@teleporthq/teleport-plugin-next-data-source 0.43.75 → 0.44.1

package/__tests__/browser-row-policy.test.ts

@@ -67,7 +67,10 @@ function bootTableRoute(tableName: string, options: BootOptions = {}) {
     options.cache
   )
   const code = esm
-    .replace("import { Client } from 'pg'", "const { Client } = require('pg')")
+    .replace(
+      "import { Client, types as pgTypes } from 'pg'",
+      "const { Client, types: pgTypes } = require('pg')"
+    )
     .replace(
       "import { tqWithCache } from '../tq-cache/server'",
       "const { tqWithCache } = require('tq-cache')"
@@ -190,11 +193,25 @@ function bootTableRoute(tableName: string, options: BootOptions = {}) {
     return moduleObj.exports.fetchData({})
   }
 
-  return { run, serverFetch, queries, cacheCalls }
+  // A page's own data, as its getStaticProps / getServerSideProps reads it.
+  const pageFetch = async (params: Record<string, unknown> = {}): Promise<unknown> => {
+    queries.length = 0
+    session = null
+    return moduleObj.exports.fetchData(params, { as: 'visitor' })
+  }
+  const pageCount = async (params: Record<string, unknown> = {}): Promise<unknown> => {
+    queries.length = 0
+    session = null
+    return moduleObj.exports.fetchCount(params, { as: 'visitor' })
+  }
+
+  return { run, serverFetch, pageFetch, pageCount, queries, cacheCalls }
 }
 
 const internal = { 'x-internal-data-secret': SECRET }
 
+const SORT_BY_NAME = JSON.stringify([{ field: 'name', order: 'asc' }])
+
 const mainQuery = (result: RouteResult): string =>
   (result.queries.find((q) => /^\s*SELECT \* FROM/i.test(q.sql)) || { sql: '' }).sql
 
@@ -230,7 +247,7 @@ describe('blog posts: a visitor reads the published posts, never an author email
     expect(JSON.stringify(shopper.body.data)).not.toContain('ana@example.com')
   })
 
-  it('serves the store everything: the admin, a server segment and getStaticProps', async () => {
+  it("serves the store everything: the admin, a server segment and the store's own server code", async () => {
     const admin = await posts.run({ session: { role: 'admin' } })
     expect(mainQuery(admin)).not.toContain("status = 'published'")
     // The post view model carries no email for anyone — a page's data must not
@@ -249,6 +266,26 @@ describe('blog posts: a visitor reads the published posts, never an author email
     expect(serverRead && serverRead.sql).not.toContain("(status = 'published')")
   })
 
+  // This used to read as the store too: a page's getStaticProps called
+  // fetchData with the store's own marker. But a page's data is what it renders,
+  // and it reaches whoever opens the page (and `/_next/data` without rendering
+  // it): a draft painted on page 1 that the visitor's own page 2 skipped, a
+  // draft's details page anyone could open. A page reads `{ as: 'visitor' }`.
+  it("reads a page's data as a visitor: published posts, no author email", async () => {
+    await posts.pageFetch()
+    const pageRead = posts.queries.find((q) => /^\s*SELECT \* FROM/i.test(q.sql))
+    expect(pageRead && pageRead.sql).toContain("(status = 'published')")
+
+    const rawRows = (await posts.pageFetch({ rawRows: 'true' })) as any[]
+    expect(JSON.stringify(rawRows)).not.toContain('ana@example.com')
+    expect(rawRows[0].title).toBe('Hello')
+
+    await posts.pageCount()
+    expect(posts.queries.some((q) => /COUNT\(\*\).*\(status = 'published'\)/.test(q.sql))).toBe(
+      true
+    )
+  })
+
   it('narrows the count the same way', async () => {
     const guest = await posts.run({ handler: 'getCount' })
     expect(guest.status).toBe(200)
@@ -331,6 +368,172 @@ describe('products: a visitor reads the active products', () => {
     )
     expect(mainQuery(await products.run({ headers: internal }))).not.toContain("= 'active'")
   })
+
+  it("narrows a page's own data like a visitor's request, page and count alike", async () => {
+    const visitor = mainQuery(
+      await products.run({ query: { page: '1', perPage: '20', sorts: SORT_BY_NAME } })
+    )
+    await products.pageFetch({ page: 1, perPage: 20, sorts: SORT_BY_NAME })
+    const page = (products.queries.find((q) => /^\s*SELECT \* FROM/i.test(q.sql)) || { sql: '' })
+      .sql
+    expect(page).toContain("(LOWER(TRIM(status)) = 'active')")
+    expect(page).toBe(visitor)
+
+    await products.pageCount()
+    expect(
+      products.queries.some((q) =>
+        /COUNT\(\*\).*\(LOWER\(TRIM\(status\)\) = 'active'\)/.test(q.sql)
+      )
+    ).toBe(true)
+  })
+
+  it("runs a page's own statement over the products a visitor is served", async () => {
+    const featured =
+      'SELECT tp.slug, fpc.blurb FROM featured_product_curations fpc INNER JOIN teleport_products tp ON tp.id = fpc.product_id ORDER BY fpc.display_rank ASC LIMIT 8'
+    await products.pageFetch({ rawQuery: featured })
+    expect(products.queries.map((q) => q.sql)).toEqual([
+      `WITH "teleport_products" AS (SELECT * FROM "teleport_products" AS __brp_rows WHERE (LOWER(TRIM(status)) = 'active')) ${featured}`,
+    ])
+
+    // Its own WITH list comes after, so its entries read the visitor's rows too.
+    const picked =
+      'WITH picks AS (SELECT * FROM teleport_products WHERE price > 6) SELECT slug FROM picks;'
+    await products.pageFetch({ rawQuery: picked })
+    expect(products.queries.map((q) => q.sql)).toEqual([
+      `WITH "teleport_products" AS (SELECT * FROM "teleport_products" AS __brp_rows WHERE (LOWER(TRIM(status)) = 'active')),  picks AS (SELECT * FROM teleport_products WHERE price > 6) SELECT slug FROM picks`,
+    ])
+
+    // A statement over no narrowed table runs as written.
+    await products.pageFetch({ rawQuery: 'SELECT id FROM category_tiles' })
+    expect(products.queries.map((q) => q.sql)).toEqual(['SELECT id FROM category_tiles'])
+
+    // The store's own server code still reads every product.
+    await products.serverFetch()
+    expect(products.queries.map((q) => q.sql).join(' ')).not.toContain("= 'active'")
+  })
+
+  it('refuses a statement it cannot narrow, rather than run it whole', async () => {
+    // A schema reaches the table past the visitor's rows; a RECURSIVE list
+    // would see its own entries.
+    for (const rawQuery of [
+      'SELECT * FROM public.teleport_products',
+      'SELECT * FROM "public"."teleport_products"',
+      'WITH RECURSIVE t AS (SELECT 1) SELECT * FROM teleport_products',
+    ]) {
+      await expect(products.pageFetch({ rawQuery })).rejects.toThrow(/cannot be read for a visitor/)
+      expect(products.queries).toEqual([])
+    }
+    // A statement that can read a table without naming it is refused sooner:
+    // it may be reading any protected one.
+    await expect(
+      products.pageFetch({
+        rawQuery: "SELECT query_to_xml('select * from teleport_products', true, true, '')",
+      })
+    ).rejects.toThrow('Unauthenticated')
+    expect(products.queries).toEqual([])
+  })
+})
+
+describe("members: a page carries a member's public profile, never their account", () => {
+  const MEMBER = {
+    id: 'u2',
+    name: 'Bo',
+    email: 'bo@example.com',
+    phone: '+40 700 000 000',
+    details: { address: '1 Main St' },
+    role: 'user',
+    password: 'hash',
+    access_token: 'token',
+    image: 'https://cdn.example.com/bo.png',
+    created_at: '2026-01-01T00:00:00.000Z',
+  }
+  const PRIVATE = [
+    'bo@example.com',
+    '+40 700',
+    '1 Main St',
+    'hash',
+    'token',
+    '"role"',
+    '2026-01-01',
+  ]
+  const byId = JSON.stringify([
+    { type: 'condition', source: 'id', destination: 'u2', operand: '=' },
+  ])
+
+  it('reads the profile a page shows: id, name and avatar only', async () => {
+    const users = bootTableRoute('users', { rows: [MEMBER] })
+    const rows = (await users.pageFetch({ filters: byId, limit: 1 })) as any[]
+
+    expect(rows).toEqual([{ id: 'u2', name: 'Bo', image: 'https://cdn.example.com/bo.png' }])
+    PRIVATE.forEach((value) => expect(JSON.stringify(rows)).not.toContain(value))
+    expect(mainQuery({ queries: users.queries } as RouteResult)).toBe(
+      'SELECT * FROM users WHERE id = $1 AND (TRUE) LIMIT 1'
+    )
+  })
+
+  it('never answers a filter, sort or search over a private column', async () => {
+    const users = bootTableRoute('users', { rows: [MEMBER] })
+    const email = JSON.stringify([
+      { type: 'condition', source: 'email', destination: 'bo@example.com', operand: '=' },
+    ])
+    await expect(users.pageFetch({ filters: email })).rejects.toThrow('email is not readable')
+    await expect(
+      users.pageFetch({ sorts: JSON.stringify([{ field: 'role', order: 'asc' }]) })
+    ).rejects.toThrow('role is not readable')
+    expect(users.queries).toEqual([])
+
+    await users.pageFetch({ query: 'bo', queryColumns: JSON.stringify(['name', 'email']) })
+    const searched = mainQuery({ queries: users.queries } as RouteResult)
+    expect(searched).toContain('"name"::text ILIKE')
+    expect(searched).not.toContain('"email"')
+  })
+
+  it("keeps a browser out, the admin's and the server's reads whole, and the profile out of every cache", async () => {
+    const users = bootTableRoute('users', {
+      rows: [MEMBER],
+      cache: { scope: 'ds-1:users', ttlSeconds: 60, sMaxAge: 30 },
+    })
+    expect((await users.run({})).status).toBe(401)
+    expect((await users.run({ session: { role: 'user' } })).status).toBe(403)
+    const admin = await users.run({ session: { role: 'admin' } })
+    expect(admin.body.data[0].email).toBe('bo@example.com')
+    expect(((await users.serverFetch()) as any[])[0].email).toBe('bo@example.com')
+    // Never a credential, whoever reads.
+    expect(JSON.stringify(admin.body.data)).not.toContain('hash')
+
+    users.cacheCalls.length = 0
+    await users.pageFetch({ filters: byId, limit: 1 })
+    expect(users.cacheCalls).toEqual([])
+  })
+})
+
+describe("a page's own data never carries a table a visitor may not read", () => {
+  it('refuses the protected tables, by name or in a statement', async () => {
+    const orders = bootTableRoute('teleport_orders', { rows: [{ id: 'o1', total: 10 }] })
+    await expect(orders.pageFetch()).rejects.toThrow('Unauthenticated')
+    await expect(orders.pageCount()).rejects.toThrow('Unauthenticated')
+    expect(orders.queries).toEqual([])
+    // The store's own server code reads them, as it always has.
+    expect(await orders.serverFetch()).toEqual([{ id: 'o1', total: 10, __rowNumber: 1 }])
+
+    const products = bootTableRoute('teleport_products')
+    await expect(
+      products.pageFetch({
+        rawQuery: 'SELECT * FROM teleport_products p JOIN users u ON u.id = p.owner_id',
+      })
+    ).rejects.toThrow('Unauthenticated')
+    expect(products.queries).toEqual([])
+  })
+
+  it("shares the visitors' cache entry, never the store's", async () => {
+    const posts = bootTableRoute('teleport_blog_posts', {
+      rows: POSTS,
+      cache: { scope: 'ds-1:teleport_blog_posts', ttlSeconds: 60, sMaxAge: 30 },
+    })
+    posts.cacheCalls.length = 0
+    await posts.pageFetch()
+    expect(posts.cacheCalls).toEqual([{ scope: 'ds-1:teleport_blog_posts', sMaxAge: 30 }])
+  })
 })
 
 describe('the AI assistant tables are read by the store only', () => {
@@ -417,7 +620,10 @@ describe('raw-query state routes bind {{Current User.*}} to the session', () =>
       paramFields
     )
     const code = esm
-      .replace("import { Client } from 'pg'", "const { Client } = require('pg')")
+      .replace(
+        "import { Client, types as pgTypes } from 'pg'",
+        "const { Client, types: pgTypes } = require('pg')"
+      )
       .replace(/^export default async function handler/m, 'async function handler')
       .concat('\nmodule.exports = { handler: handler }')
     const queries: Array<{ sql: string; params: unknown[] }> = []

package/__tests__/data-source-request-locale.test.ts

@@ -209,11 +209,12 @@ describe('data-source fetches in a multi-language project', () => {
   describe('a paginated list page', () => {
     it('fetches the first page for the language getStaticProps runs for', async () => {
       const { staticProps } = await run(pagesPlugin, makeListNode(true), makeListProvider(), true)
+      // Read as a visitor is served the rows: a public page.
       expect(collapse(staticProps)).toContain(
-        'fetchData({ page: 1, perPage: 20, queryColumns: JSON.stringify(["name", "es_name"]), locale: context.locale })'
+        'fetchData({ page: 1, perPage: 20, queryColumns: JSON.stringify(["name", "es_name"]), locale: context.locale }, { as: "visitor" })'
       )
       // The count is the same in every language.
-      expect(collapse(staticProps)).toContain('fetchCount().catch')
+      expect(collapse(staticProps)).toContain('fetchCount({}, { as: "visitor" }).catch')
     })
 
     it('sends the client locale with every refetch and refetches when it changes', async () => {
@@ -247,7 +248,7 @@ describe('data-source fetches in a multi-language project', () => {
         true
       )
       expect(collapse(staticProps)).toContain(
-        'fetchData({ "queryColumns": JSON.stringify(["name", "es_name"]), locale: context.locale })'
+        'fetchData({ "queryColumns": JSON.stringify(["name", "es_name"]), locale: context.locale }, { as: "visitor" })'
       )
       expect(collapse(code)).toContain(
         'params={useMemo(() => ({ locale: router?.locale }), [router?.locale])}'

package/__tests__/fetchers.test.ts

@@ -335,7 +335,7 @@ describe('generateDataSourceFetcher', () => {
     const dataSource = createPostgreSQLDataSource('ds-1')
     const code = generateDataSourceFetcher(dataSource, 'users')
 
-    expect(code).toContain('import { Client } from')
+    expect(code).toContain('import { Client, types as pgTypes } from')
     expect(code).toContain('export default async function handler')
     expect(code).toContain('SELECT * FROM "users"')
     expect(code).toContain('localhost')
@@ -481,8 +481,12 @@ describe('generateDataSourceFetcherWithCore', () => {
     const dataSource = createPostgreSQLDataSource('ds-1')
     const code = generateDataSourceFetcherWithCore(dataSource, 'users')
 
-    expect(code).toContain('const req = {')
-    expect(code).toContain('query: params')
+    // The store's own call by default; a page's data `{ as: 'visitor' }`.
+    expect(code).toContain('const req = __tqServerRequest(params, options)')
+    expect(code).toContain("return { query: params, method: 'GET', __tqServerCall: true }")
+    expect(code).toContain(
+      "return { query: params, method: 'GET', headers: {}, __tqVisitorView: true }"
+    )
     expect(code).toContain('const res = {')
     expect(code).toContain('status: (code)')
     expect(code).toContain('json: (data)')

package/__tests__/fixed-list-sort.test.ts

@@ -157,7 +157,7 @@ describe('a list sort the editor fixed', () => {
     const code = await runPlugin('state', CACHE)
     expect(code).not.toContain('initialData=')
     expect(code).not.toContain('ds_0_cached')
-    expect(code).toContain('field: sortBy.split("-")[0]')
+    expect(code).toContain('field: sortBy.split("-")?.[0]')
   })
 })