@programinglive/dev-workflow-mcp-server 1.7.13 → 1.7.16

package/scripts/test-auth-flow.js

@@ -0,0 +1,75 @@
+import fetch from 'node-fetch';
+
+const API_BASE_URL = 'https://hollywood-andrew-cycle-genre.trycloudflare.com';
+const USERNAME = 'programinglive';
+const PASSWORD = 'mcpdevserver';
+
+async function testAuthFlow() {
+    console.log('🚀 Starting Auth Flow Test...');
+    console.log(`Target: ${API_BASE_URL}\n`);
+
+    try {
+        // 1. Login
+        console.log('1️⃣  Attempting Login...');
+        const loginRes = await fetch(`${API_BASE_URL}/api/auth/login`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ username: USERNAME, password: PASSWORD }),
+        });
+
+        console.log(`   Status: ${loginRes.status}`);
+        if (!loginRes.ok) {
+            throw new Error(`Login failed: ${loginRes.statusText}`);
+        }
+
+        const loginData = await loginRes.json();
+        const token = loginData.token;
+
+        if (token) {
+            console.log('   ✅ Login Successful! JWT Token received.');
+            console.log(`   Token: ${token.substring(0, 20)}...`);
+        } else {
+            console.log('   ⚠️  Login successful but NO TOKEN returned (Legacy Session mode?)');
+        }
+
+        // 2. Access Protected Route (GET /me)
+        console.log('\n2️⃣  Verifying Session/Token (GET /api/auth/me)...');
+        const headers = {};
+        if (token) {
+            headers['Authorization'] = `Bearer ${token}`;
+            console.log('   Using Authorization: Bearer header');
+        } else {
+            console.log('   Using Cookies (if any)');
+        }
+
+        const meRes = await fetch(`${API_BASE_URL}/api/auth/me`, {
+            headers,
+        });
+
+        console.log(`   Status: ${meRes.status}`);
+        if (meRes.ok) {
+            const meData = await meRes.json();
+            console.log(`   ✅ Authorized! User: ${meData.username} (${meData.email})`);
+        } else {
+            console.error('   ❌ Authorization Failed!');
+            console.error(await meRes.text());
+        }
+
+        // 3. Access History (GET /api/history)
+        console.log('\n3️⃣  Fetching History...');
+        const historyRes = await fetch(`${API_BASE_URL}/api/history`, { headers });
+        console.log(`   Status: ${historyRes.status}`);
+
+        if (historyRes.ok) {
+            const historyData = await historyRes.json();
+            console.log(`   ✅ History fetched! Count: ${historyData.history ? historyData.history.length : 0}`);
+        } else {
+            console.log('   ❌ History fetch failed.');
+        }
+
+    } catch (error) {
+        console.error('\n❌ Test Failed:', error.message);
+    }
+}
+
+testAuthFlow();

package/tests/build.test.js

@@ -8,7 +8,7 @@ import path from 'path';
 const exec = promisify(execCallback);
 
 test('build generates dist/index.mjs file', async () => {
-  const { stderr } = await exec('npm run build:server');
+  const { stderr } = await exec('NODE_ENV=development npm run build:server');
   // Allow the known vite warning about node:process
   const knownWarning = '[plugin vite:resolve] Module "node:process" has been externalized for browser compatibility';
   const tailwindOutput = '≈ tailwindcss';

package/tests/startup-resilience.test.js

@@ -0,0 +1,73 @@
+import { test } from 'node:test';
+import assert from 'node:assert';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const ROOT = path.join(__dirname, '..');
+
+test('Server startup performance and resilience', async (t) => {
+    await t.test('Server starts in under 2 seconds (Studio timeout safety)', async () => {
+        const start = Date.now();
+        const server = spawn('node', [path.join(ROOT, 'index.js')], {
+            env: { ...process.env, DEV_WORKFLOW_DB_TYPE: 'sqlite' },
+            stdio: ['pipe', 'pipe', 'pipe']
+        });
+
+        return new Promise((resolve, reject) => {
+            let output = '';
+            const timeout = setTimeout(() => {
+                server.kill();
+                reject(new Error('Server timed out starting'));
+            }, 5000);
+
+            server.stderr.on('data', (data) => {
+                output += data.toString();
+                if (output.includes('running on stdio')) {
+                    const duration = Date.now() - start;
+                    console.log(`Verified startup duration: ${duration}ms`);
+                    assert.ok(duration < 2000, `Startup should be fast (took ${duration}ms)`);
+                    clearTimeout(timeout);
+                    server.kill();
+                    resolve();
+                }
+            });
+
+            server.on('error', (err) => {
+                clearTimeout(timeout);
+                reject(err);
+            });
+        });
+    });
+
+    await t.test('Resilience: Server starts even with unreachable database', async () => {
+        const server = spawn('node', [path.join(ROOT, 'index.js')], {
+            env: {
+                ...process.env,
+                DEV_WORKFLOW_DB_TYPE: 'postgres',
+                DEV_WORKFLOW_DB_URL: 'postgres://user:pass@1.2.3.4:5432/invalid'
+            },
+            stdio: ['pipe', 'pipe', 'pipe']
+        });
+
+        return new Promise((resolve, reject) => {
+            let output = '';
+            const timeout = setTimeout(() => {
+                server.kill();
+                reject(new Error('Server hung on unreachable DB'));
+            }, 15000); // Allow time for the 5s DB timeout + startup
+
+            server.stderr.on('data', (data) => {
+                output += data.toString();
+                if (output.includes('running on stdio')) {
+                    assert.ok(true, 'Server started despite invalid DB');
+                    clearTimeout(timeout);
+                    server.kill();
+                    resolve();
+                }
+            });
+        });
+    });
+});

package/web/Dockerfile.api

@@ -0,0 +1,25 @@
+FROM node:20-alpine
+
+# Install dependencies for native modules
+RUN apk add --no-cache python3 make g++ postgresql-client
+
+WORKDIR /app
+
+# Copy package files
+COPY package*.json ./
+
+# Install dependencies
+RUN npm install --only=production
+
+# Copy application code
+COPY . .
+
+# Expose API port
+EXPOSE 8080
+
+# Set environment
+ENV NODE_ENV=production
+ENV API_PORT=8080
+
+# Run API server
+CMD ["node", "api-server.js"]

package/web/__tests__/api/workflow-history.test.js

@@ -1,11 +1,13 @@
-const request = require('supertest');
-const express = require('express');
+import { test, describe } from 'node:test';
+import assert from 'node:assert';
+import request from 'supertest';
+import express from 'express';
 
 describe('Workflow History API', () => {
     let app;
     let server;
 
-    beforeAll(() => {
+    test('setup app', () => {
         // Mock Express app for testing
         app = express();
         app.use(express.json());
@@ -40,9 +42,9 @@ describe('Workflow History API', () => {
             .get('/api/workflow/history')
             .expect(200);
 
-        expect(response.body).toHaveProperty('history');
-        expect(Array.isArray(response.body.history)).toBe(true);
-        expect(response.body.history.length).toBeGreaterThan(0);
+        assert(response.body.history, 'History property should exist');
+        assert(Array.isArray(response.body.history), 'History should be an array');
+        assert(response.body.history.length > 0, 'History should not be empty');
     });
 
     test('History items have required fields', async () => {
@@ -51,11 +53,11 @@ describe('Workflow History API', () => {
             .expect(200);
 
         const item = response.body.history[0];
-        expect(item).toHaveProperty('id');
-        expect(item).toHaveProperty('task_type');
-        expect(item).toHaveProperty('description');
-        expect(item).toHaveProperty('commit_message');
-        expect(item).toHaveProperty('completed_at');
-        expect(item).toHaveProperty('tests_passed');
+        assert(item.id, 'Item should have id');
+        assert(item.task_type, 'Item should have task_type');
+        assert(item.description, 'Item should have description');
+        assert(item.commit_message, 'Item should have commit_message');
+        assert(item.completed_at, 'Item should have completed_at');
+        assert(item.tests_passed !== undefined, 'Item should have tests_passed');
     });
 });

package/web/api-server.js

@@ -0,0 +1,211 @@
+import express from 'express';
+import cors from 'cors';
+import pg from 'pg';
+import dotenv from 'dotenv';
+import bcrypt from 'bcrypt';
+import jwt from 'jsonwebtoken';
+
+dotenv.config({ path: '../.env' });
+
+const app = express();
+const { Pool } = pg;
+
+const PORT = process.env.API_PORT || 8080;
+const dbUrl = process.env.DEV_WORKFLOW_DB_URL;
+const JWT_SECRET = process.env.JWT_SECRET || 'dev-workflow-jwt-secret-change-me';
+
+if (!dbUrl) {
+    console.error('❌ DEV_WORKFLOW_DB_URL is not set');
+    process.exit(1);
+}
+
+const pool = new Pool({ connectionString: dbUrl });
+
+// Authentication helper functions
+async function authenticateUser(pool, username, password) {
+    const result = await pool.query(
+        'SELECT * FROM users WHERE username = $1',
+        [username]
+    );
+
+    if (result.rows.length === 0) {
+        return null;
+    }
+
+    const user = result.rows[0];
+    const isValid = await bcrypt.compare(password, user.password_hash);
+
+    if (!isValid) {
+        return null;
+    }
+
+    return {
+        id: user.id,
+        username: user.username,
+        email: user.email,
+    };
+}
+
+async function getUserById(pool, userId) {
+    const result = await pool.query(
+        'SELECT id, username, email FROM users WHERE id = $1',
+        [userId]
+    );
+
+    return result.rows[0] || null;
+}
+
+// CORS configuration - allow Netlify domain
+const corsOptions = {
+    origin: [
+        'https://devworkflow.programinglive.com',
+        'http://localhost:3000',
+    ],
+    credentials: true,
+    methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+    allowedHeaders: ['Content-Type', 'Authorization'],
+};
+
+app.use(cors(corsOptions));
+app.use(express.json());
+app.use(express.urlencoded({ extended: true }));
+app.set('trust proxy', 1);
+
+// Middleware to verify JWT
+const requireAuth = (req, res, next) => {
+    const authHeader = req.headers.authorization;
+
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+        const token = authHeader.split(' ')[1];
+        try {
+            const decoded = jwt.verify(token, JWT_SECRET);
+            req.user = decoded;
+            return next();
+        } catch (err) {
+            return res.status(401).json({ error: 'Invalid token' });
+        }
+    }
+
+    return res.status(401).json({ error: 'Authentication required' });
+};
+
+// Health check endpoint
+app.get('/api/health', (req, res) => {
+    res.json({ status: 'ok', timestamp: new Date().toISOString() });
+});
+
+// Authentication endpoints
+app.post('/api/auth/login', async (req, res) => {
+    try {
+        const { username, password } = req.body;
+
+        if (!username || !password) {
+            return res.status(400).json({ error: 'Username and password are required' });
+        }
+
+        const user = await authenticateUser(pool, username, password);
+
+        if (!user) {
+            return res.status(401).json({ error: 'Invalid credentials' });
+        }
+
+        // Generate JWT Token
+        const token = jwt.sign(
+            { userId: user.id, username: user.username },
+            JWT_SECRET,
+            { expiresIn: '30d' }
+        );
+
+        res.json({
+            success: true,
+            token,
+            user: {
+                id: user.id,
+                username: user.username,
+                email: user.email,
+            },
+        });
+    } catch (error) {
+        console.error('Login error:', error);
+        res.status(500).json({ error: 'Internal server error' });
+    }
+});
+
+app.post('/api/auth/logout', (req, res) => {
+    // Client-side only action for JWT
+    res.json({ success: true });
+});
+
+app.get('/api/auth/me', requireAuth, async (req, res) => {
+    try {
+        const user = await getUserById(pool, req.user.userId);
+
+        if (!user) {
+            return res.status(404).json({ error: 'User not found' });
+        }
+
+        res.json({
+            id: user.id,
+            username: user.username,
+            email: user.email,
+        });
+    } catch (error) {
+        console.error('Get user error:', error);
+        res.status(500).json({ error: 'Internal server error' });
+    }
+});
+
+// Workflow history endpoints
+app.get('/api/history', requireAuth, async (req, res) => {
+    try {
+        const result = await pool.query(
+            `SELECT id, task_type, description, commit_message, completed_at, tests_passed, documentation_type
+             FROM workflow_history
+             WHERE user_id = $1
+             ORDER BY completed_at DESC
+             LIMIT 100`,
+            [req.user.userId]
+        );
+
+        res.json({
+            history: result.rows,
+        });
+    } catch (error) {
+        console.error('Get history error:', error);
+        res.status(500).json({ error: 'Failed to fetch history' });
+    }
+});
+
+app.post('/api/history', requireAuth, async (req, res) => {
+    try {
+        const { task_type, description, commit_message, tests_passed, documentation_type } = req.body;
+
+        const result = await pool.query(
+            `INSERT INTO workflow_history (user_id, task_type, description, commit_message, tests_passed, documentation_type, completed_at)
+             VALUES ($1, $2, $3, $4, $5, $6, NOW())
+             RETURNING *`,
+            [req.user.userId, task_type, description, commit_message, tests_passed, documentation_type]
+        );
+
+        res.json({
+            success: true,
+            history: result.rows[0],
+        });
+    } catch (error) {
+        console.error('Create history error:', error);
+        res.status(500).json({ error: 'Failed to create history entry' });
+    }
+});
+
+// Error handling middleware
+app.use((err, req, res, next) => {
+    console.error('Unhandled error:', err);
+    res.status(500).json({ error: 'Internal server error' });
+});
+
+// Start server
+app.listen(PORT, '0.0.0.0', () => {
+    console.log(`✅ API server running on port ${PORT}`);
+    console.log(`📊 Database: ${dbUrl.replace(/:[^:]*@/, ':****@')}`);
+    console.log(`🌐 CORS enabled for: ${corsOptions.origin.join(', ')}`);
+});

package/web/app/docs/page.tsx

@@ -22,7 +22,7 @@ export default function DocsPage() {
                     </p>
 
                     <div className="bg-emerald-50 dark:bg-emerald-500/10 border border-emerald-200 dark:border-emerald-500/20 rounded-lg p-4 mb-8">
-                        <p className="text-emerald-700 dark:text-emerald-400 font-semibold">Version: 1.7.11</p>
+                        <p className="text-emerald-700 dark:text-emerald-400 font-semibold">Version: 1.7.15</p>
                     </div>
 
                     <h2 className="text-3xl font-bold mt-12 mb-6 text-gray-900 dark:text-white">Features</h2>

package/web/app/history/page.tsx

@@ -2,6 +2,7 @@
 
 import { useEffect, useState, useMemo } from 'react';
 import { useRouter } from 'next/navigation';
+import { apiClient } from '@/lib/api-client';
 import {
     CheckCircle,
     XCircle,
@@ -34,27 +35,33 @@ export default function HistoryPage() {
     const router = useRouter();
 
     useEffect(() => {
-        fetch('/api/auth/me')
-            .then(res => {
-                if (res.ok) {
-                    setIsAuthenticated(true);
-                    // Sync auth state with Navbar
-                    localStorage.setItem('isLoggedIn', 'true');
-                    window.dispatchEvent(new Event('authUpdate'));
-                    return fetch('/api/history-fallback');
-                } else {
-                    router.push('/login');
+        const loadData = async () => {
+            try {
+                // Verify auth
+                const user = await apiClient.getCurrentUser();
+                if (!user) {
                     throw new Error('Not authenticated');
                 }
-            })
-            .then(res => res?.json())
-            .then(data => {
-                if (data?.history) {
-                    setHistory(data.history);
+
+                setIsAuthenticated(true);
+                // Sync auth state
+                localStorage.setItem('isLoggedIn', 'true');
+                window.dispatchEvent(new Event('authUpdate'));
+
+                // Fetch history
+                const result = await apiClient.getHistory();
+                if (result?.history) {
+                    setHistory(result.history);
                 }
-            })
-            .catch(() => { })
-            .finally(() => setLoading(false));
+            } catch (error) {
+                console.error('History load error:', error);
+                router.push('/login');
+            } finally {
+                setLoading(false);
+            }
+        };
+
+        loadData();
     }, [router]);
 
     const stats = useMemo(() => {

package/web/app/login/page.tsx

@@ -4,6 +4,7 @@ import { useState, useEffect } from 'react';
 import { useRouter } from 'next/navigation';
 import Image from 'next/image';
 import { Lock, User } from 'lucide-react';
+import { apiClient } from '@/lib/api-client';
 
 export default function LoginPage() {
     const [username, setUsername] = useState('');
@@ -21,9 +22,9 @@ export default function LoginPage() {
             return;
         }
 
-        fetch('/api/auth/me')
-            .then(res => {
-                if (res.ok) {
+        apiClient.getCurrentUser()
+            .then(user => {
+                if (user) {
                     router.push('/history');
                 }
             })
@@ -37,23 +38,17 @@ export default function LoginPage() {
         setLoading(true);
 
         try {
-            const response = await fetch('/api/auth/login', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ username, password }),
-            });
+            const data = await apiClient.login(username, password);
 
-            const data = await response.json();
-
-            if (response.ok) {
+            if (data.success) {
                 localStorage.setItem('isLoggedIn', 'true');
                 window.dispatchEvent(new Event('authUpdate'));
                 router.push('/history');
             } else {
-                setError(data.error || 'Login failed');
+                setError('Login failed');
             }
-        } catch (err) {
-            setError('Network error. Please try again.');
+        } catch (err: any) {
+            setError(err.message || 'Network error. Please try again.');
         } finally {
             setLoading(false);
         }
@@ -77,6 +72,9 @@ export default function LoginPage() {
                     <p className="mt-2 text-sm text-gray-500 dark:text-gray-400">
                         Sign in to access your workflow history
                     </p>
+                    <p className="mt-1 text-xs text-gray-400 font-mono">
+                        v1.7.15
+                    </p>
                 </div>
 
                 <form className="mt-8 space-y-6" onSubmit={handleSubmit}>

package/web/components/Hero.tsx

@@ -17,7 +17,7 @@ export default function Hero() {
             .catch(() => setDownloads(null));
 
         // Version is hardcoded for static export
-        setVersion("1.7.11");
+        setVersion("1.7.15");
     }, []);
 
     const formatDownloads = (num: number) => {

package/web/components/History.tsx

@@ -1,6 +1,7 @@
 "use client";
 
 import { useState, useEffect } from "react";
+import { apiClient } from "@/lib/api-client";
 
 type HistoryItem = {
     id: number;
@@ -31,11 +32,10 @@ export default function History() {
 
     const loadData = async () => {
         try {
-            // Fetch workflow history from API
-            const response = await fetch('/api/workflow/history');
+            // Fetch workflow history from API via apiClient
+            const data = await apiClient.getHistory();
 
-            if (response.ok) {
-                const data = await response.json();
+            if (data?.history) {
                 setHistory(data.history || []);
                 setTotalPages(Math.ceil((data.history?.length || 0) / 10));
                 setSummary({

package/web/components/Navbar.tsx

@@ -4,6 +4,7 @@ import { useState, useEffect } from "react";
 import Link from "next/link";
 import { Github, Menu, X, Moon, Sun, LogOut } from "lucide-react";
 import Image from "next/image";
+import { apiClient } from "@/lib/api-client";
 
 export default function Navbar() {
     const [isOpen, setIsOpen] = useState(false);
@@ -29,18 +30,16 @@ export default function Navbar() {
             const mightBeLoggedIn = localStorage.getItem('isLoggedIn') === 'true';
 
             if (mightBeLoggedIn) {
-                fetch('/api/auth/me')
-                    .then(res => {
-                        if (res.ok) {
-                            return res.json();
-                        }
-                        throw new Error('Not authenticated');
-                    })
+                apiClient.getCurrentUser()
                     .then(data => {
-                        setIsAuthenticated(true);
-                        setUsername(data.user?.username || 'User');
-                        // Ensure local storage is in sync
-                        localStorage.setItem('isLoggedIn', 'true');
+                        if (data) {
+                            setIsAuthenticated(true);
+                            setUsername(data.username || 'User');
+                            // Ensure local storage is in sync
+                            localStorage.setItem('isLoggedIn', 'true');
+                        } else {
+                            throw new Error('Not authenticated');
+                        }
                     })
                     .catch(() => {
                         // Session invalid/expired
@@ -74,7 +73,7 @@ export default function Navbar() {
 
     const handleLogout = async () => {
         try {
-            await fetch('/api/auth/logout', { method: 'POST' });
+            await apiClient.logout();
             localStorage.removeItem('isLoggedIn');
             setIsAuthenticated(false);
             setUsername(null);