Oleg Isonen
2c9fd16689
## Description Project Settings starts with an empty response-header rule list. Users can add valid HTTP response headers for all paths (`/*`) or an Authentication-style route such as `/private/*`, and remove any configured rule. The Headers and Authentication views share the accessible rule-list form. The header form suggests standard response-header names and common values for the selected header, while accepting custom names and values. `Set-Cookie` is not suggested because a rule can store only one value per header and would replace existing cookies. `X-Powered-By`, `X-Content-Type-Options`, and `Strict-Transport-Security` are dispatcher-owned and cannot be configured. Users may configure `Content-Security-Policy`, `X-Frame-Options`, and `Referrer-Policy`; when absent, the dispatcher supplies their defaults. The SDK validates header names, values, routes, duplicates, and size limits. The CLI emits only configured rules. Customization requires Pro for custom-domain publishing, while unchanged defaults and staging remain available on Free plans. The server checks the saved production snapshot against the project owner's plan. Companion Cloud worker PR: https://github.com/webstudio-is/webstudio-saas/pull/664. Deploy its dispatcher support before exposing these settings in the Builder. Other hosts need an adapter that applies the generated rules; Webstudio Cloud dispatcher defaults do not apply automatically elsewhere. Static exports do not apply headers automatically. ## Validation - SDK, CLI, Builder browser, publish-warning, and production-build tests pass. - Builder, SDK, and CLI typechecks and lint pass. - The companion Cloud worker tests, typecheck, and lint pass. Replaces https://github.com/webstudio-is/webstudio/pull/6428 to use `headers.staging`. Closes https://github.com/webstudio-is/webstudio/issues/4748
Builder E2E tests
Builder E2E workflows run with Playwright Test. The Playwright setup project waits for PostgREST, resets the disposable database, and warms the login route before Chromium runs the selected tests.
Run the suite
Use the full command for CI-like validation:
pnpm e2e:builder
The first run after migrations change applies the regular migration pipeline
and writes an ignored schema cache under .cache/builder-e2e. Refresh it
explicitly with:
pnpm e2e:builder:refresh-schema-cache
The regular E2E suite uses lightweight PostgreSQL containers. Verify that the complete migration chain also applies to the pinned Supabase PostgreSQL image with:
pnpm e2e:builder:check-supabase-migrations
Pass normal Playwright Test arguments after --. For example:
pnpm e2e:builder -- --grep "Builder can copy, duplicate, and delete a page"
pnpm e2e:builder -- 'apps/builder/e2e/tests/pages-actions.[shard-5].e2e.ts'
pnpm e2e:builder -- --debug --grep "Builder can copy"
A lightweight Playwright discovery pass validates the selection before Docker, database migrations, browser installation, or the Builder build starts. A filter that matches no tests therefore fails without starting the test environment.
Fast local reruns
Keep the E2E backend and Builder development server running to avoid rebuilding Builder and restarting Docker for each edit.
Terminal 1:
pnpm e2e:builder:dev:backend
Terminal 2:
pnpm dev
Terminal 3:
pnpm e2e:builder:dev -- --grep "Builder can copy, duplicate, and delete a page"
pnpm e2e:builder:dev defaults to
E2E_BUILDER_URL=https://127.0.0.1:3000. Override it when the development
server uses another port. Chromium maps wstd.dev and its project subdomains
to loopback for local Builder URLs, so host-file changes are unnecessary.
The development backend uses E2E_DB_BOOTSTRAP=if-empty and keeps Docker
containers running. The Playwright setup project still resets test data before
each invocation.
Test organization
- Put workflows in
e2e/tests/*.e2e.tsand importtestfrome2e/test.ts. - Use Playwright's
pagefixture for the workflow under test. Playwright gives each test an isolated context and closes it automatically. - Use Playwright's
contextfixture when setup should share authentication with the workflow page. - Use
withBrowserContext(browser, callback)for isolated setup or setup that runs inbeforeAll. If cookies must survive frombeforeAllinto the tests, create an explicit context withnewBrowserContext(browser)and close it inafterAll. - Use
newIsolatedPage(browser)for identities that must not share cookies. - Keep tests in a file independent even though Playwright runs them in declaration order by default.
CI discovers isolated Playwright shards from filename tags. Each shard uses four workers, and files are assigned by measured CI duration to keep jobs near three to four minutes:
pages-actions.[shard-2].[shard-5].[shard-6].e2e.ts
Every E2E filename must contain at least one unique shard tag. CI derives its matrix from those tags, so adding or removing a shard does not require editing the workflow. Files with multiple tags are partitioned across those shards. All files selected by a shard must use the same set of tags. Rebalance by changing filename tags when measured job durations drift. Suites may opt into parallel mode only when every worker creates uniquely named setup data and the tests do not depend on each other's mutations.
Backend organization
Development, E2E, schema-cache, and Supabase compatibility commands share the
backend definition in apps/builder/backend. compose.yaml defines the common
services, and compose.<mode>.yaml defines only the differences for a named
mode. Backend commands resolve these files by convention; callers do not pass
Compose filenames.
The schema-cache fingerprint discovers migration sources and non-test backend files automatically. Adding a database image, initialization script, Compose override, or migration therefore invalidates the cache without updating a filename registry.
Failures
Failed shard jobs upload the Playwright HTML report, traces, screenshots, videos, and backend service logs.
When you need a completely clean backend locally:
E2E_SKIP_CLEANUP=false pnpm e2e:builder