@teleporthq/teleport-plugin-next-data-source 0.44.15 → 0.45.0

package/__tests__/_helpers/exposure.ts

@@ -0,0 +1,29 @@
+import type { DataReadExposure, ProjectDataExposure } from '@teleporthq/teleport-types'
+import { DataExposure } from '@teleporthq/teleport-shared'
+
+/**
+ * The exposure a project gives tables a page every visitor may open binds —
+ * what `DataExposure.resolveDataExposure` decides for a public list. A read
+ * route generated without one serves the app's own server code only.
+ */
+export const publicRead = (overrides: Partial<DataReadExposure> = {}): DataReadExposure => ({
+  public: true,
+  anySession: false,
+  roles: [],
+  defaultLimit: DataExposure.BROWSER_READ_DEFAULT_LIMIT,
+  maxLimit: DataExposure.BROWSER_READ_MAX_LIMIT,
+  ...overrides,
+})
+
+/** `tables` all bound by a public page (and `dataSources`, by id, for the sources without tables). */
+export const publicExposure = (
+  tables: string[],
+  dataSources: string[] = []
+): { dataExposure: ProjectDataExposure } => ({
+  dataExposure: {
+    tables: Object.fromEntries(
+      tables.map((table) => [DataExposure.tableExposureKey(null, table), publicRead()])
+    ),
+    dataSources: Object.fromEntries(dataSources.map((id) => [id, publicRead()])),
+  },
+})

package/__tests__/_helpers/first-page-runtime.ts

@@ -2,6 +2,7 @@
 import * as types from '@babel/types'
 import generator from '@babel/generator'
 import { generateDataSourceFetcherWithCore } from '../../src/data-source-fetchers'
+import { publicExposure } from './exposure'
 
 /**
  * Runs what a generated page asks its data module for: the arguments its
@@ -113,10 +114,19 @@ export const bootProductsRoute = () => {
       user: 'teleporthq.secrets.TELEPORT_DB_USER',
       password: 'teleporthq.secrets.TELEPORT_DB_PASSWORD',
       database: 'teleporthq.secrets.TELEPORT_DB_NAME',
-      selectedTables: { teleport_products: { columns: [{ name: 'id', type: 'uuid' }] } },
+      // The table's schema as the editor exports it: the only columns a request may name.
+      selectedTables: {
+        teleport_products: { columns: [{ name: 'id', type: 'uuid' }, { name: 'name' }] },
+      },
     },
   }
-  const code = generateDataSourceFetcherWithCore(dataSource as never, 'teleport_products')
+  const code = generateDataSourceFetcherWithCore(
+    dataSource as never,
+    'teleport_products',
+    false,
+    // Bound by the store's public listing page: any visitor may read it.
+    publicExposure(['teleport_products'])
+  )
     .replace(
       "import { Client, types as pgTypes } from 'pg'",
       "const { Client, types: pgTypes } = require('pg')"

package/__tests__/blog-post-contents.test.ts

@@ -32,11 +32,13 @@ const DETAILS = { details: true }
 
 const CONTENTS_FIXTURES: Array<{ name: string; html: string; sections: string[][] }> = [
   {
-    name: 'a help article: its h2 sections, not the h3 under them, never the h1',
+    // A body's own h1 is demoted to a section (the page title is the one h1).
+    name: 'a help article: its h2 sections, not the h3 under them; a body h1 is a section too',
     html:
       '<h1>Title</h1><p>Intro</p><h2>Before you start</h2><p>x</p><h2>Steps</h2>' +
       '<h3>Open the panel</h3><h2>Check that it worked</h2><h2>Troubleshooting</h2>',
     sections: [
+      ['title', 'Title'],
       ['before-you-start', 'Before you start'],
       ['steps', 'Steps'],
       ['check-that-it-worked', 'Check that it worked'],

package/__tests__/blog-post-page-enrichment.test.ts

@@ -174,7 +174,8 @@ describe('blog post transform — heading anchors', () => {
       `<${tag}${attrs}><a class="tq-heading-link" href="#${id}">${text}</a>` +
       `<a class="tq-heading-anchor" href="#${id}" aria-hidden="true" tabindex="-1">#</a></${tag}>`
     expect(built.content).toBe(
-      '<h1>Title</h1>' +
+      // The body's h1 is demoted to a section like any other (the page title is the one h1).
+      '<h2 id="title"><a class="tq-heading-link" href="#title">Title</a><a class="tq-heading-anchor" href="#title" aria-hidden="true" tabindex="-1">#</a></h2>' +
         anchored('h2', ' id="getting-started"', 'getting-started', 'Getting Started') +
         anchored('h3', ' class="x" id="custom"', 'custom', 'Café &amp; Crème') +
         anchored('h2', ' id="getting-started-3"', 'getting-started-3', 'Getting started') +

package/__tests__/blog-post-seo-fields.test.ts

@@ -0,0 +1,124 @@
+import { generateBlogPostTransformationCode } from '../src/transformations/blog-post'
+import { generateSharedTransformationCode } from '../src/transformations/shared-utils'
+
+/**
+ * What the post page's head, structured data and "Updated on" line read from
+ * a post: meta fields that always have a value, dates as ISO strings, a
+ * sharing picture only when the post has one of its own, the slug per
+ * locale, the FAQ pairs of the body, and one H1 at most on the page.
+ */
+
+const buildPost = (
+  options: Parameters<typeof generateBlogPostTransformationCode>[0] = {}
+): ((record: unknown, callOptions?: unknown) => Record<string, unknown>) => {
+  const code =
+    generateSharedTransformationCode() + '\n' + generateBlogPostTransformationCode(options)
+  return new Function(code + '\nreturn buildBlogPost;')() as (
+    record: unknown,
+    callOptions?: unknown
+  ) => Record<string, unknown>
+}
+
+const words = (count: number) => Array.from({ length: count }, (_, i) => `word${i}`).join(' ')
+const POST = { id: 'p1', title: 'Connect a domain', slug: 'connect-a-domain', status: 'published' }
+
+describe('meta fields always have a value', () => {
+  it('falls back to the title, the excerpt, then the opening of the body', () => {
+    expect(buildPost()({ ...POST, meta_title: ' Own title ' }).metaTitle).toBe(' Own title ')
+    expect(buildPost()({ ...POST }).metaTitle).toBe('Connect a domain')
+    expect(buildPost()({ ...POST, excerpt: 'Short summary.' }).metaDescription).toBe(
+      'Short summary.'
+    )
+    const fromBody = buildPost()({ ...POST, content: `<p>${words(60)}</p>` })
+      .metaDescription as string
+    expect(fromBody.length).toBeLessThanOrEqual(155)
+    expect(fromBody).toMatch(/^word0 word1/)
+    expect(fromBody.split(' ').every((word) => /^word\d+$/.test(word))).toBe(true)
+    expect(buildPost()({ ...POST }).metaDescription).toBeNull()
+  })
+})
+
+describe('dates and the updated line', () => {
+  it('gives ISO dates and shows "updated" only a day after publishing', () => {
+    const post = buildPost()({
+      ...POST,
+      published_at: '2026-03-01T10:00:00.000Z',
+      updated_at: '2026-03-03T10:00:00.000Z',
+    })
+    expect(post.publishedAtIso).toBe('2026-03-01T10:00:00.000Z')
+    expect(post.updatedAtIso).toBe('2026-03-03T10:00:00.000Z')
+    expect(post.updatedAfterPublishIso).toBe('2026-03-03T10:00:00.000Z')
+    const fresh = buildPost()({
+      ...POST,
+      published_at: '2026-03-01T10:00:00.000Z',
+      updated_at: '2026-03-01T20:00:00.000Z',
+    })
+    expect(fresh.updatedAfterPublishIso).toBeNull()
+    expect(buildPost()({ ...POST, status: 'draft' }).publishedAtIso).toBeNull()
+  })
+})
+
+describe('what the head shares', () => {
+  it('shares the post picture only when it has one of its own', () => {
+    expect(buildPost()({ ...POST, featured_image_url: 'https://cdn/x.jpg' }).socialImageUrl).toBe(
+      'https://cdn/x.jpg'
+    )
+    const standIn = buildPost()({ ...POST })
+    expect(String(standIn.featuredImageUrl)).toMatch(/^data:image/)
+    expect(standIn.socialImageUrl).toBeNull()
+  })
+
+  it('counts the words, joins the tags and names the primary category', () => {
+    const post = buildPost({
+      categories: [{ id: 'c1', name: 'Guides', slug: 'guides' } as never],
+    })({
+      ...POST,
+      content: `<h2>Steps</h2><p>${words(40)}</p>`,
+      tags: JSON.stringify(['dns', 'hosting']),
+      category_ids: JSON.stringify(['c1']),
+    })
+    expect(post.wordCount).toBe(41)
+    expect(post.tagsText).toBe('dns, hosting')
+    expect(post.categoryName).toBe('Guides')
+    expect(post.categorySlug).toBe('guides')
+    expect(buildPost()({ ...POST }).tagsText).toBeNull()
+    expect(buildPost()({ ...POST }).categorySlug).toBeNull()
+  })
+
+  it('names the slug per locale from the translated columns', () => {
+    const post = buildPost({ locales: ['en', 'ro', 'de'] })(
+      { ...POST, ro_slug: 'conecteaza-un-domeniu', de_slug: '' },
+      { mainLanguage: 'en', currentLanguage: 'ro' }
+    )
+    expect(post.slugByLocale).toEqual({ en: 'connect-a-domain', ro: 'conecteaza-un-domeniu' })
+    expect(buildPost()({ ...POST }).slugByLocale).toEqual({})
+  })
+})
+
+describe('the body on the page', () => {
+  it('reads the FAQ pairs out of the body, text only', () => {
+    const post = buildPost()({
+      ...POST,
+      content:
+        '<p>Intro</p><section class="tq-faq"><h2>FAQ</h2>' +
+        '<details><summary>Is it <em>free</em>?</summary><p>Yes, <a href="/x">mostly</a>.</p></details>' +
+        '<details><summary>How long?</summary><p>A day.</p><p>Sometimes two.</p></details>' +
+        '<details><summary></summary><p>No question.</p></details>' +
+        '</section>',
+    })
+    expect(post.faq).toEqual([
+      { question: 'Is it free?', answer: 'Yes, mostly.' },
+      { question: 'How long?', answer: 'A day. Sometimes two.' },
+    ])
+    expect(buildPost()({ ...POST, content: '<p>No faq</p>' }).faq).toEqual([])
+  })
+
+  it('demotes a body H1 to an H2: the page title is the one H1', () => {
+    const post = buildPost({ contents: true })(
+      { ...POST, content: '<h1 class="x">Top</h1><p>a</p><h2>Next</h2>' },
+      { details: true }
+    )
+    expect(post.content).toMatch(/<h2 id="top" class="x">Top<\/h2>/)
+    expect(post.content).not.toMatch(/<h1[\s>]/)
+  })
+})

package/__tests__/browser-row-policy.test.ts

@@ -1,6 +1,14 @@
 /* tslint:disable:function-constructor max-classes-per-file */
 import { generateDataSourceFetcherWithCore } from '../src/data-source-fetchers'
+import { publicExposure } from './_helpers/exposure'
 import { generateRawQueryFetcher } from '../src/fetchers/raw-query'
+import {
+  isSecurityRuntimeSpecifier,
+  loadSecurityRuntime,
+} from '../../teleport-plugin-next-workflows/__tests__/_helpers/load-security-runtime'
+
+// The data routes compare the app secret with the shared runtime's safeEqual.
+const securityRuntime = loadSecurityRuntime()
 
 /**
  * The per-table read routes served whole tables to anyone: every draft,
@@ -55,15 +63,56 @@ function bootTableRoute(tableName: string, options: BootOptions = {}) {
             user: 'teleporthq.secrets.TELEPORT_DB_USER',
             password: 'teleporthq.secrets.TELEPORT_DB_PASSWORD',
             database: 'teleporthq.secrets.TELEPORT_DB_NAME',
-            selectedTables: { [tableName]: { columns: [{ name: 'id', type: 'uuid' }] } },
+            // The table's schema as the editor exports it: the only columns a request may name.
+            selectedTables: {
+              [tableName]: {
+                columns: [
+                  { name: 'id', type: 'uuid' },
+                  { name: 'title' },
+                  { name: 'name' },
+                  { name: 'status' },
+                  { name: 'slug' },
+                  { name: 'author_email' },
+                  { name: 'created_at' },
+                  { name: 'price' },
+                  { name: 'code' },
+                  { name: 'email' },
+                  { name: 'role' },
+                ],
+              },
+            },
           }
-        : { host: 'h', port: 5432, user: 'u', password: 'p', database: 'd' },
+        : {
+            host: 'h',
+            port: 5432,
+            user: 'u',
+            password: 'p',
+            database: 'd',
+            selectedTables: {
+              [tableName]: {
+                columns: [
+                  { name: 'id', type: 'uuid' },
+                  { name: 'title' },
+                  { name: 'name' },
+                  { name: 'status' },
+                  { name: 'slug' },
+                  { name: 'author_email' },
+                  { name: 'created_at' },
+                  { name: 'price' },
+                  { name: 'code' },
+                  { name: 'email' },
+                  { name: 'role' },
+                ],
+              },
+            },
+          },
   }
   const esm = generateDataSourceFetcherWithCore(
     dataSource as never,
     tableName,
     false,
-    { trustedReaderRoles: ADMIN_ROLES },
+    // Bound by a public page: what is left to decide is the row policy.
+    { trustedReaderRoles: ADMIN_ROLES, ...publicExposure([tableName]) },
     options.cache
   )
   const code = esm
@@ -133,6 +182,9 @@ function bootTableRoute(tableName: string, options: BootOptions = {}) {
         getToken: async () => (session ? { sub: session.sub || 'u1', role: session.role } : null),
       }
     }
+    if (isSecurityRuntimeSpecifier(name)) {
+      return securityRuntime
+    }
     throw new Error('unexpected require: ' + name)
   }
   const moduleObj: { exports: any } = { exports: {} }
@@ -585,9 +637,11 @@ describe('the response cache never hands one view to the other', () => {
     await posts.run({})
     expect(posts.cacheCalls).toEqual([{ scope: 'ds-1:teleport_blog_posts', sMaxAge: 30 }])
 
+    // The store's own server code reads whole tables (a browser's read is
+    // capped), so it keeps a cache of its own as well.
     posts.cacheCalls.length = 0
     await posts.serverFetch()
-    expect(posts.cacheCalls).toEqual([{ scope: 'ds-1:teleport_blog_posts:trusted', sMaxAge: 0 }])
+    expect(posts.cacheCalls).toEqual([{ scope: 'ds-1:teleport_blog_posts:server', sMaxAge: 0 }])
 
     posts.cacheCalls.length = 0
     await posts.run({ session: { role: 'admin' } })
@@ -598,14 +652,17 @@ describe('the response cache never hands one view to the other', () => {
     expect(posts.cacheCalls).toEqual([{ scope: 'ds-1:teleport_blog_posts:count', sMaxAge: 30 }])
   })
 
-  it('lets every caller share one view of a table that answers everyone alike', async () => {
+  it('lets every visitor share one view of a table that answers everyone alike', async () => {
     const members = bootTableRoute('team_members', {
       cache: { scope: 'ds-1:team_members', ttlSeconds: 60 },
     })
     members.cacheCalls.length = 0
     await members.serverFetch()
     await members.run({})
+    await members.run({ session: { role: 'member' } })
+    // The server's whole-table read keeps its own entry; every browser shares one.
     expect(members.cacheCalls.map((call) => call.scope)).toEqual([
+      'ds-1:team_members:server',
       'ds-1:team_members',
       'ds-1:team_members',
     ])
@@ -651,6 +708,9 @@ describe('raw-query state routes bind {{Current User.*}} to the session', () =>
       if (name === 'next-auth/jwt') {
         return { getToken: async () => session }
       }
+      if (isSecurityRuntimeSpecifier(name)) {
+        return securityRuntime
+      }
       throw new Error('unexpected require: ' + name)
     }
     const moduleObj: { exports: any } = { exports: {} }

package/__tests__/data-source-cache-wrapping.test.ts

@@ -1,6 +1,7 @@
 import { UIDLDataSource } from '@teleporthq/teleport-types'
 import { generateDataSourceFetcherWithCore } from '../src/data-source-fetchers'
 import { mergeServerCacheOptions } from '../src/cache/config'
+import { publicExposure } from './_helpers/exposure'
 
 const dataSource: UIDLDataSource = {
   id: 'ds_1',
@@ -11,6 +12,9 @@ const dataSource: UIDLDataSource = {
 
 const CACHE = { scope: 'ds_1:teleport_products', ttlSeconds: 60 }
 
+// The products table as a project with a public shop page exposes it.
+const PUBLIC = publicExposure(['teleport_products', 'products'])
+
 describe('generateDataSourceFetcherWithCore — server cache wrapping', () => {
   /**
    * The regression pin. A project that never asked for caching must generate
@@ -36,7 +40,7 @@ describe('generateDataSourceFetcherWithCore — server cache wrapping', () => {
       dataSource,
       'teleport_products',
       false,
-      {},
+      PUBLIC,
       CACHE
     )
 
@@ -50,18 +54,55 @@ describe('generateDataSourceFetcherWithCore — server cache wrapping', () => {
     )
   })
 
-  it('wraps a route without the row policy in one shared cache, as before', () => {
+  it('an external driver route carries the read guard, so its cache is split by view too', () => {
     const mysql: UIDLDataSource = {
       id: 'ds_2',
       name: 'Shop',
       type: 'mysql',
       config: { host: 'h', port: 3306, user: 'u', password: 'p', database: 'd' },
     }
-    const code = generateDataSourceFetcherWithCore(mysql, 'products', false, {}, CACHE)
+    const code = generateDataSourceFetcherWithCore(mysql, 'products', false, PUBLIC, CACHE)
 
-    expect(code).toContain('const cachedHandler = tqWithCache(handler, __tqDataCache)')
-    expect(code).toContain('const cachedGetCount = tqWithCache(getCount, __tqCountCache)')
-    expect(code).not.toContain('__tqCacheByView')
+    expect(code).toContain('const cachedHandler = __tqCacheByView(handler, __tqDataCache)')
+    expect(code).toContain('const cachedGetCount = __tqCacheByView(getCount, __tqCountCache)')
+    expect(code).toContain('__taGuardedDriverRead(req, res, __tqUnguardedHandler')
+  })
+
+  /**
+   * A table only some sessions may read: a cached answer filled by one of them
+   * must never reach a visitor the route would refuse, and never a CDN.
+   */
+  it('checks the session before the cache, and shares nothing, for a table not every visitor may read', () => {
+    const code = generateDataSourceFetcherWithCore(
+      dataSource,
+      'teleport_products',
+      false,
+      {},
+      { ...CACHE, sMaxAge: 30, staleWhileRevalidate: 300 }
+    )
+
+    expect(code).toContain(
+      'const cachedHandler = __tqExposureFirst(__tqCacheByView(handler, __tqDataCache))'
+    )
+    expect(code).toContain(
+      'const cachedGetCount = __tqExposureFirst(__tqCacheByView(getCount, __tqCountCache))'
+    )
+    expect(code).toContain('"sMaxAge":0')
+    expect(code).not.toContain('"sMaxAge":30')
+  })
+
+  /** The app's own server code reads whole tables; a browser's read is capped. */
+  it('never shares a cache entry between a server-side read and a browser read', () => {
+    const code = generateDataSourceFetcherWithCore(
+      dataSource,
+      'teleport_products',
+      false,
+      PUBLIC,
+      CACHE
+    )
+
+    expect(code).toContain("scope: opts.scope + ':server'")
+    expect(code).toContain('if (__taIsInternalRequest(req)) return serverView(req, res)')
   })
 
   /**
@@ -117,7 +158,7 @@ describe('generateDataSourceFetcherWithCore — server cache wrapping', () => {
       dataSource,
       'teleport_products',
       false,
-      {},
+      PUBLIC,
       {
         ...CACHE,
         sMaxAge: 30,