@lowdefy/server-e2e 6.1.0 → 7.1.0

package/src/routes/clientError.js

@@ -14,27 +14,21 @@
   limitations under the License.
 */
 
-import { logClientError } from '@lowdefy/api';
+import { isSameOriginRequest, logClientError, parseRequestBody } from '@lowdefy/api';
 
 async function clientErrorHandler(c) {
   if (c.req.method !== 'POST') {
-    throw new Error('Only POST requests are supported.');
+    // A wrong-method request is client-caused: answer 405 rather than raising a
+    // fault that would be logged at error level and answered with a 500.
+    return c.json({ error: 'Method not allowed.' }, 405);
   }
   const context = c.get('lowdefyContext');
 
-  const origin = c.req.header('origin');
-  if (!origin) {
-    return c.json({ error: 'Forbidden' }, 403);
-  }
-  try {
-    if (new URL(origin).host !== c.req.header('host')) {
-      return c.json({ error: 'Forbidden' }, 403);
-    }
-  } catch {
+  if (!isSameOriginRequest({ getHeader: (name) => c.req.header(name) })) {
     return c.json({ error: 'Forbidden' }, 403);
   }
 
-  const body = await c.req.json();
+  const body = parseRequestBody({ text: await c.req.text() });
   // Strip received from payload — prod doesn't need it for schema validation
   if (body?.['~e']) {
     delete body['~e'].received;

package/src/routes/e2eIdentity.js

@@ -0,0 +1,28 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+// @lowdefy/e2e-utils compares this with the build directory its config expects, so a
+// Playwright run reuses a running server only when it serves this app's e2e build.
+const buildDirectory = fs.realpathSync(path.join(process.cwd(), 'build'));
+
+function e2eIdentityHandler(c) {
+  return c.json({ server: 'lowdefy-e2e', buildDirectory });
+}
+
+export default e2eIdentityHandler;

package/src/routes/e2eIdentity.test.mjs

@@ -0,0 +1,43 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+test('GET /api/e2e/identity names the e2e server and the real path of its build directory', async () => {
+  const serverDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'lowdefy-e2e-identity-'));
+  fs.mkdirSync(path.join(serverDirectory, 'build'));
+  const linkedServerDirectory = `${serverDirectory}-link`;
+  fs.symlinkSync(serverDirectory, linkedServerDirectory, 'junction');
+  jest.spyOn(process, 'cwd').mockReturnValue(linkedServerDirectory);
+
+  const { default: e2eIdentityHandler } = await import('./e2eIdentity.js');
+  const app = new Hono();
+  app.get('/api/e2e/identity', e2eIdentityHandler);
+  const res = await app.request('/api/e2e/identity');
+
+  expect(res.status).toBe(200);
+  expect(await res.json()).toEqual({
+    server: 'lowdefy-e2e',
+    buildDirectory: fs.realpathSync(path.join(serverDirectory, 'build')),
+  });
+  fs.rmSync(linkedServerDirectory);
+  fs.rmSync(serverDirectory, { recursive: true });
+});

package/src/routes/endpoints.js

@@ -14,17 +14,19 @@
   limitations under the License.
 */
 
-import { callEndpoint } from '@lowdefy/api';
+import { callEndpoint, parseRequestBody } from '@lowdefy/api';
 
 import getPathSegments from '../lib/getPathSegments.js';
 
 async function endpointsHandler(c) {
   if (c.req.method !== 'POST') {
-    throw new Error('Only POST requests are supported.');
+    // A wrong-method request is client-caused: answer 405 rather than raising a
+    // fault that would be logged at error level and answered with a 500.
+    return c.json({ error: 'Method not allowed.' }, 405);
   }
   const context = c.get('lowdefyContext');
   const endpointId = getPathSegments(c, '/api/endpoints/').join('/');
-  const { blockId, payload, pageId } = await c.req.json();
+  const { blockId, payload, pageId } = parseRequestBody({ text: await c.req.text() });
   context.logger.info({ event: 'call_api_endpoint', blockId, endpointId, pageId });
   const response = await callEndpoint(context, { blockId, endpointId, pageId, payload });
   return c.json(response);

package/src/routes/mountPageRoutes.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import getRequestPath from '../lib/getRequestPath.js';
+
+// `/` (home) and `/404` are fixed routes ahead of the page matcher; every other
+// path renders the page it matches. `.*`, not `.+`: under a basePath,
+// `<basePath>/` arrives with an empty rest, and is the app root like
+// `<basePath>` itself.
+function mountPageRoutes({ app, basePath, renderPage }) {
+  app.get('/', (c) => renderPage(c, { path: '', matchedPath: '' }));
+  app.get('/404', (c) => renderPage(c, { path: '404', matchedPath: '404', status: 404 }));
+  app.get('/:rest{.*}', (c) => renderPage(c, getRequestPath({ c, basePath, prefix: '/' })));
+}
+
+export default mountPageRoutes;

package/src/routes/mountPageRoutes.test.mjs

@@ -0,0 +1,56 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+
+import mountPageRoutes from './mountPageRoutes.js';
+
+function request({ basePath, path }) {
+  const app = basePath === '' ? new Hono() : new Hono().basePath(basePath);
+  mountPageRoutes({
+    app,
+    basePath,
+    renderPage: (c, { path: pagePath, matchedPath, status = 200 }) =>
+      c.json({ path: pagePath, matchedPath }, status),
+  });
+  return app.request(path);
+}
+
+test.each([
+  ['', '/', '', ''],
+  ['/app', '/app', '', ''],
+  ['/app', '/app/', '', ''],
+  ['/app', '/app/invoices', 'invoices', 'invoices'],
+  ['', '/support/tickets/1234/', 'support/tickets/1234/', 'support/tickets/1234'],
+  ['', '/support/tickets/a%2Fb%20c', 'support/tickets/a%2Fb%20c', 'support/tickets/a%2Fb%20c'],
+  ['/app', '/app/tickets//1', 'tickets//1', 'tickets//1'],
+])(
+  'with basePath "%s", %s renders path "%s" matched as "%s"',
+  async (basePath, url, path, matchedPath) => {
+    const res = await request({ basePath, path: url });
+    expect(res.status).toEqual(200);
+    expect(await res.json()).toEqual({ path, matchedPath });
+  }
+);
+
+test.each([[''], ['/app']])(
+  'with basePath "%s", /404 is a fixed route with status 404',
+  async (basePath) => {
+    const res = await request({ basePath, path: `${basePath}/404` });
+    expect(res.status).toEqual(404);
+    expect(await res.json()).toEqual({ path: '404', matchedPath: '404' });
+  }
+);

package/src/routes/request.js

@@ -14,13 +14,15 @@
   limitations under the License.
 */
 
-import { callRequest } from '@lowdefy/api';
+import { callRequest, parseRequestBody } from '@lowdefy/api';
 
 import getPathSegments from '../lib/getPathSegments.js';
 
 async function requestHandler(c) {
   if (c.req.method !== 'POST') {
-    throw new Error('Only POST requests are supported.');
+    // A wrong-method request is client-caused: answer 405 rather than raising a
+    // fault that would be logged at error level and answered with a 500.
+    return c.json({ error: 'Method not allowed.' }, 405);
   }
   const context = c.get('lowdefyContext');
   const segments = getPathSegments(c, '/api/request/');
@@ -29,7 +31,7 @@ async function requestHandler(c) {
   }
   const requestId = segments[segments.length - 1];
   const pageId = segments.slice(0, -1).join('/');
-  const { actionId, blockId, payload } = await c.req.json();
+  const { actionId, blockId, payload } = parseRequestBody({ text: await c.req.text() });
   context.logger.info({ event: 'call_request', pageId, requestId, blockId, actionId });
   const response = await callRequest(context, { blockId, pageId, payload, requestId });
   return c.json(response);

package/src/routes/requestBody.test.mjs

@@ -0,0 +1,69 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+import { isSameOriginRequest, parseRequestBody } from '@lowdefy/api';
+
+jest.unstable_mockModule('@lowdefy/api', () => ({
+  callEndpoint: jest.fn(),
+  callRequest: jest.fn(),
+  logClientError: jest.fn(),
+  isSameOriginRequest,
+  parseRequestBody,
+  redactErrorResponse: jest.fn(),
+}));
+
+const { default: createErrorHandler } = await import('../middleware/errorHandler.js');
+const routes = {
+  '/api/client-error': (await import('./clientError.js')).default,
+  '/api/endpoints/*': (await import('./endpoints.js')).default,
+  '/api/request/*': (await import('./request.js')).default,
+  '/api/usage': (await import('./usage.js')).default,
+};
+
+const logger = { debug: jest.fn(), error: jest.fn(), info: jest.fn(), warn: jest.fn() };
+
+function createApp() {
+  const app = new Hono();
+  app.use('*', async (c, next) => {
+    c.set('lowdefyContext', { logger, handleError: jest.fn() });
+    await next();
+  });
+  Object.entries(routes).forEach(([path, handler]) => app.all(path, handler));
+  app.onError(createErrorHandler({ logger }));
+  return app;
+}
+
+test.each([
+  ['/api/endpoints/save', 'nope', {}, 'Request body is not valid JSON.'],
+  ['/api/endpoints/save', 'null', {}, 'Request body must be a JSON object.'],
+  ['/api/request/orders/load', 'nope', {}, 'Request body is not valid JSON.'],
+  ['/api/usage', 'nope', {}, 'Request body is not valid JSON.'],
+  [
+    '/api/client-error',
+    'nope',
+    { host: 'localhost', origin: 'http://localhost' },
+    'Request body is not valid JSON.',
+  ],
+])('POST %s with body %s answers 400 and logs a warning', async (path, body, headers, message) => {
+  const res = await createApp().request(path, { method: 'POST', body, headers });
+  expect(res.status).toBe(400);
+  expect(await res.json()).toEqual({ name: 'UserError', message });
+  expect(logger.warn).toHaveBeenCalledTimes(1);
+  expect(logger.error).not.toHaveBeenCalled();
+});

package/src/routes/sessionMock.js

@@ -16,7 +16,10 @@
 
 async function sessionMockHandler(c) {
   const context = c.get('lowdefyContext');
-  return c.json(context.session ?? {});
+  if (!context.user) {
+    return c.json(null);
+  }
+  return c.json({ session: { id: 'e2e' }, user: context.user });
 }
 
 export default sessionMockHandler;

package/src/routes/usage.js

@@ -17,14 +17,18 @@
 import fs from 'node:fs';
 import path from 'node:path';
 
+import { parseRequestBody } from '@lowdefy/api';
+
 const packageJson = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8'));
 
 async function usageHandler(c) {
   if (c.req.method !== 'POST') {
-    throw new Error('Only POST requests are supported.');
+    // A wrong-method request is client-caused: answer 405 rather than raising a
+    // fault that would be logged at error level and answered with a 500.
+    return c.json({ error: 'Method not allowed.' }, 405);
   }
   const context = c.get('lowdefyContext');
-  const { user, machine } = await c.req.json();
+  const { user, machine } = parseRequestBody({ text: await c.req.text() });
   const host = c.req.header('host');
   context.logger.info({ event: 'log_usage', user, machine });
 

package/src/routes/user.js

@@ -0,0 +1,27 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The resolved caller for the client - the same resolveAuthentication output
+// the first page load embeds. The base session carries neither roles (read
+// live from the active member row) nor the merged attributes bag, so the
+// client re-syncs from here (UpdateSession) after a session change such as
+// SetActiveOrganization.
+async function userHandler(c) {
+  const context = c.get('lowdefyContext');
+  return c.json({ user: context.user ?? null });
+}
+
+export default userHandler;

package/src/routes/websocket.js

@@ -15,18 +15,26 @@
 */
 
 import { upgradeWebSocket } from '@hono/node-server';
-import { createChannelRegistry, createWebSocketConnection } from '@lowdefy/api';
+import {
+  createChannelRegistry,
+  createWebSocketConnection,
+  isWebSocketOriginAllowed,
+} from '@lowdefy/api';
 
 // One registry per server process — channels and their running source
 // resolvers are shared across all websocket connections on this instance.
 const registry = createChannelRegistry();
 
-const websocketHandler = upgradeWebSocket((c) => {
+const upgrade = upgradeWebSocket((c) => {
   const context = c.get('lowdefyContext');
   let connection;
   return {
     onOpen(event, ws) {
+      // No auth engine runs in the e2e server, so the connection keeps the
+      // cookie caller it was opened with.
       connection = createWebSocketConnection(context, {
+        closeSocket: ({ code, reason }) => ws.close(code, reason),
+        headers: c.req.raw.headers,
         registry,
         send: (message) => ws.send(message),
       });
@@ -38,9 +46,21 @@ const websocketHandler = upgradeWebSocket((c) => {
       connection?.close();
     },
     onError(event) {
-      context.logger.debug({ event: 'ws_error' }, String(event?.error ?? 'WebSocket error'));
+      // A transport fault, not routine traffic: visible at the default level with
+      // the error object attached so the cause is not reduced to a string.
+      context.logger.warn({ event: 'ws_error', err: event?.error }, 'WebSocket error.');
     },
   };
 });
 
+// Upgrades are accepted from the app's own pages and from clients that send no
+// Origin; isWebSocketOriginAllowed holds the rule and logs a refusal.
+function websocketHandler(c, next) {
+  const context = c.get('lowdefyContext');
+  if (!isWebSocketOriginAllowed({ context, getHeader: (name) => c.req.header(name) })) {
+    return c.json({ error: 'Forbidden' }, 403);
+  }
+  return upgrade(c, next);
+}
+
 export default websocketHandler;

package/src/routes/websocket.test.mjs

@@ -0,0 +1,73 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { serve } from '@hono/node-server';
+import WebSocket, { WebSocketServer } from 'ws';
+
+import websocketHandler from './websocket.js';
+
+let server;
+let port;
+
+// As src/index.js serves it: a Hono app under a basePath, with a ws server
+// for upgrades.
+beforeAll(async () => {
+  const app = new Hono().basePath('/app');
+  app.use('*', async (c, next) => {
+    c.set('lowdefyContext', {
+      config: {},
+      rid: 'request',
+      logger: { debug: () => {}, warn: () => {} },
+    });
+    await next();
+  });
+  app.get('/api/websocket', websocketHandler);
+  const wss = new WebSocketServer({ noServer: true });
+  await new Promise((resolve) => {
+    server = serve({ fetch: app.fetch, port: 0, websocket: { server: wss } }, (info) => {
+      port = info.port;
+      resolve();
+    });
+  });
+});
+
+afterAll(() => {
+  server.close();
+});
+
+function open({ headers }) {
+  return new Promise((resolve) => {
+    const socket = new WebSocket(`ws://127.0.0.1:${port}/app/api/websocket`, { headers });
+    socket.once('open', () => {
+      socket.close();
+      resolve('open');
+    });
+    socket.once('unexpected-response', (_, response) => {
+      socket.terminate();
+      resolve(response.statusCode);
+    });
+    socket.once('error', () => {});
+  });
+}
+
+test.each([
+  ['opens', 'the page is served from the same host', { origin: 'https://app.test' }, 'open'],
+  ['opens', 'a client sends no origin', {}, 'open'],
+  ['is refused', 'the origin is another site', { origin: 'https://other.test' }, 403],
+])('a websocket upgrade to the e2e server %s when %s', async (_, __, headers, expected) => {
+  expect(await open({ headers: { host: 'app.test', ...headers } })).toEqual(expected);
+});

package/vite.config.js

@@ -17,6 +17,7 @@
 import fs from 'node:fs';
 import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
+import { Features } from 'lightningcss';
 
 // basePath from the Lowdefy build — assets are served under it.
 let basePath = '';
@@ -27,14 +28,53 @@ try {
   // No build yet (e.g. editor tooling) — default base.
 }
 
+// The @lowdefy packages this server depends on. A linked plugin pinned to
+// another release brings its own copies, and the client would then mix
+// versions: the dev server pre-bundles one copy per package for every
+// importer (whichever its scan meets first, so the server's own code can get
+// a plugin's older @lowdefy/helpers without an export it imports), and a
+// production build bundles both, so blocks read module state the client never
+// filled (the HTML enhancements it registers in @lowdefy/block-utils). The
+// server's copies are the ones its client and blocks were released with.
+const lowdefyDependencies = Object.keys(
+  JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).dependencies ?? {}
+).filter((name) => name.startsWith('@lowdefy/'));
+
+// Vite 8 tree-shakes a `.module.css` imported only for its side effects
+// (`import './style.module.css'`), and its CSS goes with it: `:global(...)` rules in block and
+// plugin stylesheets never reach the built client. Marking CSS modules as side-effectful keeps
+// them, whatever the import style.
+function keepCssModuleSideEffects() {
+  return {
+    name: 'lowdefy-keep-css-module-side-effects',
+    enforce: 'post',
+    transform(code, id) {
+      if (/\.module\.css($|\?)/.test(id)) {
+        return { code, moduleSideEffects: 'no-treeshake' };
+      }
+    },
+  };
+}
+
 export default defineConfig(({ mode }) => ({
   base: `${basePath}/`,
-  plugins: [react()],
+  plugins: [react(), keepCssModuleSideEffects()],
   define: {
     // Vite does not replace process.env.NODE_ENV inside dependencies —
     // plugin and client code branch on it.
     'process.env.NODE_ENV': JSON.stringify(mode === 'production' ? 'production' : 'development'),
   },
+  css: {
+    // Vite minifies client CSS with Lightning CSS, which by default lowers
+    // light-dark() into --lightningcss-light/--lightningcss-dark variables that
+    // only a CSS color-scheme declaration defines. The client sets color-scheme
+    // from JavaScript (useDarkMode), so the lowered values never resolve and
+    // every light-dark() colour is dropped. Tailwind leaves light-dark()
+    // unlowered in its own Lightning CSS pass for the same reason.
+    lightningcss: {
+      exclude: Features.LightDark,
+    },
+  },
   build: {
     outDir: 'dist/client',
     manifest: true,
@@ -42,4 +82,20 @@ export default defineConfig(({ mode }) => ({
       input: 'client/main.jsx',
     },
   },
+  resolve: {
+    // Linked plugin packages (pnpm link: / workspace) resolve their own copies of
+    // shared libraries. They must share one React, the antd/X/cssinjs copies
+    // whose context providers (App, ConfigProvider, StyleProvider) the client
+    // renders, the dayjs whose global locale the client sets, and the server's
+    // @lowdefy packages (see lowdefyDependencies).
+    dedupe: [
+      'react',
+      'react-dom',
+      'antd',
+      '@ant-design/x',
+      '@ant-design/cssinjs',
+      'dayjs',
+      ...lowdefyDependencies,
+    ],
+  },
 }));