hands the context the route built to the websocket connection', async () => {
+  const upgrade = createUpgrade();
+
+  await handleWebSocketUpgrade({ app: createApp(), ...upgrade });
+
+  expect(upgrade.wss.handleUpgrade).toHaveBeenCalledTimes(1);
+  expect(mockCreateWebSocketConnection.mock.calls[0][0]).toEqual({
+    rid: 'request-1',
+    logger: mockLogger,
+  });
+  expect(upgrade.socket.end).not.toHaveBeenCalled();
+});
+
+test('an upgrade hands its headers and the auth strategies to the websocket connection', async () => {
+  const upgrade = createUpgrade();
+
+  await handleWebSocketUpgrade({ app: createApp(), ...upgrade });
+
+  const options = mockCreateWebSocketConnection.mock.calls[0][1];
+  expect(options.headers.get('cookie')).toBe('session=1');
+  expect(options.strategies).toBe(mockStrategies);
+});
+
+test('the websocket connection closes its socket with the code and reason it is given', async () => {
+  const upgrade = createUpgrade();
+
+  await handleWebSocketUpgrade({ app: createApp(), ...upgrade });
+
+  const ws = upgrade.wss.handleUpgrade.mock.results[0].value;
+  const { closeSocket } = mockCreateWebSocketConnection.mock.calls[0][1];
+  closeSocket({ code: 4401, reason: 'caller-changed' });
+  expect(ws.close).toHaveBeenCalledWith(4401, 'caller-changed');
+});
+
+test('concurrent upgrades through different app instances each get a connection', async () => {
+  const first = createUpgrade();
+  const second = createUpgrade();
+
+  await Promise.all([
+    handleWebSocketUpgrade({ app: createApp(), ...first }),
+    handleWebSocketUpgrade({ app: createApp(), ...second }),
+  ]);
+
+  expect(mockCreateWebSocketConnection).toHaveBeenCalledTimes(2);
+});
+
+test('a refused upgrade answers with the route status and logs why', async () => {
+  const upgrade = createUpgrade();
+
+  await handleWebSocketUpgrade({ app: createApp({ status: 401 }), ...upgrade });
+
+  expect(upgrade.wss.handleUpgrade).not.toHaveBeenCalled();
+  expect(upgrade.socket.end).toHaveBeenCalledWith(
+    'HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n'
+  );
+  expect(mockLogger.warn).toHaveBeenCalledWith(
+    { event: 'ws_upgrade_refused', status: 401 },
+    'WebSocket upgrade refused: /api/websocket answered 401. {"message":"Unauthorized."}'
+  );
+});
+
+test('the websocket route refuses a plain HTTP request', async () => {
+  const response = await createApp().request('/api/websocket');
+
+  expect(response.status).toBe(400);
+  expect(await response.json()).toEqual({ message: 'WebSocket upgrade required.' });
+});
+
+test('an upgrade answered 200 without a request context is refused and logged', async () => {
+  const upgrade = createUpgrade();
+  const app = new Hono();
+  app.get('/api/websocket', (c) => c.json({ ok: true }));
+
+  await handleWebSocketUpgrade({ app, ...upgrade });
+
+  expect(upgrade.wss.handleUpgrade).not.toHaveBeenCalled();
+  expect(upgrade.socket.end).toHaveBeenCalledWith(
+    'HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n'
+  );
+  expect(mockLogger.warn).toHaveBeenCalledWith(
+    { event: 'ws_upgrade_refused', status: 200 },
+    'WebSocket upgrade refused: /api/websocket answered 200 without a request context; the websocket route did not run.'
+  );
+});

package/vite.config.js

@@ -19,6 +19,17 @@ import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
 import devServer from '@hono/vite-dev-server';
 import { WebSocketServer } from 'ws';
+import watchOwner from '@lowdefy/node-utils/watchOwner.js';
+
+import createDevServerExclude from './lib/vite/createDevServerExclude.js';
+
+const devServerEntry = './src/app.js';
+
+// The dev manager spawns this Vite process with a stdin pipe it holds and
+// LOWDEFY_EXIT_ON_STDIN_CLOSE set, so a manager killed outright (SIGKILL, out
+// of memory) does not leave Vite holding the internal port. process.exit runs
+// Playwright's exit handler, which closes any browser this process launched.
+watchOwner({ onExit: () => process.exit(0) });
 
 // basePath from the Lowdefy build — assets and routes are served under it.
 let basePath = '';
@@ -30,10 +41,11 @@ try {
 }
 
 // Vite owns the HTTP server in dev, so /api/websocket upgrades are handled
-// here instead of @hono/node-server. The upgrade handler module is loaded
-// through Vite's SSR graph so it shares the Hono app and @lowdefy/api module
-// instances with the dev server routes. Vite's own HMR websocket uses a
-// different path and is untouched.
+// here instead of @hono/node-server. The Hono app is loaded from the same
+// entry @hono/vite-dev-server serves, so the upgrade runs the app every other
+// request runs, and the upgrade handler module is loaded through Vite's SSR
+// graph so it shares the @lowdefy/api module instances with the dev server
+// routes. Vite's own HMR websocket uses a different path and is untouched.
 function lowdefyWebSocket() {
   return {
     name: 'lowdefy-websocket',
@@ -45,12 +57,13 @@ function lowdefyWebSocket() {
           return;
         }
         try {
-          const { handleWebSocketUpgrade } = await server.ssrLoadModule(
-            './src/websocket/devWebSocket.js'
-          );
-          await handleWebSocketUpgrade({ request, socket, head, wss });
+          const [{ default: app }, { handleWebSocketUpgrade }] = await Promise.all([
+            server.ssrLoadModule(devServerEntry),
+            server.ssrLoadModule('./src/websocket/devWebSocket.js'),
+          ]);
+          await handleWebSocketUpgrade({ app, request, socket, head, wss });
         } catch (error) {
-          console.error(error);
+          console.error('WebSocket upgrade failed:', error);
           socket.destroy();
         }
       });
@@ -58,23 +71,26 @@ function lowdefyWebSocket() {
   };
 }
 
+// The @lowdefy packages this server depends on. A linked plugin pinned to
+// another release brings its own copies, and the client would then mix
+// versions: the dev server pre-bundles one copy per package for every
+// importer (whichever its scan meets first, so the server's own code can get
+// a plugin's older @lowdefy/helpers without an export it imports), and a
+// production build bundles both, so blocks read module state the client never
+// filled (the HTML enhancements it registers in @lowdefy/block-utils). The
+// server's copies are the ones its client and blocks were released with.
+const lowdefyDependencies = Object.keys(
+  JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).dependencies ?? {}
+).filter((name) => name.startsWith('@lowdefy/'));
+
 export default defineConfig(({ mode }) => ({
   base: `${basePath}/`,
   plugins: [
     react(),
     lowdefyWebSocket(),
     devServer({
-      entry: './src/app.js',
-      // Vite serves these itself; everything else routes to the Hono app.
-      exclude: [
-        /^\/client\/.+/,
-        /^\/lib\/.+/,
-        /^\/build\/.+/,
-        /^\/@.+$/,
-        /^\/node_modules\/.*/,
-        /\?t=\d+$/,
-        /^\/favicon\.ico$/,
-      ],
+      entry: devServerEntry,
+      exclude: createDevServerExclude({ basePath }),
     }),
   ],
   define: {
@@ -94,8 +110,20 @@ export default defineConfig(({ mode }) => ({
     entries: ['client/main.jsx'],
   },
   resolve: {
-    // linked plugin packages (pnpm link: / workspace) must share one React.
-    dedupe: ['react', 'react-dom'],
+    // Linked plugin packages (pnpm link: / workspace) resolve their own copies of
+    // shared libraries. They must share one React, the antd/X/cssinjs copies
+    // whose context providers (App, ConfigProvider, StyleProvider) the client
+    // renders, the dayjs whose global locale the client sets, and the server's
+    // @lowdefy packages (see lowdefyDependencies).
+    dedupe: [
+      'react',
+      'react-dom',
+      'antd',
+      '@ant-design/x',
+      '@ant-design/cssinjs',
+      'dayjs',
+      ...lowdefyDependencies,
+    ],
   },
   server: {
     watch: {
@@ -105,7 +133,9 @@ export default defineConfig(({ mode }) => ({
       // not need these events: globals.css imports build/tailwind-candidates.css,
       // which the JIT builder touches whenever tailwind content changes (the
       // sole recompile trigger — see writeGlobalsCss in @lowdefy/build).
-      ignored: ['**/lowdefy-build/tailwind/**'],
+      // The config build writes into build-staging and then moves each file
+      // into build, so only build is watched.
+      ignored: ['**/lowdefy-build/tailwind/**', '**/build-staging/**'],
     },
   },
 }));

package/lib/server/auth/getDevSession.js

@@ -1,70 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { createSessionCallback } from '@lowdefy/api';
-
-import authJson from '../../build/auth.js';
-import callbacks from '../../../build/plugins/auth/callbacks.js';
-import getHeadlessUser from './getHeadlessUser.js';
-import getMockUser from './getMockUser.js';
-
-// THE single source of dev sessions (mock user, headless renderer). Two
-// invariants live here, by construction rather than by convention:
-//
-// 1. Prod parity: the dev user runs through the identical Auth.js session
-//    callback a real sign-in uses (OIDC claim copy, userFields mapping,
-//    custom session-callback plugins, roles validation, hashed_id) — so what
-//    a mock or headless session sees is exactly what a real authenticated
-//    user would see in production, and dev validates prod behaviour.
-// 2. Client/server parity: every consumer — the server request context
-//    (session.js) and the browser client's GET /api/auth/session
-//    (routes/auth.js) — obtains the session from this one function, so the
-//    two can never diverge.
-//
-// Auth.js sessions carry an expires timestamp (the client SessionProvider
-// schedules refetches off it); dev sessions never expire while the server
-// runs, a day keeps polling calm.
-const DEV_SESSION_MAX_AGE_MS = 24 * 60 * 60 * 1000;
-
-async function getDevSession(c) {
-  const user = getMockUser() ?? getHeadlessUser(c);
-  if (!user) {
-    return undefined;
-  }
-  // Without auth configured nothing is protected and there is no session
-  // callback pipeline to run — a dev session would not match any prod
-  // behaviour. (A configured mock user already threw in getMockUser.)
-  if (authJson.configured !== true) {
-    return undefined;
-  }
-
-  const sessionCallback = createSessionCallback({
-    authConfig: authJson,
-    plugins: { callbacks },
-  });
-
-  // The dev user acts as both token and user, exactly how a decoded JWT
-  // reaches the session callback on a real request.
-  const session = await sessionCallback({
-    session: { user: {} },
-    token: user,
-    user,
-  });
-  session.expires = new Date(Date.now() + DEV_SESSION_MAX_AGE_MS).toISOString();
-  return session;
-}
-
-export default getDevSession;

package/lib/server/auth/getDevSession.test.mjs

@@ -1,138 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import fs from 'fs';
-import path from 'path';
-import { fileURLToPath } from 'url';
-
-import { jest } from '@jest/globals';
-
-// Only the auth build artifact is mocked — createSessionCallback is the REAL
-// @lowdefy/api pipeline, because prod parity is exactly what these tests
-// exist to prove: a dev session must be shaped by the same userFields
-// mapping, roles validation, and hashed_id stamping as a real sign-in.
-jest.unstable_mockModule('../../build/auth.js', () => ({
-  default: {
-    configured: true,
-    callbacks: [],
-    userFields: {
-      id: 'user.id',
-      roles: 'user.roles',
-      global_attributes: 'user.global_attributes',
-    },
-  },
-}));
-
-// getDevSession statically imports the app build's auth callbacks module,
-// which only exists in a built app (build/** is gitignored). Materialize an
-// empty one — exactly what a build without custom auth callback plugins
-// writes — so the import resolves; clean up only if this test created it.
-const dirname = path.dirname(fileURLToPath(import.meta.url));
-const callbacksDir = path.resolve(dirname, '../../../build/plugins/auth');
-const callbacksPath = path.join(callbacksDir, 'callbacks.js');
-const createdCallbacksFixture = !fs.existsSync(callbacksPath);
-if (createdCallbacksFixture) {
-  fs.mkdirSync(callbacksDir, { recursive: true });
-  fs.writeFileSync(callbacksPath, 'export default {};\n');
-}
-
-afterAll(() => {
-  if (createdCallbacksFixture) {
-    fs.rmSync(callbacksPath, { force: true });
-  }
-});
-
-const { default: getDevSession } = await import('./getDevSession.js');
-const { HEADLESS_USER_COOKIE, headlessUser } = await import('./headlessUser.js');
-
-function createContext({ cookie } = {}) {
-  return { req: { header: (name) => (name === 'cookie' ? (cookie ?? '') : undefined) } };
-}
-
-function headlessCookie(user = headlessUser) {
-  return `${HEADLESS_USER_COOKIE}=${Buffer.from(JSON.stringify(user)).toString('base64')}`;
-}
-
-const originalDevUser = process.env.LOWDEFY_DEV_USER;
-
-afterEach(() => {
-  if (originalDevUser === undefined) {
-    delete process.env.LOWDEFY_DEV_USER;
-  } else {
-    process.env.LOWDEFY_DEV_USER = originalDevUser;
-  }
-});
-
-test('getDevSession returns undefined with no mock user and no headless cookie', async () => {
-  delete process.env.LOWDEFY_DEV_USER;
-  expect(await getDevSession(createContext())).toBe(undefined);
-});
-
-test('mock user session is built by the real session callback — userFields, hashed_id, expires', async () => {
-  // The claim shape a consuming app's tenant convention uses (e.g.
-  // global_attributes.company_ids) must survive to session.user on BOTH the
-  // server request path and the client session endpoint — this session is
-  // what both serve.
-  process.env.LOWDEFY_DEV_USER = JSON.stringify({
-    id: 'dev-user',
-    sub: 'dev-user',
-    name: 'Dev User',
-    roles: ['admin'],
-    global_attributes: { company_ids: ['C-1'] },
-  });
-
-  const session = await getDevSession(createContext());
-  expect(session.user.id).toEqual('dev-user');
-  expect(session.user.name).toEqual('Dev User');
-  expect(session.user.roles).toEqual(['admin']);
-  expect(session.user.global_attributes).toEqual({ company_ids: ['C-1'] });
-  // Prod-session markers from the real pipeline:
-  expect(typeof session.hashed_id).toBe('string');
-  expect(session.hashed_id.length).toBeGreaterThan(0);
-  expect(new Date(session.expires).getTime()).toBeGreaterThan(Date.now());
-});
-
-test('headless cookie session runs through the same pipeline as a real sign-in', async () => {
-  delete process.env.LOWDEFY_DEV_USER;
-
-  const session = await getDevSession(createContext({ cookie: headlessCookie() }));
-  expect(session.user.id).toEqual(headlessUser.id);
-  expect(session.user.roles).toEqual([]);
-  expect(typeof session.hashed_id).toBe('string');
-});
-
-test('mock user takes precedence over the headless cookie', async () => {
-  process.env.LOWDEFY_DEV_USER = JSON.stringify({ id: 'mock-wins', roles: [] });
-
-  const session = await getDevSession(createContext({ cookie: headlessCookie() }));
-  expect(session.user.id).toEqual('mock-wins');
-});
-
-test('invalid roles are rejected by the real pipeline, exactly as in prod', async () => {
-  process.env.LOWDEFY_DEV_USER = JSON.stringify({ id: 'bad', roles: 'admin' });
-
-  await expect(getDevSession(createContext())).rejects.toThrow(
-    'session.user.roles must be an array of strings.'
-  );
-});
-
-test('invalid JSON in LOWDEFY_DEV_USER throws a clear error', async () => {
-  process.env.LOWDEFY_DEV_USER = 'not json';
-
-  await expect(getDevSession(createContext())).rejects.toThrow(
-    'Invalid JSON in LOWDEFY_DEV_USER environment variable.'
-  );
-});

package/manager/processes/warnAuthUrlPortMismatch.mjs

@@ -1,47 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-// Auth.js derives the app origin from request headers (trustHost), so an unset
-// AUTH_URL works on whatever port the dev server binds to. But when AUTH_URL (or
-// the v4 fallback NEXTAUTH_URL) is set, @auth/core pins the origin to it verbatim
-// — OAuth callbacks and sign-in redirects then target that URL. A pinned URL on a
-// mismatched port is left untouched but warned about.
-function warnAuthUrlPortMismatch({ context }) {
-  const { port } = context.options;
-  const name = process.env.AUTH_URL ? 'AUTH_URL' : 'NEXTAUTH_URL';
-  const current = process.env.AUTH_URL ?? process.env.NEXTAUTH_URL;
-
-  if (!current) return;
-
-  let currentPort;
-  try {
-    const url = new URL(current);
-    currentPort = url.port || (url.protocol === 'https:' ? '443' : '80');
-  } catch (_) {
-    context.logger.warn(`${name} (${current}) is not a valid URL.`);
-    return;
-  }
-
-  if (currentPort !== String(port)) {
-    context.logger.warn(
-      `${name} (${current}) does not match the dev server port ${port}. ` +
-        `Auth sign-in callbacks and redirects will target ${current}. ` +
-        `Update ${name} or unset it to derive the origin from the request.`
-    );
-  }
-}
-
-export default warnAuthUrlPortMismatch;

package/manager/processes/warnAuthUrlPortMismatch.test.mjs

@@ -1,93 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { jest } from '@jest/globals';
-import warnAuthUrlPortMismatch from './warnAuthUrlPortMismatch.mjs';
-
-const originalAuthUrl = process.env.AUTH_URL;
-const originalNextAuthUrl = process.env.NEXTAUTH_URL;
-
-function createContext(port) {
-  return {
-    options: { port },
-    logger: { warn: jest.fn() },
-  };
-}
-
-function restoreEnv(name, value) {
-  if (value === undefined) {
-    delete process.env[name];
-  } else {
-    process.env[name] = value;
-  }
-}
-
-beforeEach(() => {
-  delete process.env.AUTH_URL;
-  delete process.env.NEXTAUTH_URL;
-});
-
-afterEach(() => {
-  restoreEnv('AUTH_URL', originalAuthUrl);
-  restoreEnv('NEXTAUTH_URL', originalNextAuthUrl);
-});
-
-test('warnAuthUrlPortMismatch stays silent when no auth URL is set', () => {
-  const context = createContext(3001);
-  warnAuthUrlPortMismatch({ context });
-  expect(context.logger.warn).not.toHaveBeenCalled();
-});
-
-test('warnAuthUrlPortMismatch stays silent when AUTH_URL matches the dev port', () => {
-  process.env.AUTH_URL = 'http://localhost:3000';
-  const context = createContext(3000);
-  warnAuthUrlPortMismatch({ context });
-  expect(context.logger.warn).not.toHaveBeenCalled();
-});
-
-test('warnAuthUrlPortMismatch warns when AUTH_URL port does not match', () => {
-  process.env.AUTH_URL = 'http://localhost:3000';
-  const context = createContext(3001);
-  warnAuthUrlPortMismatch({ context });
-  expect(context.logger.warn).toHaveBeenCalledTimes(1);
-  expect(context.logger.warn.mock.calls[0][0]).toContain(
-    'AUTH_URL (http://localhost:3000) does not match the dev server port 3001'
-  );
-});
-
-test('warnAuthUrlPortMismatch falls back to NEXTAUTH_URL and names it in the warning', () => {
-  process.env.NEXTAUTH_URL = 'http://localhost:3000';
-  const context = createContext(3001);
-  warnAuthUrlPortMismatch({ context });
-  expect(context.logger.warn).toHaveBeenCalledTimes(1);
-  expect(context.logger.warn.mock.calls[0][0]).toContain('NEXTAUTH_URL (http://localhost:3000)');
-});
-
-test('warnAuthUrlPortMismatch treats an https URL without a port as 443', () => {
-  process.env.AUTH_URL = 'https://example.com';
-  const context = createContext(3000);
-  warnAuthUrlPortMismatch({ context });
-  expect(context.logger.warn).toHaveBeenCalledTimes(1);
-  expect(context.logger.warn.mock.calls[0][0]).toContain('does not match the dev server port 3000');
-});
-
-test('warnAuthUrlPortMismatch warns when the auth URL is not a valid URL', () => {
-  process.env.AUTH_URL = 'not-a-url';
-  const context = createContext(3000);
-  warnAuthUrlPortMismatch({ context });
-  expect(context.logger.warn).toHaveBeenCalledTimes(1);
-  expect(context.logger.warn.mock.calls[0][0]).toContain('is not a valid URL');
-});