plum-e2e 2.6.8 → 2.7.1

package/backend/routes/active-runs.routes.js

@@ -0,0 +1,18 @@
+/*
+ * This file is part of Plum.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
+ */
+
+const express = require('express');
+const router = express.Router();
+const activeRunsService = require('../services/activeRunsService');
+const { jwtAuth } = require('../middleware/jwtAuth');
+
+// Runs carry a real user's display name (`startedBy`) — gate this the same way as
+// other identity-bearing routes (test-suites, test-runs, users), not left open like
+// the purely operational GET routes (reports, tests) that never touch user identity.
+router.get('/', jwtAuth, (req, res) => {
+	res.json({ runs: activeRunsService.listActiveRuns() });
+});
+
+module.exports = router;

package/backend/routes/auth.routes.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');

package/backend/routes/backup.routes.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');
@@ -21,9 +9,10 @@ const backupService = require('../services/backupService');
 const settingsService = require('../services/settingsService');
 const cronService = require('../services/cronService');
 const backupCronService = require('../services/backupCronService');
-const prisma = require('../services/prisma');
+const { jwtAuth } = require('../middleware/jwtAuth');
+const { requireAdmin } = require('../middleware/requireAdmin');
 
-router.get('/export', async (req, res) => {
+router.get('/export', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		const data = await backupService.exportAll();
 		const fileName = `plum-backup-${new Date().toISOString().slice(0, 10)}.json`;
@@ -36,7 +25,7 @@ router.get('/export', async (req, res) => {
 	}
 });
 
-router.post('/import', async (req, res) => {
+router.post('/import', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		const { cronJobs, project, users, runners, testSuites, testRuns } = req.body;
 		const hasData = [cronJobs, project, users, runners, testSuites, testRuns].some(
@@ -54,7 +43,7 @@ router.post('/import', async (req, res) => {
 	}
 });
 
-router.get('/config', async (req, res) => {
+router.get('/config', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		const config = await settingsService.getBackupConfig();
 		res.json(config);
@@ -64,7 +53,7 @@ router.get('/config', async (req, res) => {
 	}
 });
 
-router.post('/config', async (req, res) => {
+router.post('/config', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		await settingsService.updateBackupConfig(req.body);
 		await backupCronService.reload();
@@ -76,12 +65,12 @@ router.post('/config', async (req, res) => {
 	}
 });
 
-router.post('/test-s3', async (req, res) => {
+router.post('/test-s3', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		// If no secret key provided in the request, fall back to the stored one
 		let config = { ...req.body };
 		if (!config.backupS3SecretKey) {
-			const stored = await prisma.project.findUnique({ where: { id: 1 } });
+			const stored = await settingsService.getProjectRaw();
 			config.backupS3SecretKey = stored?.backupS3SecretKey ?? '';
 		}
 
@@ -98,7 +87,7 @@ router.post('/test-s3', async (req, res) => {
 	}
 });
 
-router.post('/run-now', async (req, res) => {
+router.post('/run-now', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		await backupCronService.runBackup();
 		const config = await settingsService.getBackupConfig();

package/backend/routes/cron.routes.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');

package/backend/routes/node.routes.js

@@ -1,35 +1,13 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');
 const router = express.Router();
-const { spawn } = require('child_process');
-const crypto = require('crypto');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
 const { authGuard } = require('../middleware/auth');
-const { TRIGGER_REMOTE } = require('../constants/triggers');
-
-const BACKEND_DIR = path.resolve(__dirname, '..');
-
-// In-memory job store for active remote executions.
-// Jobs are purged after 10 minutes post-completion.
-const jobs = {};
+const { isNodeMode, DEFAULT_PORT } = require('../constants/env');
+const nodeExecutionService = require('../services/nodeExecutionService');
 
 // Health check — primary server uses this to confirm the node is reachable
 router.get('/ping', authGuard, (req, res) => {
@@ -38,7 +16,7 @@ router.get('/ping', authGuard, (req, res) => {
 
 // Graceful shutdown for node-mode processes (no-op on the primary server)
 router.post('/shutdown', authGuard, (req, res) => {
-	if (process.env.PLUM_MODE !== 'node') {
+	if (!isNodeMode()) {
 		return res.status(403).json({ error: 'Not a node runner' });
 	}
 	res.json({ ok: true });
@@ -50,7 +28,7 @@ router.post('/shutdown', authGuard, (req, res) => {
 // binds the same port, retrying past the brief EADDRINUSE window left by this
 // process shutting down (see the listen retry in server.js).
 router.post('/restart', authGuard, (req, res) => {
-	if (process.env.PLUM_MODE !== 'node') {
+	if (!isNodeMode()) {
 		return res.status(403).json({ error: 'Not a node runner' });
 	}
 	const id = process.env.RUNNER_ID;
@@ -60,128 +38,20 @@ router.post('/restart', authGuard, (req, res) => {
 	res.json({ ok: true });
 	setTimeout(() => {
 		const { startNode } = require('../lib/runnerProcess');
-		startNode({ id, port: process.env.PORT || '3001', token: process.env.NODE_TOKEN });
+		startNode({ id, port: process.env.PORT || DEFAULT_PORT, token: process.env.NODE_TOKEN });
 		process.exit(0);
 	}, 200);
 });
 
 // Start a remote test job
 router.post('/execute', authGuard, (req, res) => {
-	const { tags, browser = 'chromium', workers = 1, tests = null, env: userEnv = {} } = req.body;
-	const jobId = crypto.randomUUID();
-
-	// path.resolve ensures absolute even if TMPDIR env var is set to a relative path
-	const tmpdir = path.resolve(os.tmpdir());
-
-	// Write test files sent by the primary into a per-job temp dir
-	let tempTestsDir = null;
-	if (tests && Object.keys(tests).length > 0) {
-		tempTestsDir = path.join(tmpdir, `plum-job-${jobId}`);
-		for (const [rel, content] of Object.entries(tests)) {
-			const dest = path.join(tempTestsDir, rel);
-			fs.mkdirSync(path.dirname(dest), { recursive: true });
-			fs.writeFileSync(dest, Buffer.from(content, 'base64'));
-		}
-	}
-
-	// Each job writes to its own temp file so concurrent jobs on the same node
-	// cannot clobber each other's reports (shared cucumber_report.json race condition).
-	const reportFile = path.join(tmpdir, `plum-report-${jobId}.json`);
-	const ssDir = path.join(tmpdir, `plum-ss-${jobId}`);
-	fs.mkdirSync(ssDir, { recursive: true });
-
-	jobs[jobId] = {
-		status: 'running',
-		logs: '',
-		exitCode: null,
-		startedAt: Date.now(),
-		meta: { tags: tags || '', browser, workers },
-		tempTestsDir,
-		reportFile,
-		ssDir,
-		pendingScreenshots: []
-	};
-
-	const env = {
-		...process.env,
-		// User/test vars (BASE_URL, IS_HEADLESS, custom secrets) forwarded from the
-		// primary's own .env — nodes are stateless runners and shouldn't need their
-		// own copy. Spread before the job-control vars below so a stray same-named
-		// var in the user's .env can never override how this job actually runs.
-		...userEnv,
-		TAG: tags || '',
-		TRIGGER: TRIGGER_REMOTE,
-		BROWSER: browser,
-		REPORT_RUNNERS: String(workers),
-		CUCUMBER_REPORT_FILE: reportFile,
-		PLUM_SS_DIR: ssDir,
-		...(tempTestsDir ? { TESTS_ROOT: tempTestsDir } : {})
-	};
-	if (workers > 1) env.PARALLEL = String(workers);
-
-	const seenSsFiles = new Set();
-	const ssPoller = setInterval(() => {
-		const job = jobs[jobId];
-		if (!job) {
-			clearInterval(ssPoller);
-			return;
-		}
-		try {
-			const files = fs
-				.readdirSync(ssDir)
-				.filter((f) => f.endsWith('.ss.json'))
-				.sort();
-			for (const f of files) {
-				if (seenSsFiles.has(f)) continue;
-				seenSsFiles.add(f);
-				const filePath = path.join(ssDir, f);
-				const data = JSON.parse(fs.readFileSync(filePath, 'utf8'));
-				job.pendingScreenshots.push(data);
-				try {
-					fs.unlinkSync(filePath);
-				} catch {}
-			}
-		} catch {}
-	}, 400);
-
-	const proc = spawn('npm', ['run', 'test'], { env, shell: true, cwd: BACKEND_DIR });
-	proc.stdout.on('data', (d) => {
-		jobs[jobId].logs += d.toString();
-	});
-	proc.stderr.on('data', (d) => {
-		jobs[jobId].logs += d.toString();
-	});
-	proc.on('close', (code) => {
-		clearInterval(ssPoller);
-		jobs[jobId].status = code === 0 ? 'done' : 'error';
-		jobs[jobId].exitCode = code;
-
-		try {
-			if (fs.existsSync(reportFile)) {
-				jobs[jobId].reportContent = fs.readFileSync(reportFile, 'utf8');
-			}
-		} catch {}
-
-		fs.rm(ssDir, { recursive: true, force: true }, () => {});
-
-		if (jobs[jobId].tempTestsDir) {
-			fs.rm(jobs[jobId].tempTestsDir, { recursive: true, force: true }, () => {});
-		}
-
-		setTimeout(() => {
-			try {
-				fs.unlinkSync(reportFile);
-			} catch {}
-			delete jobs[jobId];
-		}, 600_000);
-	});
-
+	const jobId = nodeExecutionService.startJob(req.body);
 	res.json({ jobId, status: 'started' });
 });
 
 // Fetch the final report content after a job completes
 router.get('/report/:jobId', authGuard, (req, res) => {
-	const job = jobs[req.params.jobId];
+	const job = nodeExecutionService.getJob(req.params.jobId);
 	if (!job) return res.status(404).json({ error: 'Job not found' });
 	if (!job.reportContent) return res.status(404).json({ error: 'Report not ready' });
 	res.json({ content: job.reportContent, meta: job.meta });
@@ -189,17 +59,10 @@ router.get('/report/:jobId', authGuard, (req, res) => {
 
 // Poll job status and streamed logs
 router.get('/execute/:jobId', authGuard, (req, res) => {
-	const job = jobs[req.params.jobId];
-	if (!job) return res.status(404).json({ error: 'Job not found' });
-
 	const offset = parseInt(req.query.offset || '0', 10);
-	const screenshots = job.pendingScreenshots.splice(0);
-	res.json({
-		status: job.status,
-		logs: job.logs.slice(offset),
-		exitCode: job.exitCode,
-		screenshots
-	});
+	const result = nodeExecutionService.pollJob(req.params.jobId, offset);
+	if (!result) return res.status(404).json({ error: 'Job not found' });
+	res.json(result);
 });
 
 module.exports = router;

package/backend/routes/reports.routes.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');

package/backend/routes/runners.routes.js

@@ -1,25 +1,15 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');
 const router = express.Router();
 const runnerService = require('../services/runnerService');
+const { jwtAuth } = require('../middleware/jwtAuth');
+const { requireAdmin } = require('../middleware/requireAdmin');
 
-router.get('/', async (req, res) => {
+router.get('/', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		const runners = await runnerService.getAll();
 		res.json({ runners });
@@ -28,7 +18,7 @@ router.get('/', async (req, res) => {
 	}
 });
 
-router.post('/probe', async (req, res) => {
+router.post('/probe', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		const { url, token } = req.body;
 		if (!url || !token)
@@ -40,7 +30,7 @@ router.post('/probe', async (req, res) => {
 	}
 });
 
-router.post('/', async (req, res) => {
+router.post('/', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		const { name, url, token, browser } = req.body;
 		if (!name || !url || !token)
@@ -52,7 +42,7 @@ router.post('/', async (req, res) => {
 	}
 });
 
-router.put('/:id', async (req, res) => {
+router.put('/:id', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		const { name, url, token, browser } = req.body;
 		const runner = await runnerService.update(req.params.id, { name, url, token, browser });
@@ -62,7 +52,7 @@ router.put('/:id', async (req, res) => {
 	}
 });
 
-router.delete('/:id', async (req, res) => {
+router.delete('/:id', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		await runnerService.stop(req.params.id);
 		await runnerService.remove(req.params.id);
@@ -72,7 +62,7 @@ router.delete('/:id', async (req, res) => {
 	}
 });
 
-router.post('/:id/ping', async (req, res) => {
+router.post('/:id/ping', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		const result = await runnerService.ping(req.params.id);
 		res.json(result);
@@ -81,7 +71,7 @@ router.post('/:id/ping', async (req, res) => {
 	}
 });
 
-router.post('/:id/stop', async (req, res) => {
+router.post('/:id/stop', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		const result = await runnerService.stop(req.params.id);
 		res.json(result);
@@ -90,7 +80,7 @@ router.post('/:id/stop', async (req, res) => {
 	}
 });
 
-router.post('/:id/restart', async (req, res) => {
+router.post('/:id/restart', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		const result = await runnerService.restart(req.params.id);
 		res.json(result);

package/backend/routes/settings.routes.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');
@@ -21,8 +9,9 @@ const settingsService = require('../services/settingsService');
 const testSuiteService = require('../services/testSuiteService');
 const testCaseService = require('../services/testCaseService');
 const { jwtAuth } = require('../middleware/jwtAuth');
+const { requireAdmin } = require('../middleware/requireAdmin');
 
-router.get('/project', async (req, res, next) => {
+router.get('/project', jwtAuth, requireAdmin, async (req, res, next) => {
 	try {
 		const project = await settingsService.getProject();
 		res.json(project);
@@ -31,7 +20,7 @@ router.get('/project', async (req, res, next) => {
 	}
 });
 
-router.post('/project', async (req, res, next) => {
+router.post('/project', jwtAuth, requireAdmin, async (req, res, next) => {
 	try {
 		const { name, logoUrl, timezone, maxRetries } = req.body;
 		const project = await settingsService.updateProject({ name, logoUrl, timezone, maxRetries });
@@ -76,7 +65,7 @@ router.post('/test-prefixes/migrate', jwtAuth, async (req, res, next) => {
 	}
 });
 
-router.get('/integrations', async (req, res, next) => {
+router.get('/integrations', jwtAuth, requireAdmin, async (req, res, next) => {
 	try {
 		const webhooks = await settingsService.getWebhooks();
 		res.json(webhooks);
@@ -85,7 +74,7 @@ router.get('/integrations', async (req, res, next) => {
 	}
 });
 
-router.post('/integrations', async (req, res, next) => {
+router.post('/integrations', jwtAuth, requireAdmin, async (req, res, next) => {
 	try {
 		const { discordWebhookUrl, slackWebhookUrl, notifyPublicUrl } = req.body;
 		const project = await settingsService.updateWebhooks({

package/backend/routes/test-cases.routes.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');

package/backend/routes/test-runs.routes.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');

package/backend/routes/test-suites.routes.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');

package/backend/routes/tests.routes.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');