@lowdefy/server 6.0.0 → 7.0.0

package/lib/client/bundleBuildId.js

@@ -0,0 +1,23 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import appMeta from '../../build/appMeta.json';
+
+// The build this client bundle was made from. The auth templates in lib/client/auth are kept
+// byte-identical with server-dev's, so each server supplies the build id from outside them.
+const bundleBuildId = appMeta.buildId;
+
+export default bundleBuildId;

package/lib/client/createLogUsage.js

@@ -14,44 +14,65 @@
   limitations under the License.
 */
 import { v4 as uuid } from 'uuid';
+import { createUrl } from '@lowdefy/client/adapters/url.js';
 
-// What if this fails?
 // What about public usage
 
-function createLogUsage({ usageDataRef }) {
+// Browser storage can be disabled (a private window, blocked site data), and then every access
+// throws: fall back to an id for this page load.
+function getMachineId() {
+  try {
+    let machine = localStorage.getItem('lowdefy_machine_id');
+    if (!machine) {
+      machine = uuid();
+      localStorage.setItem('lowdefy_machine_id', machine);
+    }
+    return machine;
+  } catch (error) {
+    return uuid();
+  }
+}
+
+function createLogUsage({ basePath, usageDataRef }) {
   let lastTimestamp = 0;
   let isOffline = false;
-  let machine = localStorage.getItem('lowdefy_machine_id');
-  if (!machine) {
-    machine = uuid();
-    localStorage.setItem('lowdefy_machine_id', machine);
-  }
+  const machine = getMachineId();
 
+  // Runs on every event and nothing awaits it, so a failure (the usage route unreachable, a proxy
+  // answering with an HTML page, telemetry blocked) is dropped here instead of surfacing as an
+  // unhandled rejection. Usage logging never affects the app.
   async function logUsage() {
     if (isOffline || lastTimestamp > Date.now() - 1000 * 60 * 15) {
       return;
     }
     lastTimestamp = Date.now();
 
-    const res = await fetch('/api/usage', {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({ user: usageDataRef.current.user, machine }),
-    });
-    const { offline, data } = await res.json();
-    if (offline) {
-      isOffline = true;
-      return;
+    try {
+      const res = await fetch(createUrl({ basePath, pathname: '/api/usage' }), {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ user: usageDataRef.current.user, machine }),
+      });
+      if (!res.ok) {
+        return;
+      }
+      const { offline, data } = await res.json();
+      if (offline) {
+        isOffline = true;
+        return;
+      }
+      await fetch('https://api.lowdefy.net/v4/telemetry/usage', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(data),
+      });
+    } catch (error) {
+      // Dropped: see above.
     }
-    await fetch('https://api.lowdefy.net/v4/telemetry/usage', {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify(data),
-    });
   }
   return logUsage;
 }

package/lib/client/createLogUsage.test.mjs

@@ -0,0 +1,90 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+
+import createLogUsage from './createLogUsage.js';
+
+const usageDataRef = { current: { user: { id: 'u1' } } };
+
+function jsonResponse(body) {
+  return { ok: true, json: async () => body };
+}
+
+beforeEach(() => {
+  const stored = {};
+  globalThis.localStorage = {
+    getItem: (key) => stored[key] ?? null,
+    setItem: (key, value) => {
+      stored[key] = value;
+    },
+  };
+  globalThis.fetch = jest.fn();
+});
+
+afterEach(() => {
+  delete globalThis.localStorage;
+  delete globalThis.fetch;
+});
+
+test.each([
+  { basePath: '', url: '/api/usage' },
+  { basePath: '/app', url: '/app/api/usage' },
+])('createLogUsage posts usage to $url', async ({ basePath, url }) => {
+  globalThis.fetch.mockResolvedValueOnce(jsonResponse({ offline: true }));
+  await createLogUsage({ basePath, usageDataRef })();
+  expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+  expect(globalThis.fetch.mock.calls[0][0]).toBe(url);
+});
+
+test.each([
+  {
+    name: 'an HTML page instead of JSON',
+    response: {
+      ok: true,
+      json: async () => {
+        throw new SyntaxError('Unexpected token < in JSON at position 0');
+      },
+    },
+  },
+  { name: 'an error status', response: { ok: false, json: async () => ({}) } },
+])('createLogUsage drops a usage route answering with $name', async ({ response }) => {
+  globalThis.fetch.mockResolvedValueOnce(response);
+  await expect(createLogUsage({ basePath: '', usageDataRef })()).resolves.toBeUndefined();
+  expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+});
+
+test('createLogUsage drops a failed telemetry post', async () => {
+  globalThis.fetch
+    .mockResolvedValueOnce(jsonResponse({ offline: false, data: { machine: 'm' } }))
+    .mockRejectedValueOnce(new TypeError('Failed to fetch'));
+  await expect(createLogUsage({ basePath: '', usageDataRef })()).resolves.toBeUndefined();
+  expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+});
+
+test('createLogUsage works when browser storage throws', async () => {
+  globalThis.localStorage = {
+    getItem: () => {
+      throw new Error('SecurityError');
+    },
+    setItem: () => {
+      throw new Error('SecurityError');
+    },
+  };
+  globalThis.fetch.mockResolvedValueOnce(jsonResponse({ offline: true }));
+  await createLogUsage({ basePath: '', usageDataRef })();
+  expect(JSON.parse(globalThis.fetch.mock.calls[0][1].body).machine).toEqual(expect.any(String));
+});

package/lib/client/getCspNonce.js

@@ -0,0 +1,25 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The page's Content-Security-Policy nonce, from the csp-nonce meta tag the server
+// writes when config.security.contentSecurityPolicy is on (Vite reads the same tag).
+// Browsers hide nonce attributes from getAttribute, so it is read from the property.
+// An empty string when the policy is off.
+function getCspNonce() {
+  return document.querySelector('meta[property="csp-nonce"]')?.nonce ?? '';
+}
+
+export default getCspNonce;

package/lib/server/auth/createSystemContext.js

@@ -0,0 +1,70 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import path from 'node:path';
+import { createSystemContext as buildSystemContext } from '@lowdefy/api';
+import { getSecretsFromEnv } from '@lowdefy/node-utils';
+import { v4 as uuid } from 'uuid';
+
+import agents from '../../../build/plugins/agents.js';
+import appMeta from '../../build/appMeta.js';
+import config from '../../build/config.js';
+import connections from '../../../build/plugins/connections.js';
+import createHandleError from '../log/createHandleError.js';
+import createLogger from '../log/createLogger.js';
+import fileCache from '../fileCache.js';
+import i18nConfig from '../../build/i18n.js';
+import jsMap from '../../../build/plugins/operators/serverJsMap.js';
+import notifications from '../../../build/plugins/notifications.js';
+import operators from '../../../build/plugins/operators/server.js';
+import scrubSecrets from '../scrubSecrets.js';
+import steps from '../../../build/plugins/steps.js';
+import websockets from '../../../build/plugins/websockets.js';
+
+const secrets = getSecretsFromEnv();
+
+// Builds a fresh system context per auth hook fire - the trusted internal
+// caller the BetterAuth engine uses to invoke hook endpoints. All fields are
+// startup singletons except the per-fire rid, logger, handleError, and auth -
+// auth is threaded in by the caller (createHookDispatch) rather than
+// imported directly, since it comes from the same BetterAuth construction
+// that this factory is a dependency of (see createHookDispatch.js).
+function createSystemContext({ auth } = {}) {
+  const rid = uuid();
+  return buildSystemContext({
+    rid,
+    agents,
+    appMeta,
+    auth,
+    buildDirectory: path.join(process.cwd(), 'build'),
+    config,
+    connections,
+    createHandleError,
+    fileCache,
+    i18n: i18nConfig,
+    jsMap,
+    logger: createLogger({ rid }),
+    mode: 'prod',
+    notifications,
+    operators,
+    scrubSecrets,
+    secrets,
+    steps,
+    websockets,
+  });
+}
+
+export default createSystemContext;

package/lib/server/auth/{getAuthConfig.js → getAuth.js}

@@ -14,24 +14,32 @@
   limitations under the License.
 */
 
-import { getAuthConfig as getApiAuthConfig } from '@lowdefy/api';
+import { getBetterAuth } from '@lowdefy/api';
 import { getSecretsFromEnv } from '@lowdefy/node-utils';
 
 import adapters from '../../../build/plugins/auth/adapters.js';
 import appMeta from '../../build/appMeta.js';
 import authJson from '../../build/auth.js';
-import callbacks from '../../../build/plugins/auth/callbacks.js';
-import events from '../../../build/plugins/auth/events.js';
+import createSystemContext from './createSystemContext.js';
+import lowdefyConfig from '../../build/config.js';
 import providers from '../../../build/plugins/auth/providers.js';
 
-function getAuthConfig({ logger }) {
-  return getApiAuthConfig({
+// Returns the BetterAuth instance (memoized in @lowdefy/api), or null when
+// auth is not configured - it handles /api/auth/* and resolves the session
+// for every request.
+function getAuth({ logger }) {
+  if (authJson.configured !== true) {
+    return null;
+  }
+  return getBetterAuth({
     appMeta,
     authJson,
+    config: lowdefyConfig,
+    createSystemContext,
     logger,
-    plugins: { adapters, callbacks, events, providers },
+    plugins: { adapters, providers },
     secrets: getSecretsFromEnv(),
   });
 }
 
-export default getAuthConfig;
+export default getAuth;

package/lib/server/auth/getStrategies.js

@@ -0,0 +1,40 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { getAuthStrategies } from '@lowdefy/api';
+import { getSecretsFromEnv } from '@lowdefy/node-utils';
+
+import appMeta from '../../build/appMeta.js';
+import authJson from '../../build/auth.js';
+import strategyTypes from '../../../build/plugins/auth/strategies.js';
+
+// Returns the API auth strategy verifiers (memoized in @lowdefy/api), or an
+// empty list when auth is not configured - resolveAuthentication tries them
+// in config order when no session resolves.
+function getStrategies({ logger }) {
+  if (authJson.configured !== true) {
+    return [];
+  }
+  return getAuthStrategies({
+    appMeta,
+    authJson,
+    logger,
+    plugins: { strategies: strategyTypes },
+    secrets: getSecretsFromEnv(),
+  });
+}
+
+export default getStrategies;

package/lib/server/getClientAddress.js

@@ -0,0 +1,56 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+import { createClientAddressResolver } from '@lowdefy/node-utils';
+
+import config from '../build/config.js';
+
+const resolveClientAddress = createClientAddressResolver({
+  trustedProxies: config.trustedProxies,
+});
+
+let unconfiguredProxyWarned = false;
+
+// The address of the client a request came from, resolved once per request by
+// apiContext. A platform entry whose edge sets the client address on every
+// request (Vercel's x-real-ip) names that header. Otherwise the address is the
+// connection's peer, which @hono/node-server hands the app as c.env.incoming,
+// or the hop behind it when the peer is one of config.trustedProxies. A request
+// the app receives without a Node connection (app.fetch from a test) has no
+// peer, and its address is unknown.
+function getClientAddress({ c, clientAddressHeader, logger }) {
+  if (type.isString(clientAddressHeader)) {
+    return c.req.header(clientAddressHeader) ?? null;
+  }
+  const forwardedFor = c.req.header('x-forwarded-for');
+  if (
+    !unconfiguredProxyWarned &&
+    type.isString(forwardedFor) &&
+    type.isNone(config.trustedProxies)
+  ) {
+    unconfiguredProxyWarned = true;
+    logger.warn(
+      'A request carried X-Forwarded-For, which is ignored because config.trustedProxies is not set: the client address is the connecting peer. If the app runs behind a reverse proxy or load balancer, add its address to config.trustedProxies, or every client shares the proxy address for auth rate limits.'
+    );
+  }
+  return resolveClientAddress({
+    peerAddress: c.env?.incoming?.socket?.remoteAddress,
+    forwardedFor,
+  });
+}
+
+export default getClientAddress;

package/lib/server/getClientAddress.test.mjs

@@ -0,0 +1,108 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+const mockConfig = {};
+jest.unstable_mockModule('../build/config.js', () => ({ default: mockConfig }));
+
+// The resolver is built from config at module load, so each case loads a fresh
+// module instance (the query string) against its own trustedProxies.
+let loadCount = 0;
+async function loadGetClientAddress({ trustedProxies }) {
+  mockConfig.trustedProxies = trustedProxies;
+  loadCount += 1;
+  const { default: getClientAddress } = await import(`./getClientAddress.js?case=${loadCount}`);
+  return getClientAddress;
+}
+
+// Runs one request through a Hono app the way @hono/node-server does, with the
+// Node request (and its socket) as c.env.incoming.
+async function resolve({ getClientAddress, clientAddressHeader, headers, peerAddress, logger }) {
+  const app = new Hono();
+  app.get('/', (c) =>
+    c.json({ clientAddress: getClientAddress({ c, clientAddressHeader, logger }) })
+  );
+  const env = { incoming: { socket: { remoteAddress: peerAddress } } };
+  const response = await app.request('/', { headers }, env);
+  return (await response.json()).clientAddress;
+}
+
+function createLogger() {
+  return { warn: jest.fn() };
+}
+
+test('getClientAddress takes the connection peer and ignores X-Forwarded-For without trusted proxies', async () => {
+  const getClientAddress = await loadGetClientAddress({ trustedProxies: undefined });
+  const clientAddress = await resolve({
+    getClientAddress,
+    headers: { 'x-forwarded-for': '203.0.113.9' },
+    peerAddress: '198.51.100.4',
+    logger: createLogger(),
+  });
+  expect(clientAddress).toBe('198.51.100.4');
+});
+
+test('getClientAddress reads X-Forwarded-For behind a trusted proxy', async () => {
+  const getClientAddress = await loadGetClientAddress({ trustedProxies: ['10.0.0.0/8'] });
+  const clientAddress = await resolve({
+    getClientAddress,
+    headers: { 'x-forwarded-for': '198.51.100.66, 203.0.113.9' },
+    peerAddress: '10.0.0.2',
+    logger: createLogger(),
+  });
+  expect(clientAddress).toBe('203.0.113.9');
+});
+
+test('getClientAddress takes the platform header when the entry names one', async () => {
+  const getClientAddress = await loadGetClientAddress({ trustedProxies: undefined });
+  const clientAddress = await resolve({
+    getClientAddress,
+    clientAddressHeader: 'x-real-ip',
+    headers: { 'x-real-ip': '203.0.113.9', 'x-forwarded-for': '198.51.100.66' },
+    peerAddress: '10.0.0.2',
+    logger: createLogger(),
+  });
+  expect(clientAddress).toBe('203.0.113.9');
+});
+
+test('getClientAddress warns once when X-Forwarded-For arrives and trustedProxies is not set', async () => {
+  const getClientAddress = await loadGetClientAddress({ trustedProxies: undefined });
+  const logger = createLogger();
+  const request = {
+    getClientAddress,
+    headers: { 'x-forwarded-for': '203.0.113.9' },
+    peerAddress: '10.0.0.2',
+    logger,
+  };
+  await resolve(request);
+  await resolve(request);
+  expect(logger.warn).toHaveBeenCalledTimes(1);
+  expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining('config.trustedProxies'));
+});
+
+test('getClientAddress does not warn when trustedProxies is set', async () => {
+  const getClientAddress = await loadGetClientAddress({ trustedProxies: [] });
+  const logger = createLogger();
+  await resolve({
+    getClientAddress,
+    headers: { 'x-forwarded-for': '203.0.113.9' },
+    peerAddress: '10.0.0.2',
+    logger,
+  });
+  expect(logger.warn).not.toHaveBeenCalled();
+});

package/lib/server/log/createHandleError.js

@@ -24,9 +24,13 @@ import {
   RequestError,
   loadAndResolveErrorLocation,
   ServiceError,
+  TenantIntegrityError,
 } from '@lowdefy/errors';
 
 import captureSentryError from '../sentry/captureSentryError.js';
+import redactUrlQuery from './redactUrlQuery.js';
+import scrubSecrets from '../scrubSecrets.js';
+import serializeErrorForLog from './serializeErrorForLog.js';
 
 function getEventType(error) {
   if (error instanceof ServiceError) {
@@ -50,6 +54,9 @@ function getEventType(error) {
   if (error instanceof ConfigError) {
     return 'config_error';
   }
+  if (error instanceof TenantIntegrityError) {
+    return 'tenant_integrity_error';
+  }
   if (error instanceof LowdefyInternalError) {
     return 'lowdefy_error';
   }
@@ -92,7 +99,7 @@ function createHandleError({ context }) {
         error.config = location.config;
       }
 
-      // Single structured log call — pino serializes error via extractErrorProps,
+      // Single structured log call — pino serializes the error via serializeErrorForLog,
       // message string gives human-readable display via CLI logger
       const errorName = error?.name || 'Error';
       context.logger.error(
@@ -104,6 +111,8 @@ function createHandleError({ context }) {
           errorMessage: error.message,
           isServiceError,
           pageId: context.pageId || null,
+          endpointId: error.endpointId ?? context.endpointId ?? null,
+          organization_id: error.organizationId ?? context.user?.organization_id ?? null,
           timestamp: new Date().toISOString(),
           source: error.source || null,
           config: error.config || null,
@@ -118,6 +127,7 @@ function createHandleError({ context }) {
           method: context.req.method,
           resolvedUrl: context.nextContext?.resolvedUrl,
           hostname: context.req.hostname,
+          client_address: context.clientAddress,
           headers: {
             'accept-language': headers['accept-language'],
             'sec-ch-ua-mobile': headers['sec-ch-ua-mobile'],
@@ -125,7 +135,7 @@ function createHandleError({ context }) {
             'sec-ch-ua': headers['sec-ch-ua'],
             'user-agent': headers['user-agent'],
             host: headers.host,
-            referer: headers.referer,
+            referer: redactUrlQuery(headers.referer),
             // Non localhost headers
             'x-forwarded-for': headers['x-forwarded-for'],
             // Vercel headers
@@ -154,9 +164,11 @@ function createHandleError({ context }) {
         configLocation: location,
       });
     } catch (e) {
-      console.error(error);
+      // console.error writes to stderr past pino and its line scrub, and would print the raw
+      // error - an axios error's config.auth included - so it gets both layers by hand.
+      console.error(scrubSecrets(JSON.stringify(serializeErrorForLog(error))));
       console.error('An error occurred while logging the error.');
-      console.error(e);
+      console.error(scrubSecrets(JSON.stringify(serializeErrorForLog(e))));
     }
   };
 }