@xdelivered/emberflow@0.6.2: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@xdelivered/emberflow@0.6.2: Suspicious npm security report | LPM Firewall

dist/server/projectConfig.jsView file

Lines 13-53javascript

13 return config;

14}

15/** The resolved emberflow.config.* path for a project dir, or undefined. */

16export function configPathFor(dir) {

17 const root = resolve(dir);

18 return CONFIG_BASENAMES.map((b) => join(root, b)).find(existsSync);

19}

20/**

21 * Loads a project's config. `fresh: true` cache-busts the dynamic import so an

22 * edited config re-imports (the module loader caches by URL) — used by the

23 * in-process node hot-reload so editing registerNodes takes effect without a

24 * process restart (which would kill in-flight agent runs).

25 */

26export async function loadProjectConfig(dir, opts = {}) {

27 const root = resolve(dir);

28 const file = CONFIG_BASENAMES.map((b) => join(root, b)).find(existsSync);

29 if (!file)

30 return null;

31 let raw;

32 try {

33 const url = pathToFileURL(file).href + (opts.fresh ? `?t=${Date.now()}` : '');

34 const mod = (await import(url));

35 raw = mod.default ?? {};

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/projectConfig.jsView on unpkg · L33

36 }

37 catch (err) {

38 throw new Error(`Failed to load ${file}: ${err instanceof Error ? err.message : String(err)}`);

39 }

40 const flowsDir = raw.flowsDir

41 ? isAbsolute(raw.flowsDir) ? raw.flowsDir : join(root, raw.flowsDir)

42 : join(root, 'emberflow', 'flows');

43 // Explicit `language` wins; otherwise infer from the config file's own

44 // extension — a .ts config implies a TypeScript project, everything else JS.

45 const inferredLanguage = file.endsWith('.ts') ? 'typescript' : 'javascript';

46 const language = raw.language ?? inferredLanguage;

47 // Drift is only detectable when the field is EXPLICIT: inferred language

48 // agrees with the extension by construction, so there's nothing to flag.

49 const languageDrift = raw.language && raw.language !== inferredLanguage

50 ? { projectLanguage: raw.language, configPathExtension: extname(file) }

51 : undefined;

52 return {

53 root,

src/nodes/login.test.tsView file

Lines 20-60typescript

20 });

21

22 it('result node output contains the token', async () => {

23 const flow = createLoginFlow();

24 const run = await startRun({ flow, registry: createDefaultRegistry(0) }).runToEnd();

25 const resultNode = flow.nodes.find((n) => n.type === 'Result')!;

26 expect((run.nodeStates[resultNode.id].output as any).data.token).toBe('tok_user-ada');

27 });

28

29 it('fails on short password', async () => {

30 const flow = createLoginFlow();

31 (flow.nodes.find((n) => n.id === 'input')!.config.defaults as Record<string, unknown>).password = 'x';

32 const run = await startRun({ flow, registry: createDefaultRegistry(0) }).runToEnd();

33 expect(run.status).toBe('failed');

34 });

35

36 it('takes the welcome branch for a run invoked with a new-user payload', async () => {

37 const run = await startRun({

38 flow: createLoginFlow(),

39 registry: createDefaultRegistry(0),

40 input: { username: 'new-zoe', password: 'longenough' },

Medium

Secret Pattern

Hardcoded password in src/nodes/login.test.ts

src/nodes/login.test.tsView on unpkg · L40

41 }).runToEnd();

42 expect(run.status).toBe('succeeded');

43 expect((run.nodeStates.route.output as any).$branch).toBe('true');

44 expect(run.nodeStates.welcome.status).toBe('succeeded');

45 expect((run.nodeStates.issueToken.output as any).token).toBe('tok_user-new-zoe');

46 });

47

48 it('falls back to configured defaults when invoked with no input', async () => {

49 const run = await startRun({

50 flow: createLoginFlow(),

51 registry: createDefaultRegistry(0),

52 }).runToEnd();

53 expect(run.status).toBe('succeeded');

54 expect((run.nodeStates.issueToken.output as any).token).toBe('tok_user-ada');

55 });

56

57 it('existing user (ada) routes through checkPlan and skips welcome', async () => {

58 const flow = createLoginFlow();

59 const run = await startRun({ flow, registry: createDefaultRegistry(0) }).runToEnd();

60 expect(run.status).toBe('succeeded');