@lowdefy/server 6.0.0 → 7.0.0

package/src/routes/requestBody.test.mjs

@@ -0,0 +1,146 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+import { isSameOriginRequest, parseRequestBody } from '@lowdefy/api';
+
+const mockCallEndpoint = jest.fn();
+const mockGetEndpointConfig = jest.fn().mockRejectedValue(new Error('not found'));
+const mockRunWebhookEndpoint = jest.fn();
+jest.unstable_mockModule('@lowdefy/api', () => ({
+  acceptDetachedEndpoint: jest.fn(),
+  callAgent: jest.fn(),
+  callEndpoint: mockCallEndpoint,
+  callRequest: jest.fn(),
+  getEndpointConfig: mockGetEndpointConfig,
+  logClientError: jest.fn(),
+  isSameOriginRequest,
+  parseRequestBody,
+  redactErrorResponse: jest.fn(),
+  runWebhookEndpoint: mockRunWebhookEndpoint,
+}));
+
+const { default: createErrorHandler } = await import('../middleware/errorHandler.js');
+const routes = {
+  '/api/agent/*': (await import('./agent.js')).default,
+  '/api/client-error': (await import('./clientError.js')).default,
+  '/api/detached/*': (await import('./detached.js')).default,
+  '/api/endpoints/*': (await import('./endpoints.js')).default,
+  '/api/request/*': (await import('./request.js')).default,
+  '/api/usage': (await import('./usage.js')).default,
+};
+
+const logger = { debug: jest.fn(), error: jest.fn(), info: jest.fn(), warn: jest.fn() };
+
+function createApp() {
+  const app = new Hono();
+  app.use('*', async (c, next) => {
+    c.set('lowdefyContext', { logger, handleError: jest.fn() });
+    await next();
+  });
+  Object.entries(routes).forEach(([path, handler]) => app.all(path, handler));
+  app.onError(createErrorHandler({ logger }));
+  return app;
+}
+
+const originalCronSecret = process.env.CRON_SECRET;
+beforeAll(() => {
+  process.env.CRON_SECRET = 'secret';
+});
+afterAll(() => {
+  if (originalCronSecret === undefined) {
+    delete process.env.CRON_SECRET;
+  } else {
+    process.env.CRON_SECRET = originalCronSecret;
+  }
+});
+
+test.each([
+  ['/api/endpoints/save', 'nope', {}, 'Request body is not valid JSON.'],
+  ['/api/endpoints/save', 'null', {}, 'Request body must be a JSON object.'],
+  ['/api/request/orders/load', 'nope', {}, 'Request body is not valid JSON.'],
+  ['/api/agent/orders/assistant', 'nope', {}, 'Request body is not valid JSON.'],
+  [
+    '/api/detached/save',
+    'nope',
+    { authorization: 'Bearer secret' },
+    'Request body is not valid JSON.',
+  ],
+  ['/api/usage', 'nope', {}, 'Request body is not valid JSON.'],
+  [
+    '/api/client-error',
+    'nope',
+    { host: 'localhost', origin: 'http://localhost' },
+    'Request body is not valid JSON.',
+  ],
+])('POST %s with body %s answers 400 and logs a warning', async (path, body, headers, message) => {
+  const res = await createApp().request(path, { method: 'POST', body, headers });
+  expect(res.status).toBe(400);
+  expect(await res.json()).toEqual({ name: 'UserError', message });
+  expect(logger.warn).toHaveBeenCalledTimes(1);
+  expect(logger.error).not.toHaveBeenCalled();
+});
+
+test('POST /api/endpoints with a JSON body passes its fields to callEndpoint', async () => {
+  mockCallEndpoint.mockResolvedValue({ success: true });
+  const res = await createApp().request('/api/endpoints/save', {
+    method: 'POST',
+    body: JSON.stringify({ blockId: 'b', pageId: 'p', payload: { a: 1 } }),
+  });
+  expect(res.status).toBe(200);
+  expect(mockCallEndpoint).toHaveBeenCalledWith(expect.anything(), {
+    blockId: 'b',
+    endpointId: 'save',
+    pageId: 'p',
+    payload: { a: 1 },
+  });
+});
+
+test('POST /api/endpoints to a webhook endpoint passes the body text exactly as sent as rawBody', async () => {
+  mockGetEndpointConfig.mockResolvedValueOnce({ webhook: { verify: {} } });
+  mockRunWebhookEndpoint.mockResolvedValue({ status: 200, body: { ok: true } });
+  const body = '{ "zeta": 1,  "alpha": "caf\\u00e9", "beta": "café" }';
+  const res = await createApp().request('/api/endpoints/signed_hook?t=1', {
+    method: 'POST',
+    body,
+    headers: { 'x-hub-signature-256': 'sha256=abc' },
+  });
+  expect(res.status).toBe(200);
+  expect(mockRunWebhookEndpoint).toHaveBeenCalledWith(expect.anything(), {
+    endpointId: 'signed_hook',
+    rawBody: body,
+    query: { t: '1' },
+    headers: expect.objectContaining({ 'x-hub-signature-256': 'sha256=abc' }),
+  });
+});
+
+test.each([
+  [200, { received: true }],
+  [401, { error: { code: 'unauthorized', message: 'Webhook verification failed.' } }],
+  [404, { error: 'not_found', id: 'ticket-1' }],
+  [500, { error: { code: 'internal_error', message: 'Webhook failed.' } }],
+])(
+  'POST /api/endpoints to a webhook endpoint answers status %s with its body',
+  async (status, body) => {
+    mockGetEndpointConfig.mockResolvedValueOnce({ webhook: true });
+    mockRunWebhookEndpoint.mockResolvedValue({ status, body });
+    const res = await createApp().request('/api/endpoints/hook', { method: 'POST', body: '{}' });
+    expect(res.status).toBe(status);
+    expect(await res.json()).toEqual(body);
+  }
+);

package/src/routes/usage.js

@@ -17,14 +17,18 @@
 import fs from 'node:fs';
 import path from 'node:path';
 
+import { parseRequestBody } from '@lowdefy/api';
+
 const packageJson = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8'));
 
 async function usageHandler(c) {
   if (c.req.method !== 'POST') {
-    throw new Error('Only POST requests are supported.');
+    // A wrong-method request is client-caused: answer 405 rather than raising a
+    // fault that would be logged at error level and answered with a 500.
+    return c.json({ error: 'Method not allowed.' }, 405);
   }
   const context = c.get('lowdefyContext');
-  const { user, machine } = await c.req.json();
+  const { user, machine } = parseRequestBody({ text: await c.req.text() });
   const host = c.req.header('host');
   context.logger.info({ event: 'log_usage', user, machine });
 

package/src/routes/user.js

@@ -0,0 +1,27 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The resolved caller for the client - the same resolveAuthentication output
+// the first page load embeds. The base session carries neither roles (read
+// live from the active member row) nor the merged attributes bag, so the
+// client re-syncs from here (UpdateSession) after a session change such as
+// SetActiveOrganization.
+async function userHandler(c) {
+  const context = c.get('lowdefyContext');
+  return c.json({ user: context.user ?? null });
+}
+
+export default userHandler;

package/src/routes/websocket.js

@@ -15,20 +15,31 @@
 */
 
 import { upgradeWebSocket } from '@hono/node-server';
-import { createChannelRegistry, createWebSocketConnection } from '@lowdefy/api';
+import {
+  createChannelRegistry,
+  createWebSocketConnection,
+  isWebSocketOriginAllowed,
+} from '@lowdefy/api';
+
+import getStrategies from '../../lib/server/auth/getStrategies.js';
 
 // One registry per server process — channels and their running source
 // resolvers are shared across all websocket connections on this instance.
 const registry = createChannelRegistry();
 
-const websocketHandler = upgradeWebSocket((c) => {
+const upgrade = upgradeWebSocket((c) => {
   const context = c.get('lowdefyContext');
   let connection;
   return {
     onOpen(event, ws) {
+      // The upgrade's headers stay with the connection: its caller is resolved
+      // from them again while the socket is open.
       connection = createWebSocketConnection(context, {
+        closeSocket: ({ code, reason }) => ws.close(code, reason),
+        headers: c.req.raw.headers,
         registry,
         send: (message) => ws.send(message),
+        strategies: getStrategies({ logger: context.logger }),
       });
     },
     onMessage(event) {
@@ -38,9 +49,21 @@ const websocketHandler = upgradeWebSocket((c) => {
       connection?.close();
     },
     onError(event) {
-      context.logger.debug({ event: 'ws_error' }, String(event?.error ?? 'WebSocket error'));
+      // A transport fault, not routine traffic: visible at the default level with
+      // the error object attached so the cause is not reduced to a string.
+      context.logger.warn({ event: 'ws_error', err: event?.error }, 'WebSocket error.');
     },
   };
 });
 
+// Upgrades are accepted from the app's own pages and from clients that send no
+// Origin; isWebSocketOriginAllowed holds the rule and logs a refusal.
+function websocketHandler(c, next) {
+  const context = c.get('lowdefyContext');
+  if (!isWebSocketOriginAllowed({ context, getHeader: (name) => c.req.header(name) })) {
+    return c.json({ error: 'Forbidden' }, 403);
+  }
+  return upgrade(c, next);
+}
+
 export default websocketHandler;

package/src/routes/websocket.test.mjs

@@ -0,0 +1,106 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+import { serve } from '@hono/node-server';
+import WebSocket, { WebSocketServer } from 'ws';
+
+jest.unstable_mockModule('../../lib/server/auth/getStrategies.js', () => ({
+  default: () => [],
+}));
+
+const { default: websocketHandler } = await import('./websocket.js');
+
+let server;
+let port;
+
+// The production wiring (src/index.js): a Hono app under the app's basePath,
+// served by @hono/node-server with a ws server for upgrades. The Vercel
+// function runs the same app through the same upgrade support.
+beforeAll(async () => {
+  const app = new Hono().basePath('/app');
+  app.use('*', async (c, next) => {
+    // The caller the upgrade resolved: signed in when the test says so.
+    const signedIn = c.req.header('x-test-signed-in') === 'true';
+    c.set('lowdefyContext', {
+      // The auth engine finds no session for the socket's cookie on a re-check.
+      auth: { api: { getSession: async () => null } },
+      config: {},
+      i18n: { active: 'en-US', messages: {} },
+      rid: 'request',
+      logger: { debug: () => {}, info: () => {}, warn: () => {} },
+      handleError: () => {},
+      user: signedIn ? { id: 'user-1', organization_id: 'org-1', roles: [] } : null,
+    });
+    await next();
+  });
+  app.get('/api/websocket', websocketHandler);
+  const wss = new WebSocketServer({ noServer: true });
+  await new Promise((resolve) => {
+    server = serve({ fetch: app.fetch, port: 0, websocket: { server: wss } }, (info) => {
+      port = info.port;
+      resolve();
+    });
+  });
+});
+
+afterAll(() => {
+  server.close();
+});
+
+function open({ headers }) {
+  return new Promise((resolve) => {
+    const socket = new WebSocket(`ws://127.0.0.1:${port}/app/api/websocket`, { headers });
+    socket.once('open', () => {
+      socket.close();
+      resolve('open');
+    });
+    socket.once('unexpected-response', (_, response) => {
+      socket.terminate();
+      resolve(response.statusCode);
+    });
+    socket.once('error', () => {});
+  });
+}
+
+test.each([
+  ['opens', 'the page is served from the same host', { origin: 'https://app.test' }, 'open'],
+  ['opens', 'a client sends no origin', {}, 'open'],
+  ['is refused', 'the origin is another site', { origin: 'https://other.test' }, 403],
+  [
+    'opens',
+    'a proxy rewrote Host and passed X-Forwarded-Host',
+    { host: 'localhost:3000', 'x-forwarded-host': 'app.test', origin: 'https://app.test' },
+    'open',
+  ],
+])('a websocket upgrade %s when %s', async (_, __, headers, expected) => {
+  expect(await open({ headers: { host: 'app.test', ...headers } })).toEqual(expected);
+});
+
+test('a websocket whose session ended closes with 4401 on its next subscribe', async () => {
+  const socket = new WebSocket(`ws://127.0.0.1:${port}/app/api/websocket`, {
+    headers: { host: 'app.test', 'x-test-signed-in': 'true' },
+  });
+  await new Promise((resolve) => socket.once('open', resolve));
+  const closed = new Promise((resolve) => {
+    socket.once('close', (code, reason) => resolve({ code, reason: reason.toString() }));
+  });
+
+  socket.send(JSON.stringify({ type: 'subscribe', websocketId: 'ticker', requestId: 's1' }));
+
+  expect(await closed).toEqual({ code: 4401, reason: 'caller-changed' });
+});

package/src/routes/wellKnownFallback.js

@@ -0,0 +1,30 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// RFC 8615 well-known URIs are machine-facing: a path this deployment does not
+// serve must answer 404, never the app's HTML shell. Serving 200 HTML breaks
+// clients that probe discovery documents - an MCP client's OAuth probe, for
+// example, fails with "Failed to parse JSON" instead of learning there is no
+// auth to discover. Mounted after the real discovery documents, before the
+// page catch-all.
+function wellKnownFallbackHandler(c) {
+  return c.json(
+    { name: 'NotFoundError', message: `No well-known document at ${c.req.path}.` },
+    404
+  );
+}
+
+export default wellKnownFallbackHandler;

package/vite.config.js

@@ -17,6 +17,7 @@
 import fs from 'node:fs';
 import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
+import { Features } from 'lightningcss';
 import { sentryVitePlugin } from '@sentry/vite-plugin';
 
 // basePath from the Lowdefy build — assets are served under it.
@@ -28,12 +29,41 @@ try {
   // No build yet (e.g. editor tooling) — default base.
 }
 
+// Vite 8 tree-shakes a `.module.css` imported only for its side effects
+// (`import './style.module.css'`), and its CSS goes with it: `:global(...)` rules in block and
+// plugin stylesheets never reach the built client. Marking CSS modules as side-effectful keeps
+// them, whatever the import style.
+function keepCssModuleSideEffects() {
+  return {
+    name: 'lowdefy-keep-css-module-side-effects',
+    enforce: 'post',
+    transform(code, id) {
+      if (/\.module\.css($|\?)/.test(id)) {
+        return { code, moduleSideEffects: 'no-treeshake' };
+      }
+    },
+  };
+}
+
 const uploadSourceMaps = Boolean(process.env.SENTRY_AUTH_TOKEN);
 
+// The @lowdefy packages this server depends on. A linked plugin pinned to
+// another release brings its own copies, and the client would then mix
+// versions: the dev server pre-bundles one copy per package for every
+// importer (whichever its scan meets first, so the server's own code can get
+// a plugin's older @lowdefy/helpers without an export it imports), and a
+// production build bundles both, so blocks read module state the client never
+// filled (the HTML enhancements it registers in @lowdefy/block-utils). The
+// server's copies are the ones its client and blocks were released with.
+const lowdefyDependencies = Object.keys(
+  JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).dependencies ?? {}
+).filter((name) => name.startsWith('@lowdefy/'));
+
 export default defineConfig(({ mode }) => ({
   base: `${basePath}/`,
   plugins: [
     react(),
+    keepCssModuleSideEffects(),
     uploadSourceMaps &&
       sentryVitePlugin({
         org: process.env.SENTRY_ORG,
@@ -46,6 +76,17 @@ export default defineConfig(({ mode }) => ({
     // plugin and client code branch on it.
     'process.env.NODE_ENV': JSON.stringify(mode === 'production' ? 'production' : 'development'),
   },
+  css: {
+    // Vite minifies client CSS with Lightning CSS, which by default lowers
+    // light-dark() into --lightningcss-light/--lightningcss-dark variables that
+    // only a CSS color-scheme declaration defines. The client sets color-scheme
+    // from JavaScript (useDarkMode), so the lowered values never resolve and
+    // every light-dark() colour is dropped. Tailwind leaves light-dark()
+    // unlowered in its own Lightning CSS pass for the same reason.
+    lightningcss: {
+      exclude: Features.LightDark,
+    },
+  },
   build: {
     outDir: 'dist/client',
     manifest: true,
@@ -55,7 +96,19 @@ export default defineConfig(({ mode }) => ({
     },
   },
   resolve: {
-    // linked plugin packages (pnpm link: / workspace) must share one React.
-    dedupe: ['react', 'react-dom'],
+    // Linked plugin packages (pnpm link: / workspace) resolve their own copies of
+    // shared libraries. They must share one React, the antd/X/cssinjs copies
+    // whose context providers (App, ConfigProvider, StyleProvider) the client
+    // renders, the dayjs whose global locale the client sets, and the server's
+    // @lowdefy packages (see lowdefyDependencies).
+    dedupe: [
+      'react',
+      'react-dom',
+      'antd',
+      '@ant-design/x',
+      '@ant-design/cssinjs',
+      'dayjs',
+      ...lowdefyDependencies,
+    ],
   },
 }));

package/lib/server/apiWrapper.js

@@ -1,87 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import path from 'path';
-import { createApiContext, redactErrorResponse } from '@lowdefy/api';
-import { getSecretsFromEnv } from '@lowdefy/node-utils';
-import { v4 as uuid } from 'uuid';
-
-import agents from '../../build/plugins/agents.js';
-import appMeta from '../build/appMeta.js';
-import config from '../build/config.js';
-import i18nConfig from '../build/i18n.js';
-import connections from '../../build/plugins/connections.js';
-import createLogger from './log/createLogger.js';
-import fileCache from './fileCache.js';
-import getServerSession from './auth/getServerSession.js';
-import createHandleError from './log/createHandleError.js';
-import logRequest from './log/logRequest.js';
-import operators from '../../build/plugins/operators/server.js';
-import jsMap from '../../build/plugins/operators/serverJsMap.js';
-import getAuthOptions from './auth/getAuthOptions.js';
-import loggerConfig from '../build/logger.js';
-import setSentryUser from './sentry/setSentryUser.js';
-
-const secrets = getSecretsFromEnv();
-
-function apiWrapper(handler) {
-  return async function wrappedHandler(req, res) {
-    const context = {
-      // Important to give absolute path so Next can trace build files
-      rid: uuid(),
-      agents,
-      appMeta,
-      buildDirectory: path.join(process.cwd(), 'build'),
-      config,
-      connections,
-      fileCache,
-      headers: req?.headers,
-      i18n: i18nConfig,
-      jsMap,
-      handleError: async (err) => {
-        console.error(err);
-      },
-      logger: console,
-      operators,
-      req,
-      res,
-      secrets,
-    };
-    try {
-      context.logger = createLogger({ rid: context.rid });
-      context.handleError = createHandleError({ context });
-      context.authOptions = getAuthOptions(context);
-      if (!req.url.startsWith('/api/auth')) {
-        context.session = await getServerSession(context);
-        // Set Sentry user context for authenticated requests
-        setSentryUser({
-          user: context.session?.user,
-          sentryConfig: loggerConfig.sentry,
-        });
-      }
-      createApiContext(context);
-      logRequest({ context });
-      // Await here so that if handler throws it is caught.
-      const response = await handler({ context, req, res });
-      return response;
-    } catch (error) {
-      await context.handleError(error);
-      res.status(500).json(redactErrorResponse(context, error));
-    }
-  };
-}
-
-export default apiWrapper;