plum-e2e 2.6.9 → 2.7.1

package/backend/lib/serverBootstrap.js

@@ -0,0 +1,189 @@
+/*
+ * This file is part of Plum.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { loadRegistry, saveRegistry } = require('./runnerProcess');
+const { SOCKET_EVENTS } = require('../constants/socketEvents');
+
+const WATCH_OPTS = { usePolling: true, interval: 800, ignoreInitial: true };
+
+function ensureTestsDir(testsDir, isNodeMode) {
+	if (fs.existsSync(testsDir)) {
+		console.log('📂 Loading tests from:', testsDir);
+		return;
+	}
+	if (isNodeMode) {
+		console.warn('⚠️  No tests folder found — will be populated when a job is received');
+		return;
+	}
+	console.error('❌ No tests folder found at /app/tests');
+	process.exit(1);
+}
+
+// A self-restart (POST /api/restart) spawns the replacement before this
+// process has released the port, so the first bind attempt can briefly hit
+// EADDRINUSE — retry instead of dying immediately.
+function attachListenRetry(server, port) {
+	let retriesLeft = 20;
+	server.on('error', (err) => {
+		if (err.code === 'EADDRINUSE' && retriesLeft > 0) {
+			retriesLeft -= 1;
+			setTimeout(() => server.listen(port), 250);
+		} else {
+			console.error(`❌ Failed to bind port ${port}:`, err.message);
+			process.exit(1);
+		}
+	});
+}
+
+function wireRealtimeServices(io, isNodeMode) {
+	if (isNodeMode) return { cronService: null, backupCronService: null };
+
+	const socketHandler = require('../websockets/socketHandler.js');
+	const cronService = require('../services/cronService');
+	const backupCronService = require('../services/backupCronService');
+
+	socketHandler(io);
+	cronService.setSocketIO(io);
+	require('../routes/trigger.routes').setSocketIO(io);
+
+	return { cronService, backupCronService };
+}
+
+async function initCronServices(cronService, backupCronService) {
+	if (cronService) await cronService.init();
+	if (backupCronService) await backupCronService.init();
+}
+
+async function bootstrapMcpKey(isNodeMode) {
+	if (isNodeMode || process.env.PLUM_MCP_KEY) return;
+	try {
+		const settingsService = require('../services/settingsService');
+		const { mcpKey } = await settingsService.getMcpConfig();
+		if (mcpKey) process.env.PLUM_MCP_KEY = mcpKey;
+	} catch {}
+}
+
+function logServerReady(port, isNodeMode) {
+	console.log(`Backend running on port ${port}${isNodeMode ? ' (node/runner mode)' : ''}`);
+}
+
+// Dispatches to the node-runner startup path or the full-server startup path
+// once the HTTP server is actually listening.
+async function onServerListening({ port, io, testsDir, isNodeMode }) {
+	logServerReady(port, isNodeMode);
+	if (isNodeMode) {
+		handleNodeModeStartup(port);
+		return;
+	}
+	await handleFullModeStartup(io, testsDir);
+}
+
+function handleNodeModeStartup(port) {
+	// Self-register PID so manage-runners can track and stop this process.
+	const runnerId = process.env.RUNNER_ID;
+	if (!runnerId) return;
+
+	const registry = loadRegistry();
+	registry[runnerId] = { pid: process.pid, port: String(port), startedAt: Date.now() };
+	saveRegistry(registry);
+
+	const cleanup = () => {
+		try {
+			const reg = loadRegistry();
+			// A self-restart already wrote the replacement's pid under this
+			// id before this process exits — only touch the entry if it's
+			// still ours, so we don't clobber the new process's registration.
+			// Keep the entry (with its port) rather than deleting it — that's
+			// the only place a later manual Start can find the port this
+			// runner was last running on.
+			if (reg[runnerId]?.pid === process.pid) {
+				reg[runnerId] = { ...reg[runnerId], pid: null };
+				saveRegistry(reg);
+			}
+		} catch {}
+	};
+
+	// Adding a SIGTERM/SIGINT listener suppresses Node's default
+	// "terminate immediately" behavior — the handler must exit itself,
+	// or the process (and the port it's bound to) lives on forever
+	// after a plain `kill`/SIGTERM with nothing left to stop it short
+	// of SIGKILL.
+	process.once('SIGTERM', () => {
+		cleanup();
+		process.exit(0);
+	});
+	process.once('SIGINT', () => {
+		cleanup();
+		process.exit(0);
+	});
+	process.once('exit', cleanup);
+}
+
+async function handleFullModeStartup(io, testsDir) {
+	syncAutomatedFlags();
+
+	const chokidar = await loadChokidar();
+	if (!chokidar) return;
+
+	watchTestFiles(chokidar, testsDir);
+	watchReports(chokidar, io);
+}
+
+function syncAutomatedFlags() {
+	// Sync automated flags from feature files on every startup
+	require('../services/reportService')
+		.syncAutomatedFromFeatures()
+		.catch(() => {});
+}
+
+async function loadChokidar() {
+	// chokidar v5+ is ESM-only — use dynamic import to stay compatible with CJS
+	try {
+		return (await import('chokidar')).default;
+	} catch {
+		console.warn('⚠️  chokidar unavailable — file watching disabled');
+		return null;
+	}
+}
+
+function watchTestFiles(chokidar, testsDir) {
+	const featuresDir = path.join(testsDir, 'features');
+	if (!fs.existsSync(featuresDir)) return;
+
+	let debounce = null;
+	chokidar.watch(featuresDir, WATCH_OPTS).on('all', (event, filePath) => {
+		clearTimeout(debounce);
+		debounce = setTimeout(() => {
+			console.log(`📝 Tests changed (${event}: ${path.basename(filePath)})`);
+			syncAutomatedFlags();
+		}, 300);
+	});
+	console.log('👀 Watching for test file changes...');
+}
+
+function watchReports(chokidar, io) {
+	const reportsDir = path.resolve(process.cwd(), 'reports');
+	fs.mkdirSync(reportsDir, { recursive: true });
+
+	chokidar.watch(reportsDir, { ...WATCH_OPTS, interval: 1200 }).on('add', (filePath) => {
+		const name = path.basename(filePath);
+		if ((name.startsWith('PASS_') || name.startsWith('FAIL_')) && name.endsWith('.json')) {
+			console.log(`📊 New report: ${name} — notifying clients`);
+			io.emit(SOCKET_EVENTS.REPORT_READY);
+		}
+	});
+	console.log('👀 Watching for new reports...');
+}
+
+module.exports = {
+	ensureTestsDir,
+	attachListenRetry,
+	wireRealtimeServices,
+	initCronServices,
+	bootstrapMcpKey,
+	onServerListening
+};

package/backend/lib/serverConfig.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 /**

package/backend/lib/testChunker.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const { getTestSuites } = require('../services/testService');

package/backend/lib/testEnv.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const fs = require('fs');

package/backend/mcp/server.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 /**
@@ -40,6 +28,8 @@ const sdkCjs = path.resolve(
 const { McpServer } = require(path.join(sdkCjs, 'server', 'mcp.js'));
 const { StdioServerTransport } = require(path.join(sdkCjs, 'server', 'stdio.js'));
 const { z } = require('zod');
+const { AUTH_SCHEME } = require('../lib/authHeader');
+const { JOB_STATUS } = require('../constants/jobStatus');
 
 const API_URL = (process.env.PLUM_API_URL || 'http://localhost:3001').replace(/\/$/, '');
 const API_KEY = process.env.PLUM_API_KEY || '';
@@ -53,7 +43,7 @@ async function api(method, path, body) {
 		method,
 		headers: {
 			'Content-Type': 'application/json',
-			Authorization: `ApiKey ${API_KEY}`
+			Authorization: `${AUTH_SCHEME.API_KEY} ${API_KEY}`
 		},
 		body: body !== undefined ? JSON.stringify(body) : undefined
 	});
@@ -78,7 +68,7 @@ async function pollJob(jobId, { maxMs = 600_000, intervalMs = 5_000 } = {}) {
 	while (Date.now() < deadline) {
 		await new Promise((r) => setTimeout(r, intervalMs));
 		const job = await get(`/trigger/${jobId}`);
-		if (job.status !== 'running') return job;
+		if (job.status !== JOB_STATUS.RUNNING) return job;
 	}
 	return { status: 'timeout', jobId };
 }

package/backend/middleware/auth.js

@@ -1,20 +1,10 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
+const { AUTH_SCHEME } = require('../lib/authHeader');
+
 /**
  * Bearer-token auth guard for node-mode API routes.
  * Passes through when NODE_TOKEN is not configured (open/dev environments).
@@ -23,7 +13,7 @@ function authGuard(req, res, next) {
 	const nodeToken = process.env.NODE_TOKEN;
 	if (!nodeToken) return next();
 	const auth = req.headers.authorization;
-	if (!auth || auth !== `Bearer ${nodeToken}`) {
+	if (!auth || auth !== `${AUTH_SCHEME.BEARER} ${nodeToken}`) {
 		return res.status(401).json({ error: 'Unauthorized' });
 	}
 	next();

package/backend/middleware/jwtAuth.js

@@ -1,29 +1,18 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const { verifyToken } = require('../services/userService');
 const prisma = require('../services/prisma');
+const { AUTH_SCHEME } = require('../lib/authHeader');
 
 function jwtAuth(req, res, next) {
 	const auth = req.headers.authorization;
 
 	// MCP API key — resolves to the first admin user so createdById is always valid
 	const mcpKey = process.env.PLUM_MCP_KEY;
-	if (mcpKey && auth === `ApiKey ${mcpKey}`) {
+	if (mcpKey && auth === `${AUTH_SCHEME.API_KEY} ${mcpKey}`) {
 		prisma.user
 			.findFirst({ where: { role: 'admin' }, select: { id: true } })
 			.then((admin) => {
@@ -37,12 +26,12 @@ function jwtAuth(req, res, next) {
 		return;
 	}
 
-	if (!auth || !auth.startsWith('Bearer ')) {
+	if (!auth || !auth.startsWith(`${AUTH_SCHEME.BEARER} `)) {
 		return res.status(401).json({ error: 'Unauthorized' });
 	}
 	let payload;
 	try {
-		payload = verifyToken(auth.slice(7));
+		payload = verifyToken(auth.slice(AUTH_SCHEME.BEARER.length + 1));
 	} catch {
 		return res.status(401).json({ error: 'Invalid or expired token' });
 	}

package/backend/middleware/requireAdmin.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 function requireAdmin(req, res, next) {

package/backend/package.json

@@ -8,12 +8,12 @@
 		"create-env": "node services/envService.js",
 		"test": "node config/scripts/run-tests.js",
 		"manage-runners": "node scripts/manage-runners.mjs",
-		"create-test": "node scripts/create-test.js",
+		"create-test": "node config/scripts/create-test.mjs",
 		"mcp": "node mcp/server.js"
 	},
 	"keywords": [],
-	"author": "",
-	"license": "ISC",
+	"author": "silverlunah",
+	"license": "MIT",
 	"devDependencies": {
 		"@playwright/test": "^1.50.1",
 		"@types/node": "^22.17.0",

package/backend/playwright.config.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 // @ts-check

package/backend/routes/active-runs.routes.js

@@ -0,0 +1,18 @@
+/*
+ * This file is part of Plum.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
+ */
+
+const express = require('express');
+const router = express.Router();
+const activeRunsService = require('../services/activeRunsService');
+const { jwtAuth } = require('../middleware/jwtAuth');
+
+// Runs carry a real user's display name (`startedBy`) — gate this the same way as
+// other identity-bearing routes (test-suites, test-runs, users), not left open like
+// the purely operational GET routes (reports, tests) that never touch user identity.
+router.get('/', jwtAuth, (req, res) => {
+	res.json({ runs: activeRunsService.listActiveRuns() });
+});
+
+module.exports = router;

package/backend/routes/auth.routes.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');

package/backend/routes/backup.routes.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');
@@ -21,9 +9,10 @@ const backupService = require('../services/backupService');
 const settingsService = require('../services/settingsService');
 const cronService = require('../services/cronService');
 const backupCronService = require('../services/backupCronService');
-const prisma = require('../services/prisma');
+const { jwtAuth } = require('../middleware/jwtAuth');
+const { requireAdmin } = require('../middleware/requireAdmin');
 
-router.get('/export', async (req, res) => {
+router.get('/export', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		const data = await backupService.exportAll();
 		const fileName = `plum-backup-${new Date().toISOString().slice(0, 10)}.json`;
@@ -36,7 +25,7 @@ router.get('/export', async (req, res) => {
 	}
 });
 
-router.post('/import', async (req, res) => {
+router.post('/import', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		const { cronJobs, project, users, runners, testSuites, testRuns } = req.body;
 		const hasData = [cronJobs, project, users, runners, testSuites, testRuns].some(
@@ -54,7 +43,7 @@ router.post('/import', async (req, res) => {
 	}
 });
 
-router.get('/config', async (req, res) => {
+router.get('/config', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		const config = await settingsService.getBackupConfig();
 		res.json(config);
@@ -64,7 +53,7 @@ router.get('/config', async (req, res) => {
 	}
 });
 
-router.post('/config', async (req, res) => {
+router.post('/config', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		await settingsService.updateBackupConfig(req.body);
 		await backupCronService.reload();
@@ -76,12 +65,12 @@ router.post('/config', async (req, res) => {
 	}
 });
 
-router.post('/test-s3', async (req, res) => {
+router.post('/test-s3', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		// If no secret key provided in the request, fall back to the stored one
 		let config = { ...req.body };
 		if (!config.backupS3SecretKey) {
-			const stored = await prisma.project.findUnique({ where: { id: 1 } });
+			const stored = await settingsService.getProjectRaw();
 			config.backupS3SecretKey = stored?.backupS3SecretKey ?? '';
 		}
 
@@ -98,7 +87,7 @@ router.post('/test-s3', async (req, res) => {
 	}
 });
 
-router.post('/run-now', async (req, res) => {
+router.post('/run-now', jwtAuth, requireAdmin, async (req, res) => {
 	try {
 		await backupCronService.runBackup();
 		const config = await settingsService.getBackupConfig();

package/backend/routes/cron.routes.js

@@ -1,18 +1,6 @@
 /*
  * This file is part of Plum.
- *
- * Plum is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Plum is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Plum. If not, see https://www.gnu.org/licenses/.
+ * Licensed under the MIT License. See LICENSE file in the project root for details.
  */
 
 const express = require('express');