@lowdefy/server 5.6.0 → 6.1.0

package/lib/server/sentry/initSentry.js

@@ -14,30 +14,43 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/nextjs';
+import * as Sentry from '@sentry/node';
 
 import loggerConfig from '../../build/logger.js';
+import scrubEvent from './scrubEvent.js';
 
+// Returns true when Sentry was initialized, so the caller can log it through
+// the structured logger — this module runs before the logger exists.
 function initSentryServer() {
   // No-op if SENTRY_DSN not set
   if (!process.env.SENTRY_DSN) {
-    return;
+    return false;
   }
 
   const sentryConfig = loggerConfig.sentry || {};
 
   // No-op if server logging is explicitly disabled
   if (sentryConfig.server === false) {
-    return;
+    return false;
   }
 
   Sentry.init({
     dsn: process.env.SENTRY_DSN,
     environment: sentryConfig.environment || process.env.NODE_ENV || 'production',
     tracesSampleRate: sentryConfig.tracesSampleRate ?? 0.1,
+    // Every path out to Sentry gets the log's secret scrub: error events with their cause
+    // chain, and the spans and breadcrumbs that carry outgoing URLs with their query strings.
+    beforeSend: (event) => scrubEvent(event),
+    beforeSendTransaction: (event) => scrubEvent(event),
+    beforeSendSpan: (span) => scrubEvent(span),
+    beforeBreadcrumb: (breadcrumb) => scrubEvent(breadcrumb),
+    // Incoming request bodies are attached to error events by default - an endpoint payload,
+    // a sign-in password - and no value scrub can recognise them. This replaces the default
+    // Http integration by name rather than adding a second one.
+    integrations: [Sentry.httpIntegration({ maxIncomingRequestBodySize: 'none' })],
   });
 
-  console.log('Sentry enabled: server');
+  return true;
 }
 
 export default initSentryServer;

package/lib/server/sentry/initSentry.test.mjs

@@ -0,0 +1,237 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import http from 'node:http';
+
+import { jest } from '@jest/globals';
+import * as RealSentry from '@sentry/node';
+
+const secret = 'planted/secret+value=1';
+
+const envelopes = [];
+function createStubTransport() {
+  return {
+    send: async (envelope) => {
+      envelopes.push(envelope);
+      return {};
+    },
+    flush: async () => true,
+  };
+}
+
+const httpIntegrations = [];
+
+// The real SDK with its network transport swapped for memory, so each test reads the exact
+// event Sentry would send, after the hooks initSentry installs.
+jest.unstable_mockModule('@sentry/node', () => ({
+  ...RealSentry,
+  init: (options) => RealSentry.init({ ...options, transport: createStubTransport }),
+  httpIntegration: (options) => {
+    const integration = RealSentry.httpIntegration(options);
+    httpIntegrations.push(integration);
+    return integration;
+  },
+}));
+jest.unstable_mockModule('../../build/logger.js', () => ({ default: { sentry: {} } }));
+
+process.env.SENTRY_DSN = 'https://public@o0.ingest.sentry.io/1';
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+
+const { default: initSentryServer } = await import('./initSentry.js');
+
+const enabled = initSentryServer();
+const client = RealSentry.getClient();
+const options = client.getOptions();
+
+function sentEvents() {
+  return envelopes.flatMap(([, items]) =>
+    items.filter(([header]) => header.type === 'event').map(([, payload]) => payload)
+  );
+}
+
+beforeEach(() => {
+  envelopes.length = 0;
+});
+
+afterAll(async () => {
+  await RealSentry.close();
+});
+
+test('initSentry initializes Sentry when SENTRY_DSN is set', () => {
+  expect(enabled).toBe(true);
+  expect(client).toBeDefined();
+});
+
+test('initSentry installs exactly one Http integration, the one that attaches no request bodies', () => {
+  expect(httpIntegrations).toHaveLength(1);
+  const installedHttp = options.integrations.filter(({ name }) => name === 'Http');
+  expect(installedHttp).toHaveLength(1);
+  expect(installedHttp[0]).toBe(httpIntegrations[0]);
+  expect(client.getIntegrationByName('Http')).toBe(httpIntegrations[0]);
+});
+
+test('beforeSend replaces a planted secret in an exception value, a cause-chain exception value and extra', () => {
+  const event = {
+    event_id: 'a'.repeat(32),
+    level: 'error',
+    exception: {
+      values: [
+        {
+          type: 'AxiosError',
+          value: `connect failed for key ${secret}`,
+          mechanism: { type: 'chained', source: 'cause', exception_id: 1, parent_id: 0 },
+        },
+        {
+          type: 'RequestError',
+          value: `Request failed: ${encodeURIComponent(secret)}`,
+          stacktrace: { frames: [{ filename: 'app.js', function: 'handler', lineno: 12 }] },
+          mechanism: { type: 'generic', handled: true, exception_id: 0 },
+        },
+      ],
+    },
+    extra: {
+      configKey: 'key-1',
+      error: { name: 'RequestError', message: `failed with ${secret}`, received: [secret] },
+    },
+    tags: { requestId: 'req-1' },
+  };
+  const scrubbed = options.beforeSend(event, {});
+  expect(JSON.stringify(scrubbed)).not.toContain(secret);
+  expect(JSON.stringify(scrubbed)).not.toContain(encodeURIComponent(secret));
+  expect(scrubbed.exception.values[0].value).toEqual('connect failed for key [REDACTED]');
+  expect(scrubbed.exception.values[1].value).toEqual('Request failed: [REDACTED]');
+  expect(scrubbed.exception.values[1].stacktrace).toEqual(event.exception.values[1].stacktrace);
+  expect(scrubbed.extra).toEqual({
+    configKey: 'key-1',
+    error: { name: 'RequestError', message: 'failed with [REDACTED]', received: ['[REDACTED]'] },
+  });
+  expect(scrubbed.tags).toEqual({ requestId: 'req-1' });
+});
+
+test('beforeSend scrubs an exception captured through the SDK, cause chain included', async () => {
+  const cause = new Error(`upstream rejected ${secret}`);
+  RealSentry.captureException(new Error('Request failed.', { cause }), {
+    extra: { detail: `sent ${secret}` },
+  });
+  await RealSentry.flush();
+  const events = sentEvents();
+  expect(events).toHaveLength(1);
+  expect(JSON.stringify(events[0])).not.toContain(secret);
+  const values = events[0].exception.values.map(({ value }) => value);
+  expect(values).toEqual(['upstream rejected [REDACTED]', 'Request failed.']);
+  expect(events[0].extra.detail).toEqual('sent [REDACTED]');
+});
+
+test('beforeBreadcrumb replaces a planted secret in a breadcrumb URL', () => {
+  const breadcrumb = {
+    type: 'http',
+    category: 'http',
+    level: 'info',
+    data: {
+      url: `https://api.example.com/v1/items?api_key=${secret}`,
+      'http.method': 'GET',
+      status_code: 200,
+    },
+    timestamp: 1700000000,
+  };
+  expect(options.beforeBreadcrumb(breadcrumb)).toEqual({
+    ...breadcrumb,
+    data: {
+      url: 'https://api.example.com/v1/items?api_key=[REDACTED]',
+      'http.method': 'GET',
+      status_code: 200,
+    },
+  });
+});
+
+function createFetchSpan() {
+  return {
+    span_id: 'b'.repeat(16),
+    trace_id: 'c'.repeat(32),
+    parent_span_id: 'd'.repeat(16),
+    op: 'http.client',
+    description: `GET https://api.example.com/v1/items?api_key=${secret}`,
+    origin: 'auto.http.otel.node_fetch',
+    start_timestamp: 1700000000,
+    timestamp: 1700000001,
+    status: 'ok',
+    data: {
+      'sentry.op': 'http.client',
+      'http.method': 'GET',
+      url: `https://api.example.com/v1/items?api_key=${secret}`,
+      'http.url': `https://api.example.com/v1/items?api_key=${secret}`,
+      'http.query': `?api_key=${secret}`,
+      'http.response.status_code': 200,
+    },
+  };
+}
+
+test('beforeSendSpan replaces a planted secret in a fetch span http.url and http.query', () => {
+  const scrubbed = options.beforeSendSpan(createFetchSpan());
+  expect(JSON.stringify(scrubbed)).not.toContain(secret);
+  expect(scrubbed.data['http.url']).toEqual('https://api.example.com/v1/items?api_key=[REDACTED]');
+  expect(scrubbed.data['http.query']).toEqual('?api_key=[REDACTED]');
+  expect(scrubbed.data['http.response.status_code']).toEqual(200);
+});
+
+test('beforeSendTransaction replaces a planted secret in a fetch span http.url and http.query', () => {
+  const transaction = {
+    type: 'transaction',
+    transaction: 'POST /api/endpoints/fetch-items',
+    start_timestamp: 1700000000,
+    timestamp: 1700000002,
+    contexts: {
+      trace: { span_id: 'd'.repeat(16), trace_id: 'c'.repeat(32), op: 'http.server' },
+    },
+    spans: [createFetchSpan()],
+  };
+  const scrubbed = options.beforeSendTransaction(transaction, {});
+  expect(JSON.stringify(scrubbed)).not.toContain(secret);
+  expect(scrubbed.spans[0].data['http.url']).toEqual(
+    'https://api.example.com/v1/items?api_key=[REDACTED]'
+  );
+  expect(scrubbed.spans[0].data['http.query']).toEqual('?api_key=[REDACTED]');
+  expect(scrubbed.contexts).toEqual(transaction.contexts);
+});
+
+test('an error event captured during a request with a JSON body carries no request data', async () => {
+  const server = http.createServer((req, res) => {
+    const chunks = [];
+    req.on('data', (chunk) => chunks.push(chunk));
+    req.on('end', () => {
+      RealSentry.captureException(new Error('Endpoint failed.'));
+      res.end('{}');
+    });
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const { port } = server.address();
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/api/endpoints/sign-in`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ email: 'user@example.com', password: 'planted-user-password' }),
+    });
+    await response.text();
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+  await RealSentry.flush();
+  const events = sentEvents();
+  expect(events).toHaveLength(1);
+  expect(events[0].request.url).toMatch(/\/api\/endpoints\/sign-in$/);
+  expect(events[0].request.data).toBeUndefined();
+  expect(JSON.stringify(events[0])).not.toContain('planted-user-password');
+});

package/lib/server/sentry/scrubEvent.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { mapPlainValues, type } from '@lowdefy/helpers';
+
+import scrubSecrets from '../scrubSecrets.js';
+
+// Class instances are left as they are: Sentry normalizes those before beforeSend
+// runs, so the event hook still reaches their strings. Breadcrumbs reach
+// beforeBreadcrumb un-normalized - a console breadcrumb holds the logged arguments
+// as they are - so the walk must be cycle-safe, which mapPlainValues is.
+function scrubEvent(value) {
+  return mapPlainValues(value, (item) => (type.isString(item) ? scrubSecrets(item) : item));
+}
+
+export default scrubEvent;

package/lib/server/sentry/scrubEvent.test.mjs

@@ -0,0 +1,88 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+const secret = 'planted/secret+value=1';
+const shortSecret = 'short77';
+
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+process.env.LOWDEFY_SECRET_SHORT = shortSecret;
+
+const { default: scrubEvent } = await import('./scrubEvent.js');
+
+test('scrubEvent replaces a planted secret in strings at every depth of objects and arrays', () => {
+  expect(
+    scrubEvent({
+      message: `failed ${secret}`,
+      nested: { list: [`a ${secret}`, { deeper: [[secret]] }] },
+    })
+  ).toEqual({
+    message: 'failed [REDACTED]',
+    nested: { list: ['a [REDACTED]', { deeper: [['[REDACTED]']] }] },
+  });
+});
+
+test('scrubEvent leaves keys as they are, even a key holding a secret', () => {
+  expect(scrubEvent({ [secret]: 'value' })).toEqual({ [secret]: 'value' });
+});
+
+test('scrubEvent returns a copy and does not mutate the value it scrubs', () => {
+  const event = { extra: { detail: secret }, values: [secret] };
+  const scrubbed = scrubEvent(event);
+  expect(scrubbed).not.toBe(event);
+  expect(scrubbed.extra).not.toBe(event.extra);
+  expect(event).toEqual({ extra: { detail: secret }, values: [secret] });
+});
+
+test('scrubEvent returns numbers, booleans, null and undefined unchanged', () => {
+  expect(scrubEvent({ a: 1, b: true, c: null, d: undefined })).toEqual({
+    a: 1,
+    b: true,
+    c: null,
+    d: undefined,
+  });
+  expect(scrubEvent(null)).toBeNull();
+});
+
+test('scrubEvent scrubs a top-level string', () => {
+  expect(scrubEvent(`value ${secret}`)).toEqual('value [REDACTED]');
+});
+
+test('scrubEvent leaves a secret shorter than 8 characters alone', () => {
+  expect(scrubEvent({ detail: `value ${shortSecret}` })).toEqual({
+    detail: `value ${shortSecret}`,
+  });
+});
+
+test('scrubEvent returns class instances unchanged', () => {
+  class Client {
+    constructor() {
+      this.detail = secret;
+    }
+  }
+  const client = new Client();
+  const date = new Date(0);
+  const scrubbed = scrubEvent({ client, date });
+  expect(scrubbed.client).toBe(client);
+  expect(scrubbed.date).toBe(date);
+});
+
+test('scrubEvent copies a cycle as a cycle', () => {
+  const data = { message: secret };
+  data.self = data;
+  const scrubbed = scrubEvent({ data });
+  expect(scrubbed.data.message).toEqual('[REDACTED]');
+  expect(scrubbed.data.self).toBe(scrubbed.data);
+});

package/lib/server/sentry/setSentryUser.js

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/nextjs';
+import * as Sentry from '@sentry/node';
 
 function setSentryUser({ user, sentryConfig }) {
   // No-op if Sentry not initialized (DSN not set)

package/lowdefy/createCustomPluginTypesMap.mjs

@@ -55,6 +55,7 @@ async function createCustomPluginTypesMap({ directories }) {
       server: {},
     },
     requests: {},
+    websockets: {},
   };
 
   const pluginDefinitions = await getPluginDefinitions({ directories });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server",
-  "version": "5.6.0",
+  "version": "6.1.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -28,68 +28,80 @@
   "files": [
     "lib/*",
     "lowdefy/*",
-    "pages/*",
     "public_default/*",
-    "next.config.js",
-    "postcss.config.js",
     "package.original.json",
     ".eslintrc.yaml",
-    ".npmrc"
+    ".npmrc",
+    "src/*",
+    "client/*",
+    "vite.config.js",
+    "postcss.config.cjs"
   ],
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
     "@ant-design/x": "2.7.0",
-    "@lowdefy/actions-core": "5.6.0",
-    "@lowdefy/api": "5.6.0",
-    "@lowdefy/block-utils": "5.6.0",
-    "@lowdefy/blocks-antd": "5.6.0",
-    "@lowdefy/blocks-antd-x": "5.6.0",
-    "@lowdefy/blocks-basic": "5.6.0",
-    "@lowdefy/blocks-loaders": "5.6.0",
-    "@lowdefy/blocks-tiptap": "5.6.0",
-    "@lowdefy/client": "5.6.0",
-    "@lowdefy/errors": "5.6.0",
-    "@lowdefy/helpers": "5.6.0",
-    "@lowdefy/layout": "5.6.0",
-    "@lowdefy/logger": "5.6.0",
-    "@lowdefy/node-utils": "5.6.0",
-    "@lowdefy/operators-js": "5.6.0",
-    "@lowdefy/plugin-next-auth": "5.6.0",
-    "@sentry/nextjs": "8.53.0",
-    "@tailwindcss/postcss": "4.2.1",
+    "@auth/core": "0.41.3",
+    "@hono/auth-js": "1.1.1",
+    "@hono/mcp": "0.3.0",
+    "@hono/node-server": "2.0.10",
+    "@lowdefy/actions-core": "6.1.0",
+    "@lowdefy/api": "6.1.0",
+    "@lowdefy/block-utils": "6.1.0",
+    "@lowdefy/blocks-aggrid": "6.1.0",
+    "@lowdefy/blocks-antd": "6.1.0",
+    "@lowdefy/blocks-antd-x": "6.1.0",
+    "@lowdefy/blocks-basic": "6.1.0",
+    "@lowdefy/blocks-echarts": "6.1.0",
+    "@lowdefy/blocks-files": "6.1.0",
+    "@lowdefy/blocks-loaders": "6.1.0",
+    "@lowdefy/blocks-markdown": "6.1.0",
+    "@lowdefy/blocks-tiptap": "6.1.0",
+    "@lowdefy/client": "6.1.0",
+    "@lowdefy/errors": "6.1.0",
+    "@lowdefy/helpers": "6.1.0",
+    "@lowdefy/layout": "6.1.0",
+    "@lowdefy/logger": "6.1.0",
+    "@lowdefy/node-utils": "6.1.0",
+    "@lowdefy/operators-js": "6.1.0",
+    "@lowdefy/plugin-next-auth": "6.1.0",
+    "@lowdefy/websockets-core": "6.1.0",
+    "@sentry/browser": "10.57.0",
+    "@sentry/node": "10.57.0",
+    "@sentry/vite-plugin": "5.3.0",
+    "@tailwindcss/postcss": "4.3.1",
+    "@vitejs/plugin-react": "6.0.2",
     "antd": "6.3.1",
-    "dayjs": "1.11.19",
-    "next": "16.1.6",
-    "next-auth": "4.24.10",
-    "pino": "8.16.2",
+    "dayjs": "1.11.20",
+    "hono": "4.13.5",
+    "pino": "10.3.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",
     "react-icons": "5.6.0",
-    "tailwindcss": "4.2.1",
-    "uuid": "13.0.0"
+    "tailwindcss": "4.3.1",
+    "uuid": "14.0.0",
+    "vite": "8.0.16",
+    "ws": "8.21.0"
   },
   "devDependencies": {
-    "@lowdefy/build": "5.6.0",
-    "@next/eslint-plugin-next": "16.1.6",
-    "@tailwindcss/postcss": "4.2.1",
-    "tailwindcss": "4.2.1",
-    "webpack": "5.94.0",
-    "yaml": "2.3.4",
-    "yargs": "17.7.2"
+    "@lowdefy/build": "6.1.0",
+    "@tailwindcss/postcss": "4.3.1",
+    "jest": "28.1.3",
+    "tailwindcss": "4.3.1",
+    "yaml": "2.9.0",
+    "yargs": "18.0.0"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "publishConfig": {
     "access": "public"
   },
+  "type": "module",
   "scripts": {
     "build": "cp package.json package.original.json || copy package.json package.original.json",
+    "build:client": "vite build",
     "build:lowdefy": "node lowdefy/build.mjs",
-    "build:next": "next build",
-    "dev": "next dev",
-    "start": "next start",
-    "lint": "next lint",
-    "next": "next"
+    "start": "node src/index.js",
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js"
   }
 }