@lowdefy/server-e2e 6.0.0 → 6.1.0

package/lib/server/scrubSecrets.js

@@ -0,0 +1,25 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { createSecretScrubber } from '@lowdefy/node-utils';
+
+import getE2eSecrets from './getE2eSecrets.js';
+
+// E2E logs stay unscrubbed, but _error reads this off the context like every
+// other server package, so a thrown message behaves identically in every mode.
+const scrubSecrets = createSecretScrubber({ secrets: getE2eSecrets() });
+
+export default scrubSecrets;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server-e2e",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "license": "Apache-2.0",
   "description": "Lowdefy e2e testing server with cookie-based user injection",
   "homepage": "https://lowdefy.com",
@@ -42,35 +42,35 @@
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
     "@ant-design/x": "2.7.0",
-    "@hono/node-server": "2.0.4",
-    "@lowdefy/actions-core": "6.0.0",
-    "@lowdefy/api": "6.0.0",
-    "@lowdefy/block-utils": "6.0.0",
-    "@lowdefy/blocks-aggrid": "6.0.0",
-    "@lowdefy/blocks-antd": "6.0.0",
-    "@lowdefy/blocks-antd-x": "6.0.0",
-    "@lowdefy/blocks-basic": "6.0.0",
-    "@lowdefy/blocks-echarts": "6.0.0",
-    "@lowdefy/blocks-loaders": "6.0.0",
-    "@lowdefy/blocks-markdown": "6.0.0",
-    "@lowdefy/blocks-tiptap": "6.0.0",
-    "@lowdefy/client": "6.0.0",
-    "@lowdefy/connection-axios-http": "6.0.0",
-    "@lowdefy/connection-mongodb": "6.0.0",
-    "@lowdefy/errors": "6.0.0",
-    "@lowdefy/helpers": "6.0.0",
-    "@lowdefy/layout": "6.0.0",
-    "@lowdefy/logger": "6.0.0",
-    "@lowdefy/node-utils": "6.0.0",
-    "@lowdefy/operators-js": "6.0.0",
-    "@lowdefy/operators-nunjucks": "6.0.0",
-    "@lowdefy/operators-uuid": "6.0.0",
-    "@lowdefy/websockets-core": "6.0.0",
+    "@hono/node-server": "2.0.10",
+    "@lowdefy/actions-core": "6.1.0",
+    "@lowdefy/api": "6.1.0",
+    "@lowdefy/block-utils": "6.1.0",
+    "@lowdefy/blocks-aggrid": "6.1.0",
+    "@lowdefy/blocks-antd": "6.1.0",
+    "@lowdefy/blocks-antd-x": "6.1.0",
+    "@lowdefy/blocks-basic": "6.1.0",
+    "@lowdefy/blocks-echarts": "6.1.0",
+    "@lowdefy/blocks-loaders": "6.1.0",
+    "@lowdefy/blocks-markdown": "6.1.0",
+    "@lowdefy/blocks-tiptap": "6.1.0",
+    "@lowdefy/client": "6.1.0",
+    "@lowdefy/connection-axios-http": "6.1.0",
+    "@lowdefy/connection-mongodb": "6.1.0",
+    "@lowdefy/errors": "6.1.0",
+    "@lowdefy/helpers": "6.1.0",
+    "@lowdefy/layout": "6.1.0",
+    "@lowdefy/logger": "6.1.0",
+    "@lowdefy/node-utils": "6.1.0",
+    "@lowdefy/operators-js": "6.1.0",
+    "@lowdefy/operators-nunjucks": "6.1.0",
+    "@lowdefy/operators-uuid": "6.1.0",
+    "@lowdefy/websockets-core": "6.1.0",
     "@tailwindcss/postcss": "4.3.1",
     "@vitejs/plugin-react": "6.0.2",
     "antd": "6.3.1",
     "dayjs": "1.11.20",
-    "hono": "4.12.25",
+    "hono": "4.13.5",
     "pino": "10.3.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",
@@ -78,16 +78,14 @@
     "tailwindcss": "4.3.1",
     "uuid": "14.0.0",
     "vite": "8.0.16",
-    "ws": "8.18.0"
+    "ws": "8.21.0"
   },
   "devDependencies": {
     "@jest/globals": "28.1.3",
-    "@lowdefy/build": "6.0.0",
-    "@next/eslint-plugin-next": "16.1.6",
+    "@lowdefy/build": "6.1.0",
     "@tailwindcss/postcss": "4.3.1",
     "jest": "28.1.3",
     "tailwindcss": "4.3.1",
-    "webpack": "5.94.0",
     "yaml": "2.9.0",
     "yargs": "18.0.0"
   },

package/package.original.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server-e2e",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "license": "Apache-2.0",
   "description": "Lowdefy e2e testing server with cookie-based user injection",
   "homepage": "https://lowdefy.com",
@@ -50,35 +50,35 @@
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
     "@ant-design/x": "2.7.0",
-    "@hono/node-server": "2.0.4",
-    "@lowdefy/actions-core": "6.0.0",
-    "@lowdefy/api": "6.0.0",
-    "@lowdefy/block-utils": "6.0.0",
-    "@lowdefy/blocks-aggrid": "6.0.0",
-    "@lowdefy/blocks-antd": "6.0.0",
-    "@lowdefy/blocks-antd-x": "6.0.0",
-    "@lowdefy/blocks-basic": "6.0.0",
-    "@lowdefy/blocks-echarts": "6.0.0",
-    "@lowdefy/blocks-loaders": "6.0.0",
-    "@lowdefy/blocks-markdown": "6.0.0",
-    "@lowdefy/blocks-tiptap": "6.0.0",
-    "@lowdefy/client": "6.0.0",
-    "@lowdefy/connection-axios-http": "6.0.0",
-    "@lowdefy/connection-mongodb": "6.0.0",
-    "@lowdefy/errors": "6.0.0",
-    "@lowdefy/helpers": "6.0.0",
-    "@lowdefy/layout": "6.0.0",
-    "@lowdefy/logger": "6.0.0",
-    "@lowdefy/node-utils": "6.0.0",
-    "@lowdefy/operators-js": "6.0.0",
-    "@lowdefy/operators-nunjucks": "6.0.0",
-    "@lowdefy/operators-uuid": "6.0.0",
-    "@lowdefy/websockets-core": "6.0.0",
+    "@hono/node-server": "2.0.10",
+    "@lowdefy/actions-core": "6.1.0",
+    "@lowdefy/api": "6.1.0",
+    "@lowdefy/block-utils": "6.1.0",
+    "@lowdefy/blocks-aggrid": "6.1.0",
+    "@lowdefy/blocks-antd": "6.1.0",
+    "@lowdefy/blocks-antd-x": "6.1.0",
+    "@lowdefy/blocks-basic": "6.1.0",
+    "@lowdefy/blocks-echarts": "6.1.0",
+    "@lowdefy/blocks-loaders": "6.1.0",
+    "@lowdefy/blocks-markdown": "6.1.0",
+    "@lowdefy/blocks-tiptap": "6.1.0",
+    "@lowdefy/client": "6.1.0",
+    "@lowdefy/connection-axios-http": "6.1.0",
+    "@lowdefy/connection-mongodb": "6.1.0",
+    "@lowdefy/errors": "6.1.0",
+    "@lowdefy/helpers": "6.1.0",
+    "@lowdefy/layout": "6.1.0",
+    "@lowdefy/logger": "6.1.0",
+    "@lowdefy/node-utils": "6.1.0",
+    "@lowdefy/operators-js": "6.1.0",
+    "@lowdefy/operators-nunjucks": "6.1.0",
+    "@lowdefy/operators-uuid": "6.1.0",
+    "@lowdefy/websockets-core": "6.1.0",
     "@tailwindcss/postcss": "4.3.1",
     "@vitejs/plugin-react": "6.0.2",
     "antd": "6.3.1",
     "dayjs": "1.11.20",
-    "hono": "4.12.25",
+    "hono": "4.13.5",
     "pino": "10.3.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",
@@ -86,16 +86,14 @@
     "tailwindcss": "4.3.1",
     "uuid": "14.0.0",
     "vite": "8.0.16",
-    "ws": "8.18.0"
+    "ws": "8.21.0"
   },
   "devDependencies": {
     "@jest/globals": "28.1.3",
-    "@lowdefy/build": "6.0.0",
-    "@next/eslint-plugin-next": "16.1.6",
+    "@lowdefy/build": "6.1.0",
     "@tailwindcss/postcss": "4.3.1",
     "jest": "28.1.3",
     "tailwindcss": "4.3.1",
-    "webpack": "5.94.0",
     "yaml": "2.9.0",
     "yargs": "18.0.0"
   },

package/src/middleware/apiContext.js

@@ -31,6 +31,7 @@ import i18nConfig from '../../lib/build/i18n.js';
 import jsMap from '../../build/plugins/operators/serverJsMap.js';
 import logRequest from '../../lib/server/log/logRequest.js';
 import operators from '../../build/plugins/operators/server.js';
+import scrubSecrets from '../../lib/server/scrubSecrets.js';
 import websockets from '../../build/plugins/websockets.js';
 
 const secrets = getE2eSecrets();
@@ -60,12 +61,14 @@ function apiContext() {
       i18n: i18nConfig,
       jsMap,
       logger: createLogger({ rid }),
+      mode: 'prod',
       operators,
       req: {
         url: c.req.path,
         method: c.req.method,
         hostname: c.req.header('host'),
       },
+      scrubSecrets,
       secrets,
       websockets,
     };

package/src/middleware/apiContext.test.mjs

@@ -0,0 +1,109 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+const secret = 'planted-e2e-secret';
+process.env.LOWDEFY_SECRET_TEST = secret;
+
+jest.unstable_mockModule('@lowdefy/api', () => ({ createApiContext: jest.fn() }));
+jest.unstable_mockModule('../../lib/build/appMeta.js', () => ({ default: {} }));
+jest.unstable_mockModule('../../lib/build/config.js', () => ({ default: {} }));
+jest.unstable_mockModule('../../lib/build/i18n.js', () => ({ default: {} }));
+jest.unstable_mockModule('../../lib/server/log/createHandleError.js', () => ({
+  default: jest.fn(() => jest.fn()),
+}));
+jest.unstable_mockModule('../../lib/server/log/createLogger.js', () => ({
+  default: jest.fn(() => ({ debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn() })),
+}));
+jest.unstable_mockModule('../../lib/server/fileCache.js', () => ({ default: {} }));
+jest.unstable_mockModule('../../lib/server/getE2eSecrets.js', () => ({
+  default: jest.fn(() => ({ TEST: process.env.LOWDEFY_SECRET_TEST })),
+}));
+jest.unstable_mockModule('../../lib/server/auth/session.js', () => ({
+  default: jest.fn(() => undefined),
+}));
+jest.unstable_mockModule('../../lib/server/log/logRequest.js', () => ({ default: jest.fn() }));
+
+// apiContext statically imports the app build's plugin artifacts, which only
+// exist in a built app (build/** is gitignored). Materialize the minimal set
+// it needs so the import resolves; clean up only what this test created.
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const pluginsDir = path.resolve(dirname, '../../build/plugins');
+const fixtures = [
+  { file: 'agents.js', content: 'export default {};\n' },
+  { file: 'connections.js', content: 'export default {};\n' },
+  { file: path.join('operators', 'server.js'), content: 'export default {};\n' },
+  { file: path.join('operators', 'serverJsMap.js'), content: 'export default {};\n' },
+  { file: 'websockets.js', content: 'export default {};\n' },
+].map(({ file, content }) => ({ absolutePath: path.join(pluginsDir, file), content }));
+
+const createdFixtures = [];
+fixtures.forEach(({ absolutePath, content }) => {
+  if (!fs.existsSync(absolutePath)) {
+    fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+    fs.writeFileSync(absolutePath, content);
+    createdFixtures.push(absolutePath);
+  }
+});
+
+// A checkout that has built an app already holds real artifacts here, which import plugins this
+// package does not depend on, so the stubs are also mocked over whatever is on disk.
+fixtures.forEach(({ absolutePath }) => {
+  jest.unstable_mockModule(absolutePath, () => ({
+    default: {},
+    interpolateProperties: () => {},
+    renderEmail: () => {},
+  }));
+});
+
+afterAll(() => {
+  createdFixtures.forEach((absolutePath) => fs.rmSync(absolutePath, { force: true }));
+});
+
+const { default: apiContext } = await import('./apiContext.js');
+
+function createApp() {
+  const app = new Hono();
+  app.use('*', apiContext());
+  app.get('/api/ping', (c) => {
+    const context = c.get('lowdefyContext');
+    return c.json({
+      mode: context.mode,
+      scrubbed: context.scrubSecrets(`token ${secret} end`),
+    });
+  });
+  return app;
+}
+
+test('apiContext sets mode to prod', async () => {
+  const res = await createApp().request('/api/ping');
+  expect(res.status).toEqual(200);
+  const body = await res.json();
+  expect(body.mode).toEqual('prod');
+});
+
+test('apiContext scrubSecrets redacts a planted secret', async () => {
+  const res = await createApp().request('/api/ping');
+  expect(res.status).toEqual(200);
+  const body = await res.json();
+  expect(body.scrubbed).toEqual('token [REDACTED] end');
+});

package/lib/server/apiWrapper.js

@@ -1,73 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import path from 'path';
-import { createApiContext, redactErrorResponse } from '@lowdefy/api';
-import { v4 as uuid } from 'uuid';
-
-import appMeta from '../build/appMeta.js';
-import config from '../build/config.js';
-import connections from '../../build/plugins/connections.js';
-import createLogger from './log/createLogger.js';
-import fileCache from './fileCache.js';
-import getE2eSecrets from './getE2eSecrets.js';
-import getServerSession from './auth/getServerSession.js';
-import createHandleError from './log/createHandleError.js';
-import logRequest from './log/logRequest.js';
-import operators from '../../build/plugins/operators/server.js';
-import jsMap from '../../build/plugins/operators/serverJsMap.js';
-
-const secrets = getE2eSecrets();
-
-function apiWrapper(handler) {
-  return async function wrappedHandler(req, res) {
-    const context = {
-      // Important to give absolute path so Next can trace build files
-      rid: uuid(),
-      appMeta,
-      buildDirectory: path.join(process.cwd(), 'build'),
-      configDirectory: process.env.LOWDEFY_DIRECTORY_CONFIG || process.cwd(),
-      config,
-      connections,
-      fileCache,
-      headers: req?.headers,
-      jsMap,
-      handleError: async (err) => {
-        console.error(err);
-      },
-      logger: console,
-      operators,
-      req,
-      res,
-      secrets,
-    };
-    try {
-      context.logger = createLogger({ rid: context.rid });
-      context.handleError = createHandleError({ context });
-      context.session = getServerSession(context);
-      createApiContext(context);
-      logRequest({ context });
-      // Await here so that if handler throws it is caught.
-      const response = await handler({ context, req, res });
-      return response;
-    } catch (error) {
-      await context.handleError(error);
-      res.status(500).json(redactErrorResponse(context, error));
-    }
-  };
-}
-
-export default apiWrapper;