@teleporthq/teleport-plugin-next-data-source 0.43.66 → 0.43.68

package/src/fetchers/teleport.ts

@@ -16,6 +16,12 @@ import {
   generateSortFieldSqlHelper,
   generateSortTiebreakSql,
 } from '../product-price-sort'
+import { generateProductFilterClauseHelper } from '../product-filter-fields'
+import { collectLocalizedColumns, generateLocalizedColumnsHelper } from '../localized-columns'
+import { REQUEST_LOCALE_PARAM } from '../request-locale'
+import { generateReadGuardCall, generateTableAccessPreamble } from './utils/table-access-guard'
+import { generateRequestSqlGuardsCode } from './utils/request-sql-guards'
+import { generateArrayOverlapSqlCode } from '../array-overlap-sql'
 
 interface TeleportDBConfig {
   host?: string
@@ -27,6 +33,8 @@ interface TeleportDBConfig {
   ssl?: boolean | { ca?: string; cert?: string; key?: string; rejectUnauthorized?: boolean }
   sslConfig?: { ca?: string; cert?: string; key?: string; rejectUnauthorized?: boolean }
   options?: { schema?: string }
+  /** The provisioned schema, as the editor recorded it — the source of the per-language columns. */
+  selectedTables?: Record<string, { columns?: Array<{ name?: string }> }>
 }
 
 const DEFAULT_ENV_KEYS = {
@@ -62,6 +70,10 @@ export const generateTeleportFetcher = (
 ): string => {
   const dbConfig = config as TeleportDBConfig
   const schema = dbConfig.options?.schema
+  const columnNames = (dbConfig.selectedTables?.[tableName]?.columns || [])
+    .map((column) => column.name)
+    .filter((name): name is string => typeof name === 'string')
+  const localizedColumns = collectLocalizedColumns(columnNames, transformOptions.localization)
 
   const hostRef = resolveEnvReference(dbConfig.host, DEFAULT_ENV_KEYS.host)
   const portRef = resolveEnvReference(dbConfig.port, DEFAULT_ENV_KEYS.port)
@@ -95,6 +107,7 @@ export const generateTeleportFetcher = (
 
   return `import { Client } from 'pg'
 
+${generateTableAccessPreamble(transformOptions.trustedReaderRoles || [])}
 function normalizePostgresConnectionString(connectionString) {
   if (!connectionString || typeof connectionString !== 'string') return connectionString;
   if (/^postgresql:\\/(?!\\/)/i.test(connectionString)) {
@@ -150,8 +163,10 @@ ${generateSafeJSONParseCode()}
 ${generateFilterTreeHelpersCode()}
 
 ${generateSearchEscapeHelpersCode()}
+${generateArrayOverlapSqlCode()}
 ${getTransformationCode(tableName, transformOptions)}
-${getTransformWrapperCode(tableName)}
+${getTransformWrapperCode(tableName, transformOptions)}
+${generateRequestSqlGuardsCode()}
 const processFilters = (filters, conditions, queryParams, paramIndex) => {
   if (!filters) return paramIndex
   
@@ -160,16 +175,34 @@ const processFilters = (filters, conditions, queryParams, paramIndex) => {
   
   const buildCondition = (condition) => {
     const field = condition.source
-    const value = condition.destination
-    const operand = condition.operand
+    const normalizedCondition = normalizeInOperand(condition.operand, condition.destination)
+    if (normalizedCondition === null) return null
+    const value = normalizedCondition.value
+    const operand = normalizedCondition.operand
+    
+    // The products table's virtual fields (effective price, rating bucket,
+    // on-sale flag, variant axes) are whole clauses, not columns - so they are
+    // answered before any branch below can interpolate the field name raw.
+    const productClause = productFilterClause(field, operand, value, (param) => {
+      queryParams.push(param)
+      return '$' + paramIndex++
+    })
+    if (productClause !== null) return productClause
+
+    // A translatable column is compared against the value in every language,
+    // so a localized slug resolves under any locale - see localized-columns.ts.
+    const localizedClause = localizedEqualityClause(field, operand, value, (param) => {
+      queryParams.push(param)
+      return '$' + paramIndex++
+    })
+    if (localizedClause !== null) return localizedClause
+    assertRequestColumn(field, 'filter field')
     
     if (Array.isArray(value)) {
       if (value.length === 0) return null
       if (operand === 'array_overlap') {
-        // Row column is a JSON array (e.g. category_ids). Match when it
-        // shares any element with the destination set. jsonb ?| (function
-        // form) avoids the '?' placeholder-token ambiguity some drivers hit.
-        const clause = \`jsonb_exists_any(NULLIF(\${field}, '')::jsonb, $\${paramIndex}::text[])\`
+        // The row's list (see array-overlap-sql.ts) shares any value with the set.
+        const clause = arrayOverlapSql((localizedColumnList(field) || [field]), '$' + paramIndex)
         queryParams.push(value.map((entry) => String(entry)))
         paramIndex++
         return clause
@@ -187,7 +220,7 @@ const processFilters = (filters, conditions, queryParams, paramIndex) => {
       // ?categoryFilter=a,b,c) expands to multiple ids; one id stays one.
       const overlapValues = String(value).split(',').map((entry) => entry.trim()).filter(Boolean)
       if (overlapValues.length === 0) return null
-      const clause = \`jsonb_exists_any(NULLIF(\${field}, '')::jsonb, $\${paramIndex}::text[])\`
+      const clause = arrayOverlapSql((localizedColumnList(field) || [field]), '$' + paramIndex)
       queryParams.push(overlapValues)
       paramIndex++
       return clause
@@ -219,6 +252,10 @@ ${generateSortFieldSqlHelper(tableName)}
 
 ${generateSortFallbackFieldHelper(tableName)}
 
+${generateProductFilterClauseHelper(tableName)}
+
+${generateLocalizedColumnsHelper(localizedColumns)}
+
 // Matches DDL / dangerous statements the raw-query branch should refuse.
 // Keep this list conservative — anything destructive or schema-changing is
 // out of scope for a client-triggered fetch. SELECT and CTEs (WITH ...) are
@@ -263,6 +300,7 @@ function assertRawQuerySafe(rawQuery) {
 }
 
 export default async function handler(req, res) {
+${generateReadGuardCall(tableName, 'req.query && req.query.rawQuery')}
   const client = getClient()
 
   try {
@@ -285,12 +323,18 @@ export default async function handler(req, res) {
       const rawSafe = JSON.parse(JSON.stringify(rawPlain, dateReplacer))
       return res.status(200).json({
         success: true,
-        data: rawSafe,
+        // Every row here ends up in a browser (a page's props or a client
+        // refetch), so no credential column survives, whatever joined it.
+        data: __taWithoutCredentials(rawSafe, null),
         timestamp: Date.now()
       })
     }
 
     const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset } = req.query
+    // A visitor never filters, sorts or searches by a column it is not served.
+    if (__rowPolicy) __brpAssertVisibleFields(__rowPolicy, req.query)
+    // The language the page is in - what a translatable sort orders by.
+    const requestLocale = typeof req.query.${REQUEST_LOCALE_PARAM} === 'string' ? req.query.${REQUEST_LOCALE_PARAM} : null
     
     const conditions = []
     const queryParams = []
@@ -323,6 +367,7 @@ export default async function handler(req, res) {
           console.warn('Failed to fetch column names from information_schema:', schemaError.message)
         }
       }
+      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)
       
       if (columns.length > 0) {
         const pattern = '%' + escapeLikePattern(query) + '%'
@@ -337,6 +382,7 @@ export default async function handler(req, res) {
     }
     
     paramIndex = processFilters(filters, conditions, queryParams, paramIndex)
+    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')
     
     let sql = \`SELECT * FROM ${tableName}\`
     
@@ -345,15 +391,18 @@ export default async function handler(req, res) {
     }
     
     // Handle sorts - new array format. Two ORDER BY clauses are built: the one
-    // actually used, and a plain-column twin kept only as the fallback below.
+    // actually used (a translatable column in the request's language, the
+    // products table's price rewrites), and a plain-column twin kept only as
+    // the fallback below.
     let orderBySql = ''
     let plainOrderBySql = ''
     if (sorts) {
       const parsedSorts = safeJSONParse(sorts)
       if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
         const valid = parsedSorts.filter((sort) => sort && sort.field)
+        valid.forEach((sort) => assertRequestColumn(sort.field, 'sort field'))
         const orderOf = (sort) => (sort.order || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'
-        const orderClauses = valid.map((sort) => \`\${sortFieldSql(sort.field)} \${orderOf(sort)}\`)
+        const orderClauses = valid.map((sort) => \`\${localizedSortFieldSql(sort.field, requestLocale) || sortFieldSql(sort.field)} \${orderOf(sort)}\`)
         const plainClauses = valid.map((sort) => \`\${sortFallbackField(sort.field)} \${orderOf(sort)}\`)
 
         if (orderClauses.length > 0) {
@@ -369,16 +418,18 @@ export default async function handler(req, res) {
         }
       }
     } else if (sortBy) {
-      orderBySql = \` ORDER BY \${sortBy} \${(sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'}\`
-      plainOrderBySql = orderBySql
+      assertRequestColumn(sortBy, 'sort field')
+      const sortByDirection = (sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'
+      orderBySql = \` ORDER BY \${localizedSortFieldSql(sortBy, requestLocale) || sortBy} \${sortByDirection}\`
+      plainOrderBySql = \` ORDER BY \${sortBy} \${sortByDirection}\`
     }
     const usedDiscountAwareSort = orderBySql !== plainOrderBySql
 
-    const limitValue = limit || perPage
+    const limitValue = requestRowCount(limit || perPage)
     const offsetValue = offset !== undefined ? parseInt(offset) : (page && perPage ? (parseInt(page) - 1) * parseInt(perPage) : undefined)
 
     let sqlTail = ''
-    if (limitValue) {
+    if (limitValue !== undefined) {
       sqlTail += \` LIMIT \${limitValue}\`
     }
     
@@ -392,14 +443,16 @@ export default async function handler(req, res) {
     // The discount-aware price ordering is an inline sub-select over a JSON
     // column. It is written to be unraisable, but it runs inside ORDER BY for
     // the whole table - so if a database ever rejects it, fall back to ordering
-    // by the stored list price rather than serving an empty products page.
+    // by the stored list price rather than serving an empty products page. The
+    // translatable-column ordering takes the same exit: a per-language column
+    // the schema had at generation time may have been dropped since.
     let result
     try {
       result = await client.query(sql, queryParams)
     } catch (sortError) {
       if (!usedDiscountAwareSort) throw sortError
       console.warn(
-        'Discount-aware price sort failed; falling back to the list price:',
+        'Rewritten sort failed; falling back to the plain column:',
         sortError && sortError.message
       )
       result = await client.query(baseSql + plainOrderBySql + sqlTail, queryParams)
@@ -430,14 +483,20 @@ export default async function handler(req, res) {
 
     return res.status(200).json({
       success: true,
-      data: __numberedData,
+      data: __taWithoutCredentials(
+        __rowPolicy ? __brpStripHidden(__rowPolicy, __numberedData) : __numberedData,
+        ${JSON.stringify(tableName)}
+      ),
       timestamp: Date.now()
     })
   } catch (error) {
     console.error('Teleport DB fetch error:', error)
-    return res.status(500).json({
+    // A database error names tables, columns and values: it stays in the server
+    // log. Only an error this route raised for the caller (it carries a status)
+    // is repeated to it.
+    return res.status(error.status || 500).json({
       success: false,
-      error: error.message || 'Failed to fetch data',
+      error: error.status ? error.message : 'Failed to fetch data',
       timestamp: Date.now()
     })
   } finally {
@@ -462,11 +521,13 @@ export const generateTeleportCountFetcher = (
 
   return `
 async function getCount(req, res) {
+${generateReadGuardCall(tableName, null)}
   const client = getClient()
 
   try {
     await client.connect()
     const { query, queryColumns, filters } = req.query
+    if (__rowPolicy) __brpAssertVisibleFields(__rowPolicy, req.query)
     const conditions = []
     const queryParams = []
     let paramIndex = 1
@@ -498,6 +559,7 @@ async function getCount(req, res) {
           console.warn('Failed to fetch column names from information_schema:', schemaError.message)
         }
       }
+      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)
       
       if (columns.length > 0) {
         const pattern = '%' + escapeLikePattern(query) + '%'
@@ -514,6 +576,7 @@ async function getCount(req, res) {
     }
 
     paramIndex = processFilters(filters, conditions, queryParams, paramIndex)
+    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')
 
     let countSql = \`SELECT COUNT(*) FROM ${tableName}\`
     if (conditions.length > 0) {
@@ -530,9 +593,9 @@ async function getCount(req, res) {
     })
   } catch (error) {
     console.error('Error getting count:', error)
-    return res.status(500).json({
+    return res.status(error.status || 500).json({
       success: false,
-      error: error.message || 'Failed to get count',
+      error: error.status ? error.message : 'Failed to get count',
       timestamp: Date.now()
     })
   } finally {

package/src/fetchers/turso.ts

@@ -100,8 +100,10 @@ export default async function handler(req, res) {
       if (filterTree) {
         const buildCondition = (condition) => {
           const field = sanitizeIdentifier(condition.source)
-          const value = condition.destination
-          const operand = condition.operand
+          const normalizedCondition = normalizeInOperand(condition.operand, condition.destination)
+          if (normalizedCondition === null) return null
+          const value = normalizedCondition.value
+          const operand = normalizedCondition.operand
           
           if (Array.isArray(value)) {
             if (value.length === 0) return null

package/src/fetchers/utils/browser-row-policy.ts

@@ -0,0 +1,212 @@
+/**
+ * What a per-table read route (`/api/teleport-<table>-<source>` and its count
+ * twin) serves a BROWSER of the tables whose unpublished rows sit beside the
+ * public ones. (The tables it serves a browser not at all — the AI assistant's
+ * among them — are `TableAccess.PROTECTED_TABLES`, guarded by `__taGuardRead`.)
+ *
+ * The route answers whoever asks, with the whole table. For the blog that was
+ * every draft, scheduled and archived post — and each author's email address;
+ * for the catalogue, every draft and inactive product. The storefront's own
+ * bindings ask for the public rows, but the route is a URL anyone can call
+ * without them. So a caller that is not the store itself (its server code, or a
+ * signed-in administrator — the generated admin edits drafts through these
+ * routes) is served only the rows the storefront publishes, never a hidden
+ * column, and may neither filter, sort nor search by a hidden column: a filter
+ * is an oracle for a column it never returns.
+ */
+
+export interface BrowserRowPolicy {
+  /** SQL every browser read of the table is narrowed with. */
+  predicate: string
+  /** Keys never served to a browser, wherever they sit in a row (raw and transformed names). */
+  hiddenColumns: ReadonlyArray<string>
+}
+
+export const BROWSER_ROW_POLICIES: Readonly<Record<string, BrowserRowPolicy>> = {
+  // ONLY `published` is public — the blog's own rule (see the GUI's
+  // `blog-post-status.ts`): drafts, scheduled and archived posts are not.
+  teleport_blog_posts: {
+    predicate: "status = 'published'",
+    hiddenColumns: ['author_email', 'authorEmail'],
+  },
+  // The storefront sells `active` products; a draft or inactive one is the
+  // merchant's, spelled in any case the admin form stored it in.
+  teleport_products: {
+    predicate: "LOWER(TRIM(status)) = 'active'",
+    hiddenColumns: [],
+  },
+}
+
+/**
+ * ES5 source inlined after the table-access preamble (it uses `__ta*` and
+ * `__tqSessionToken`). Declares `__brpAccess(req, tableName, rawQuery)`, which
+ * resolves to `{ denied, policy }`: `denied` a `{ status, message }` refusal or
+ * null, `policy` the narrowing to apply to this read or null (the caller reads
+ * the table whole). Plus the helpers that apply a policy to a request and to
+ * its rows.
+ */
+export const generateBrowserRowPolicyCode =
+  (): string => `// GENERATED — see browser-row-policy.ts in teleport-plugin-next-data-source.
+var __BRP_POLICIES = ${JSON.stringify(BROWSER_ROW_POLICIES)};
+
+// Who is asking: the store's own server code and its administrators read every
+// row; anyone else is a visitor.
+async function __brpReader(req) {
+  if (__taIsInternalRequest(req)) return { trusted: true };
+  var token = null;
+  try {
+    token = await __tqSessionToken(req);
+  } catch (e) {
+    token = null;
+  }
+  var role = token ? __taRoleOf(token) : null;
+  return { trusted: !!role && __TA_TRUSTED_READER_ROLES.indexOf(role) !== -1 };
+}
+
+function __brpMentionsAny(rawQuery, tables) {
+  for (var i = 0; i < tables.length; i++) {
+    if (__taSqlMentionsTable(rawQuery, tables[i])) return true;
+  }
+  return false;
+}
+
+// A raw statement cannot be narrowed, so a visitor's statement that names a
+// narrowed table is refused whole. The session is only decoded when the read
+// touches one of these tables.
+async function __brpAccess(req, tableName, rawQuery) {
+  var raw = typeof rawQuery === 'string' && rawQuery.length > 0 ? rawQuery : null;
+  var bare = __taNormalizeTable(tableName);
+  var rawNarrowed = !!raw && __brpMentionsAny(raw, Object.keys(__BRP_POLICIES));
+  var policy = raw ? null : (Object.prototype.hasOwnProperty.call(__BRP_POLICIES, bare) ? __BRP_POLICIES[bare] : null);
+  if (!rawNarrowed && !policy) return { denied: null, policy: null };
+  var reader = await __brpReader(req);
+  if (reader.trusted) return { denied: null, policy: null };
+  if (rawNarrowed) {
+    return { denied: { status: 403, message: 'Forbidden: raw queries over this table are only available to server-side calls' }, policy: null };
+  }
+  return { denied: null, policy: policy };
+}
+
+function __brpColumnName(field) {
+  var parts = String(field == null ? '' : field).replace(/"/g, '').trim().split('.');
+  return parts[parts.length - 1];
+}
+
+function __brpIsHidden(policy, field) {
+  var name = __brpColumnName(field).toLowerCase();
+  for (var i = 0; i < policy.hiddenColumns.length; i++) {
+    if (policy.hiddenColumns[i].toLowerCase() === name) return true;
+  }
+  return false;
+}
+
+// Every field a request filters, sorts or searches by, however deep a filter
+// group nests it. A condition's value is data, not a field.
+function __brpRequestFields(value, out) {
+  if (Array.isArray(value)) {
+    for (var i = 0; i < value.length; i++) __brpRequestFields(value[i], out);
+  } else if (value && typeof value === 'object') {
+    if (typeof value.source === 'string') out.push(value.source);
+    if (typeof value.field === 'string') out.push(value.field);
+    var keys = Object.keys(value);
+    for (var k = 0; k < keys.length; k++) {
+      if (keys[k] === 'destination' || keys[k] === 'value') continue;
+      if (value[keys[k]] && typeof value[keys[k]] === 'object') __brpRequestFields(value[keys[k]], out);
+    }
+  } else if (typeof value === 'string' && value) {
+    out.push(value);
+  }
+  return out;
+}
+
+function __brpParse(value) {
+  if (typeof value !== 'string') return value;
+  try {
+    return JSON.parse(value);
+  } catch (e) {
+    return value;
+  }
+}
+
+function __brpAssertVisibleFields(policy, query) {
+  var q = query || {};
+  var fields = [];
+  __brpRequestFields(__brpParse(q.filters), fields);
+  __brpRequestFields(__brpParse(q.sorts), fields);
+  __brpRequestFields(__brpParse(q.queryColumns), fields);
+  if (typeof q.sortBy === 'string') fields.push(q.sortBy);
+  for (var i = 0; i < fields.length; i++) {
+    if (__brpIsHidden(policy, fields[i])) {
+      var err = new Error('Forbidden: ' + __brpColumnName(fields[i]) + ' is not readable');
+      err.status = 403;
+      throw err;
+    }
+  }
+}
+
+function __brpVisibleColumns(policy, columns) {
+  return columns.filter(function(column) { return !__brpIsHidden(policy, column); });
+}
+
+// The rows without a hidden key, at any depth: a transformed row nests related
+// rows (a post's related and adjacent posts) built the same way.
+function __brpStripHidden(policy, value) {
+  if (Array.isArray(value)) {
+    return value.map(function(entry) { return __brpStripHidden(policy, entry); });
+  }
+  if (!value || typeof value !== 'object') return value;
+  var copy = {};
+  Object.keys(value).forEach(function(key) {
+    if (!__brpIsHidden(policy, key)) copy[key] = __brpStripHidden(policy, value[key]);
+  });
+  return copy;
+}
+
+// Whether this request is answered exactly as an anonymous visitor's would be,
+// so a response cached for one may serve the other. A read whose answer depends
+// on who asks (\`viewDependent\`: a narrowed, protected or admin-only table) or
+// that runs a raw statement differs for the store's own server code and its
+// administrators, and must never share a cache entry with a visitor.
+async function __brpSharesPublicView(req, viewDependent) {
+  var raw = !!(req && req.query && typeof req.query.rawQuery === 'string' && req.query.rawQuery.length > 0);
+  if (!viewDependent && !raw) return true;
+  return !(await __brpReader(req)).trusted;
+}
+`
+
+/**
+ * Whether a per-table read route's answer depends on who asks — the rows it
+ * narrows, the tables it guards — so its response cache must be split by view.
+ */
+export const isViewDependentTable = (
+  tableName: string,
+  protectedTables: ReadonlyArray<string>
+): boolean => {
+  const parts = String(tableName || '')
+    .trim()
+    .toLowerCase()
+    .split('.')
+  const bare = parts[parts.length - 1].replace(/"/g, '')
+  return (
+    Object.prototype.hasOwnProperty.call(BROWSER_ROW_POLICIES, bare) ||
+    protectedTables.indexOf(bare) !== -1
+  )
+}
+
+/**
+ * The early return right after the table-access guard, plus the policy
+ * (`__rowPolicy`, null or a policy) the handler narrows the rest of its read by.
+ */
+export const generateBrowserRowAccessCall = (
+  tableName: string,
+  rawQueryExpr: string | null
+): string => {
+  return `  const __rowAccess = await __brpAccess(req, ${JSON.stringify(tableName)}, ${
+    rawQueryExpr || 'null'
+  })
+  if (__rowAccess.denied) {
+    return res.status(__rowAccess.denied.status).json({ success: false, error: __rowAccess.denied.message, timestamp: Date.now() })
+  }
+  const __rowPolicy = __rowAccess.policy
+`
+}

package/src/fetchers/utils/request-sql-guards.ts

@@ -0,0 +1,25 @@
+/**
+ * What a per-table read route takes from its query string and splices into
+ * SQL: filter columns, sort columns and a row count. Values are bound as
+ * parameters; these three are not, so each is checked for the one shape it
+ * may have before it reaches the statement.
+ */
+export const generateRequestSqlGuardsCode = (): string => `
+// A column name as this route accepts one from a request: plain, optionally
+// quoted or table-qualified. Anything else - an expression, a sub-select - is
+// SQL the caller wrote, and it would run as part of this statement.
+const REQUEST_COLUMN_RE = /^"?[A-Za-z_][A-Za-z0-9_]*"?(?:\\."?[A-Za-z_][A-Za-z0-9_]*"?)?$/
+function assertRequestColumn(field, label) {
+  if (typeof field !== 'string' || !REQUEST_COLUMN_RE.test(field)) {
+    const error = new Error('Invalid ' + label)
+    error.status = 400
+    throw error
+  }
+}
+
+// A row count from a request, as a whole number or nothing.
+function requestRowCount(value) {
+  const parsed = parseInt(value, 10)
+  return isNaN(parsed) || parsed < 0 ? undefined : parsed
+}
+`