plum-e2e 2.6.8 → 2.7.1

package/backend/services/runnerService.js

@@ -1,35 +1,43 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const fs = require('fs');
 const path = require('path');
 const prisma = require('./prisma');
 const { loadTestEnv } = require('../lib/testEnv');
+const { BUILT_IN_RUNNER_ID } = require('../constants/triggers');
+const { DEFAULT_BROWSER } = require('../constants/defaults');
+const { bearerHeader } = require('../lib/authHeader');
+const { JOB_STATUS } = require('../constants/jobStatus');
 
 // ---------------------------------------------------------------------------
 // Runner CRUD
 // ---------------------------------------------------------------------------
 
-const getAll = () => prisma.runner.findMany({ orderBy: { createdAt: 'asc' } });
+// Strips the auth token before a runner row crosses the HTTP boundary — the
+// token is only ever needed internally (ping/stop/restart/dispatch below all
+// read it via getById, whose result never reaches a client directly).
+function toPublicRunner(runner) {
+	if (!runner) return runner;
+	const { token, ...safe } = runner;
+	return { ...safe, tokenSet: Boolean(token) };
+}
+
+const getAll = async () => {
+	const runners = await prisma.runner.findMany({ orderBy: { createdAt: 'asc' } });
+	return runners.map(toPublicRunner);
+};
 
 const normaliseUrl = (url) => (url ?? '').replace(/\/+$/, '');
 
-const create = ({ name, url, token, browser = 'chromium' }) =>
-	prisma.runner.create({ data: { name, url: normaliseUrl(url), token, browser } });
+const create = async ({ name, url, token, browser = DEFAULT_BROWSER }) => {
+	const runner = await prisma.runner.create({
+		data: { name, url: normaliseUrl(url), token, browser }
+	});
+	return toPublicRunner(runner);
+};
 
 async function remove(id) {
 	// Scrub the deleted runner from any cron job's runnerIds string before
@@ -42,18 +50,29 @@ async function remove(id) {
 			.filter((s) => s && s !== id);
 		await prisma.cronJob.update({
 			where: { id: job.id },
-			data: { runnerIds: ids.length > 0 ? ids.join(',') : 'built-in' }
+			data: { runnerIds: ids.length > 0 ? ids.join(',') : BUILT_IN_RUNNER_ID }
 		});
 	}
 	return prisma.runner.delete({ where: { id } });
 }
 
-const update = (id, data) =>
-	prisma.runner.update({
+// Leaving `token` blank keeps the existing one (same pattern as the S3 backup
+// secret key) instead of clearing a runner's auth on an unrelated edit.
+const update = async (id, { name, url, token, browser }) => {
+	const runner = await prisma.runner.update({
 		where: { id },
-		data: { ...data, ...(data.url && { url: normaliseUrl(data.url) }) }
+		data: {
+			...(name !== undefined && { name }),
+			...(url !== undefined && { url: normaliseUrl(url) }),
+			...(token && { token }),
+			...(browser !== undefined && { browser })
+		}
 	});
+	return toPublicRunner(runner);
+};
 
+// Raw accessor (includes token) — internal use only, for authenticating
+// outbound requests to the runner node (ping/stop/restart/dispatch below).
 const getById = (id) => prisma.runner.findUnique({ where: { id } });
 
 // ---------------------------------------------------------------------------
@@ -65,7 +84,7 @@ async function probe({ url, token }) {
 	try {
 		const res = await fetch(`${url}/api/ping`, {
 			method: 'GET',
-			headers: { Authorization: `Bearer ${token}` },
+			headers: bearerHeader(token),
 			signal: AbortSignal.timeout(5000)
 		});
 		if (!res.ok) return { ok: false, error: `HTTP ${res.status}` };
@@ -95,7 +114,7 @@ async function callControlEndpoint(id, endpoint, timeoutMs) {
 	try {
 		const res = await fetch(`${runner.url}/api/${endpoint}`, {
 			method: 'POST',
-			headers: { Authorization: `Bearer ${runner.token}` },
+			headers: bearerHeader(runner.token),
 			signal: AbortSignal.timeout(timeoutMs)
 		});
 		if (!res.ok) return { ok: false, error: `HTTP ${res.status}` };
@@ -141,7 +160,7 @@ function collectTestFiles() {
 async function fetchReportContent(runner, jobId, onLog) {
 	try {
 		const res = await fetch(`${runner.url}/api/report/${jobId}`, {
-			headers: { Authorization: `Bearer ${runner.token}` },
+			headers: bearerHeader(runner.token),
 			signal: AbortSignal.timeout(15000)
 		});
 		if (!res.ok) {
@@ -194,7 +213,7 @@ async function dispatchAndPoll(
 			method: 'POST',
 			headers: {
 				'Content-Type': 'application/json',
-				Authorization: `Bearer ${runner.token}`
+				...bearerHeader(runner.token)
 			},
 			body: JSON.stringify({
 				tags,
@@ -222,7 +241,7 @@ async function dispatchAndPoll(
 		polling = true;
 		try {
 			const res = await fetch(`${runner.url}/api/execute/${jobId}?offset=${logOffset}`, {
-				headers: { Authorization: `Bearer ${runner.token}` },
+				headers: bearerHeader(runner.token),
 				signal: AbortSignal.timeout(8000)
 			});
 			if (!res.ok) return;
@@ -237,10 +256,10 @@ async function dispatchAndPoll(
 				for (const ss of body.screenshots) onScreenshot(ss);
 			}
 
-			if (body.status === 'done' || body.status === 'error') {
+			if (body.status === JOB_STATUS.DONE || body.status === JOB_STATUS.ERROR) {
 				clearInterval(poll);
 				const content = await fetchReportContent(runner, jobId, onLog);
-				finish(body.exitCode ?? (body.status === 'done' ? 0 : 1), content);
+				finish(body.exitCode ?? (body.status === JOB_STATUS.DONE ? 0 : 1), content);
 			}
 		} catch {
 			// transient polling error — keep trying

package/backend/services/settingsService.js

@@ -1,24 +1,16 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const crypto = require('crypto');
 const prisma = require('./prisma');
 
-const getProject = async () => {
+// Raw accessor — includes secret fields (backupS3SecretKey, mcpKey). Only for
+// internal use by this file's own functions and other trusted internal
+// callers (e.g. backup.routes.js needs the real S3 secret for a connection
+// test). Never expose this return value directly over HTTP.
+const getProjectRaw = async () => {
 	let project = await prisma.project.findUnique({ where: { id: 1 } });
 	if (!project) {
 		project = await prisma.project.create({ data: { id: 1 } });
@@ -26,6 +18,12 @@ const getProject = async () => {
 	return project;
 };
 
+// Public accessor — strips secret fields. This is what routes should use.
+const getProject = async () => {
+	const { backupS3SecretKey, mcpKey, ...safe } = await getProjectRaw();
+	return safe;
+};
+
 const updateProject = async ({ name, logoUrl, timezone, maxRetries }) => {
 	const data = {
 		name: name ?? '',
@@ -46,11 +44,12 @@ const updateProject = async ({ name, logoUrl, timezone, maxRetries }) => {
 		await require('./backupCronService').reload();
 	}
 
-	return project;
+	const { backupS3SecretKey, mcpKey, ...safe } = project;
+	return safe;
 };
 
 const getTestPrefixes = async () => {
-	const project = await getProject();
+	const project = await getProjectRaw();
 	return { testCasePrefix: project.testCasePrefix, testSuitePrefix: project.testSuitePrefix };
 };
 
@@ -66,7 +65,7 @@ const updateTestPrefixes = async ({ testCasePrefix, testSuitePrefix }) => {
 };
 
 const getWebhooks = async () => {
-	const project = await getProject();
+	const project = await getProjectRaw();
 	return {
 		discordWebhookUrl: project.discordWebhookUrl ?? '',
 		slackWebhookUrl: project.slackWebhookUrl ?? '',
@@ -87,7 +86,7 @@ const updateWebhooks = async ({ discordWebhookUrl, slackWebhookUrl, notifyPublic
 };
 
 const getBackupConfig = async () => {
-	const project = await getProject();
+	const project = await getProjectRaw();
 	return {
 		backupEnabled: project.backupEnabled,
 		backupCron: project.backupCron,
@@ -130,7 +129,7 @@ const updateBackupConfig = async ({
 };
 
 const getMcpConfig = async () => {
-	const project = await getProject();
+	const project = await getProjectRaw();
 	return { mcpKeySet: project.mcpKey.length > 0, mcpKey: project.mcpKey };
 };
 
@@ -147,6 +146,7 @@ const generateMcpKey = async () => {
 
 module.exports = {
 	getProject,
+	getProjectRaw,
 	updateProject,
 	getTestPrefixes,
 	updateTestPrefixes,

package/backend/services/testCaseService.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const fs = require('fs');

package/backend/services/testRunService.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const prisma = require('./prisma');

package/backend/services/testService.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const fs = require('fs');

package/backend/services/testSuiteService.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const prisma = require('./prisma');

package/backend/services/triggerService.js

@@ -0,0 +1,246 @@
+/*
+ * This file is part of Plum.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const { spawn } = require('child_process');
+const { randomUUID } = require('crypto');
+const { startSsPoller } = require('../lib/screenshotPoller');
+const { TRIGGER_TYPE } = require('../constants/triggers');
+const { DEFAULT_BROWSER } = require('../constants/defaults');
+const { PLUM_MODE_NODE } = require('../constants/env');
+const { SOCKET_EVENTS } = require('../constants/socketEvents');
+const { JOB_STATUS } = require('../constants/jobStatus');
+const { readCucumberReportFile } = require('../lib/reportFilename');
+const { runWithRetries } = require('../lib/retryRunner');
+const settingsService = require('./settingsService');
+const reportService = require('./reportService');
+const activeRunsService = require('./activeRunsService');
+
+const BACKEND_DIR = path.resolve(__dirname, '..');
+const JOB_TTL_MS = 60 * 60 * 1000; // 1 hour
+
+// In-memory job store: jobId → { status, exitCode, reportId, startedAt }
+const jobs = new Map();
+
+let _io = null;
+function setSocketIO(io) {
+	_io = io;
+}
+
+function pruneOldJobs() {
+	const cutoff = Date.now() - JOB_TTL_MS;
+	for (const [id, job] of jobs) {
+		if (job.startedAt < cutoff) jobs.delete(id);
+	}
+}
+
+function getJob(jobId) {
+	return jobs.get(jobId);
+}
+
+function runAttempt({
+	jobId,
+	tag,
+	browser,
+	workers,
+	trigger,
+	testRunId,
+	baseUrl,
+	suppressSave,
+	onLog,
+	onScreenshot
+}) {
+	return new Promise((resolve) => {
+		const ssDir = path.join(os.tmpdir(), `plum-trigger-ss-${jobId}-${Date.now()}`);
+		fs.mkdirSync(ssDir, { recursive: true });
+
+		const env = {
+			...process.env,
+			TAG: tag,
+			TRIGGER: trigger,
+			BROWSER: browser,
+			REPORT_RUNNERS: String(workers),
+			PLUM_SS_DIR: ssDir
+		};
+		if (Number(workers) > 1) env.PARALLEL = String(workers);
+		if (testRunId) env.TEST_RUN_ID = testRunId;
+		if (baseUrl) env.BASE_URL = baseUrl;
+		if (suppressSave) env.PLUM_MODE = PLUM_MODE_NODE;
+
+		const proc = spawn('npm', ['run', 'test'], { env, shell: true, cwd: BACKEND_DIR });
+
+		const ssPoller = startSsPoller(ssDir, onScreenshot);
+
+		proc.stdout.on('data', (d) => onLog(d.toString()));
+		proc.stderr.on('data', (d) => onLog(`[ERROR] ${d.toString()}`));
+
+		proc.on('close', (code) => {
+			clearInterval(ssPoller);
+			fs.rm(ssDir, { recursive: true, force: true }, () => {});
+			resolve({ code, raw: suppressSave ? readCucumberReportFile() : null });
+		});
+	});
+}
+
+function runNoRetry({
+	jobId,
+	tag,
+	browser,
+	workers,
+	trigger,
+	testRunId,
+	baseUrl,
+	startedAt,
+	onLog,
+	onScreenshot
+}) {
+	runAttempt({
+		jobId,
+		tag,
+		browser,
+		workers,
+		trigger,
+		testRunId,
+		baseUrl,
+		suppressSave: false,
+		onLog,
+		onScreenshot
+	}).then(async ({ code }) => {
+		let reportId = null;
+		try {
+			const report = await reportService.attachDurationToLatestReport({
+				afterTimestamp: startedAt,
+				duration: Date.now() - startedAt
+			});
+			reportId = report?.id ?? null;
+			jobs.set(jobId, {
+				status: code === 130 ? JOB_STATUS.CANCELLED : JOB_STATUS.DONE,
+				exitCode: code,
+				reportId,
+				startedAt
+			});
+		} catch {
+			jobs.set(jobId, { status: JOB_STATUS.DONE, exitCode: code, reportId: null, startedAt });
+		}
+		activeRunsService.unregisterRun(jobId);
+		if (_io) _io.emit(SOCKET_EVENTS.BG_RUN_DONE, { runId: jobId, code, reportId });
+	});
+}
+
+function runWithRetriesAndSave({
+	jobId,
+	tag,
+	browser,
+	workers,
+	trigger,
+	testRunId,
+	baseUrl,
+	maxRetries,
+	startedAt,
+	onLog,
+	onScreenshot
+}) {
+	runWithRetries({
+		maxRetries,
+		spawnAttempt: async (tagOverride) => {
+			const { code, raw } = await runAttempt({
+				jobId,
+				tag: tagOverride ?? tag,
+				browser,
+				workers,
+				trigger,
+				testRunId,
+				baseUrl,
+				suppressSave: true,
+				onLog,
+				onScreenshot
+			});
+			return { code, rawJson: raw ? JSON.parse(raw) : [] };
+		},
+		onLog
+	}).then(async ({ code, rawJson, attempts }) => {
+		let reportId = null;
+		try {
+			const report = await reportService.saveReport({
+				rawCucumberJson: rawJson,
+				tags: tag,
+				triggerType: trigger,
+				browser,
+				testRunId: testRunId ?? null,
+				duration: Date.now() - startedAt,
+				attempts
+			});
+			reportId = report.id;
+			jobs.set(jobId, {
+				status: code === 130 ? JOB_STATUS.CANCELLED : JOB_STATUS.DONE,
+				exitCode: code,
+				reportId,
+				startedAt
+			});
+		} catch {
+			jobs.set(jobId, { status: JOB_STATUS.DONE, exitCode: code, reportId: null, startedAt });
+		}
+		activeRunsService.unregisterRun(jobId);
+		if (_io) _io.emit(SOCKET_EVENTS.BG_RUN_DONE, { runId: jobId, code, reportId });
+	});
+}
+
+// Starts a background test run for the HTTP trigger API and returns the jobId
+// immediately — the run continues asynchronously, reporting progress via
+// socket.io events (bg-run-start/log/screenshot/done) and the job store
+// (polled through getJob).
+async function startRun({
+	tag = '',
+	browser = DEFAULT_BROWSER,
+	workers = 1,
+	baseUrl,
+	testRunId,
+	trigger
+}) {
+	pruneOldJobs();
+	const { maxRetries } = await settingsService.getProject();
+
+	const jobId = randomUUID();
+	const startedAt = Date.now();
+	jobs.set(jobId, { status: JOB_STATUS.RUNNING, exitCode: null, reportId: null, startedAt });
+
+	const label = trigger === TRIGGER_TYPE.MCP ? 'MCP run' : 'External run';
+	const meta = { tag, browser, workers };
+	activeRunsService.registerRun(jobId, { kind: trigger, label, meta });
+	if (_io) {
+		_io.emit(SOCKET_EVENTS.BG_RUN_START, { runId: jobId, kind: trigger, label, meta });
+	}
+
+	const onLog = (text) => {
+		if (_io) _io.emit(SOCKET_EVENTS.BG_RUN_LOG, { runId: jobId, log: text });
+	};
+	const onScreenshot = ({ stepName, data }) => {
+		if (_io) _io.emit(SOCKET_EVENTS.BG_RUN_SCREENSHOT, { runId: jobId, stepName, data });
+	};
+
+	const runParams = {
+		jobId,
+		tag,
+		browser,
+		workers,
+		trigger,
+		testRunId,
+		baseUrl,
+		startedAt,
+		onLog,
+		onScreenshot
+	};
+	if (maxRetries === 0) {
+		runNoRetry(runParams);
+	} else {
+		runWithRetriesAndSave({ ...runParams, maxRetries });
+	}
+
+	return jobId;
+}
+
+module.exports = { setSocketIO, startRun, getJob };

package/backend/services/userService.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const bcrypt = require('bcryptjs');