@teleporthq/teleport-plugin-next-data-source 0.43.66 → 0.43.68

package/src/fetchers/postgresql.ts

@@ -10,6 +10,10 @@ import {
   generateSortFieldSqlHelper,
   generateSortTiebreakSql,
 } from '../product-price-sort'
+import { generateProductFilterClauseHelper } from '../product-filter-fields'
+import { generateReadGuardCall, generateTableAccessPreamble } from './utils/table-access-guard'
+import { generateRequestSqlGuardsCode } from './utils/request-sql-guards'
+import { generateArrayOverlapSqlCode } from '../array-overlap-sql'
 
 interface PostgreSQLConfig {
   connectionString?: string
@@ -26,7 +30,8 @@ interface PostgreSQLConfig {
 
 export const generatePostgreSQLFetcher = (
   config: Record<string, unknown>,
-  tableName: string
+  tableName: string,
+  trustedReaderRoles: ReadonlyArray<string> = []
 ): string => {
   const pgConfig = config as PostgreSQLConfig
   const schema = pgConfig.options?.schema
@@ -57,6 +62,8 @@ export const generatePostgreSQLFetcher = (
 
   return `import { Client } from 'pg'
 
+${generateTableAccessPreamble(trustedReaderRoles)}
+
 const getClient = () => {
   return new Client(${clientConfig})
 }
@@ -66,9 +73,11 @@ ${generateSafeJSONParseCode()}
 ${generateFilterTreeHelpersCode()}
 
 ${generateSearchEscapeHelpersCode()}
+${generateArrayOverlapSqlCode()}
 
 // Builds one SQL clause for the whole filter tree, so an OR group nested in
 // the root AND keeps its meaning instead of being flattened into ANDs.
+${generateRequestSqlGuardsCode()}
 const processFilters = (filters, conditions, queryParams, paramIndex) => {
   if (!filters) return paramIndex
   
@@ -77,13 +86,26 @@ const processFilters = (filters, conditions, queryParams, paramIndex) => {
   
   const buildCondition = (condition) => {
     const field = condition.source
-    const value = condition.destination
-    const operand = condition.operand
+    const normalizedCondition = normalizeInOperand(condition.operand, condition.destination)
+    if (normalizedCondition === null) return null
+    const value = normalizedCondition.value
+    const operand = normalizedCondition.operand
+    
+    // The products table's virtual fields (effective price, rating bucket,
+    // on-sale flag, variant axes) are whole clauses, not columns - so they are
+    // answered before any branch below can interpolate the field name raw.
+    const productClause = productFilterClause(field, operand, value, (param) => {
+      queryParams.push(param)
+      return '$' + paramIndex++
+    })
+    if (productClause !== null) return productClause
+    assertRequestColumn(field, 'filter field')
     
     if (Array.isArray(value)) {
       if (value.length === 0) return null
       if (operand === 'array_overlap') {
-        const clause = \`jsonb_exists_any(NULLIF(\${field}, '')::jsonb, $\${paramIndex}::text[])\`
+        // The row's list (see array-overlap-sql.ts) shares any value with the set.
+        const clause = arrayOverlapSql([field], '$' + paramIndex)
         queryParams.push(value.map((entry) => String(entry)))
         paramIndex++
         return clause
@@ -101,7 +123,7 @@ const processFilters = (filters, conditions, queryParams, paramIndex) => {
       // ?categoryFilter=a,b,c) expands to multiple ids; one id stays one.
       const overlapValues = String(value).split(',').map((entry) => entry.trim()).filter(Boolean)
       if (overlapValues.length === 0) return null
-      const clause = \`jsonb_exists_any(NULLIF(\${field}, '')::jsonb, $\${paramIndex}::text[])\`
+      const clause = arrayOverlapSql([field], '$' + paramIndex)
       queryParams.push(overlapValues)
       paramIndex++
       return clause
@@ -133,7 +155,10 @@ ${generateSortFieldSqlHelper(tableName)}
 
 ${generateSortFallbackFieldHelper(tableName)}
 
+${generateProductFilterClauseHelper(tableName)}
+
 export default async function handler(req, res) {
+${generateReadGuardCall(tableName, null)}
   const client = getClient()
   
   try {
@@ -141,6 +166,8 @@ export default async function handler(req, res) {
     ${schema ? `await client.query('SET search_path TO ${schema}')` : ''}
     
     const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset } = req.query
+    // A visitor never filters, sorts or searches by a column it is not served.
+    if (__rowPolicy) __brpAssertVisibleFields(__rowPolicy, req.query)
     
     const conditions = []
     const queryParams = []
@@ -175,6 +202,7 @@ export default async function handler(req, res) {
           // Continue without search if we can't get columns
         }
       }
+      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)
       
       if (columns.length > 0) {
         const pattern = '%' + escapeLikePattern(query) + '%'
@@ -190,6 +218,7 @@ export default async function handler(req, res) {
 
     // Apply filters using helper function
     paramIndex = processFilters(filters, conditions, queryParams, paramIndex)
+    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')
     
     let sql = \`SELECT * FROM "${tableName}"\`
     
@@ -205,6 +234,7 @@ export default async function handler(req, res) {
       const parsedSorts = safeJSONParse(sorts)
       if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
         const valid = parsedSorts.filter((sort) => sort && sort.field)
+        valid.forEach((sort) => assertRequestColumn(sort.field, 'sort field'))
         const orderOf = (sort) => (sort.order || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'
         const orderClauses = valid.map((sort) => \`\${sortFieldSql(sort.field)} \${orderOf(sort)}\`)
         const plainClauses = valid.map((sort) => \`\${sortFallbackField(sort.field)} \${orderOf(sort)}\`)
@@ -222,16 +252,17 @@ export default async function handler(req, res) {
         }
       }
     } else if (sortBy) {
+      assertRequestColumn(sortBy, 'sort field')
       orderBySql = \` ORDER BY \${sortBy} \${(sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'}\`
       plainOrderBySql = orderBySql
     }
     const usedDiscountAwareSort = orderBySql !== plainOrderBySql
 
-    const limitValue = limit || perPage
+    const limitValue = requestRowCount(limit || perPage)
     const offsetValue = offset !== undefined ? parseInt(offset) : (page && perPage ? (parseInt(page) - 1) * parseInt(perPage) : undefined)
 
     let sqlTail = ''
-    if (limitValue) {
+    if (limitValue !== undefined) {
       sqlTail += \` LIMIT \${limitValue}\`
     }
     
@@ -265,14 +296,20 @@ export default async function handler(req, res) {
 
     return res.status(200).json({
       success: true,
-      data: safeData,
+      data: __taWithoutCredentials(
+        __rowPolicy ? __brpStripHidden(__rowPolicy, safeData) : safeData,
+        ${JSON.stringify(tableName)}
+      ),
       timestamp: Date.now()
     })
   } catch (error) {
     console.error('PostgreSQL fetch error:', error)
-    return res.status(500).json({
+    // A database error names tables, columns and values: it stays in the server
+    // log. Only an error this route raised for the caller (it carries a status)
+    // is repeated to it.
+    return res.status(error.status || 500).json({
       success: false,
-      error: error.message || 'Failed to fetch data',
+      error: error.status ? error.message : 'Failed to fetch data',
       timestamp: Date.now()
     })
   } finally {
@@ -297,11 +334,13 @@ export const generatePostgreSQLCountFetcher = (
 
   return `
 async function getCount(req, res) {
+${generateReadGuardCall(tableName, null)}
   const client = getClient()
 
   try {
     await client.connect()
     const { query, queryColumns, filters } = req.query
+    if (__rowPolicy) __brpAssertVisibleFields(__rowPolicy, req.query)
     const conditions = []
     const queryParams = []
     let paramIndex = 1
@@ -336,6 +375,7 @@ async function getCount(req, res) {
           // Continue without search if we can't get columns
         }
       }
+      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)
       
       if (columns.length > 0) {
         const pattern = '%' + escapeLikePattern(query) + '%'
@@ -353,6 +393,7 @@ async function getCount(req, res) {
 
     // Apply filters using helper function
     paramIndex = processFilters(filters, conditions, queryParams, paramIndex)
+    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')
 
     let countSql = \`SELECT COUNT(*) FROM "${tableName}"\`
     if (conditions.length > 0) {
@@ -369,9 +410,9 @@ async function getCount(req, res) {
     })
   } catch (error) {
     console.error('Error getting count:', error)
-    return res.status(500).json({
+    return res.status(error.status || 500).json({
       success: false,
-      error: error.message || 'Failed to get count',
+      error: error.status ? error.message : 'Failed to get count',
       timestamp: Date.now()
     })
   } finally {

package/src/fetchers/raw-query.ts

@@ -1,3 +1,4 @@
+import { SessionCookieResolver } from '@teleporthq/teleport-shared'
 import { replaceSecretReference } from '../utils'
 
 interface PostgreSQLConfig {
@@ -13,9 +14,28 @@ interface PostgreSQLConfig {
 
 const FORBIDDEN_KEYWORDS = ['CREATE', 'ALTER', 'DROP', 'TRUNCATE', 'RENAME', 'GRANT', 'REVOKE']
 
+/** The param a `{{Current User.<field>}}` token becomes: `currentUser` + the field, capitalised. */
+const CURRENT_USER_PARAM_PREFIX = 'currentUser'
+
+const isCurrentUserParam = (param: string): boolean =>
+  param.length > CURRENT_USER_PARAM_PREFIX.length && param.indexOf(CURRENT_USER_PARAM_PREFIX) === 0
+
+/** The user field a `currentUser<Field>` param stands for (`currentUserId` → `id`). */
+const currentUserField = (param: string): string => {
+  const rest = param.slice(CURRENT_USER_PARAM_PREFIX.length)
+  return rest.charAt(0).toLowerCase() + rest.slice(1)
+}
+
 /**
  * Generates an API route handler that executes a parameterized raw SQL query.
- * Supports {{Current User.*}} substitution via query params.
+ * Supports {{Current User.*}} substitution — bound to the SESSION's user.
+ *
+ * ⛔ A `{{Current User.<field>}}` value is read from the signed-in session on
+ * the server, never from the request: the query string is whatever the caller
+ * wrote, so a route that bound `?currentUserId=` served any user's rows (their
+ * favourites, their orders) to anyone who named that user's id. A caller with
+ * no session gets no rows, exactly as when the value is missing. Other params
+ * (`currentPageEntityId`, the details page's route param) stay request values.
  *
  * @param config - PostgreSQL connection config
  * @param query - Raw SQL query string with {{Current User.*}} patterns already replaced to $N placeholders
@@ -27,9 +47,43 @@ export const generateRawQueryFetcher = (
   paramFields: string[]
 ): string => {
   const pgConfig = config as PostgreSQLConfig
+  const userParams = paramFields.filter(isCurrentUserParam)
+  const requestParams = paramFields.filter((param) => !isCurrentUserParam(param))
+
+  const paramDestructure = [
+    requestParams.length > 0 ? `const { ${requestParams.join(', ')} } = req.query` : '',
+    userParams.length > 0 ? 'const __sessionUser = await sessionUser(req)' : '',
+    ...userParams.map(
+      (param) =>
+        `const ${param} = sessionUserField(__sessionUser, ${JSON.stringify(
+          currentUserField(param)
+        )})`
+    ),
+  ]
+    .filter(Boolean)
+    .join('\n    ')
+
+  const sessionHelpers =
+    userParams.length > 0
+      ? `${SessionCookieResolver.generateCommonJsSessionTokenResolverCode()}
+// The signed-in user this request's session names, or null.
+async function sessionUser(req) {
+  try {
+    return await __tqSessionToken(req)
+  } catch (e) {
+    return null
+  }
+}
 
-  const paramDestructure =
-    paramFields.length > 0 ? `const { ${paramFields.join(', ')} } = req.query` : ''
+// One field of that user, as the session carries it (the token is seeded from
+// the users row), or undefined. The id is the token's subject when not copied.
+function sessionUserField(user, field) {
+  if (!user) return undefined
+  var value = field === 'id' && user.id == null ? user.sub : user[field]
+  return value == null || value === '' ? undefined : value
+}
+`
+      : ''
 
   const paramValidation =
     paramFields.length > 0
@@ -58,7 +112,7 @@ export const generateRawQueryFetcher = (
   return `import { Client } from 'pg'
 
 const FORBIDDEN_KEYWORDS = ${JSON.stringify(FORBIDDEN_KEYWORDS)}
-
+${sessionHelpers}
 const getClient = () => {
   const connStr = process.env.TELEPORT_DB_CONNECTION_STRING
   if (connStr) {
@@ -122,10 +176,11 @@ export default async function handler(req, res) {
       await client.end()
     }
   } catch (error) {
+    // A database error names tables, columns and values: server log only.
     console.error('Raw query fetch error:', error)
     return res.status(500).json({
       success: false,
-      error: error.message || 'Failed to fetch data',
+      error: 'Failed to fetch data',
       timestamp: Date.now()
     })
   }

package/src/fetchers/redshift.ts

@@ -127,8 +127,10 @@ export default async function handler(req, res) {
       if (filterTree) {
         const buildCondition = (condition) => {
           const field = sanitizeIdentifier(condition.source)
-          const value = condition.destination
-          const operand = condition.operand
+          const normalizedCondition = normalizeInOperand(condition.operand, condition.destination)
+          if (normalizedCondition === null) return null
+          const value = normalizedCondition.value
+          const operand = normalizedCondition.operand
           
           if (Array.isArray(value)) {
             if (value.length === 0) return null

package/src/fetchers/rest-api.ts

@@ -5,6 +5,11 @@ import {
   generateSafeJSONParseCode,
   generateFilterTreeHelpersCode,
 } from '../utils'
+import {
+  RESTAPICacheConfig,
+  generateRESTAPIResponseCacheCode,
+  resolveRESTAPICacheTTLSeconds,
+} from './utils/rest-api-response-cache'
 
 export const validateRESTAPIConfig = (
   config: Record<string, unknown>
@@ -76,11 +81,16 @@ interface RESTAPIConfig {
   authorization?: Authorization
   bodyType?: string
   body?: string
+  cache?: RESTAPICacheConfig
 }
 
 export const generateRESTAPIFetcher = (config: Record<string, unknown>): string => {
   const restConfig = config as RESTAPIConfig
   const authCode = generateAuthCode(restConfig.authorization || {})
+  // Every cache-only fragment below is empty when caching is off, so an
+  // uncached data source keeps generating byte-identical output.
+  const cacheTTLSeconds = resolveRESTAPICacheTTLSeconds(restConfig.cache)
+  const cached = cacheTTLSeconds !== undefined
 
   return `import fetch from 'node-fetch'
 
@@ -92,11 +102,13 @@ ${generateSortFilterHelperCode()}
 
 ${generateFilterTreeHelpersCode()}
 
-${generateCollectionPathHelperCode()}
+${generateCollectionPathHelperCode()}${
+    cached ? `\n\n${generateRESTAPIResponseCacheCode(cacheTTLSeconds)}` : ''
+  }
 
 export default async function handler(req, res) {
   try {
-    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset, collectionPath } = req.query
+    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset, collectionPath, itemsPath } = req.query
     
     const url = ${JSON.stringify(restConfig.url)}
     const method = ${JSON.stringify(restConfig.method || 'GET')}
@@ -134,7 +146,7 @@ export default async function handler(req, res) {
         : ''
     }
     
-    const response = await fetch(url, options)
+    const response = await ${cached ? 'fetchRestApiWithCache' : 'fetch'}(url, options)
     
     if (!response.ok) {
       return res.status(response.status).json({
@@ -144,9 +156,13 @@ export default async function handler(req, res) {
       })
     }
     
-    let data = await response.json()
+    let data = ${cached ? 'JSON.parse(response.bodyText)' : 'await response.json()'}
     
     data = resolveCollectionPath(data, collectionPath)
+    const itemsEnvelope = openItemsEnvelope(data, itemsPath)
+    if (itemsEnvelope) {
+      data = itemsEnvelope.items
+    }
     
     if (Array.isArray(data)) {
       if (query && query.trim()) {
@@ -278,9 +294,15 @@ export default async function handler(req, res) {
       }
     }
     
+    if (itemsEnvelope) {
+      data = itemsEnvelope.close(data)
+    }
+    
     const safeData = JSON.parse(JSON.stringify(data, dateReplacer))
     
-    return res.status(200).json({
+    ${
+      cached ? 'applyRestApiCacheHeaders(req, res, response.fetchedAt)\n    \n    ' : ''
+    }return res.status(200).json({
       success: true,
       data: safeData,
       timestamp: Date.now()