From 141dc0ea28710d57cc16ff0c50bb448edc9fab4c Mon Sep 17 00:00:00 2001
From: Francisco Baralle <francisco.baralle@webflow.com>
Date: Wed, 8 Jul 2026 16:40:25 -0300
Subject: [PATCH] Add guarded build-time secret probe for Webflow Cloud E2E
 tests

Webflow Cloud's end-to-end tests verify that build-time secret values are
redacted from build logs. That requires the app to print the secret during the
build so there is something to redact.

This adds a build-time probe (scripts/e2e-buildtime-secret-probe.mjs) that prints
E2E_TEST_SECRET behind a stable marker during the production build, invoked from
next.config.ts so it runs under `opennextjs-cloudflare build`. It is a no-op
unless E2E_TEST_SECRET is set, so normal builds and `next dev` are unaffected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 next.config.ts                         | 20 +++++++++++++++++++-
 package.json                           |  1 +
 scripts/e2e-buildtime-secret-probe.mjs | 17 +++++++++++++++++
 3 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 scripts/e2e-buildtime-secret-probe.mjs

diff --git a/next.config.ts b/next.config.ts
index 742f3a4..f5f5e87 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -1,4 +1,6 @@
 import type { NextConfig } from 'next';
+import { execSync } from 'node:child_process';
+import { PHASE_PRODUCTION_BUILD } from 'next/constants';
 
 // User's custom Next.js configuration
 // NOTE: basePath is handled by Webflow Cloud builder
@@ -21,4 +23,20 @@ const nextConfig: NextConfig = {
   },
 };
 
-export default nextConfig;
+// Webflow Cloud end-to-end test hook. During the production build (what
+// `opennextjs-cloudflare build` runs when deploying to Webflow Cloud), emit the
+// build-time secret probe so its output flows through the build log pipeline
+// and the tests can verify build-time secret values are redacted from build
+// logs. Guarded on E2E_TEST_SECRET, so it is a complete no-op for `next dev`
+// and for normal builds that never set that variable.
+export default (phase: string): NextConfig => {
+  if (phase === PHASE_PRODUCTION_BUILD && process.env.E2E_TEST_SECRET) {
+    try {
+      execSync('npm run e2e:buildtime-secret-probe', { stdio: 'inherit' });
+    } catch (error) {
+      console.error('[webflow-cloud-e2e] build-time secret probe failed', error);
+    }
+  }
+
+  return nextConfig;
+};
diff --git a/package.json b/package.json
index 15e9b3f..dc12f06 100644
--- a/package.json
+++ b/package.json
@@ -6,6 +6,7 @@
     "dev": "next dev",
     "dev:cf": "opennextjs-cloudflare build && wrangler dev",
     "build": "next build",
+    "e2e:buildtime-secret-probe": "node ./scripts/e2e-buildtime-secret-probe.mjs",
     "start": "next start",
     "lint": "eslint",
     "db:setup": "wrangler d1 migrations apply DB --local",
diff --git a/scripts/e2e-buildtime-secret-probe.mjs b/scripts/e2e-buildtime-secret-probe.mjs
new file mode 100644
index 0000000..5b4b8ac
--- /dev/null
+++ b/scripts/e2e-buildtime-secret-probe.mjs
@@ -0,0 +1,17 @@
+// Webflow Cloud build-time secret probe (used by Webflow Cloud's end-to-end
+// tests).
+//
+// Prints the E2E_TEST_SECRET environment variable during the production build,
+// behind a stable marker, so the end-to-end tests can verify that Webflow Cloud
+// redacts build-time secret values from build logs. It is a deliberate no-op
+// unless E2E_TEST_SECRET is set, so a normal build (local dev or a real deploy)
+// prints nothing and behaves identically.
+const MARKER = '[webflow-cloud-e2e] build-time secret probe';
+
+const value = process.env.E2E_TEST_SECRET;
+if (value) {
+  // Emit line by line so a multiline secret is printed one line at a time.
+  for (const line of value.split('\n')) {
+    console.log(`${MARKER} E2E_TEST_SECRET=${line}`);
+  }
+}