@lowdefy/server 6.1.0 → 7.0.0

package/src/routes/websocket.js

@@ -15,20 +15,31 @@
 */
 
 import { upgradeWebSocket } from '@hono/node-server';
-import { createChannelRegistry, createWebSocketConnection } from '@lowdefy/api';
+import {
+  createChannelRegistry,
+  createWebSocketConnection,
+  isWebSocketOriginAllowed,
+} from '@lowdefy/api';
+
+import getStrategies from '../../lib/server/auth/getStrategies.js';
 
 // One registry per server process — channels and their running source
 // resolvers are shared across all websocket connections on this instance.
 const registry = createChannelRegistry();
 
-const websocketHandler = upgradeWebSocket((c) => {
+const upgrade = upgradeWebSocket((c) => {
   const context = c.get('lowdefyContext');
   let connection;
   return {
     onOpen(event, ws) {
+      // The upgrade's headers stay with the connection: its caller is resolved
+      // from them again while the socket is open.
       connection = createWebSocketConnection(context, {
+        closeSocket: ({ code, reason }) => ws.close(code, reason),
+        headers: c.req.raw.headers,
         registry,
         send: (message) => ws.send(message),
+        strategies: getStrategies({ logger: context.logger }),
       });
     },
     onMessage(event) {
@@ -38,9 +49,21 @@ const websocketHandler = upgradeWebSocket((c) => {
       connection?.close();
     },
     onError(event) {
-      context.logger.debug({ event: 'ws_error' }, String(event?.error ?? 'WebSocket error'));
+      // A transport fault, not routine traffic: visible at the default level with
+      // the error object attached so the cause is not reduced to a string.
+      context.logger.warn({ event: 'ws_error', err: event?.error }, 'WebSocket error.');
     },
   };
 });
 
+// Upgrades are accepted from the app's own pages and from clients that send no
+// Origin; isWebSocketOriginAllowed holds the rule and logs a refusal.
+function websocketHandler(c, next) {
+  const context = c.get('lowdefyContext');
+  if (!isWebSocketOriginAllowed({ context, getHeader: (name) => c.req.header(name) })) {
+    return c.json({ error: 'Forbidden' }, 403);
+  }
+  return upgrade(c, next);
+}
+
 export default websocketHandler;

package/src/routes/websocket.test.mjs

@@ -0,0 +1,106 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+import { serve } from '@hono/node-server';
+import WebSocket, { WebSocketServer } from 'ws';
+
+jest.unstable_mockModule('../../lib/server/auth/getStrategies.js', () => ({
+  default: () => [],
+}));
+
+const { default: websocketHandler } = await import('./websocket.js');
+
+let server;
+let port;
+
+// The production wiring (src/index.js): a Hono app under the app's basePath,
+// served by @hono/node-server with a ws server for upgrades. The Vercel
+// function runs the same app through the same upgrade support.
+beforeAll(async () => {
+  const app = new Hono().basePath('/app');
+  app.use('*', async (c, next) => {
+    // The caller the upgrade resolved: signed in when the test says so.
+    const signedIn = c.req.header('x-test-signed-in') === 'true';
+    c.set('lowdefyContext', {
+      // The auth engine finds no session for the socket's cookie on a re-check.
+      auth: { api: { getSession: async () => null } },
+      config: {},
+      i18n: { active: 'en-US', messages: {} },
+      rid: 'request',
+      logger: { debug: () => {}, info: () => {}, warn: () => {} },
+      handleError: () => {},
+      user: signedIn ? { id: 'user-1', organization_id: 'org-1', roles: [] } : null,
+    });
+    await next();
+  });
+  app.get('/api/websocket', websocketHandler);
+  const wss = new WebSocketServer({ noServer: true });
+  await new Promise((resolve) => {
+    server = serve({ fetch: app.fetch, port: 0, websocket: { server: wss } }, (info) => {
+      port = info.port;
+      resolve();
+    });
+  });
+});
+
+afterAll(() => {
+  server.close();
+});
+
+function open({ headers }) {
+  return new Promise((resolve) => {
+    const socket = new WebSocket(`ws://127.0.0.1:${port}/app/api/websocket`, { headers });
+    socket.once('open', () => {
+      socket.close();
+      resolve('open');
+    });
+    socket.once('unexpected-response', (_, response) => {
+      socket.terminate();
+      resolve(response.statusCode);
+    });
+    socket.once('error', () => {});
+  });
+}
+
+test.each([
+  ['opens', 'the page is served from the same host', { origin: 'https://app.test' }, 'open'],
+  ['opens', 'a client sends no origin', {}, 'open'],
+  ['is refused', 'the origin is another site', { origin: 'https://other.test' }, 403],
+  [
+    'opens',
+    'a proxy rewrote Host and passed X-Forwarded-Host',
+    { host: 'localhost:3000', 'x-forwarded-host': 'app.test', origin: 'https://app.test' },
+    'open',
+  ],
+])('a websocket upgrade %s when %s', async (_, __, headers, expected) => {
+  expect(await open({ headers: { host: 'app.test', ...headers } })).toEqual(expected);
+});
+
+test('a websocket whose session ended closes with 4401 on its next subscribe', async () => {
+  const socket = new WebSocket(`ws://127.0.0.1:${port}/app/api/websocket`, {
+    headers: { host: 'app.test', 'x-test-signed-in': 'true' },
+  });
+  await new Promise((resolve) => socket.once('open', resolve));
+  const closed = new Promise((resolve) => {
+    socket.once('close', (code, reason) => resolve({ code, reason: reason.toString() }));
+  });
+
+  socket.send(JSON.stringify({ type: 'subscribe', websocketId: 'ticker', requestId: 's1' }));
+
+  expect(await closed).toEqual({ code: 4401, reason: 'caller-changed' });
+});

package/src/routes/wellKnownFallback.js

@@ -0,0 +1,30 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// RFC 8615 well-known URIs are machine-facing: a path this deployment does not
+// serve must answer 404, never the app's HTML shell. Serving 200 HTML breaks
+// clients that probe discovery documents - an MCP client's OAuth probe, for
+// example, fails with "Failed to parse JSON" instead of learning there is no
+// auth to discover. Mounted after the real discovery documents, before the
+// page catch-all.
+function wellKnownFallbackHandler(c) {
+  return c.json(
+    { name: 'NotFoundError', message: `No well-known document at ${c.req.path}.` },
+    404
+  );
+}
+
+export default wellKnownFallbackHandler;

package/vite.config.js

@@ -17,6 +17,7 @@
 import fs from 'node:fs';
 import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
+import { Features } from 'lightningcss';
 import { sentryVitePlugin } from '@sentry/vite-plugin';
 
 // basePath from the Lowdefy build — assets are served under it.
@@ -28,12 +29,41 @@ try {
   // No build yet (e.g. editor tooling) — default base.
 }
 
+// Vite 8 tree-shakes a `.module.css` imported only for its side effects
+// (`import './style.module.css'`), and its CSS goes with it: `:global(...)` rules in block and
+// plugin stylesheets never reach the built client. Marking CSS modules as side-effectful keeps
+// them, whatever the import style.
+function keepCssModuleSideEffects() {
+  return {
+    name: 'lowdefy-keep-css-module-side-effects',
+    enforce: 'post',
+    transform(code, id) {
+      if (/\.module\.css($|\?)/.test(id)) {
+        return { code, moduleSideEffects: 'no-treeshake' };
+      }
+    },
+  };
+}
+
 const uploadSourceMaps = Boolean(process.env.SENTRY_AUTH_TOKEN);
 
+// The @lowdefy packages this server depends on. A linked plugin pinned to
+// another release brings its own copies, and the client would then mix
+// versions: the dev server pre-bundles one copy per package for every
+// importer (whichever its scan meets first, so the server's own code can get
+// a plugin's older @lowdefy/helpers without an export it imports), and a
+// production build bundles both, so blocks read module state the client never
+// filled (the HTML enhancements it registers in @lowdefy/block-utils). The
+// server's copies are the ones its client and blocks were released with.
+const lowdefyDependencies = Object.keys(
+  JSON.parse(fs.readFileSync(new URL('./package.json', import.meta.url), 'utf8')).dependencies ?? {}
+).filter((name) => name.startsWith('@lowdefy/'));
+
 export default defineConfig(({ mode }) => ({
   base: `${basePath}/`,
   plugins: [
     react(),
+    keepCssModuleSideEffects(),
     uploadSourceMaps &&
       sentryVitePlugin({
         org: process.env.SENTRY_ORG,
@@ -46,6 +76,17 @@ export default defineConfig(({ mode }) => ({
     // plugin and client code branch on it.
     'process.env.NODE_ENV': JSON.stringify(mode === 'production' ? 'production' : 'development'),
   },
+  css: {
+    // Vite minifies client CSS with Lightning CSS, which by default lowers
+    // light-dark() into --lightningcss-light/--lightningcss-dark variables that
+    // only a CSS color-scheme declaration defines. The client sets color-scheme
+    // from JavaScript (useDarkMode), so the lowered values never resolve and
+    // every light-dark() colour is dropped. Tailwind leaves light-dark()
+    // unlowered in its own Lightning CSS pass for the same reason.
+    lightningcss: {
+      exclude: Features.LightDark,
+    },
+  },
   build: {
     outDir: 'dist/client',
     manifest: true,
@@ -55,7 +96,19 @@ export default defineConfig(({ mode }) => ({
     },
   },
   resolve: {
-    // linked plugin packages (pnpm link: / workspace) must share one React.
-    dedupe: ['react', 'react-dom'],
+    // Linked plugin packages (pnpm link: / workspace) resolve their own copies of
+    // shared libraries. They must share one React, the antd/X/cssinjs copies
+    // whose context providers (App, ConfigProvider, StyleProvider) the client
+    // renders, the dayjs whose global locale the client sets, and the server's
+    // @lowdefy packages (see lowdefyDependencies).
+    dedupe: [
+      'react',
+      'react-dom',
+      'antd',
+      '@ant-design/x',
+      '@ant-design/cssinjs',
+      'dayjs',
+      ...lowdefyDependencies,
+    ],
   },
 }));

package/client/shouldReloadForBuild.js

@@ -1,48 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import { type } from '@lowdefy/helpers';
-
-// sessionStorage key holding the server build this tab last reloaded for.
-const RELOADED_FOR_BUILD_KEY = 'lowdefy.reloadedForBuild';
-
-// True when a page config fetched during SPA navigation came from a newer
-// deploy than the bundle this tab is running, so the tab must do a full load
-// to pick up the current bundle. Without this the new config can reference
-// _js functions the old bundle never shipped, and the page throws mid-event.
-//
-// A tab reloads at most once per server build: if the freshly loaded bundle
-// still disagrees with the server (a rolling deploy answering from mixed
-// versions, a proxy caching old HTML), reloading again would loop forever.
-// The old-config-on-old-bundle throw is the lesser failure in that case.
-function shouldReloadForBuild({ bundleBuildId, serverBuildId, window }) {
-  if (type.isNone(serverBuildId) || serverBuildId === bundleBuildId) {
-    return false;
-  }
-  try {
-    if (window.sessionStorage.getItem(RELOADED_FOR_BUILD_KEY) === serverBuildId) {
-      return false;
-    }
-    window.sessionStorage.setItem(RELOADED_FOR_BUILD_KEY, serverBuildId);
-  } catch (error) {
-    // Browsers with storage disabled throw on sessionStorage access. Without
-    // the once-per-build record the loop guard cannot work, so do not reload.
-    return false;
-  }
-  return true;
-}
-
-export default shouldReloadForBuild;

package/client/shouldReloadForBuild.test.mjs

@@ -1,75 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import shouldReloadForBuild from './shouldReloadForBuild.js';
-
-function createWindow({ stored = {}, throws = false } = {}) {
-  return {
-    sessionStorage: {
-      getItem: (key) => {
-        if (throws) throw new Error('storage disabled');
-        return stored[key] ?? null;
-      },
-      setItem: (key, value) => {
-        if (throws) throw new Error('storage disabled');
-        stored[key] = value;
-      },
-    },
-  };
-}
-
-test('shouldReloadForBuild is false when the server build matches the bundle', () => {
-  const window = createWindow();
-  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: 'build-1', window })).toBe(
-    false
-  );
-});
-
-test('shouldReloadForBuild is false when the server sends no build id', () => {
-  const window = createWindow();
-  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: undefined, window })).toBe(
-    false
-  );
-  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: null, window })).toBe(
-    false
-  );
-});
-
-test('shouldReloadForBuild is true once per newer server build, then false', () => {
-  const stored = {};
-  const window = createWindow({ stored });
-  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: 'build-2', window })).toBe(
-    true
-  );
-  expect(stored['lowdefy.reloadedForBuild']).toEqual('build-2');
-  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: 'build-2', window })).toBe(
-    false
-  );
-});
-
-test('shouldReloadForBuild reloads again when the server moves to a third build', () => {
-  const window = createWindow({ stored: { 'lowdefy.reloadedForBuild': 'build-2' } });
-  expect(shouldReloadForBuild({ bundleBuildId: 'build-2', serverBuildId: 'build-3', window })).toBe(
-    true
-  );
-});
-
-test('shouldReloadForBuild is false when sessionStorage is unavailable', () => {
-  const window = createWindow({ throws: true });
-  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: 'build-2', window })).toBe(
-    false
-  );
-});