build: Release 29 04 26.staging

apps/builder/app/routes/_ui.$.test.ts

@@ -0,0 +1,31 @@
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { loader } from "./_ui.$";
+
+describe("_ui.$ loader", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  test("returns 404 for missing apple touch icons without cross-origin logging", async () => {
+    const consoleInfo = vi.spyOn(console, "info").mockImplementation(() => {});
+    const request = new Request(
+      "https://p-project.apps.webstudio.is/apple-touch-icon-precomposed.png",
+      {
+        headers: {
+          accept: "*/*",
+        },
+      }
+    );
+
+    await expect(
+      loader({
+        request,
+        params: {},
+        context: {},
+      })
+    ).rejects.toMatchObject({
+      status: 404,
+    });
+    expect(consoleInfo).not.toHaveBeenCalled();
+  });
+});

apps/builder/app/routes/_ui.$.tsx

@@ -6,10 +6,6 @@ import { preventCrossOriginCookie } from "~/services/no-cross-origin-cookie";
 export { ErrorBoundary } from "~/shared/error/error-boundary";
 
 export const loader = async ({ request }: LoaderFunctionArgs) => {
-  preventCrossOriginCookie(request);
-
-  // No data to protect with CSRF token
-
   const url = new URL(request.url);
 
   // Redirecting asset files (e.g., .js, .css) to the dashboard should be avoided.
@@ -28,6 +24,10 @@ export const loader = async ({ request }: LoaderFunctionArgs) => {
     });
   }
 
+  preventCrossOriginCookie(request);
+
+  // No data to protect with CSRF token
+
   const contentType = request.headers.get("Content-Type");
 
   if (contentType?.includes("application/json")) {

apps/builder/app/routes/rest.assets.test.ts

@@ -0,0 +1,10 @@
+import { describe, expect, test } from "vitest";
+import { MaxAssetsPerProjectError } from "@webstudio-is/asset-uploader/index.server";
+
+describe("MaxAssetsPerProjectError", () => {
+  test("can be classified by type", () => {
+    expect(new MaxAssetsPerProjectError(100)).toBeInstanceOf(
+      MaxAssetsPerProjectError
+    );
+  });
+});

apps/builder/app/routes/rest.assets.tsx

@@ -6,6 +6,7 @@ import type { Asset } from "@webstudio-is/sdk";
 import {
   loadAssetsByProject,
   createUploadName,
+  MaxAssetsPerProjectError,
 } from "@webstudio-is/asset-uploader/index.server";
 import { createContext } from "~/shared/context.server";
 import { preventCrossOriginCookie } from "~/services/no-cross-origin-cookie";
@@ -61,10 +62,16 @@ export const action = async (props: ActionFunctionArgs) => {
       };
     }
   } catch (error) {
-    console.error(error);
+    const parsedError = parseError(error);
+
+    if (error instanceof MaxAssetsPerProjectError) {
+      console.info(error);
+    } else {
+      console.error(error);
+    }
 
     return {
-      errors: parseError(error).message,
+      errors: parsedError.message,
     };
   }
 };

apps/builder/app/services/no-cross-origin-cookie.test.ts

@@ -0,0 +1,30 @@
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { preventCrossOriginCookie } from "./no-cross-origin-cookie";
+
+describe("preventCrossOriginCookie", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  test("logs blocked cross-origin requests as info", () => {
+    const consoleError = vi
+      .spyOn(console, "error")
+      .mockImplementation(() => {});
+    const consoleInfo = vi.spyOn(console, "info").mockImplementation(() => {});
+    const request = new Request("https://apps.webstudio.is/rest/data", {
+      method: "POST",
+      headers: {
+        cookie: "session=1",
+      },
+    });
+
+    expect(() => preventCrossOriginCookie(request)).toThrow();
+
+    expect(consoleError).not.toHaveBeenCalled();
+    expect(consoleInfo).toHaveBeenCalledWith(
+      "Blocked cross-origin request to https://apps.webstudio.is/rest/data",
+      []
+    );
+    expect(request.headers.has("cookie")).toBe(false);
+  });
+});

apps/builder/app/services/no-cross-origin-cookie.ts

@@ -41,7 +41,7 @@ export const preventCrossOriginCookie = (
   }
 
   if (throwError) {
-    console.error(`Cross-origin request to ${request.url} blocked`, [
+    console.info(`Blocked cross-origin request to ${request.url}`, [
       ...request.headers.entries(),
     ]);
 

apps/builder/vite.config.ts

@@ -42,6 +42,7 @@ export default defineConfig(({ mode }) => {
     plugins: [
       remix({
         presets: [vercelPreset()],
+        ignoredRouteFiles: ["**/.*", "**/*.test.{ts,tsx}"],
         future: {
           v3_lazyRouteDiscovery: false,
           v3_relativeSplatPath: false,

packages/asset-uploader/src/schema.ts

@@ -11,9 +11,3 @@ export const MaxSize: z.ZodEffects<
   .default(MAX_UPLOAD_SIZE)
   // user inputs the max value in mb and we transform it to bytes
   .transform(toBytes);
-
-export const MaxAssets: z.ZodEffects<
-  z.ZodDefault<z.ZodString>,
-  number,
-  string | undefined
-> = z.string().default("50").transform(Number.parseFloat);

packages/asset-uploader/src/upload.ts

@@ -17,6 +17,15 @@ type UploadData = {
   maxAssetsPerProject: number;
 };
 
+export class MaxAssetsPerProjectError extends Error {
+  constructor(maxAssetsPerProject: number) {
+    super(
+      `The maximum number of assets per project is ${maxAssetsPerProject}.`
+    );
+    this.name = "MaxAssetsPerProjectError";
+  }
+}
+
 const UPLOADING_STALE_TIMEOUT = 1000 * 60 * 30; // 30 minutes
 
 export const createUploadName = async (
@@ -65,9 +74,7 @@ export const createUploadName = async (
      * it's probable that the user can exceed the limit a little bit.
      * So it can be a little bit strange that the limit is 5 but the user already has 7.
      **/
-    throw new Error(
-      `The maximum number of assets per project is ${maxAssetsPerProject}.`
-    );
+    throw new MaxAssetsPerProjectError(maxAssetsPerProject);
   }
 
   /**

packages/plans/src/plan-features.test.ts

@@ -36,6 +36,10 @@ describe("parsePlansEnv", () => {
     { name: "Workspaces", features: { ...fullFeatures, maxWorkspaces: 10 } },
   ]);
 
+  test("default plan allows 100 assets per project", () => {
+    expect(defaultPlanFeatures.maxAssetsPerProject).toBe(100);
+  });
+
   test("returns empty map for empty JSON array", () => {
     expect(parsePlansEnv("[]").size).toBe(0);
   });

packages/plans/src/plan-features.ts

@@ -44,7 +44,7 @@ export const defaultPlanFeatures: PlanFeatures = {
   maxDailyPublishesPerUser: 10,
   maxWorkspaces: 1,
   maxProjectsAllowedPerUser: 100,
-  maxAssetsPerProject: 50,
+  maxAssetsPerProject: 100,
   seatsIncluded: 0,
   maxSeatsPerWorkspace: 0,
 };

packages/sdk/src/resource-loader.test.ts

@@ -1,4 +1,12 @@
-import { describe, expect, test, beforeEach, vi, type Mock } from "vitest";
+import {
+  afterEach,
+  describe,
+  expect,
+  test,
+  beforeEach,
+  vi,
+  type Mock,
+} from "vitest";
 
 import { loadResource } from "./resource-loader";
 import type { ResourceRequest } from "./schema/resources";
@@ -13,6 +21,10 @@ describe("loadResource", () => {
     vi.clearAllMocks();
   });
 
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
   test("should successfully fetch a resource and return a JSON response", async () => {
     const mockResponse = new Response(JSON.stringify({ key: "value" }), {
       status: 200,
@@ -156,4 +168,37 @@ describe("loadResource", () => {
       ]),
     });
   });
+
+  test("should log failed resource responses as info", async () => {
+    const consoleError = vi
+      .spyOn(console, "error")
+      .mockImplementation(() => {});
+    const consoleInfo = vi.spyOn(console, "info").mockImplementation(() => {});
+    const mockResponse = new Response("not found", {
+      status: 404,
+    });
+    mockFetch.mockResolvedValue(mockResponse);
+
+    const resourceRequest: ResourceRequest = {
+      name: "resource",
+      url: "https://example.com/resource",
+      searchParams: [],
+      method: "get",
+      headers: [],
+      body: undefined,
+    };
+
+    const result = await loadResource(mockFetch, resourceRequest);
+
+    expect(result).toEqual({
+      data: "not found",
+      ok: false,
+      status: 404,
+      statusText: "",
+    });
+    expect(consoleError).not.toHaveBeenCalled();
+    expect(consoleInfo).toHaveBeenCalledWith(
+      'Failed to load resource: https://example.com/resource - 404: "not found"'
+    );
+  });
 });

packages/sdk/src/resource-loader.ts

@@ -66,7 +66,7 @@ export const loadResource = async (
     }
 
     if (!response.ok) {
-      console.error(
+      console.info(
         `Failed to load resource: ${href} - ${response.status}: ${JSON.stringify(data).slice(0, 300)}`
       );
     }