@piwitests/reporter 0.20.0 → 0.22.0

package/dist/global-setup-module.js

@@ -222,6 +222,32 @@ var HttpClient = class {
     this.serverUrl = serverUrl;
     this.logger = logger;
     this.timeout = timeout;
+    this.warnIfInsecureTransport();
+  }
+  /**
+   * Warn once when the dashboard URL is plaintext `http://` to a non-loopback
+   * host. The reporter sends the API key as a Bearer token — and uploads
+   * captured test data, including request URLs whose query strings the server
+   * only strips after receipt — over this connection, so a non-TLS remote
+   * endpoint exposes the key and payloads on the wire. Loopback (localhost /
+   * 127.0.0.1 / ::1) is exempt: that traffic never leaves the machine. This
+   * warns rather than refuses so internal HTTP deployments (e.g. behind a VPN)
+   * still work, but the exposure is no longer silent.
+   */
+  warnIfInsecureTransport() {
+    let url;
+    try {
+      url = new import_node_url.URL(this.serverUrl);
+    } catch {
+      return;
+    }
+    if (url.protocol !== "http:") return;
+    const host = url.hostname.toLowerCase();
+    const isLoopback = host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+    if (isLoopback) return;
+    this.logger.warn(
+      `Dashboard URL ${this.serverUrl} uses plaintext http:// \u2014 the API key and captured test data are transmitted unencrypted. Use https:// for any non-local server.`
+    );
   }
   /** Base URL of the Piwi Dashboard server this client talks to (used to print run links). */
   get baseUrl() {

package/dist/index.d.ts

@@ -2,6 +2,7 @@ import { FullConfig, Suite, TestCase, TestResult, FullResult } from '@playwright
 import { PlaywrightTestConfig } from '@playwright/test';
 export { PlaywrightTestConfig } from '@playwright/test';
 export { PiwiFixtures, extendPiwiFixtures, piwiFixtures } from './internal/capture/capture-fixtures.js';
+import '@piwitests/picker-dom';
 
 /**
  * Options for configuring the Piwi Dashboard reporter.
@@ -50,7 +51,7 @@ interface PiwiDashboardOptions {
     /**
      * Capture server-side spans for each API/document request the test makes,
      * read from the `X-Piwi-Trace` response header emitted by a Piwi
-     * instrumentation plugin (e.g. `@piwitests/instrumentation`). The spans show
+     * instrumentation plugin (e.g. `@piwitests/instrumentation-nitro`). The spans show
      * up next to the network request in the dashboard and feed AI diagnosis. Free
      * when no instrumentation is present (the header is simply absent). Defaults
      * to `true`; automatically disabled when `collectPerformanceMetrics` is