@teleporthq/teleport-plugin-next-data-source 0.44.0 → 0.44.1

package/__tests__/_helpers/first-page-runtime.ts

@@ -0,0 +1,184 @@
+/* tslint:disable:function-constructor max-classes-per-file no-any */
+import * as types from '@babel/types'
+import generator from '@babel/generator'
+import { generateDataSourceFetcherWithCore } from '../../src/data-source-fetchers'
+
+/**
+ * Runs what a generated page asks its data module for: the arguments its
+ * `getStaticProps` hands `fetchData`, the params a provider computes in the
+ * browser, and the products route both reach — so a test can check that the
+ * build and the browser order one row set the same way.
+ *
+ * `__tests__/_helpers` is excluded from the jest test match, so this file is a
+ * fixture rather than a suite.
+ */
+
+const isFetchDataCall = (node: types.Node): node is types.CallExpression =>
+  node.type === 'CallExpression' &&
+  node.callee.type === 'MemberExpression' &&
+  node.callee.property.type === 'Identifier' &&
+  node.callee.property.name === 'fetchData' &&
+  node.arguments[0]?.type === 'ObjectExpression'
+
+// The `Promise.all` entry whose result lands in `propKey`.
+const prefetchOf = (content: types.Node, propKey: string): types.Node | undefined => {
+  let entry: types.Node | undefined
+  types.traverseFast(content, (node) => {
+    if (
+      !entry &&
+      node.type === 'VariableDeclarator' &&
+      node.id.type === 'ArrayPattern' &&
+      node.init?.type === 'AwaitExpression' &&
+      node.init.argument.type === 'CallExpression' &&
+      node.init.argument.arguments[0]?.type === 'ArrayExpression'
+    ) {
+      const index = node.id.elements.findIndex(
+        (element) => element?.type === 'Identifier' && element.name === propKey
+      )
+      if (index !== -1) {
+        entry = (node.init.argument.arguments[0] as types.ArrayExpression).elements[index] as
+          | types.Node
+          | undefined
+      }
+    }
+  })
+  return entry
+}
+
+/**
+ * What getStaticProps hands fetchData — `{ page: 1, perPage: 20, …, sorts }`,
+ * then who it reads for — for the prefetch filling `propKey`, or the first one.
+ */
+export const buildTimeArguments = (
+  staticPropsChunk: any,
+  propKey?: string
+): Array<Record<string, unknown>> => {
+  const scope = propKey ? prefetchOf(staticPropsChunk.content, propKey) : staticPropsChunk.content
+  let call: types.CallExpression | undefined
+  types.traverseFast(scope as types.Node, (node) => {
+    if (!call && isFetchDataCall(node)) {
+      call = node
+    }
+  })
+  const args = call!.arguments.map((arg) => generator(arg as types.Node).code)
+  return new Function(`return [${args.join(', ')}]`)()
+}
+
+// The `nth` memoized `params` a provider of the component sends.
+const browserParamsBody = (chunk: any, nth: number): types.Expression => {
+  const bodies: types.Expression[] = []
+  types.traverseFast(chunk.content, (node) => {
+    if (
+      node.type === 'JSXAttribute' &&
+      node.name.name === 'params' &&
+      node.value?.type === 'JSXExpressionContainer' &&
+      node.value.expression.type === 'CallExpression'
+    ) {
+      const arrow = node.value.expression.arguments[0]
+      if (arrow?.type === 'ArrowFunctionExpression') {
+        bodies.push(arrow.body as types.Expression)
+      }
+    }
+  })
+  return bodies[nth]
+}
+
+/** The provider's params as the browser computes them for the given state, as they go on the wire. */
+export const browserParams = (
+  chunk: any,
+  state: Record<string, unknown>,
+  nth: number = 0
+): Record<string, string> => {
+  const names = Object.keys(state)
+  const params = new Function(
+    ...names,
+    `return (${generator(browserParamsBody(chunk, nth)).code})`
+  )(...names.map((name) => state[name]))
+  // What `new URLSearchParams(params)` puts on the wire.
+  return Object.fromEntries(new URLSearchParams(params))
+}
+
+/**
+ * The products route as the project ships it, over a database that records
+ * the statements it is sent.
+ */
+export const bootProductsRoute = () => {
+  const dataSource = {
+    id: 'ds-1',
+    name: 'db',
+    type: 'teleport',
+    config: {
+      host: 'teleporthq.secrets.TELEPORT_DB_HOST',
+      port: 5432,
+      user: 'teleporthq.secrets.TELEPORT_DB_USER',
+      password: 'teleporthq.secrets.TELEPORT_DB_PASSWORD',
+      database: 'teleporthq.secrets.TELEPORT_DB_NAME',
+      selectedTables: { teleport_products: { columns: [{ name: 'id', type: 'uuid' }] } },
+    },
+  }
+  const code = generateDataSourceFetcherWithCore(dataSource as never, 'teleport_products')
+    .replace(
+      "import { Client, types as pgTypes } from 'pg'",
+      "const { Client, types: pgTypes } = require('pg')"
+    )
+    .replace(/^export \{[^}]*\}\s*$/m, '')
+    .replace(/^export default \{[^}]*\}\s*$/m, '')
+    .concat('\nmodule.exports = { handler: handler, fetchData: fetchData }')
+  expect(code).not.toMatch(/^(export|import) /m)
+
+  const statements: string[] = []
+  class FakeClient {
+    public async connect(): Promise<void> {
+      return
+    }
+    public async end(): Promise<void> {
+      return
+    }
+    public async query(sql: string): Promise<any> {
+      statements.push(sql)
+      return { rows: [], rowCount: 0 }
+    }
+  }
+  const fakeRequire = (name: string): any => {
+    if (name === 'pg') {
+      return { Client: FakeClient }
+    }
+    if (name === 'next-auth/jwt') {
+      return { getToken: async (): Promise<null> => null }
+    }
+    throw new Error('unexpected require: ' + name)
+  }
+  const moduleObj: { exports: any } = { exports: {} }
+  new Function('require', 'module', 'exports', 'process', 'console', code)(
+    fakeRequire,
+    moduleObj,
+    moduleObj.exports,
+    {
+      env: {
+        NEXTAUTH_SECRET: 'secret',
+        TELEPORT_DB_HOST: 'h',
+        TELEPORT_DB_USER: 'u',
+        TELEPORT_DB_PASSWORD: 'p',
+        TELEPORT_DB_NAME: 'd',
+      },
+    },
+    { error: (): void => undefined, warn: (): void => undefined, log: (): void => undefined }
+  )
+  const lastSelect = (): string =>
+    statements.filter((sql) => /^\s*SELECT \* FROM/i.test(sql)).pop() || ''
+  return {
+    atBuild: async (args: Array<Record<string, unknown>>) => {
+      await moduleObj.exports.fetchData(...args)
+      return lastSelect()
+    },
+    inBrowser: async (query: Record<string, string>) => {
+      const res = { status: () => res, json: () => res, setHeader: () => res }
+      await moduleObj.exports.handler({ method: 'GET', query, headers: {} }, res)
+      return lastSelect()
+    },
+  }
+}
+
+export const orderBy = (sql: string): string => (sql.match(/ ORDER BY .*? LIMIT/) || [''])[0]
+export const rowWindow = (sql: string): string =>
+  (sql.match(/ LIMIT \d+( OFFSET \d+)?$/) || [''])[0]

package/__tests__/_helpers/pagination-widget-fixture.ts

@@ -271,6 +271,14 @@ export interface RepeaterOptions {
   filters?: unknown[]
   /** The mapper's editor node id, as the UIDL carries it on the repeater. */
   nodeId?: string
+  /** The repeater's sort and direction as the UIDL carries them: a static column, or an expression. */
+  sort?: unknown
+  sortDirection?: unknown
+  /** The repeater's cache config. */
+  cache?: unknown
+  /** The repeater's `source`, for a list bound inside the payload (with `dataSourceType`). */
+  source?: string
+  dataSourceType?: string
 }
 
 export const makeUidlNode = (options: RepeaterOptions, identifier: string = 'items'): any => ({
@@ -280,7 +288,7 @@ export const makeUidlNode = (options: RepeaterOptions, identifier: string = 'ite
     resourceDefinition: {
       dataSourceId: 'ds1',
       tableName: 'products',
-      dataSourceType: 'postgresql',
+      dataSourceType: options.dataSourceType ?? 'postgresql',
     },
     resource: {
       params: {
@@ -301,6 +309,10 @@ export const makeUidlNode = (options: RepeaterOptions, identifier: string = 'ite
           ...(options.infiniteScroll ? { infiniteScroll: true } : {}),
           ...(options.infiniteScrollLoadMore ? { infiniteScrollLoadMore: true } : {}),
           ...(options.nodeId ? { nodeId: options.nodeId } : {}),
+          ...(options.sort ? { sort: options.sort } : {}),
+          ...(options.sortDirection ? { sortDirection: options.sortDirection } : {}),
+          ...(options.cache ? { cache: options.cache } : {}),
+          ...(options.source ? { source: options.source } : {}),
           nodes: { list: { type: 'element', content: { elementType: 'div' } } },
         },
       },
@@ -318,3 +330,57 @@ export const makeMultiMapperUidl = (repeaters: RepeaterOptions[]): any => ({
     ),
   },
 })
+
+/**
+ * The page's `getStaticProps` as the main data-source plugin leaves it: a
+ * `Promise.all` of prefetches and a `props` object, which the pagination plugin
+ * extends with each paginated list's first page and its count. Its presence is
+ * what makes the component a page.
+ */
+export const makeGetStaticPropsChunk = (): ChunkDefinition => ({
+  name: 'getStaticProps',
+  type: ChunkType.AST,
+  fileType: FileType.JS,
+  linkAfter: ['jsx-component'],
+  meta: {},
+  content: types.exportNamedDeclaration(
+    types.functionDeclaration(
+      types.identifier('getStaticProps'),
+      [types.identifier('context')],
+      types.blockStatement([
+        types.tryStatement(
+          types.blockStatement([
+            types.variableDeclaration('const', [
+              types.variableDeclarator(
+                types.arrayPattern([]),
+                types.awaitExpression(
+                  types.callExpression(
+                    types.memberExpression(types.identifier('Promise'), types.identifier('all')),
+                    [types.arrayExpression([])]
+                  )
+                )
+              ),
+            ]),
+            types.returnStatement(
+              types.objectExpression([
+                types.objectProperty(types.identifier('props'), types.objectExpression([])),
+              ])
+            ),
+          ]),
+          types.catchClause(
+            types.identifier('error'),
+            types.blockStatement([
+              types.returnStatement(
+                types.objectExpression([
+                  types.objectProperty(types.identifier('props'), types.objectExpression([])),
+                ])
+              ),
+            ])
+          )
+        ),
+      ]),
+      false,
+      true
+    )
+  ),
+})

package/__tests__/browser-row-policy.test.ts

@@ -193,11 +193,25 @@ function bootTableRoute(tableName: string, options: BootOptions = {}) {
     return moduleObj.exports.fetchData({})
   }
 
-  return { run, serverFetch, queries, cacheCalls }
+  // A page's own data, as its getStaticProps / getServerSideProps reads it.
+  const pageFetch = async (params: Record<string, unknown> = {}): Promise<unknown> => {
+    queries.length = 0
+    session = null
+    return moduleObj.exports.fetchData(params, { as: 'visitor' })
+  }
+  const pageCount = async (params: Record<string, unknown> = {}): Promise<unknown> => {
+    queries.length = 0
+    session = null
+    return moduleObj.exports.fetchCount(params, { as: 'visitor' })
+  }
+
+  return { run, serverFetch, pageFetch, pageCount, queries, cacheCalls }
 }
 
 const internal = { 'x-internal-data-secret': SECRET }
 
+const SORT_BY_NAME = JSON.stringify([{ field: 'name', order: 'asc' }])
+
 const mainQuery = (result: RouteResult): string =>
   (result.queries.find((q) => /^\s*SELECT \* FROM/i.test(q.sql)) || { sql: '' }).sql
 
@@ -233,7 +247,7 @@ describe('blog posts: a visitor reads the published posts, never an author email
     expect(JSON.stringify(shopper.body.data)).not.toContain('ana@example.com')
   })
 
-  it('serves the store everything: the admin, a server segment and getStaticProps', async () => {
+  it("serves the store everything: the admin, a server segment and the store's own server code", async () => {
     const admin = await posts.run({ session: { role: 'admin' } })
     expect(mainQuery(admin)).not.toContain("status = 'published'")
     // The post view model carries no email for anyone — a page's data must not
@@ -252,6 +266,26 @@ describe('blog posts: a visitor reads the published posts, never an author email
     expect(serverRead && serverRead.sql).not.toContain("(status = 'published')")
   })
 
+  // This used to read as the store too: a page's getStaticProps called
+  // fetchData with the store's own marker. But a page's data is what it renders,
+  // and it reaches whoever opens the page (and `/_next/data` without rendering
+  // it): a draft painted on page 1 that the visitor's own page 2 skipped, a
+  // draft's details page anyone could open. A page reads `{ as: 'visitor' }`.
+  it("reads a page's data as a visitor: published posts, no author email", async () => {
+    await posts.pageFetch()
+    const pageRead = posts.queries.find((q) => /^\s*SELECT \* FROM/i.test(q.sql))
+    expect(pageRead && pageRead.sql).toContain("(status = 'published')")
+
+    const rawRows = (await posts.pageFetch({ rawRows: 'true' })) as any[]
+    expect(JSON.stringify(rawRows)).not.toContain('ana@example.com')
+    expect(rawRows[0].title).toBe('Hello')
+
+    await posts.pageCount()
+    expect(posts.queries.some((q) => /COUNT\(\*\).*\(status = 'published'\)/.test(q.sql))).toBe(
+      true
+    )
+  })
+
   it('narrows the count the same way', async () => {
     const guest = await posts.run({ handler: 'getCount' })
     expect(guest.status).toBe(200)
@@ -334,6 +368,172 @@ describe('products: a visitor reads the active products', () => {
     )
     expect(mainQuery(await products.run({ headers: internal }))).not.toContain("= 'active'")
   })
+
+  it("narrows a page's own data like a visitor's request, page and count alike", async () => {
+    const visitor = mainQuery(
+      await products.run({ query: { page: '1', perPage: '20', sorts: SORT_BY_NAME } })
+    )
+    await products.pageFetch({ page: 1, perPage: 20, sorts: SORT_BY_NAME })
+    const page = (products.queries.find((q) => /^\s*SELECT \* FROM/i.test(q.sql)) || { sql: '' })
+      .sql
+    expect(page).toContain("(LOWER(TRIM(status)) = 'active')")
+    expect(page).toBe(visitor)
+
+    await products.pageCount()
+    expect(
+      products.queries.some((q) =>
+        /COUNT\(\*\).*\(LOWER\(TRIM\(status\)\) = 'active'\)/.test(q.sql)
+      )
+    ).toBe(true)
+  })
+
+  it("runs a page's own statement over the products a visitor is served", async () => {
+    const featured =
+      'SELECT tp.slug, fpc.blurb FROM featured_product_curations fpc INNER JOIN teleport_products tp ON tp.id = fpc.product_id ORDER BY fpc.display_rank ASC LIMIT 8'
+    await products.pageFetch({ rawQuery: featured })
+    expect(products.queries.map((q) => q.sql)).toEqual([
+      `WITH "teleport_products" AS (SELECT * FROM "teleport_products" AS __brp_rows WHERE (LOWER(TRIM(status)) = 'active')) ${featured}`,
+    ])
+
+    // Its own WITH list comes after, so its entries read the visitor's rows too.
+    const picked =
+      'WITH picks AS (SELECT * FROM teleport_products WHERE price > 6) SELECT slug FROM picks;'
+    await products.pageFetch({ rawQuery: picked })
+    expect(products.queries.map((q) => q.sql)).toEqual([
+      `WITH "teleport_products" AS (SELECT * FROM "teleport_products" AS __brp_rows WHERE (LOWER(TRIM(status)) = 'active')),  picks AS (SELECT * FROM teleport_products WHERE price > 6) SELECT slug FROM picks`,
+    ])
+
+    // A statement over no narrowed table runs as written.
+    await products.pageFetch({ rawQuery: 'SELECT id FROM category_tiles' })
+    expect(products.queries.map((q) => q.sql)).toEqual(['SELECT id FROM category_tiles'])
+
+    // The store's own server code still reads every product.
+    await products.serverFetch()
+    expect(products.queries.map((q) => q.sql).join(' ')).not.toContain("= 'active'")
+  })
+
+  it('refuses a statement it cannot narrow, rather than run it whole', async () => {
+    // A schema reaches the table past the visitor's rows; a RECURSIVE list
+    // would see its own entries.
+    for (const rawQuery of [
+      'SELECT * FROM public.teleport_products',
+      'SELECT * FROM "public"."teleport_products"',
+      'WITH RECURSIVE t AS (SELECT 1) SELECT * FROM teleport_products',
+    ]) {
+      await expect(products.pageFetch({ rawQuery })).rejects.toThrow(/cannot be read for a visitor/)
+      expect(products.queries).toEqual([])
+    }
+    // A statement that can read a table without naming it is refused sooner:
+    // it may be reading any protected one.
+    await expect(
+      products.pageFetch({
+        rawQuery: "SELECT query_to_xml('select * from teleport_products', true, true, '')",
+      })
+    ).rejects.toThrow('Unauthenticated')
+    expect(products.queries).toEqual([])
+  })
+})
+
+describe("members: a page carries a member's public profile, never their account", () => {
+  const MEMBER = {
+    id: 'u2',
+    name: 'Bo',
+    email: 'bo@example.com',
+    phone: '+40 700 000 000',
+    details: { address: '1 Main St' },
+    role: 'user',
+    password: 'hash',
+    access_token: 'token',
+    image: 'https://cdn.example.com/bo.png',
+    created_at: '2026-01-01T00:00:00.000Z',
+  }
+  const PRIVATE = [
+    'bo@example.com',
+    '+40 700',
+    '1 Main St',
+    'hash',
+    'token',
+    '"role"',
+    '2026-01-01',
+  ]
+  const byId = JSON.stringify([
+    { type: 'condition', source: 'id', destination: 'u2', operand: '=' },
+  ])
+
+  it('reads the profile a page shows: id, name and avatar only', async () => {
+    const users = bootTableRoute('users', { rows: [MEMBER] })
+    const rows = (await users.pageFetch({ filters: byId, limit: 1 })) as any[]
+
+    expect(rows).toEqual([{ id: 'u2', name: 'Bo', image: 'https://cdn.example.com/bo.png' }])
+    PRIVATE.forEach((value) => expect(JSON.stringify(rows)).not.toContain(value))
+    expect(mainQuery({ queries: users.queries } as RouteResult)).toBe(
+      'SELECT * FROM users WHERE id = $1 AND (TRUE) LIMIT 1'
+    )
+  })
+
+  it('never answers a filter, sort or search over a private column', async () => {
+    const users = bootTableRoute('users', { rows: [MEMBER] })
+    const email = JSON.stringify([
+      { type: 'condition', source: 'email', destination: 'bo@example.com', operand: '=' },
+    ])
+    await expect(users.pageFetch({ filters: email })).rejects.toThrow('email is not readable')
+    await expect(
+      users.pageFetch({ sorts: JSON.stringify([{ field: 'role', order: 'asc' }]) })
+    ).rejects.toThrow('role is not readable')
+    expect(users.queries).toEqual([])
+
+    await users.pageFetch({ query: 'bo', queryColumns: JSON.stringify(['name', 'email']) })
+    const searched = mainQuery({ queries: users.queries } as RouteResult)
+    expect(searched).toContain('"name"::text ILIKE')
+    expect(searched).not.toContain('"email"')
+  })
+
+  it("keeps a browser out, the admin's and the server's reads whole, and the profile out of every cache", async () => {
+    const users = bootTableRoute('users', {
+      rows: [MEMBER],
+      cache: { scope: 'ds-1:users', ttlSeconds: 60, sMaxAge: 30 },
+    })
+    expect((await users.run({})).status).toBe(401)
+    expect((await users.run({ session: { role: 'user' } })).status).toBe(403)
+    const admin = await users.run({ session: { role: 'admin' } })
+    expect(admin.body.data[0].email).toBe('bo@example.com')
+    expect(((await users.serverFetch()) as any[])[0].email).toBe('bo@example.com')
+    // Never a credential, whoever reads.
+    expect(JSON.stringify(admin.body.data)).not.toContain('hash')
+
+    users.cacheCalls.length = 0
+    await users.pageFetch({ filters: byId, limit: 1 })
+    expect(users.cacheCalls).toEqual([])
+  })
+})
+
+describe("a page's own data never carries a table a visitor may not read", () => {
+  it('refuses the protected tables, by name or in a statement', async () => {
+    const orders = bootTableRoute('teleport_orders', { rows: [{ id: 'o1', total: 10 }] })
+    await expect(orders.pageFetch()).rejects.toThrow('Unauthenticated')
+    await expect(orders.pageCount()).rejects.toThrow('Unauthenticated')
+    expect(orders.queries).toEqual([])
+    // The store's own server code reads them, as it always has.
+    expect(await orders.serverFetch()).toEqual([{ id: 'o1', total: 10, __rowNumber: 1 }])
+
+    const products = bootTableRoute('teleport_products')
+    await expect(
+      products.pageFetch({
+        rawQuery: 'SELECT * FROM teleport_products p JOIN users u ON u.id = p.owner_id',
+      })
+    ).rejects.toThrow('Unauthenticated')
+    expect(products.queries).toEqual([])
+  })
+
+  it("shares the visitors' cache entry, never the store's", async () => {
+    const posts = bootTableRoute('teleport_blog_posts', {
+      rows: POSTS,
+      cache: { scope: 'ds-1:teleport_blog_posts', ttlSeconds: 60, sMaxAge: 30 },
+    })
+    posts.cacheCalls.length = 0
+    await posts.pageFetch()
+    expect(posts.cacheCalls).toEqual([{ scope: 'ds-1:teleport_blog_posts', sMaxAge: 30 }])
+  })
 })
 
 describe('the AI assistant tables are read by the store only', () => {

package/__tests__/data-source-request-locale.test.ts

@@ -209,11 +209,12 @@ describe('data-source fetches in a multi-language project', () => {
   describe('a paginated list page', () => {
     it('fetches the first page for the language getStaticProps runs for', async () => {
       const { staticProps } = await run(pagesPlugin, makeListNode(true), makeListProvider(), true)
+      // Read as a visitor is served the rows: a public page.
       expect(collapse(staticProps)).toContain(
-        'fetchData({ page: 1, perPage: 20, queryColumns: JSON.stringify(["name", "es_name"]), locale: context.locale })'
+        'fetchData({ page: 1, perPage: 20, queryColumns: JSON.stringify(["name", "es_name"]), locale: context.locale }, { as: "visitor" })'
       )
       // The count is the same in every language.
-      expect(collapse(staticProps)).toContain('fetchCount().catch')
+      expect(collapse(staticProps)).toContain('fetchCount({}, { as: "visitor" }).catch')
     })
 
     it('sends the client locale with every refetch and refetches when it changes', async () => {
@@ -247,7 +248,7 @@ describe('data-source fetches in a multi-language project', () => {
         true
       )
       expect(collapse(staticProps)).toContain(
-        'fetchData({ "queryColumns": JSON.stringify(["name", "es_name"]), locale: context.locale })'
+        'fetchData({ "queryColumns": JSON.stringify(["name", "es_name"]), locale: context.locale }, { as: "visitor" })'
       )
       expect(collapse(code)).toContain(
         'params={useMemo(() => ({ locale: router?.locale }), [router?.locale])}'

package/__tests__/fetchers.test.ts

@@ -481,8 +481,12 @@ describe('generateDataSourceFetcherWithCore', () => {
     const dataSource = createPostgreSQLDataSource('ds-1')
     const code = generateDataSourceFetcherWithCore(dataSource, 'users')
 
-    expect(code).toContain('const req = {')
-    expect(code).toContain('query: params')
+    // The store's own call by default; a page's data `{ as: 'visitor' }`.
+    expect(code).toContain('const req = __tqServerRequest(params, options)')
+    expect(code).toContain("return { query: params, method: 'GET', __tqServerCall: true }")
+    expect(code).toContain(
+      "return { query: params, method: 'GET', headers: {}, __tqVisitorView: true }"
+    )
     expect(code).toContain('const res = {')
     expect(code).toContain('status: (code)')
     expect(code).toContain('json: (data)')