@lowdefy/server 5.6.0 → 6.1.0

package/lib/client/sentry/initSentryClient.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/nextjs';
+import * as Sentry from '@sentry/browser';
 
 let initialized = false;
 

package/lib/client/sentry/setSentryUser.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/nextjs';
+import * as Sentry from '@sentry/browser';
 
 function setSentryUser({ user, sentryConfig }) {
   // No-op if no user

package/lib/server/auth/{getAuthOptions.js → getAuthConfig.js}

@@ -14,23 +14,26 @@
   limitations under the License.
 */
 
-import { getNextAuthConfig } from '@lowdefy/api';
+import { getAuthConfig as getApiAuthConfig } from '@lowdefy/api';
 import { getSecretsFromEnv } from '@lowdefy/node-utils';
 
 import adapters from '../../../build/plugins/auth/adapters.js';
+import appMeta from '../../build/appMeta.js';
 import authJson from '../../build/auth.js';
+import config from '../../build/config.js';
 import callbacks from '../../../build/plugins/auth/callbacks.js';
 import events from '../../../build/plugins/auth/events.js';
 import providers from '../../../build/plugins/auth/providers.js';
 
-function getAuthOptions({ appMeta, logger }) {
-  return getNextAuthConfig({
+function getAuthConfig({ logger }) {
+  return getApiAuthConfig({
     appMeta,
     authJson,
+    config,
     logger,
     plugins: { adapters, callbacks, events, providers },
     secrets: getSecretsFromEnv(),
   });
 }
 
-export default getAuthOptions;
+export default getAuthConfig;

package/{pages/api/auth/[...nextauth].js → lib/server/auth/session.js}

@@ -14,24 +14,18 @@
   limitations under the License.
 */
 
-import NextAuth from 'next-auth';
+import { getAuthUser } from '@hono/auth-js';
 
-import apiWrapper from '../../../lib/server/apiWrapper.js';
-import authJson from '../../../lib/build/auth.js';
+import authJson from '../../build/auth.js';
 
-async function handler({ context, req, res }) {
+// Replaces getServerSession.js — reads the session from the Hono context
+// populated by the initAuthConfig middleware.
+async function getSession(c) {
   if (authJson.configured !== true) {
-    return res.status(404).json({
-      message: 'Auth not configured',
-    });
+    return undefined;
   }
-
-  // Required for emails in corporate networks, see:
-  // https://next-auth.js.org/tutorials/avoid-corporate-link-checking-email-provider
-  if (req.method === 'HEAD') {
-    return res.status(200).end();
-  }
-  return NextAuth(req, res, context.authOptions);
+  const authUser = await getAuthUser(c);
+  return authUser?.session ?? undefined;
 }
 
-export default apiWrapper(handler);
+export default getSession;

package/lib/server/auth/strategies.js

@@ -0,0 +1,47 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { getAuthStrategies, resolveStrategyCaller } from '@lowdefy/api';
+import { getSecretsFromEnv } from '@lowdefy/node-utils';
+
+import appMeta from '../../build/appMeta.js';
+import authJson from '../../build/auth.js';
+import strategies from '../../../build/plugins/auth/strategies.js';
+
+// Secrets are process-static env, so read once at module load rather than
+// on every sessionless request.
+const secrets = getSecretsFromEnv();
+
+// API auth strategies (apiKey/jwt headers) let MCP and service clients that
+// cannot hold a session cookie authenticate. Tried only when no session
+// resolved; a match is synthesized as session.user so createAuthorize and
+// _user work unchanged.
+async function getStrategyCaller(c, logger) {
+  const authStrategies = getAuthStrategies({
+    appMeta,
+    authJson,
+    logger,
+    plugins: { strategies },
+    secrets,
+  });
+  return resolveStrategyCaller({
+    headers: c.req.raw.headers,
+    logger,
+    strategies: authStrategies,
+  });
+}
+
+export default getStrategyCaller;

package/lib/server/log/createHandleError.js

@@ -27,6 +27,9 @@ import {
 } from '@lowdefy/errors';
 
 import captureSentryError from '../sentry/captureSentryError.js';
+import redactUrlQuery from './redactUrlQuery.js';
+import scrubSecrets from '../scrubSecrets.js';
+import serializeErrorForLog from './serializeErrorForLog.js';
 
 function getEventType(error) {
   if (error instanceof ServiceError) {
@@ -92,7 +95,7 @@ function createHandleError({ context }) {
         error.config = location.config;
       }
 
-      // Single structured log call — pino serializes error via extractErrorProps,
+      // Single structured log call — pino serializes the error via serializeErrorForLog,
       // message string gives human-readable display via CLI logger
       const errorName = error?.name || 'Error';
       context.logger.error(
@@ -125,9 +128,9 @@ function createHandleError({ context }) {
             'sec-ch-ua': headers['sec-ch-ua'],
             'user-agent': headers['user-agent'],
             host: headers.host,
-            referer: headers.referer,
+            referer: redactUrlQuery(headers.referer),
             // Non localhost headers
-            'x-forward-for': headers['x-forward-for'],
+            'x-forwarded-for': headers['x-forwarded-for'],
             // Vercel headers
             'x-vercel-id': headers['x-vercel-id'],
             'x-real-ip': headers['x-real-ip'],
@@ -154,9 +157,11 @@ function createHandleError({ context }) {
         configLocation: location,
       });
     } catch (e) {
-      console.error(error);
+      // console.error writes to stderr past pino and its line scrub, and would print the raw
+      // error - an axios error's config.auth included - so it gets both layers by hand.
+      console.error(scrubSecrets(JSON.stringify(serializeErrorForLog(error))));
       console.error('An error occurred while logging the error.');
-      console.error(e);
+      console.error(scrubSecrets(JSON.stringify(serializeErrorForLog(e))));
     }
   };
 }

package/lib/server/log/createHandleError.test.mjs

@@ -0,0 +1,85 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+
+const secret = 'planted-handle-error-secret';
+
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+
+const { default: createHandleError } = await import('./createHandleError.js');
+
+function createAxiosError() {
+  const error = new Error(`Request failed for key ${secret}`);
+  error.name = 'AxiosError';
+  error.code = 'ERR_BAD_REQUEST';
+  error.config = {
+    auth: { username: 'svc-user', password: 'planted-config-password' },
+    params: { api_key: 'planted-config-param' },
+    headers: { Authorization: 'Bearer planted-config-header' },
+  };
+  return error;
+}
+
+function testContext({ logger, headers } = {}) {
+  return {
+    headers,
+    logger: logger ?? { error: jest.fn() },
+    readConfigFile: jest.fn(async () => null),
+    req: { url: '/api/request/page/req', method: 'POST', hostname: 'app.example.com' },
+  };
+}
+
+beforeEach(() => {
+  console.error = jest.fn();
+});
+
+test('handleError logs the referer header with credential query parameters redacted', async () => {
+  const context = testContext({
+    headers: { referer: 'https://app.example.com/verify?token=planted-token&page=2' },
+  });
+  const handleError = createHandleError({ context });
+
+  await handleError(new Error('Failed.'));
+
+  const [fields] = context.logger.error.mock.calls[0];
+  expect(fields.headers.referer).toBe('https://app.example.com/verify?token=%5Bredacted%5D&page=2');
+});
+
+test('handleError fallback output carries no axios config auth and no planted secret when the log call throws', async () => {
+  const logError = new Error(`Log sink rejected ${secret}`);
+  const context = testContext({
+    logger: {
+      error: jest.fn(() => {
+        throw logError;
+      }),
+    },
+  });
+  const handleError = createHandleError({ context });
+
+  await handleError(createAxiosError());
+
+  expect(console.error).toHaveBeenCalledTimes(3);
+  const output = console.error.mock.calls.map(([line]) => line).join('\n');
+  expect(output).not.toContain('planted-config-password');
+  expect(output).not.toContain('planted-config-param');
+  expect(output).not.toContain('planted-config-header');
+  expect(output).not.toContain(secret);
+  const logged = JSON.parse(console.error.mock.calls[0][0]);
+  expect(logged.message).toBe('Request failed for key [REDACTED]');
+  expect(logged.code).toBe('ERR_BAD_REQUEST');
+  expect(JSON.parse(console.error.mock.calls[2][0]).message).toBe('Log sink rejected [REDACTED]');
+});

package/lib/server/log/createLogger.js

@@ -15,10 +15,37 @@
 */
 
 import { createNodeLogger } from '@lowdefy/logger/node';
+import { type } from '@lowdefy/helpers';
+
+import appMeta from '../../build/appMeta.js';
+import scrubSecrets from '../scrubSecrets.js';
+import serializeErrorForLog from './serializeErrorForLog.js';
+
+// Deploy identity on every log line — pid/hostname are stripped, so these
+// fields are what correlates a line to an app build across replicas.
+const base = { pid: undefined, hostname: undefined };
+if (!type.isNone(appMeta.name)) {
+  base.app_name = appMeta.name;
+}
+if (!type.isNone(appMeta.version)) {
+  base.app_version = appMeta.version;
+}
+if (!type.isNone(appMeta.gitSha)) {
+  base.git_sha = appMeta.gitSha;
+}
+// The deployment environment (LOWDEFY_ENVIRONMENT), so one log drain can hold every environment.
+if (!type.isNone(appMeta.environment)) {
+  base.environment = appMeta.environment;
+}
+
 const logger = createNodeLogger({
   name: 'lowdefy_server',
   level: process.env.LOWDEFY_LOG_LEVEL ?? 'info',
-  base: { pid: undefined, hostname: undefined },
+  base,
+  serializers: { err: serializeErrorForLog },
+  // Scrubbing the finished line rather than the logged object covers every field of every
+  // call - debug payloads and request results as well as `err` - with no walker to miss one.
+  hooks: { streamWrite: scrubSecrets },
 });
 
 function createLogger(metadata = {}) {

package/lib/server/log/createLogger.test.mjs

@@ -0,0 +1,102 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+import { createNodeLogger } from '@lowdefy/logger/node';
+
+const secret = 'planted/secret+value=1';
+const shortSecret = 'short77';
+
+const lines = [];
+const destination = {
+  write(line) {
+    lines.push(line);
+  },
+};
+
+// The prod logger writes to stdout; route the real logger to memory so each test reads the
+// exact line pino would emit, after the streamWrite hook.
+jest.unstable_mockModule('@lowdefy/logger/node', () => ({
+  createNodeLogger: (options) => createNodeLogger({ ...options, destination }),
+}));
+jest.unstable_mockModule('../../build/appMeta.js', () => ({ default: {} }));
+
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+process.env.LOWDEFY_SECRET_SHORT = shortSecret;
+process.env.LOWDEFY_LOG_LEVEL = 'debug';
+
+const { default: createLogger } = await import('./createLogger.js');
+
+function createAxiosError() {
+  const error = new Error('Request failed with status code 401');
+  error.name = 'AxiosError';
+  error.code = 'ERR_BAD_REQUEST';
+  error.config = {
+    auth: { username: 'svc-user', password: 'planted-config-password' },
+    params: { api_key: 'planted-config-param' },
+    headers: { Authorization: 'Bearer planted-config-header' },
+    baseURL: 'https://api.example.com',
+  };
+  error.response = { status: 401, data: { detail: 'planted-response-body' } };
+  return error;
+}
+
+beforeEach(() => {
+  lines.length = 0;
+});
+
+test('prod logger drops an axios error config auth, params and headers', () => {
+  createLogger().error({ err: createAxiosError() }, 'Request failed');
+  expect(lines).toHaveLength(1);
+  const line = lines[0];
+  expect(line).not.toContain('planted-config-password');
+  expect(line).not.toContain('planted-config-param');
+  expect(line).not.toContain('planted-config-header');
+  expect(line).not.toContain('planted-response-body');
+  const { err } = JSON.parse(line);
+  expect(err.config).toBeUndefined();
+  expect(err.code).toBe('ERR_BAD_REQUEST');
+  expect(err.statusCode).toBe(401);
+});
+
+test('prod logger redacts a planted secret in a message raw, URL-encoded and base64', () => {
+  const basic = Buffer.from(`svc-user:${secret}`).toString('base64');
+  const error = new Error(`raw ${secret} encoded ${encodeURIComponent(secret)} basic ${basic}`);
+  createLogger().error({ err: error }, error.message);
+  expect(lines).toHaveLength(1);
+  const line = lines[0];
+  expect(line).not.toContain(secret);
+  expect(line).not.toContain(encodeURIComponent(secret));
+  expect(line).not.toContain(Buffer.from(secret).toString('base64').slice(0, 20));
+  const { msg, err } = JSON.parse(line);
+  expect(msg).toMatch(/^raw \[REDACTED\] encoded \[REDACTED\] basic \S*\[REDACTED\]/);
+  expect(err.message).toBe(msg);
+});
+
+test('prod logger redacts a planted secret in a debug payload that is not an error', () => {
+  createLogger({ rid: 'req-1' }).debug({ response: { token: secret } }, 'Request result');
+  expect(lines).toHaveLength(1);
+  expect(lines[0]).not.toContain(secret);
+  expect(JSON.parse(lines[0]).response.token).toBe('[REDACTED]');
+});
+
+test('prod logger leaves a secret shorter than 8 characters alone', () => {
+  createLogger().info({ detail: shortSecret }, `value ${shortSecret}`);
+  expect(lines).toHaveLength(1);
+  const { msg, detail } = JSON.parse(lines[0]);
+  expect(msg).toBe(`value ${shortSecret}`);
+  expect(detail).toBe(shortSecret);
+});

package/lib/server/log/logRequest.js

@@ -14,53 +14,55 @@
   limitations under the License.
 */
 
-// TODO: Better name needed here maybe?
-function logRequest({ context }) {
+import redactUrlQuery from './redactUrlQuery.js';
+
+// Emits one access-log line per request, after the response is finalized.
+// `url` is the route path only (c.req.path). The referer keeps its query but
+// with credential parameters redacted, because the browser sends the page's
+// full URL there and that URL can carry a sign-in token or a signed OAuth
+// query (see redactUrlQuery).
+function logRequest({ context, status, durationMs }) {
   const { headers = {}, user = {} } = context;
-  context.logger.info({
-    // TODO:
-    // app_name
-    // app_version
-    // lowdefy_version
-    // build_hash
-    // config_hash
-    user: {
-      id: user.id,
-      roles: user.roles,
-      sub: user.sub,
-      session_id: user.session_id, // TODO: Implement session id
-    },
-    url: context.req.url,
-    method: context.req.method,
-    resolvedUrl: context.nextContext?.resolvedUrl,
-    hostname: context.req.hostname,
-    headers: {
-      'accept-language': headers['accept-language'],
-      'sec-ch-ua-mobile': headers['sec-ch-ua-mobile'],
-      'sec-ch-ua-platform': headers['sec-ch-ua-platform'],
-      'sec-ch-ua': headers['sec-ch-ua'],
-      'user-agent': headers['user-agent'],
-      host: headers.host,
-      referer: headers.referer,
-      'x-forward-for': headers['x-forward-for'],
-      // Vercel headers
-      'x-vercel-id': headers['x-vercel-id'],
-      'x-real-ip': headers['x-real-ip'],
-      'x-vercel-ip-country': headers['x-vercel-ip-country'],
-      'x-vercel-ip-country-region': headers['x-vercel-ip-country-region'],
-      'x-vercel-ip-city': headers['x-vercel-ip-city'],
-      'x-vercel-ip-latitude': headers['x-vercel-ip-latitude'],
-      'x-vercel-ip-longitude': headers['x-vercel-ip-longitude'],
-      'x-vercel-ip-timezone': headers['x-vercel-ip-timezone'],
-      // Cloudflare headers
-      'cf-connecting-ip': headers['cf-connecting-ip'],
-      'cf-ray': headers['cf-ray'],
-      'cf-ipcountry': headers['cf-ipcountry'],
-      'cf-visitor': headers['cf-visitor'],
+  context.logger.info(
+    {
+      user: {
+        id: user.id,
+        roles: user.roles,
+        sub: user.sub,
+        session_id: user.session_id, // TODO: Implement session id
+      },
+      url: context.req.url,
+      method: context.req.method,
+      hostname: context.req.hostname,
+      status,
+      duration_ms: durationMs,
+      headers: {
+        'accept-language': headers['accept-language'],
+        'sec-ch-ua-mobile': headers['sec-ch-ua-mobile'],
+        'sec-ch-ua-platform': headers['sec-ch-ua-platform'],
+        'sec-ch-ua': headers['sec-ch-ua'],
+        'user-agent': headers['user-agent'],
+        host: headers.host,
+        referer: redactUrlQuery(headers.referer),
+        'x-forwarded-for': headers['x-forwarded-for'],
+        // Vercel headers
+        'x-vercel-id': headers['x-vercel-id'],
+        'x-real-ip': headers['x-real-ip'],
+        'x-vercel-ip-country': headers['x-vercel-ip-country'],
+        'x-vercel-ip-country-region': headers['x-vercel-ip-country-region'],
+        'x-vercel-ip-city': headers['x-vercel-ip-city'],
+        'x-vercel-ip-latitude': headers['x-vercel-ip-latitude'],
+        'x-vercel-ip-longitude': headers['x-vercel-ip-longitude'],
+        'x-vercel-ip-timezone': headers['x-vercel-ip-timezone'],
+        // Cloudflare headers
+        'cf-connecting-ip': headers['cf-connecting-ip'],
+        'cf-ray': headers['cf-ray'],
+        'cf-ipcountry': headers['cf-ipcountry'],
+        'cf-visitor': headers['cf-visitor'],
+      },
     },
-  });
-  // TODO:
-  // Next local? nextContext.locale, nextContext.locales, nextContext.defaultLocale
+    'request completed'
+  );
 }
 
 export default logRequest;

package/lib/server/log/maskCredentialKeys.js

@@ -0,0 +1,37 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { mapPlainValues } from '@lowdefy/helpers';
+
+// `received` is the one kept log field holding values fetched at runtime (a token
+// from an earlier step sent as a header), which the by-value secret scrub
+// cannot recognise, so credential-looking keys are masked by name instead.
+const credentialKeyParts = ['authorization', 'token', 'secret', 'password', 'apikey', 'cookie'];
+
+function isCredentialKey(key) {
+  const normalized = key.toLowerCase().replace(/[-_]/g, '');
+  return credentialKeyParts.some((part) => normalized.includes(part));
+}
+
+// Shared references and cycles are copied as such, so the serializer walk still
+// marks them '[Circular]'.
+function maskCredentialKeys(value) {
+  return mapPlainValues(value, (item, key) =>
+    key !== undefined && isCredentialKey(key) ? '[REDACTED]' : item
+  );
+}
+
+export default maskCredentialKeys;

package/lib/server/log/projectErrorForLog.js

@@ -0,0 +1,55 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { lowdefyErrorNames, readErrorCodes } from '@lowdefy/errors';
+
+import maskCredentialKeys from './maskCredentialKeys.js';
+
+// Kept only on nodes named as a Lowdefy error class: libraries reuse some of
+// these names for their own data - axios's `config` carries auth, params and
+// headers - so keying on the field alone would let a library's copy through.
+const lowdefyErrorFields = [
+  'configKey',
+  'source',
+  'config',
+  'handled',
+  'isLowdefyError',
+  'received',
+  'typeName',
+  'location',
+  'service',
+  'hint',
+  'methodName',
+  'metaData',
+  'blockId',
+  'pageId',
+  'isReject',
+];
+
+function projectErrorForLog(err) {
+  const { code, statusCode } = readErrorCodes(err);
+  const props = { name: err.name, message: err.message, stack: err.stack, code, statusCode };
+  if (lowdefyErrorNames.has(err.name)) {
+    lowdefyErrorFields.forEach((field) => {
+      props[field] = err[field];
+    });
+    props.received = maskCredentialKeys(err.received);
+  }
+  props.cause = err.cause;
+  return props;
+}
+
+export default projectErrorForLog;