Zod security hardening (alpha.8) + full Jest→Vitest migration

[tnramalho]

What this PR contains

Two phases, stacked (6 commits):

Phase 1 — alpha baseline + security hardening (b43f6b8..aed9e47)

• Packages publish as @conceptadev/*; upstream @concepta/nestjs-* moves to 8.0.0-alpha.8 (NestJS 12 alpha).
• Security (CWE-863 / CWE-200 / CWE-284), covered by a dedicated e2e suite:
  • Owner scoping on by default for owner-annotated zod resources (ownerScope: false opts out — the sample pet resource does, in favour of its owner-or-shared hook). Breaking for consumers relying on unscoped reads.
  • Response DTO exposure is opt-in; the credential-name regex is gone (it hid tokenExpiresAt while missing apiKey). Secrets opt out explicitly with dto: { response: false }.
  • defineZodUserMetadata projects through projectSchema — closed a second projection path that ignored response: false.
  • Path-scope invariants assert on core.providers (real artifact) + behavioural e2e; the write-only meta.guards mirror is deleted.
• Library hygiene: Nest Logger in the exceptions filter (no console, no NODE_ENV gate), local validation-error flattening (no private Nest API), descriptor-based isThunk, WeakMap hook caches, Firestore native Timestamp round-trip, per-instance in-memory backend.

Phase 2 — Jest→Vitest 4 (93a2569..857cbd2)

• scripts/ no longer exists: the isolated-runner bridge, both Babel ESM-compat plugins, all 14 Jest configs, and every Jest dependency across 10 workspaces are deleted (net −1,400 lines).
• Official projects model: root vitest.config.ts declares unit, e2e-packages, and one project per example; vitest.shared.ts holds the single SWC block (decorator metadata for Nest DI — esbuild can't emit it). yarn test:all runs the whole monorepo: 106 files / 971 tests.
• globals: false everywhere — every test file imports its API explicitly; proven by the runner itself.
• Test files are now type-checked (yarn typecheck:spec, wired into CI). First run surfaced 42 latent errors across 19 files (orphaned fixtures importing upstream members deleted in alpha.8, entity-contract drift, deep dist/ imports, under-typed doubles) — all fixed or deleted, none suppressed. Two interfaces consumers need are now exported from the public index.
• Dynamic-import audit: 41 cargo-cult await import()s replaced by static imports after checking the real graph (madge); the one justified case is kept and documented with file:line evidence.

Test evidence

Gate	Result
yarn build / yarn typecheck:spec / yarn lint:all	green
unit (--project unit)	62 files / 572 tests — identical to Jest baseline
package e2e (--project e2e-packages)	30 / 156
samples	8/194 · 2/40 · 4 files/9 tests
yarn test:ci artifacts	junit.xml + coverage/ + coverage-e2e/ at historical paths

Known limitations (documented in CHANGELOG)

• Intermittent e2e failures: diagnosed as host memory pressure, not a code defect. Rotating victim suite with inconsistent symptoms; the instrumented hunt showed a failing run takes 216s vs 10.8s, two independent suites stall in the same instant, the real failures are 30s timeouts with no HTTP response, and the host was at ~16 MB free RAM with continuous pageouts (16 GB machine, 26 GB swap in use). Not a CI risk — a full run peaks at ~650 MB across 4 workers vs 4 GB on a standard runner. Full evidence in CHANGELOG "Intermittent e2e failures".
• SafeCrudContextInterceptor still string-matches an upstream error message (named contract test pins it; deleted when upstream 5249672f ships).
• Firestore now stores dates as native Timestamp; rows written by earlier builds hold ISO strings and are no longer converted on read. Verified safe: the package has never been published to npm (registry 404) and the only in-repo consumer is a test stub, so there is no persisted data to migrate.
• Base remains pre-release @concepta 8.0.0-alpha.x.

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 55 complexity · 3 duplication

Metric	Results
Complexity	55
Duplication	3

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[tnramalho]

HIGH — withHiddenFieldsRemoved silently drops the entire computed field from runtime responses; the leak it targets is only closed by accident

Rebuilding the field (z.object(shape) / z.array(strippedElement) + re-wrapping) loses the rocketsFieldMeta registration — the registry is keyed by schema instance, and the rebuilt schema was never registered. Downstream, compileDtoClass reads meta.compute off the projected field to install the @Transform that populates the value. With the meta gone, no transform is installed, so the computed key is absent from every HTTP response — while the response DTO / OpenAPI still documents it (minus the hidden column).

Verified against the built dist, replicating the upstream CrudSerializeInterceptor pipeline (default toInstanceOptions + ZOD_TO_PLAIN_OPTIONS from zod-operations.ts), with secret: f.string({ dto: { response: false } }) inside the compute element schema:

B (hidden col in compute schema): meta.compute preserved? false
   wire: {"id":"row-1"}                              // computed field GONE
A (clean compute schema):        meta.compute preserved? true
   wire: {"id":"row-1","items":[{"id":"i1","label":"ok",
          "secret":"SECRET-VALUE","extraNotInSchema":"ALSO-OUT?"}]}

Case A shows the deeper problem: the compute schema is never enforced at runtime. toPlain runs with strategy: 'exposeAll' and the transform output bypasses all whitelisting, so whatever the callback returns goes out verbatim — including keys never declared in the compute schema. The stripping added here only edits the documented schema; the CWE-200 scenario in this docstring is prevented solely because the whole field vanishes, and rows carrying sensitive columns that are hidden on some other schema (or not annotated at all) still leak through a compute in the clean case.

The new unit test (strips dto.response=false out of a computed field schema) asserts schema keys only, which is why this wasn't caught.

Suggested fix: enforce the projection at serialization time, not (only) schema time — in compileDtoClass, wrap the compute transform to pick only the projected element keys (or parse through the stripped schema), and preserve the field-meta registration when this function rebuilds the field. Add an e2e asserting the computed field still appears on the wire minus the hidden column.

[tnramalho]

Fixed in 5bb83319 + f1b50966. The rebuilt field re-registers its rocketsFieldMeta (compute @Transform installs again — unit test pins the registration), and the transform now strips the compute output to the declared shape at runtime (key-level, not schema.parse, since computed values legitimately differ from wire types). The e2e you asked for is in rockets-core-zod-security.e2e-spec.ts — 'computed field reaches the wire minus hidden and undeclared keys' — through the real serializer pipeline: field present, internalNote and an undeclared key absent. It fails against both shapes of the original bug.

[tnramalho]

MEDIUM — dependency cache is dead after this change: both paths are absolute

path: '/node_modules' points at the filesystem root — that directory never exists on the runner, so the post-job cache save fails silently. And hashFiles() patterns are relative to GITHUB_WORKSPACE; '/yarn.lock' matches nothing, so the expression returns the empty string and the key degenerates to the constant Linux-modules-. Net effect: every CI run cold-installs, and nothing useful is ever saved or restored. The same edit landed in ci-merge.yml.

If the intent was "cache only the root node_modules" instead of the old **/node_modules glob:

path: node_modules
key: ${{ runner.os }}-modules-${{ hashFiles('yarn.lock') }}

[tnramalho]

Fixed in 5bb83319: relative path: node_modules + hashFiles('yarn.lock'), with a workflow comment recording why the absolute paths were dead. Applied to both ci-pr-test.yml and ci-merge.yml.

[tnramalho]

LOW — String(exception) logs [object Object] for stack-less exceptions

Observed in this branch's own e2e output while verifying the run:

ERROR [RocketsCoreExceptionsFilter] Unhandled 5xx
[object Object]

For a thrown plain object (or an exception whose stack is missing), the fallback carries zero information — which defeats the purpose of always logging 5xx. Consider something like e.stack ?? (exception instanceof Error ? exception.message : JSON.stringify(exception)) so the log line is always actionable.

[tnramalho]

Fixed in 5bb83319: util.inspect fallback for both the exception and originalError — a stack-less plain object now logs its structure instead of '[object Object]'.

[tnramalho]

Review — changes requested (posted as comment: GitHub blocks request-changes on own PR)

Independent review of both phases (security hardening + Jest→Vitest). One verified blocker, one CI bug, one logging nit. The known limitations declared in the PR body (rotating-404 flake, SafeCrud string-match, Firestore legacy ISO data, alpha base) were treated as out of scope.

Findings (ranked)

1. HIGH / blocker — computed fields with a hidden column vanish from responses; compute output is not runtime-enforced — packages/rockets-core/src/zod/zod-projections.ts (withHiddenFieldsRemoved). Rebuilding the field loses the rocketsFieldMeta registration, so compileDtoClass never installs the compute @Transform: the field is absent from every HTTP response while OpenAPI still documents it. The CWE-200 fix this docstring claims holds only because the field disappears entirely; in the clean-schema case, compute output still goes out verbatim (toPlain is exposeAll), including keys never declared in the compute schema. Reproduced against the built dist replicating the CrudSerializeInterceptor options — repro output in the inline comment. The new unit test asserts schema keys only, so it cannot catch this.
2. MEDIUM — CI dependency cache is dead — .github/workflows/ci-pr-test.yml and ci-merge.yml: path: '/node_modules' (filesystem root, never exists) + hashFiles('/yarn.lock') (workspace-relative patterns → empty hash → constant key). Every run cold-installs; the save step fails silently.
3. LOW — Unhandled 5xx log prints [object Object] — packages/rockets-core/src/infrastructure/filters/exceptions.filter.ts:145; String(exception) fallback carries no information (observed in this branch's own e2e output).

Observations (no action required, flagging deliberate trade-offs)

• OwnerScopeHook is fail-open when no actor is on the context (documented as "public route" semantics). It relies entirely on AuthServerGuard rejecting unauthenticated requests first; any future route that is authenticated through a mechanism that doesn't populate the actor would silently return the full table.
• isThunk in define-sub-resource.ts now throws for function-expression entities. Consumers compiling with a target below ES2015 (transpiled classes have writable prototypes) would hit the ambiguity throw for a legitimate entity: MyEntity. Modern targets are unaffected.

Verified green (commands run locally on the PR head, 857cbd2)

• corepack yarn vitest run --project unit → 62 files / 572 tests, all pass (matches the PR's claim).
• corepack yarn vitest run --project e2e-packages → 30 files / 156 tests, all pass, no flake on this run.
• File-count audit: exactly 62 *.spec.ts and 30 *.e2e-spec.ts exist under packages/ — the include/exclude globs in vitest.config.ts un-test nothing. tsconfig.spec.json covers all spec/e2e/fixture locations; the only excluded specs are the Playwright files under apps/web/e2e (correctly out of Vitest scope).

Checked and clean

• Owner scoping defaults: resolveOwnerColumns + applyOwnerHooks wire OwnerScopeHook per owner column with per-side opt-outs; read coverage is complete (the repository abstraction's only read entry points are findOne/findAndCount, both hooked). zodModuleResource contributes non-CRUD slices only, so it is not a scoping bypass.
• Response exposure (non-compute paths): runtime-enforced, not docs-only — compileDtoClass emits class-level @Exclude + per-field @Expose, and toInstance runs with excludeAll/excludeExtraneousValues, so unprojected fields never reach the instance. Nested relation exposure (expose: true) recurses through per-field opt-in and dedicated nested DTO classes via @Type — hidden nested columns are stripped on the way in. Owner columns are excluded from create/update projections (no owner spoofing).
• defineZodUserMetadata: now shares projectSchema; create/update parity with the old omit() behavior holds, userId frozen on update, and managed fields are enforced on top of the projection.
• Sub-resource scoping: materialise-sub-resource.ts asserts ScopeGuard/ScopeHook survive provider merging against core.providers (the real artifact); guard now precedes consumer decorators. path-scope.guard.ts cache-key fix (JSON tuple vs :: join) is correct.
• Exceptions filter rewrite: unwrap chains are cycle-safe, unwrapToClientRuntimeException correctly picks the innermost 4xx, local validation flattening matches the private-API behavior it replaces (parent-property prefixing included), and the always-log-5xx change removes the NODE_ENV stack-leak gate.
• Firestore: Date→Timestamp→Date round trip is now symmetric at the top level for both backends; the name-based (startsWith('date')/endsWith('At')) type-guessing is gone; in-memory backend state is per-instance.
• Converted tests: no .only/.skip/any/ts-suppressions in added lines; expect balance is +95/−2, and both removals are org-rename substitutions with the assertion preserved. globals: false + SWC decorator metadata config is correct; groupOrder is unique per project.
• CI report pipeline: download-artifact@v4 + run-id fix is correct, artifact paths line up with test:ci/test:e2e:cov outputs, java-junit parses Vitest's junit reporter output, $GITHUB_OUTPUT migration correct.

Not covered

• Sample-app e2e suites (194/40/9 tests) were not re-run locally; I relied on the PR's evidence there.
• yarn.lock (3,774 lines) reviewed only for shape, not audited dependency-by-dependency.
• The ~250 files of mechanical @bitwild→@conceptadev rename churn were spot-checked, not exhaustively read.
• CHANGELOG/docs prose accuracy beyond the claims tested above.

Verdict: the migration itself is solid and the security defaults are real improvements — but finding 1 sits at the center of the PR's CWE-200 claim and silently breaks a documented feature, so it should be fixed (with a wire-level test) before merge.

[tnramalho]

All three review findings are addressed as of 5bb83319:

• HIGH — compute projection was docs-only + rebuilt field lost its meta registration: withHiddenFieldsRemoved now re-registers the original rocketsFieldMeta on the rebuilt node (the compute @Transform installs again), and the transform strips the compute output to the declared shape at runtime — key-level rather than schema.parse, since computed values legitimately differ from wire types (Date vs ISO string). Two new unit tests pin both layers: meta survives the rebuild, and hidden + undeclared keys of embedded rows are absent from the serialized instance (zod-projections.spec.ts).
• MEDIUM — dead CI cache: /node_modules + hashFiles('/yarn.lock') → relative paths; comment in the workflow records why.
• LOW — [object Object] logs: util.inspect fallback in the exceptions filter.

Gates re-run on the fix: build, lint:all, typecheck:spec, unit 574/574 (2 new tests), package e2e 156/156 (one hit of the documented rotating-404 flake, green on rerun), sample-server 194/194.