@teleporthq/teleport-plugin-next-static-props 0.44.0 → 0.44.1

package/src/index.ts

@@ -5,7 +5,7 @@ import {
   FileType,
   TeleportError,
 } from '@teleporthq/teleport-types'
-import { StringUtils, GenericUtils } from '@teleporthq/teleport-shared'
+import { StringUtils, GenericUtils, TableAccess } from '@teleporthq/teleport-shared'
 import { RouteUtils } from '@teleporthq/teleport-plugin-common'
 import { generateInitialPropsAST } from './utils'
 
@@ -13,7 +13,17 @@ interface StaticPropsPluginConfig {
   componentChunkName?: string
 }
 
-const { isDynamicRoute, pageHasSameTableMutationWorkflow, pageReadsProtectedTable } = RouteUtils
+const {
+  isDynamicRoute,
+  pageDataReadArguments,
+  pageDataReadsAsStore,
+  pageHasSameTableMutationWorkflow,
+  pageReadsProtectedTable,
+} = RouteUtils
+
+// The data sources whose read routes guard their tables (see
+// teleport-plugin-next-data-source `table-access-guard.ts`).
+const GUARDED_SOURCE_TYPES = ['teleport', 'postgresql']
 
 export const createStaticPropsPlugin: ComponentPluginFactory<StaticPropsPluginConfig> = (
   config
@@ -50,6 +60,10 @@ export const createStaticPropsPlugin: ComponentPluginFactory<StaticPropsPluginCo
       Name of the function that is being imported
     */
     let resourceImportName
+    // The page's row is what it renders, so it is read as a visitor is served
+    // it — unless only the store's trusted readers can open the page.
+    const readsAsVisitor = !pageDataReadsAsStore(uidl, options.auth)
+    let entityReadable = true
 
     if (isLocalResource) {
       const usedResource = resources.items?.[resource.id]
@@ -63,6 +77,20 @@ export const createStaticPropsPlugin: ComponentPluginFactory<StaticPropsPluginCo
         StringUtils.camelCaseToDashCase(usedResource.name + 'Resource')
       )
 
+      // A visitor is served no row of an order or a gift card, so a page that
+      // is not the admin's renders without one rather than carry a row read as
+      // the store. A member's page reads their public profile only (see
+      // `TableAccess.PUBLIC_PROFILE_COLUMNS`): read as the store, it put any
+      // member's whole account in the page data of whoever opened `/profile/<id>`.
+      const tableName = usedResource.params?.tableName?.content
+      const sourceType = usedResource.params?.dataSourceType?.content
+      entityReadable = !(
+        readsAsVisitor &&
+        typeof tableName === 'string' &&
+        GUARDED_SOURCE_TYPES.indexOf(String(sourceType)) !== -1 &&
+        TableAccess.pageDataReadsNoRowOf(tableName)
+      )
+
       dependencies[resourceImportName] = {
         type: 'local',
         path: `${GenericUtils.generatePageDependenciesPrefix({
@@ -83,7 +111,11 @@ export const createStaticPropsPlugin: ComponentPluginFactory<StaticPropsPluginCo
       resourceImportName,
       resources.cache,
       options.skipI18n,
-      useServerSideProps
+      useServerSideProps,
+      // A resource the project generated forwards it to the data-source module;
+      // another package's function takes its own arguments.
+      () => (isLocalResource ? pageDataReadArguments(uidl, options.auth) : []),
+      entityReadable
     )
 
     // NOTE: the chunk is always registered under the 'getStaticProps' name

package/src/utils.ts

@@ -19,7 +19,11 @@ export const generateInitialPropsAST = (
    * auth-gated per request, so there is no real CDN-caching upside being
    * traded away. See `createStaticPropsPlugin` for the selection logic.
    */
-  useServerSideProps?: boolean
+  useServerSideProps?: boolean,
+  /** What the page's read hands the resource after its params (`{ as: 'visitor' }`). */
+  readArguments: () => types.Expression[] = () => [],
+  /** False when the page's reader is served no row of the table: it renders without one. */
+  entityReadable: boolean = true
 ) => {
   // Destructure params from context so expr-type resource params can reference `params` directly
   const paramsDestructureAST = types.variableDeclaration('const', [
@@ -51,7 +55,9 @@ export const generateInitialPropsAST = (
           resourceImportName,
           revalidateSeconds,
           skipI18n,
-          useServerSideProps
+          useServerSideProps,
+          readArguments,
+          entityReadable
         ),
       ]),
       types.catchClause(
@@ -138,7 +144,9 @@ const computePropsAST = (
   resourceImportName: string,
   revalidateSeconds: number | null,
   skipI18n?: boolean,
-  useServerSideProps?: boolean
+  useServerSideProps?: boolean,
+  readArguments: () => types.Expression[] = () => [],
+  entityReadable: boolean = true
 ) => {
   const funcParams: types.ObjectProperty[] = Object.keys(
     initialPropsData.resource?.params || {}
@@ -218,6 +226,7 @@ const computePropsAST = (
               : types.cloneNode(param, true)
           ),
         ]),
+        ...readArguments(),
       ])
     )
 
@@ -288,6 +297,10 @@ const computePropsAST = (
     )
   )
 
+  if (!entityReadable) {
+    return [buildUnreadableEntityReturnAST(initialPropsData, revalidateProperty)]
+  }
+
   return [
     declarationAST,
     notFoundAST,
@@ -297,6 +310,46 @@ const computePropsAST = (
   ]
 }
 
+/**
+ * The page, without its row: `{ props: { ...context?.params, <exposeAs>: null } }`.
+ *
+ * For a page whose reader is served no row of the table it shows (an order, a
+ * gift card — see `TableAccess.pageDataReadsNoRowOf`). Reading it as the
+ * store put another member's row in the page data of whoever opened the
+ * address; reading it as the visitor is always refused, which would 404 the
+ * page whatever else it shows.
+ */
+const buildUnreadableEntityReturnAST = (
+  initialPropsData: UIDLInitialPropsData,
+  revalidateProperty: () => types.ObjectProperty | null
+): types.ReturnStatement =>
+  types.returnStatement(
+    types.objectExpression(
+      [
+        types.objectProperty(
+          types.identifier('props'),
+          types.objectExpression([
+            types.spreadElement(
+              types.optionalMemberExpression(
+                types.identifier('context'),
+                types.identifier('params'),
+                false,
+                true
+              )
+            ),
+            types.objectProperty(
+              types.identifier(
+                StringUtils.createStateOrPropStoringValue(initialPropsData.exposeAs.name)
+              ),
+              types.nullLiteral()
+            ),
+          ])
+        ),
+        revalidateProperty(),
+      ].filter(Boolean)
+    )
+  )
+
 /**
  * A page that shows a SUBSET of a table's rows (`redirect.unlessFieldEquals`)
  * and names the filter selecting its own rows (`redirect.ownRowsFilter`): two