@teleporthq/teleport-plugin-next-data-source 0.43.75 → 0.44.1

package/src/fetchers/raw-query.ts

@@ -1,5 +1,6 @@
 import { SessionCookieResolver } from '@teleporthq/teleport-shared'
 import { replaceSecretReference } from '../utils'
+import { PG_CLIENT_IMPORT } from './pg-client-import'
 
 interface PostgreSQLConfig {
   host?: string
@@ -109,7 +110,7 @@ function sessionUserField(user, field) {
         : '{ rejectUnauthorized: false }'
       : 'false'
 
-  return `import { Client } from 'pg'
+  return `${PG_CLIENT_IMPORT}
 
 const FORBIDDEN_KEYWORDS = ${JSON.stringify(FORBIDDEN_KEYWORDS)}
 ${sessionHelpers}

package/src/fetchers/teleport.ts

@@ -12,6 +12,7 @@ import {
   type EntityTransformOptions,
 } from '../transformations'
 import { generateSortFallbackFieldHelper, generateSortFieldSqlHelper } from '../product-price-sort'
+import { SORT_NULLS_LAST_SQL } from '../list-sort-order'
 import { generateRowOrderTiebreakHelper, rowIdentityColumn } from '../row-order'
 import { generateProductFilterClauseHelper } from '../product-filter-fields'
 import { collectLocalizedColumns, generateLocalizedColumnsHelper } from '../localized-columns'
@@ -19,6 +20,7 @@ import { REQUEST_LOCALE_PARAM } from '../request-locale'
 import { generateReadGuardCall, generateTableAccessPreamble } from './utils/table-access-guard'
 import { generateRequestSqlGuardsCode } from './utils/request-sql-guards'
 import { generateArrayOverlapSqlCode } from '../array-overlap-sql'
+import { PG_CLIENT_IMPORT } from './pg-client-import'
 
 interface TeleportDBConfig {
   host?: string
@@ -102,7 +104,7 @@ export const generateTeleportFetcher = (
     }`
       : `(process.env.${DEFAULT_ENV_KEYS.ssl} === 'false' ? false : process.env.${DEFAULT_ENV_KEYS.ssl} === 'true' ? { rejectUnauthorized: false } : undefined)`
 
-  return `import { Client } from 'pg'
+  return `${PG_CLIENT_IMPORT}
 
 ${generateTableAccessPreamble(transformOptions.trustedReaderRoles || [])}
 function normalizePostgresConnectionString(connectionString) {
@@ -314,7 +316,10 @@ ${generateReadGuardCall(tableName, 'req.query && req.query.rawQuery')}
     // \`fetchData({ rawQuery })\` and expect it to execute verbatim.
     if (req.query && typeof req.query.rawQuery === 'string' && req.query.rawQuery.length > 0) {
       assertRawQuerySafe(req.query.rawQuery)
-      const rawResult = await client.query(req.query.rawQuery)
+      // A page's own statement, read for a visitor, runs over the rows a
+      // visitor is served of every narrowed table it names.
+      const rawSql = __rowAccess.narrowRaw ? __brpNarrowRawQuery(req.query.rawQuery) : req.query.rawQuery
+      const rawResult = await client.query(rawSql)
       const rawRows = Array.isArray(rawResult?.rows) ? rawResult.rows : []
       const rawPlain = rawRows.map((row) =>
         row && typeof row.toJSON === 'function' ? row.toJSON() : row
@@ -324,7 +329,10 @@ ${generateReadGuardCall(tableName, 'req.query && req.query.rawQuery')}
         success: true,
         // Every row here ends up in a browser (a page's props or a client
         // refetch), so no credential column survives, whatever joined it.
-        data: __taWithoutCredentials(rawSafe, null),
+        data: __taWithoutCredentials(
+          __rowAccess.narrowRaw ? __brpStripHiddenOfRaw(req.query.rawQuery, rawSafe) : rawSafe,
+          null
+        ),
         timestamp: Date.now()
       })
     }
@@ -391,8 +399,8 @@ ${generateReadGuardCall(tableName, 'req.query && req.query.rawQuery')}
     
     // Handle sorts - new array format. Two ORDER BY clauses are built: the one
     // actually used (a translatable column in the request's language, the
-    // products table's price rewrites), and a plain-column twin kept only as
-    // the fallback below.
+    // products table's price rewrites, rows without a value last), and a
+    // plain-column twin kept only as the fallback below.
     let orderBySql = ''
     let plainOrderBySql = ''
     if (sorts) {
@@ -401,7 +409,7 @@ ${generateReadGuardCall(tableName, 'req.query && req.query.rawQuery')}
         const valid = parsedSorts.filter((sort) => sort && sort.field)
         valid.forEach((sort) => assertRequestColumn(sort.field, 'sort field'))
         const orderOf = (sort) => (sort.order || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'
-        const orderClauses = valid.map((sort) => \`\${localizedSortFieldSql(sort.field, requestLocale) || sortFieldSql(sort.field)} \${orderOf(sort)}\`)
+        const orderClauses = valid.map((sort) => \`\${localizedSortFieldSql(sort.field, requestLocale) || sortFieldSql(sort.field)} \${orderOf(sort)}${SORT_NULLS_LAST_SQL}\`)
         const plainClauses = valid.map((sort) => \`\${sortFallbackField(sort.field)} \${orderOf(sort)}\`)
 
         if (orderClauses.length > 0) {
@@ -416,10 +424,10 @@ ${generateReadGuardCall(tableName, 'req.query && req.query.rawQuery')}
       assertRequestColumn(sortBy, 'sort field')
       const sortByDirection = (sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'
       const tiebreak = rowOrderTiebreak([sortBy], sortByDirection)
-      orderBySql = \` ORDER BY \${localizedSortFieldSql(sortBy, requestLocale) || sortBy} \${sortByDirection}\${tiebreak}\`
+      orderBySql = \` ORDER BY \${localizedSortFieldSql(sortBy, requestLocale) || sortBy} \${sortByDirection}${SORT_NULLS_LAST_SQL}\${tiebreak}\`
       plainOrderBySql = \` ORDER BY \${sortBy} \${sortByDirection}\${tiebreak}\`
     }
-    const usedDiscountAwareSort = orderBySql !== plainOrderBySql
+    const usedRewrittenSort = orderBySql !== plainOrderBySql
 
     const limitValue = requestRowCount(limit || perPage)
     const offsetValue = offset !== undefined ? parseInt(offset) : (page && perPage ? (parseInt(page) - 1) * parseInt(perPage) : undefined)
@@ -441,12 +449,13 @@ ${generateReadGuardCall(tableName, 'req.query && req.query.rawQuery')}
     // the whole table - so if a database ever rejects it, fall back to ordering
     // by the stored list price rather than serving an empty products page. The
     // translatable-column ordering takes the same exit: a per-language column
-    // the schema had at generation time may have been dropped since.
+    // the schema had at generation time may have been dropped since. So does
+    // the empty-values-last ordering.
     let result
     try {
       result = await client.query(sql, queryParams)
     } catch (sortError) {
-      if (!usedDiscountAwareSort) throw sortError
+      if (!usedRewrittenSort) throw sortError
       console.warn(
         'Rewritten sort failed; falling back to the plain column:',
         sortError && sortError.message

package/src/fetchers/utils/browser-row-policy.ts

@@ -1,4 +1,4 @@
-import { ContentTables } from '@teleporthq/teleport-shared'
+import { ContentTables, TableAccess } from '@teleporthq/teleport-shared'
 
 /**
  * What a per-table read route (`/api/teleport-<table>-<source>` and its count
@@ -42,9 +42,19 @@ export const generateBrowserRowPolicyCode =
   (): string => `// GENERATED — see browser-row-policy.ts in teleport-plugin-next-data-source.
 var __BRP_POLICIES = ${JSON.stringify(BROWSER_ROW_POLICIES)};
 
+// What a page's own data carries of a member, read for a visitor: the public
+// profile (TableAccess.PUBLIC_PROFILE_COLUMNS) — an allow-list, so a column the
+// account row gains later stays out too. A browser reads the table not at all.
+var __BRP_PUBLIC_PROFILE = ${JSON.stringify({
+    predicate: 'TRUE',
+    hiddenColumns: [],
+    visibleColumns: TableAccess.PUBLIC_PROFILE_COLUMNS,
+  })};
+
 // Who is asking: the store's own server code and its administrators read every
-// row; anyone else is a visitor.
+// row; anyone else is a visitor — a page's own data included (\`__taIsVisitorView\`).
 async function __brpReader(req) {
+  if (__taIsVisitorView(req)) return { trusted: false };
   if (__taIsInternalRequest(req)) return { trusted: true };
   var token = null;
   try {
@@ -63,11 +73,15 @@ function __brpMentionsAny(rawQuery, tables) {
   return false;
 }
 
-// A raw statement cannot be narrowed, so a visitor's statement that names a
-// narrowed table is refused whole. The session is only decoded when the read
-// touches one of these tables.
+// A visitor's browser may not send a statement that names a narrowed table: it
+// is refused whole. A page's own statement, read for a visitor, is run over the
+// rows a visitor is served instead (\`narrowRaw\`, see \`__brpNarrowRawQuery\`).
+// The session is only decoded when the read touches one of these tables.
 async function __brpAccess(req, tableName, rawQuery) {
   var raw = typeof rawQuery === 'string' && rawQuery.length > 0 ? rawQuery : null;
+  if (!raw && __taIsVisitorView(req) && __taIsCredentialTable(tableName)) {
+    return { denied: null, policy: __BRP_PUBLIC_PROFILE };
+  }
   var bare = __taNormalizeTable(tableName);
   var rawNarrowed = !!raw && __brpMentionsAny(raw, Object.keys(__BRP_POLICIES));
   var policy = raw ? null : (Object.prototype.hasOwnProperty.call(__BRP_POLICIES, bare) ? __BRP_POLICIES[bare] : null);
@@ -75,18 +89,78 @@ async function __brpAccess(req, tableName, rawQuery) {
   var reader = await __brpReader(req);
   if (reader.trusted) return { denied: null, policy: null };
   if (rawNarrowed) {
+    if (__taIsVisitorView(req)) return { denied: null, policy: null, narrowRaw: true };
     return { denied: { status: 403, message: 'Forbidden: raw queries over this table are only available to server-side calls' }, policy: null };
   }
   return { denied: null, policy: policy };
 }
 
+function __brpRefuseRaw(what) {
+  var err = new Error('Forbidden: ' + what + ' cannot be read for a visitor');
+  err.status = 403;
+  return err;
+}
+
+// A page's own statement over the rows a visitor is served: every narrowed
+// table it reads becomes a WITH entry of the same name, ahead of the
+// statement, which its own references — and its own WITH entries — resolve to:
+//
+//   WITH "teleport_products" AS (SELECT * FROM "teleport_products" AS __brp_rows WHERE (<predicate>)) <statement>
+//
+// Inside its own definition the entry names the table itself (a WITH that is
+// not RECURSIVE does not see itself). A hidden column reads NULL however the
+// statement spells it — an alias, a whole-row value. A statement this cannot
+// vouch for is refused: unreadable or opaque, RECURSIVE (its entries would see
+// themselves), or naming a narrowed table through a schema, which reaches the
+// table past the entry.
+function __brpNarrowRawQuery(sql) {
+  var cleaned = __taCleanSql(sql);
+  if (!cleaned.ok || __TA_OPAQUE_SQL_RE.test(cleaned.text)) throw __brpRefuseRaw('this statement');
+  var tables = Object.keys(__BRP_POLICIES).filter(function(table) {
+    return new RegExp('(?:^|[^A-Za-z0-9_])"?' + table + '"?(?![A-Za-z0-9_])', 'i').test(cleaned.text);
+  });
+  if (tables.length === 0) return sql;
+  var leading = /^\\s*with\\b(\\s+recursive\\b)?/i.exec(cleaned.text);
+  if (leading && leading[1]) throw __brpRefuseRaw('a recursive statement');
+  tables.forEach(function(table) {
+    if (new RegExp('\\\\.\\\\s*"?' + table + '"?(?![A-Za-z0-9_])', 'i').test(cleaned.text)) throw __brpRefuseRaw(table);
+  });
+  var entries = tables.map(function(table) {
+    var policy = __BRP_POLICIES[table];
+    var hidden = {};
+    policy.hiddenColumns.forEach(function(column) { hidden[column] = null; });
+    var columns = policy.hiddenColumns.length > 0
+      ? '(jsonb_populate_record(__brp_rows, ' + "'" + JSON.stringify(hidden) + "'" + '::jsonb)).*'
+      : '*';
+    return '"' + table + '" AS (SELECT ' + columns + ' FROM "' + table + '" AS __brp_rows WHERE (' + policy.predicate + '))';
+  });
+  var statement = String(sql).trim().replace(/;\\s*$/, '');
+  if (!leading) return 'WITH ' + entries.join(', ') + ' ' + statement;
+  // The statement's own WITH list follows ours, so its entries read ours too.
+  var own = /^with\\b/i.exec(statement);
+  if (!own) throw __brpRefuseRaw('this statement');
+  return 'WITH ' + entries.join(', ') + ', ' + statement.slice(own[0].length);
+}
+
+// The rows of a statement narrowed for a visitor, without the hidden columns
+// of the tables it read.
+function __brpStripHiddenOfRaw(sql, rows) {
+  var cleaned = __taCleanSql(sql);
+  return Object.keys(__BRP_POLICIES).reduce(function(current, table) {
+    return cleaned.ok && __taSqlMentionsTable(sql, table) ? __brpStripHidden(__BRP_POLICIES[table], current) : current;
+  }, rows);
+}
+
 function __brpColumnName(field) {
   var parts = String(field == null ? '' : field).replace(/"/g, '').trim().split('.');
   return parts[parts.length - 1];
 }
 
+// A column the policy keeps from the reader: one it hides, or — for a policy
+// that names the only columns it serves (\`visibleColumns\`) — any other.
 function __brpIsHidden(policy, field) {
   var name = __brpColumnName(field).toLowerCase();
+  if (policy.visibleColumns) return policy.visibleColumns.indexOf(name) === -1;
   for (var i = 0; i < policy.hiddenColumns.length; i++) {
     if (policy.hiddenColumns[i].toLowerCase() === name) return true;
   }

package/src/index.ts

@@ -8,6 +8,7 @@ import {
   UIDLDynamicReference,
 } from '@teleporthq/teleport-types'
 import { UIDLUtils, StringUtils } from '@teleporthq/teleport-shared'
+import { RouteUtils } from '@teleporthq/teleport-plugin-common'
 import {
   extractDataSourceIntoNextAPIFolder,
   extractDataSourceIntoGetStaticProps,
@@ -652,7 +653,9 @@ export const createNextPagesDataSourcePlugin: ComponentPluginFactory<{}> = () =>
           dependencies,
           dynamicRouteAttr,
           uidl.outputOptions?.folderPath,
-          transformOptions
+          transformOptions,
+          () => RouteUtils.pageDataReadArguments(uidl, options.auth),
+          uidl.stateDefinitions
         )
 
         if (result.success && result.chunk) {
@@ -794,7 +797,10 @@ export const createNextPagesDataSourcePlugin: ComponentPluginFactory<{}> = () =>
                   types.identifier(fetcherImportName),
                   types.identifier('fetchData')
                 ),
-                [types.objectExpression([])]
+                [
+                  types.objectExpression([]),
+                  ...RouteUtils.pageDataReadArguments(uidl, options.auth),
+                ]
               )
 
               const safeFetchExpression = types.callExpression(