@sdods/core 0.2.0 → 0.2.2

package/dist/analyze/modules.js

@@ -199,20 +199,52 @@ export function detectModules(report, opts = {}) {
         // S2 workspace (0.9)
         const ws = longestWorkspaceMatch(r.file, workspaces);
         if (ws) {
-            cast({ target: r.path, kind, module: ws, weight: SIGNAL_WEIGHTS.workspace, signal: 'workspace', layer, evidence: ev });
+            cast({
+                target: r.path,
+                kind,
+                module: ws,
+                weight: SIGNAL_WEIGHTS.workspace,
+                signal: 'workspace',
+                layer,
+                evidence: ev,
+            });
         }
         // S3 domain-dir (0.8)
         const dd = DOMAIN_DIR_RE.exec(r.file.replace(/\\/g, '/'));
         if (dd?.[1] && !GENERIC_DIRS.has(dd[1].toLowerCase())) {
-            cast({ target: r.path, kind, module: slugify(dd[1]), weight: SIGNAL_WEIGHTS['domain-dir'], signal: 'domain-dir', layer, evidence: ev });
+            cast({
+                target: r.path,
+                kind,
+                module: slugify(dd[1]),
+                weight: SIGNAL_WEIGHTS['domain-dir'],
+                signal: 'domain-dir',
+                layer,
+                evidence: ev,
+            });
         }
         // S4 source-file (0.7) - the primary signal
         const mf = moduleOfFile(r.file);
         if (mf) {
-            cast({ target: r.path, kind, module: mf, weight: SIGNAL_WEIGHTS['source-file'], signal: 'source-file', layer, evidence: ev });
+            cast({
+                target: r.path,
+                kind,
+                module: mf,
+                weight: SIGNAL_WEIGHTS['source-file'],
+                signal: 'source-file',
+                layer,
+                evidence: ev,
+            });
         }
         // S5 route-segment (0.3) - today's rule, kept as the floor so nothing goes unassigned
-        cast({ target: r.path, kind, module: moduleOfPath(r.path), weight: SIGNAL_WEIGHTS['route-segment'], signal: 'route-segment', layer, evidence: ev });
+        cast({
+            target: r.path,
+            kind,
+            module: moduleOfPath(r.path),
+            weight: SIGNAL_WEIGHTS['route-segment'],
+            signal: 'route-segment',
+            layer,
+            evidence: ev,
+        });
     }
     // resolve: strongest vote per target
     const winners = new Map();
@@ -224,8 +256,15 @@ export function detectModules(report, opts = {}) {
     // build modules
     const acc = new Map();
     for (const v of winners.values()) {
-        const m = acc.get(v.module) ??
-            { routes: new Set(), endpoints: new Set(), layers: new Set(), signals: new Set(), evidence: [], weights: [], contract: false };
+        const m = acc.get(v.module) ?? {
+            routes: new Set(),
+            endpoints: new Set(),
+            layers: new Set(),
+            signals: new Set(),
+            evidence: [],
+            weights: [],
+            contract: false,
+        };
         if (v.kind === 'endpoint')
             m.endpoints.add(v.target);
         else

package/dist/auth/capture.js

@@ -148,7 +148,8 @@ export async function captureAuth(opts) {
                 const token = await strategy.token({ config, user });
                 if (token) {
                     const file = tokenFileFor(config, user);
-                    writeFileSync(file, JSON.stringify({ token, capturedAt: new Date().toISOString(), user: user.username, role: user.role }, null, 2));
+                    // Owner-only: this holds a usable API token for the application under test.
+                    writeFileSync(file, JSON.stringify({ token, capturedAt: new Date().toISOString(), user: user.username, role: user.role }, null, 2), { mode: 0o600 });
                     result.tokenFile = file;
                 }
             }

package/dist/auth/index.js

@@ -1,3 +1,5 @@
+import { mkdirSync } from 'node:fs';
+import { join } from 'node:path';
 /**
  * Define the project's auth strategy. `form` uses `auth.form` selectors from the project yaml
  * unless a custom `login` is provided.
@@ -71,16 +73,52 @@ export async function formLogin(page, config, user) {
     if (!form) {
         throw new Error('auth.strategy is "form" but auth.form selectors are missing in sdods.project.yaml.');
     }
-    await page.goto(form.loginPath);
-    await page.locator(form.usernameSelector).fill(user.username);
-    await page.locator(form.passwordSelector).fill(user.password);
-    await page.locator(form.submitSelector).click();
-    if (form.readySelector)
-        await page.locator(form.readySelector).first().waitFor({ state: 'visible' });
-    else if (form.readyUrl)
-        await page.waitForURL(`**${form.readyUrl}*`);
-    else
-        await page.waitForLoadState('domcontentloaded');
+    try {
+        await page.goto(form.loginPath);
+        await page.locator(form.usernameSelector).fill(user.username);
+        await page.locator(form.passwordSelector).fill(user.password);
+        await page.locator(form.submitSelector).click();
+        if (form.readySelector)
+            await page.locator(form.readySelector).first().waitFor({ state: 'visible' });
+        else if (form.readyUrl)
+            await page.waitForURL(`**${form.readyUrl}*`);
+        else
+            await page.waitForLoadState('domcontentloaded');
+    }
+    catch (cause) {
+        throw await describeLoginFailure(page, config, user, cause);
+    }
+}
+/**
+ * The form login runs in its own context (see `defineAuth`), so Playwright's video/trace/screenshot
+ * settings never attach to it — a failure here would otherwise surface as a bare locator timeout
+ * with no artifact. Name the page we actually landed on, and leave a screenshot behind.
+ */
+async function describeLoginFailure(page, config, user, cause) {
+    let where = '';
+    let shot = '';
+    try {
+        const url = page.url();
+        const title = await page.title();
+        where = ` at ${url}${title ? ` (title: ${JSON.stringify(title)})` : ''}`;
+    }
+    catch {
+        // page already closed or crashed — the original error is still worth reporting
+    }
+    try {
+        const dir = join(config.runtime.runDir, 'auth');
+        mkdirSync(dir, { recursive: true });
+        const file = join(dir, `login-failed-${user.role}-${user.username}.png`.replace(/\s+/g, '_'));
+        await page.screenshot({ path: file, fullPage: true });
+        shot = `\nScreenshot: ${file}`;
+    }
+    catch {
+        // screenshotting is best effort
+    }
+    const reason = cause instanceof Error ? cause.message : String(cause);
+    return new Error(`Form login for ${user.username} (${user.role}) failed${where}.\n${reason}` +
+        `\nIs the application under test running at ${config.env.ui.baseUrl}, and does that page ` +
+        `use the auth.form selectors in sdods.project.yaml?${shot}`, { cause });
 }
 export const noopAuth = defineAuth({ strategy: 'none' });
 //# sourceMappingURL=index.js.map

package/dist/config/runner.js

@@ -236,6 +236,9 @@ export function buildRunnerConfig(registry, sel = {}) {
             trace: 'on-first-retry',
             actionTimeout: timeouts.action,
             navigationTimeout: timeouts.navigation,
+            // Playwright's own `--headed` flag still wins on the CLI; this is what makes the documented
+            // SDODS_HEADED env var and the --headed CliOverride reach the browser at all.
+            headless: !first?.runtime.headed,
         },
         projects,
         metadata: {

package/dist/fixtures/auth.d.ts

@@ -39,7 +39,15 @@ export declare class AuthStateCache {
     private readState;
     /** Return a fresh storageState path for the user, capturing it with the strategy when needed. */
     ensure(user: PoolUserLike, auth: AuthStrategy, browser: Browser): Promise<string | undefined>;
-    /** Atomic save: temp file + rename, sidecar written last. */
+    /**
+     * Atomic save: temp file + rename, sidecar written last.
+     *
+     * Written owner-only. This file is a live session for the application under test — cookies and
+     * localStorage, replayable as-is — and it used to land world-readable (0644 in a 0755
+     * directory), so any other account on the machine could lift it. Encryption is not the control
+     * here: the state has to be decryptable to be replayed, so a key would have to sit on the same
+     * disk. Restricting access is what actually protects it.
+     */
     save(user: PoolUserLike, state: Record<string, unknown>): string;
     /** Apply a cached state to a live context/page (step path: cookies + localStorage). */
     apply(args: {

package/dist/fixtures/auth.js

@@ -92,15 +92,23 @@ export class AuthStateCache {
             return this.save(user, state);
         });
     }
-    /** Atomic save: temp file + rename, sidecar written last. */
+    /**
+     * Atomic save: temp file + rename, sidecar written last.
+     *
+     * Written owner-only. This file is a live session for the application under test — cookies and
+     * localStorage, replayable as-is — and it used to land world-readable (0644 in a 0755
+     * directory), so any other account on the machine could lift it. Encryption is not the control
+     * here: the state has to be decryptable to be replayed, so a key would have to sit on the same
+     * disk. Restricting access is what actually protects it.
+     */
     save(user, state) {
-        mkdirSync(this.dir, { recursive: true });
+        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
         const file = this.fileFor(user);
         const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-        writeFileSync(tmp, JSON.stringify(state, null, 2));
+        writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 0o600 });
         renameSync(tmp, file);
         const sideTmp = `${this.sidecarFor(user)}.${process.pid}.tmp`;
-        writeFileSync(sideTmp, JSON.stringify({ capturedAt: new Date().toISOString(), user: user.username, role: user.role }, null, 2));
+        writeFileSync(sideTmp, JSON.stringify({ capturedAt: new Date().toISOString(), user: user.username, role: user.role }, null, 2), { mode: 0o600 });
         renameSync(sideTmp, this.sidecarFor(user));
         return file;
     }
@@ -147,7 +155,7 @@ export class AuthStateCache {
      * LOCK_STALE_MS is treated as abandoned by a crashed worker.
      */
     async withLock(user, fn) {
-        mkdirSync(this.dir, { recursive: true });
+        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
         const lock = this.lockFor(user);
         const deadline = Date.now() + LOCK_STALE_MS * 2;
         for (;;) {

package/dist/har/api-har.d.ts

@@ -63,6 +63,7 @@ export interface HarFile {
         entries: SdodsHarEntry[];
     };
 }
+export declare const SECRET_HEADER: RegExp;
 export declare function normalizeUrl(url: string): string;
 export declare function bodyHash(body: unknown): string;
 export declare function harKey(method: string, url: string, body?: unknown): string;

package/dist/har/api-har.js

@@ -3,7 +3,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { redact } from '../logger.js';
 import { VERSION } from '../version.js';
-const SECRET_HEADER = /^(authorization|cookie|set-cookie|x-api-key|proxy-authorization)$/i;
+export const SECRET_HEADER = /^(authorization|cookie|set-cookie|x-api-key|proxy-authorization)$/i;
 const VOLATILE_QUERY = /^(_|t|ts|timestamp|nonce|cb|cache)$/i;
 export function normalizeUrl(url) {
     let u;

package/dist/har/index.d.ts

@@ -1,4 +1,5 @@
 export * from './paths.js';
 export * from './api-har.js';
 export * from './hooks.js';
+export * from './scrub.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/har/index.js

@@ -1,4 +1,5 @@
 export * from './paths.js';
 export * from './api-har.js';
 export * from './hooks.js';
+export * from './scrub.js';
 //# sourceMappingURL=index.js.map

package/dist/har/scrub.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Strip credentials out of a HAR recorded by the browser.
+ *
+ * The API layer builds its own HAR and redacts secret headers as it goes. The browser layer does
+ * not: Playwright's `routeFromHAR({ update: true })` writes the file itself, verbatim, including
+ * the `Cookie`, `Set-Cookie` and `Authorization` headers of the application under test. HARs are
+ * meant to be committed — the demo project's are in git — so recording against a real application
+ * while signed in wrote a live session into a tracked file.
+ *
+ * Values are replaced rather than the headers removed, so replay still matches on their presence.
+ */
+export declare function scrubHar(har: unknown): {
+    changed: number;
+};
+/** Scrub a HAR file in place. Returns how many values were replaced, or -1 if it is not readable. */
+export declare function scrubHarFile(file: string): number;
+//# sourceMappingURL=scrub.d.ts.map

package/dist/har/scrub.js

@@ -0,0 +1,60 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { SECRET_HEADER } from './api-har.js';
+/**
+ * Strip credentials out of a HAR recorded by the browser.
+ *
+ * The API layer builds its own HAR and redacts secret headers as it goes. The browser layer does
+ * not: Playwright's `routeFromHAR({ update: true })` writes the file itself, verbatim, including
+ * the `Cookie`, `Set-Cookie` and `Authorization` headers of the application under test. HARs are
+ * meant to be committed — the demo project's are in git — so recording against a real application
+ * while signed in wrote a live session into a tracked file.
+ *
+ * Values are replaced rather than the headers removed, so replay still matches on their presence.
+ */
+export function scrubHar(har) {
+    let changed = 0;
+    const entries = har?.log?.entries;
+    if (!Array.isArray(entries))
+        return { changed };
+    for (const entry of entries) {
+        for (const side of ['request', 'response']) {
+            const headers = entry[side]?.headers;
+            if (!Array.isArray(headers))
+                continue;
+            for (const h of headers) {
+                if (h && typeof h.name === 'string' && SECRET_HEADER.test(h.name) && h.value !== '***') {
+                    h.value = '***';
+                    changed++;
+                }
+            }
+        }
+        // Playwright also records cookies as structured arrays alongside the headers.
+        for (const side of ['request', 'response']) {
+            const cookies = entry[side]?.cookies;
+            if (!Array.isArray(cookies))
+                continue;
+            for (const c of cookies) {
+                if (c && typeof c.value === 'string' && c.value !== '***') {
+                    c.value = '***';
+                    changed++;
+                }
+            }
+        }
+    }
+    return { changed };
+}
+/** Scrub a HAR file in place. Returns how many values were replaced, or -1 if it is not readable. */
+export function scrubHarFile(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        return -1;
+    }
+    const { changed } = scrubHar(parsed);
+    if (changed > 0)
+        writeFileSync(file, `${JSON.stringify(parsed, null, 2)}\n`);
+    return changed;
+}
+//# sourceMappingURL=scrub.js.map

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.2.0";
+export declare const VERSION = "0.2.2";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = '0.2.0';
+export const VERSION = '0.2.2';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdods/core",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "SDODS runtime: configuration, project registry, fixtures, step libraries, data providers, screenshot narratives and self-healing locators.",
   "license": "Apache-2.0",
   "author": "SDODS <admin@sdods.com>",
@@ -42,7 +42,7 @@
     "playwright-bdd": ">=9"
   },
   "dependencies": {
-    "@sdods/contracts": "0.2.0",
+    "@sdods/contracts": "0.2.2",
     "@cucumber/gherkin": "^42.0.1",
     "@cucumber/messages": "^34.2.1",
     "@faker-js/faker": "^10.6.0",
@@ -59,7 +59,7 @@
     "ts-morph": "^28.0.0",
     "yaml": "^2.9.0",
     "zod": "^4.5.4",
-    "@sdods/db": "0.2.0"
+    "@sdods/db": "0.2.2"
   },
   "homepage": "https://sdods.com",
   "bugs": {