@teleporthq/teleport-plugin-next-data-source 0.43.67 → 0.43.68

package/src/fetchers/teleport.ts

@@ -19,6 +19,9 @@ import {
 import { generateProductFilterClauseHelper } from '../product-filter-fields'
 import { collectLocalizedColumns, generateLocalizedColumnsHelper } from '../localized-columns'
 import { REQUEST_LOCALE_PARAM } from '../request-locale'
+import { generateReadGuardCall, generateTableAccessPreamble } from './utils/table-access-guard'
+import { generateRequestSqlGuardsCode } from './utils/request-sql-guards'
+import { generateArrayOverlapSqlCode } from '../array-overlap-sql'
 
 interface TeleportDBConfig {
   host?: string
@@ -104,6 +107,7 @@ export const generateTeleportFetcher = (
 
   return `import { Client } from 'pg'
 
+${generateTableAccessPreamble(transformOptions.trustedReaderRoles || [])}
 function normalizePostgresConnectionString(connectionString) {
   if (!connectionString || typeof connectionString !== 'string') return connectionString;
   if (/^postgresql:\\/(?!\\/)/i.test(connectionString)) {
@@ -159,8 +163,10 @@ ${generateSafeJSONParseCode()}
 ${generateFilterTreeHelpersCode()}
 
 ${generateSearchEscapeHelpersCode()}
+${generateArrayOverlapSqlCode()}
 ${getTransformationCode(tableName, transformOptions)}
 ${getTransformWrapperCode(tableName, transformOptions)}
+${generateRequestSqlGuardsCode()}
 const processFilters = (filters, conditions, queryParams, paramIndex) => {
   if (!filters) return paramIndex
   
@@ -190,14 +196,13 @@ const processFilters = (filters, conditions, queryParams, paramIndex) => {
       return '$' + paramIndex++
     })
     if (localizedClause !== null) return localizedClause
+    assertRequestColumn(field, 'filter field')
     
     if (Array.isArray(value)) {
       if (value.length === 0) return null
       if (operand === 'array_overlap') {
-        // Row column is a JSON array (e.g. category_ids). Match when it
-        // shares any element with the destination set. jsonb ?| (function
-        // form) avoids the '?' placeholder-token ambiguity some drivers hit.
-        const clause = \`jsonb_exists_any(NULLIF(\${field}, '')::jsonb, $\${paramIndex}::text[])\`
+        // The row's list (see array-overlap-sql.ts) shares any value with the set.
+        const clause = arrayOverlapSql((localizedColumnList(field) || [field]), '$' + paramIndex)
         queryParams.push(value.map((entry) => String(entry)))
         paramIndex++
         return clause
@@ -215,7 +220,7 @@ const processFilters = (filters, conditions, queryParams, paramIndex) => {
       // ?categoryFilter=a,b,c) expands to multiple ids; one id stays one.
       const overlapValues = String(value).split(',').map((entry) => entry.trim()).filter(Boolean)
       if (overlapValues.length === 0) return null
-      const clause = \`jsonb_exists_any(NULLIF(\${field}, '')::jsonb, $\${paramIndex}::text[])\`
+      const clause = arrayOverlapSql((localizedColumnList(field) || [field]), '$' + paramIndex)
       queryParams.push(overlapValues)
       paramIndex++
       return clause
@@ -295,6 +300,7 @@ function assertRawQuerySafe(rawQuery) {
 }
 
 export default async function handler(req, res) {
+${generateReadGuardCall(tableName, 'req.query && req.query.rawQuery')}
   const client = getClient()
 
   try {
@@ -317,12 +323,16 @@ export default async function handler(req, res) {
       const rawSafe = JSON.parse(JSON.stringify(rawPlain, dateReplacer))
       return res.status(200).json({
         success: true,
-        data: rawSafe,
+        // Every row here ends up in a browser (a page's props or a client
+        // refetch), so no credential column survives, whatever joined it.
+        data: __taWithoutCredentials(rawSafe, null),
         timestamp: Date.now()
       })
     }
 
     const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset } = req.query
+    // A visitor never filters, sorts or searches by a column it is not served.
+    if (__rowPolicy) __brpAssertVisibleFields(__rowPolicy, req.query)
     // The language the page is in - what a translatable sort orders by.
     const requestLocale = typeof req.query.${REQUEST_LOCALE_PARAM} === 'string' ? req.query.${REQUEST_LOCALE_PARAM} : null
     
@@ -357,6 +367,7 @@ export default async function handler(req, res) {
           console.warn('Failed to fetch column names from information_schema:', schemaError.message)
         }
       }
+      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)
       
       if (columns.length > 0) {
         const pattern = '%' + escapeLikePattern(query) + '%'
@@ -371,6 +382,7 @@ export default async function handler(req, res) {
     }
     
     paramIndex = processFilters(filters, conditions, queryParams, paramIndex)
+    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')
     
     let sql = \`SELECT * FROM ${tableName}\`
     
@@ -388,6 +400,7 @@ export default async function handler(req, res) {
       const parsedSorts = safeJSONParse(sorts)
       if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
         const valid = parsedSorts.filter((sort) => sort && sort.field)
+        valid.forEach((sort) => assertRequestColumn(sort.field, 'sort field'))
         const orderOf = (sort) => (sort.order || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'
         const orderClauses = valid.map((sort) => \`\${localizedSortFieldSql(sort.field, requestLocale) || sortFieldSql(sort.field)} \${orderOf(sort)}\`)
         const plainClauses = valid.map((sort) => \`\${sortFallbackField(sort.field)} \${orderOf(sort)}\`)
@@ -405,17 +418,18 @@ export default async function handler(req, res) {
         }
       }
     } else if (sortBy) {
+      assertRequestColumn(sortBy, 'sort field')
       const sortByDirection = (sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'
       orderBySql = \` ORDER BY \${localizedSortFieldSql(sortBy, requestLocale) || sortBy} \${sortByDirection}\`
       plainOrderBySql = \` ORDER BY \${sortBy} \${sortByDirection}\`
     }
     const usedDiscountAwareSort = orderBySql !== plainOrderBySql
 
-    const limitValue = limit || perPage
+    const limitValue = requestRowCount(limit || perPage)
     const offsetValue = offset !== undefined ? parseInt(offset) : (page && perPage ? (parseInt(page) - 1) * parseInt(perPage) : undefined)
 
     let sqlTail = ''
-    if (limitValue) {
+    if (limitValue !== undefined) {
       sqlTail += \` LIMIT \${limitValue}\`
     }
     
@@ -469,14 +483,20 @@ export default async function handler(req, res) {
 
     return res.status(200).json({
       success: true,
-      data: __numberedData,
+      data: __taWithoutCredentials(
+        __rowPolicy ? __brpStripHidden(__rowPolicy, __numberedData) : __numberedData,
+        ${JSON.stringify(tableName)}
+      ),
       timestamp: Date.now()
     })
   } catch (error) {
     console.error('Teleport DB fetch error:', error)
-    return res.status(500).json({
+    // A database error names tables, columns and values: it stays in the server
+    // log. Only an error this route raised for the caller (it carries a status)
+    // is repeated to it.
+    return res.status(error.status || 500).json({
       success: false,
-      error: error.message || 'Failed to fetch data',
+      error: error.status ? error.message : 'Failed to fetch data',
       timestamp: Date.now()
     })
   } finally {
@@ -501,11 +521,13 @@ export const generateTeleportCountFetcher = (
 
   return `
 async function getCount(req, res) {
+${generateReadGuardCall(tableName, null)}
   const client = getClient()
 
   try {
     await client.connect()
     const { query, queryColumns, filters } = req.query
+    if (__rowPolicy) __brpAssertVisibleFields(__rowPolicy, req.query)
     const conditions = []
     const queryParams = []
     let paramIndex = 1
@@ -537,6 +559,7 @@ async function getCount(req, res) {
           console.warn('Failed to fetch column names from information_schema:', schemaError.message)
         }
       }
+      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)
       
       if (columns.length > 0) {
         const pattern = '%' + escapeLikePattern(query) + '%'
@@ -553,6 +576,7 @@ async function getCount(req, res) {
     }
 
     paramIndex = processFilters(filters, conditions, queryParams, paramIndex)
+    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')
 
     let countSql = \`SELECT COUNT(*) FROM ${tableName}\`
     if (conditions.length > 0) {
@@ -569,9 +593,9 @@ async function getCount(req, res) {
     })
   } catch (error) {
     console.error('Error getting count:', error)
-    return res.status(500).json({
+    return res.status(error.status || 500).json({
       success: false,
-      error: error.message || 'Failed to get count',
+      error: error.status ? error.message : 'Failed to get count',
       timestamp: Date.now()
     })
   } finally {

package/src/fetchers/utils/browser-row-policy.ts

@@ -0,0 +1,212 @@
+/**
+ * What a per-table read route (`/api/teleport-<table>-<source>` and its count
+ * twin) serves a BROWSER of the tables whose unpublished rows sit beside the
+ * public ones. (The tables it serves a browser not at all — the AI assistant's
+ * among them — are `TableAccess.PROTECTED_TABLES`, guarded by `__taGuardRead`.)
+ *
+ * The route answers whoever asks, with the whole table. For the blog that was
+ * every draft, scheduled and archived post — and each author's email address;
+ * for the catalogue, every draft and inactive product. The storefront's own
+ * bindings ask for the public rows, but the route is a URL anyone can call
+ * without them. So a caller that is not the store itself (its server code, or a
+ * signed-in administrator — the generated admin edits drafts through these
+ * routes) is served only the rows the storefront publishes, never a hidden
+ * column, and may neither filter, sort nor search by a hidden column: a filter
+ * is an oracle for a column it never returns.
+ */
+
+export interface BrowserRowPolicy {
+  /** SQL every browser read of the table is narrowed with. */
+  predicate: string
+  /** Keys never served to a browser, wherever they sit in a row (raw and transformed names). */
+  hiddenColumns: ReadonlyArray<string>
+}
+
+export const BROWSER_ROW_POLICIES: Readonly<Record<string, BrowserRowPolicy>> = {
+  // ONLY `published` is public — the blog's own rule (see the GUI's
+  // `blog-post-status.ts`): drafts, scheduled and archived posts are not.
+  teleport_blog_posts: {
+    predicate: "status = 'published'",
+    hiddenColumns: ['author_email', 'authorEmail'],
+  },
+  // The storefront sells `active` products; a draft or inactive one is the
+  // merchant's, spelled in any case the admin form stored it in.
+  teleport_products: {
+    predicate: "LOWER(TRIM(status)) = 'active'",
+    hiddenColumns: [],
+  },
+}
+
+/**
+ * ES5 source inlined after the table-access preamble (it uses `__ta*` and
+ * `__tqSessionToken`). Declares `__brpAccess(req, tableName, rawQuery)`, which
+ * resolves to `{ denied, policy }`: `denied` a `{ status, message }` refusal or
+ * null, `policy` the narrowing to apply to this read or null (the caller reads
+ * the table whole). Plus the helpers that apply a policy to a request and to
+ * its rows.
+ */
+export const generateBrowserRowPolicyCode =
+  (): string => `// GENERATED — see browser-row-policy.ts in teleport-plugin-next-data-source.
+var __BRP_POLICIES = ${JSON.stringify(BROWSER_ROW_POLICIES)};
+
+// Who is asking: the store's own server code and its administrators read every
+// row; anyone else is a visitor.
+async function __brpReader(req) {
+  if (__taIsInternalRequest(req)) return { trusted: true };
+  var token = null;
+  try {
+    token = await __tqSessionToken(req);
+  } catch (e) {
+    token = null;
+  }
+  var role = token ? __taRoleOf(token) : null;
+  return { trusted: !!role && __TA_TRUSTED_READER_ROLES.indexOf(role) !== -1 };
+}
+
+function __brpMentionsAny(rawQuery, tables) {
+  for (var i = 0; i < tables.length; i++) {
+    if (__taSqlMentionsTable(rawQuery, tables[i])) return true;
+  }
+  return false;
+}
+
+// A raw statement cannot be narrowed, so a visitor's statement that names a
+// narrowed table is refused whole. The session is only decoded when the read
+// touches one of these tables.
+async function __brpAccess(req, tableName, rawQuery) {
+  var raw = typeof rawQuery === 'string' && rawQuery.length > 0 ? rawQuery : null;
+  var bare = __taNormalizeTable(tableName);
+  var rawNarrowed = !!raw && __brpMentionsAny(raw, Object.keys(__BRP_POLICIES));
+  var policy = raw ? null : (Object.prototype.hasOwnProperty.call(__BRP_POLICIES, bare) ? __BRP_POLICIES[bare] : null);
+  if (!rawNarrowed && !policy) return { denied: null, policy: null };
+  var reader = await __brpReader(req);
+  if (reader.trusted) return { denied: null, policy: null };
+  if (rawNarrowed) {
+    return { denied: { status: 403, message: 'Forbidden: raw queries over this table are only available to server-side calls' }, policy: null };
+  }
+  return { denied: null, policy: policy };
+}
+
+function __brpColumnName(field) {
+  var parts = String(field == null ? '' : field).replace(/"/g, '').trim().split('.');
+  return parts[parts.length - 1];
+}
+
+function __brpIsHidden(policy, field) {
+  var name = __brpColumnName(field).toLowerCase();
+  for (var i = 0; i < policy.hiddenColumns.length; i++) {
+    if (policy.hiddenColumns[i].toLowerCase() === name) return true;
+  }
+  return false;
+}
+
+// Every field a request filters, sorts or searches by, however deep a filter
+// group nests it. A condition's value is data, not a field.
+function __brpRequestFields(value, out) {
+  if (Array.isArray(value)) {
+    for (var i = 0; i < value.length; i++) __brpRequestFields(value[i], out);
+  } else if (value && typeof value === 'object') {
+    if (typeof value.source === 'string') out.push(value.source);
+    if (typeof value.field === 'string') out.push(value.field);
+    var keys = Object.keys(value);
+    for (var k = 0; k < keys.length; k++) {
+      if (keys[k] === 'destination' || keys[k] === 'value') continue;
+      if (value[keys[k]] && typeof value[keys[k]] === 'object') __brpRequestFields(value[keys[k]], out);
+    }
+  } else if (typeof value === 'string' && value) {
+    out.push(value);
+  }
+  return out;
+}
+
+function __brpParse(value) {
+  if (typeof value !== 'string') return value;
+  try {
+    return JSON.parse(value);
+  } catch (e) {
+    return value;
+  }
+}
+
+function __brpAssertVisibleFields(policy, query) {
+  var q = query || {};
+  var fields = [];
+  __brpRequestFields(__brpParse(q.filters), fields);
+  __brpRequestFields(__brpParse(q.sorts), fields);
+  __brpRequestFields(__brpParse(q.queryColumns), fields);
+  if (typeof q.sortBy === 'string') fields.push(q.sortBy);
+  for (var i = 0; i < fields.length; i++) {
+    if (__brpIsHidden(policy, fields[i])) {
+      var err = new Error('Forbidden: ' + __brpColumnName(fields[i]) + ' is not readable');
+      err.status = 403;
+      throw err;
+    }
+  }
+}
+
+function __brpVisibleColumns(policy, columns) {
+  return columns.filter(function(column) { return !__brpIsHidden(policy, column); });
+}
+
+// The rows without a hidden key, at any depth: a transformed row nests related
+// rows (a post's related and adjacent posts) built the same way.
+function __brpStripHidden(policy, value) {
+  if (Array.isArray(value)) {
+    return value.map(function(entry) { return __brpStripHidden(policy, entry); });
+  }
+  if (!value || typeof value !== 'object') return value;
+  var copy = {};
+  Object.keys(value).forEach(function(key) {
+    if (!__brpIsHidden(policy, key)) copy[key] = __brpStripHidden(policy, value[key]);
+  });
+  return copy;
+}
+
+// Whether this request is answered exactly as an anonymous visitor's would be,
+// so a response cached for one may serve the other. A read whose answer depends
+// on who asks (\`viewDependent\`: a narrowed, protected or admin-only table) or
+// that runs a raw statement differs for the store's own server code and its
+// administrators, and must never share a cache entry with a visitor.
+async function __brpSharesPublicView(req, viewDependent) {
+  var raw = !!(req && req.query && typeof req.query.rawQuery === 'string' && req.query.rawQuery.length > 0);
+  if (!viewDependent && !raw) return true;
+  return !(await __brpReader(req)).trusted;
+}
+`
+
+/**
+ * Whether a per-table read route's answer depends on who asks — the rows it
+ * narrows, the tables it guards — so its response cache must be split by view.
+ */
+export const isViewDependentTable = (
+  tableName: string,
+  protectedTables: ReadonlyArray<string>
+): boolean => {
+  const parts = String(tableName || '')
+    .trim()
+    .toLowerCase()
+    .split('.')
+  const bare = parts[parts.length - 1].replace(/"/g, '')
+  return (
+    Object.prototype.hasOwnProperty.call(BROWSER_ROW_POLICIES, bare) ||
+    protectedTables.indexOf(bare) !== -1
+  )
+}
+
+/**
+ * The early return right after the table-access guard, plus the policy
+ * (`__rowPolicy`, null or a policy) the handler narrows the rest of its read by.
+ */
+export const generateBrowserRowAccessCall = (
+  tableName: string,
+  rawQueryExpr: string | null
+): string => {
+  return `  const __rowAccess = await __brpAccess(req, ${JSON.stringify(tableName)}, ${
+    rawQueryExpr || 'null'
+  })
+  if (__rowAccess.denied) {
+    return res.status(__rowAccess.denied.status).json({ success: false, error: __rowAccess.denied.message, timestamp: Date.now() })
+  }
+  const __rowPolicy = __rowAccess.policy
+`
+}

package/src/fetchers/utils/request-sql-guards.ts

@@ -0,0 +1,25 @@
+/**
+ * What a per-table read route takes from its query string and splices into
+ * SQL: filter columns, sort columns and a row count. Values are bound as
+ * parameters; these three are not, so each is checked for the one shape it
+ * may have before it reaches the statement.
+ */
+export const generateRequestSqlGuardsCode = (): string => `
+// A column name as this route accepts one from a request: plain, optionally
+// quoted or table-qualified. Anything else - an expression, a sub-select - is
+// SQL the caller wrote, and it would run as part of this statement.
+const REQUEST_COLUMN_RE = /^"?[A-Za-z_][A-Za-z0-9_]*"?(?:\\."?[A-Za-z_][A-Za-z0-9_]*"?)?$/
+function assertRequestColumn(field, label) {
+  if (typeof field !== 'string' || !REQUEST_COLUMN_RE.test(field)) {
+    const error = new Error('Invalid ' + label)
+    error.status = 400
+    throw error
+  }
+}
+
+// A row count from a request, as a whole number or nothing.
+function requestRowCount(value) {
+  const parsed = parseInt(value, 10)
+  return isNaN(parsed) || parsed < 0 ? undefined : parsed
+}
+`

package/src/fetchers/utils/rest-api-response-cache.ts

@@ -0,0 +1,188 @@
+import { DataCache } from '@teleporthq/teleport-shared'
+
+/**
+ * The REST API data source's response cache: `config.cache` as the editor
+ * stores it on the data source.
+ */
+export interface RESTAPICacheConfig {
+  enabled?: boolean
+  ttlSeconds?: number
+}
+
+/** A year: past that, the window only ever ends with the next deployment. */
+const MAX_TTL_SECONDS = 31_536_000
+
+/**
+ * Bounds for the one store every REST API data source in a server process
+ * shares. Entries are raw JSON text, so the character budget is close to the
+ * memory the cache holds.
+ */
+const MAX_ENTRIES = 100
+const MAX_CHARS = 33_554_432
+
+/**
+ * How long a request may wait on an upstream call another request started.
+ * An older call is treated as stuck and a new one is made, so one hung socket
+ * cannot hold every later visitor.
+ */
+const IN_FLIGHT_JOIN_MS = 10_000
+
+/**
+ * The window, in whole seconds, a REST API data source caches its upstream
+ * response for — or `undefined` when caching is off, which keeps the emitted
+ * fetcher exactly what it was before this option existed.
+ */
+export const resolveRESTAPICacheTTLSeconds = (
+  cache: RESTAPICacheConfig | undefined
+): number | undefined => {
+  if (!cache || typeof cache !== 'object' || cache.enabled !== true) {
+    return undefined
+  }
+
+  const { ttlSeconds } = cache
+  const seconds =
+    typeof ttlSeconds === 'number' && Number.isFinite(ttlSeconds) && ttlSeconds > 0
+      ? Math.max(1, Math.floor(ttlSeconds))
+      : DataCache.DEFAULT_CACHE_TTL_SECONDS
+
+  return Math.min(seconds, MAX_TTL_SECONDS)
+}
+
+/**
+ * Runtime helpers of a cached REST API fetcher.
+ *
+ * The cache sits under the handler, around the upstream `fetch` only: every
+ * caller — the API route, `getStaticProps` through `fetchData`, the count
+ * route, the global-state route — asks the same URL, and search, filters, sort
+ * and paging are applied to the cached payload afterwards. One upstream call
+ * per window therefore serves every page, filter and visitor.
+ *
+ * - The store lives on `globalThis`, so every data-source module in the
+ *   process (each API route is its own bundle) shares it. On a serverless host
+ *   that is one store per warm instance; the `s-maxage` header below is what
+ *   carries the window to the CDN in front of all of them.
+ * - Entries are keyed by the whole upstream request (method, URL, headers,
+ *   body) and hold the response TEXT: every reader parses its own copy, so a
+ *   handler that sorts in place can never reorder another request's rows.
+ * - Freshness is judged by the READER's window, so two data sources calling
+ *   the same URL with different windows each get what they asked for.
+ * - Only a 2xx JSON response is kept. Errors, non-JSON bodies and network
+ *   failures reach the caller as before and are retried by the next request.
+ *
+ * Emitted inside a template literal: no backticks or template placeholders in
+ * here, not even in comments.
+ */
+export const generateRESTAPIResponseCacheCode = (ttlSeconds: number): string => {
+  return `const REST_API_CACHE_TTL_MS = ${ttlSeconds * 1000}
+const REST_API_CACHE_MAX_ENTRIES = ${MAX_ENTRIES}
+const REST_API_CACHE_MAX_CHARS = ${MAX_CHARS}
+const REST_API_IN_FLIGHT_JOIN_MS = ${IN_FLIGHT_JOIN_MS}
+
+// One store per server process, shared by every REST API data source module.
+if (!globalThis.__tqRestApiCache) {
+  globalThis.__tqRestApiCache = { entries: new Map(), inFlight: new Map(), chars: 0 }
+}
+const restApiCache = globalThis.__tqRestApiCache
+
+function restApiCacheKey(url, options) {
+  return JSON.stringify([options.method, url, options.headers, options.body === undefined ? null : options.body])
+}
+
+function forgetRestApiResponse(key) {
+  const entry = restApiCache.entries.get(key)
+  if (entry) {
+    restApiCache.entries.delete(key)
+    restApiCache.chars -= entry.bodyText.length
+  }
+}
+
+function rememberRestApiResponse(key, entry) {
+  forgetRestApiResponse(key)
+  if (entry.bodyText.length > REST_API_CACHE_MAX_CHARS) {
+    return
+  }
+  restApiCache.entries.set(key, entry)
+  restApiCache.chars += entry.bodyText.length
+  // A Map iterates in insertion order and every hit re-inserts its entry, so
+  // the first key is always the least recently used one.
+  while (
+    restApiCache.entries.size > REST_API_CACHE_MAX_ENTRIES ||
+    restApiCache.chars > REST_API_CACHE_MAX_CHARS
+  ) {
+    forgetRestApiResponse(restApiCache.entries.keys().next().value)
+  }
+}
+
+async function requestRestApi(url, options) {
+  const response = await fetch(url, options)
+  if (!response.ok) {
+    return { ok: false, status: response.status, statusText: response.statusText }
+  }
+  const bodyText = await response.text()
+  // Parsed once here so a body that is not JSON fails this request, as
+  // response.json() would, instead of being cached and failing every request
+  // until the window ends.
+  JSON.parse(bodyText)
+  return {
+    ok: true,
+    status: response.status,
+    statusText: response.statusText,
+    bodyText,
+    fetchedAt: Date.now(),
+  }
+}
+
+function fetchRestApiWithCache(url, options) {
+  const key = restApiCacheKey(url, options)
+  const now = Date.now()
+
+  const cached = restApiCache.entries.get(key)
+  if (cached && now >= cached.fetchedAt && now - cached.fetchedAt < REST_API_CACHE_TTL_MS) {
+    restApiCache.entries.delete(key)
+    restApiCache.entries.set(key, cached)
+    return Promise.resolve(cached)
+  }
+
+  // Concurrent misses share one upstream call instead of each making their own.
+  const pending = restApiCache.inFlight.get(key)
+  if (pending && now - pending.startedAt < REST_API_IN_FLIGHT_JOIN_MS) {
+    return pending.promise
+  }
+
+  const flight = { startedAt: now, promise: null }
+  const release = () => {
+    if (restApiCache.inFlight.get(key) === flight) {
+      restApiCache.inFlight.delete(key)
+    }
+  }
+  flight.promise = requestRestApi(url, options).then(
+    (result) => {
+      release()
+      if (result.ok) {
+        rememberRestApiResponse(key, result)
+      }
+      return result
+    },
+    (error) => {
+      release()
+      throw error
+    }
+  )
+  restApiCache.inFlight.set(key, flight)
+  return flight.promise
+}
+
+// Lets the CDN answer this exact URL until the upstream response it was built
+// from expires, so neither layer serves it longer than the window. Only a real
+// GET response gets the header: fetchData, fetchCount and tqWithCache call the
+// handler with a bare { status, json } object.
+function applyRestApiCacheHeaders(req, res, fetchedAt) {
+  if (!req || req.method !== 'GET' || !res || typeof res.setHeader !== 'function') {
+    return
+  }
+  const remainingSeconds = Math.floor((fetchedAt + REST_API_CACHE_TTL_MS - Date.now()) / 1000)
+  if (remainingSeconds > 0) {
+    res.setHeader('Cache-Control', 'public, max-age=0, s-maxage=' + remainingSeconds)
+  }
+}`
+}

package/src/fetchers/utils/table-access-guard.ts

@@ -0,0 +1,39 @@
+import { SessionCookieResolver, TableAccess } from '@teleporthq/teleport-shared'
+import { generateBrowserRowAccessCall, generateBrowserRowPolicyCode } from './browser-row-policy'
+
+/**
+ * The money-table guard for a generated per-table read route
+ * (`/api/teleport-<table>-<source>` and its `-count` twin).
+ *
+ * Every table a page binds gets such a route, and the route serves the whole
+ * table — plus any single SELECT through `?rawQuery=` — to whoever asks. For a
+ * catalogue that is the product; for gift cards and voucher codes it is theft.
+ * The guard refuses a protected table (see `TableAccess.PROTECTED_TABLES`)
+ * unless the caller is a server segment presenting the app secret or a
+ * signed-in member of a trusted role — the generated admin, whose list pages
+ * are the one browser reader these tables have. It is followed by the
+ * browser row policy (see `browser-row-policy.ts`): unpublished rows and
+ * private columns of the public tables, and the admin-only tables.
+ */
+
+/** Declares the session resolver and the `__ta*` guard once per module. */
+export const generateTableAccessPreamble = (trustedReaderRoles: ReadonlyArray<string>): string => {
+  return `${SessionCookieResolver.generateCommonJsSessionTokenResolverCode()}
+${TableAccess.generateTableAccessHelperCode({ trustedReaderRoles })}
+${generateBrowserRowPolicyCode()}`
+}
+
+/**
+ * The early return at the top of a handler, before the client connects:
+ * `tableName` is the module's table, `rawQueryExpr` the request's raw statement
+ * (or `null` where the handler accepts none).
+ */
+export const generateReadGuardCall = (tableName: string, rawQueryExpr: string | null): string => {
+  return `  const __access = await __taGuardRead(req, ${JSON.stringify(tableName)}, ${
+    rawQueryExpr || 'null'
+  })
+  if (__access) {
+    return res.status(__access.status).json({ success: false, error: __access.message, timestamp: Date.now() })
+  }
+${generateBrowserRowAccessCall(tableName, rawQueryExpr)}`
+}