@teleporthq/teleport-plugin-next-workflows 0.43.1

package/dist/esm/sql-validator.js

@@ -0,0 +1,352 @@
+/**
+ * Generates the runtime SQL validation code that is embedded in the
+ * Next.js data API route.  Every query – whether built from structured
+ * parameters or supplied as a raw string – is validated **before** it
+ * reaches the database.
+ *
+ * The generated code exposes two helpers:
+ *   • validateSqlQuery(sql)        – rejects forbidden DDL / DCL statements
+ *   • validateIdentifier(name)     – rejects identifiers that are not safe
+ *                                     to interpolate into SQL
+ */
+// ---------------------------------------------------------------------------
+// Forbidden-operation regex patterns
+// ---------------------------------------------------------------------------
+// Each entry is [regex-source (case-insensitive), human-readable label].
+// The patterns operate on *cleaned* SQL (comments & string literals removed,
+// whitespace collapsed).
+const FORBIDDEN_PATTERNS = [
+    // ── CREATE operations ────────────────────────────────────────────────
+    [
+        '\\bcreate\\s+(?:temporary\\s+|temp\\s+|unlogged\\s+|global\\s+|local\\s+)?table\\b',
+        'CREATE TABLE',
+    ],
+    ['\\bcreate\\s+(?:unique\\s+)?index\\b', 'CREATE INDEX'],
+    ['\\bcreate\\s+(?:or\\s+replace\\s+)?(?:materialized\\s+)?view\\b', 'CREATE VIEW'],
+    ['\\bcreate\\s+(?:or\\s+replace\\s+)?trigger\\b', 'CREATE TRIGGER'],
+    ['\\bcreate\\s+(?:or\\s+replace\\s+)?(?:aggregate\\s+)?function\\b', 'CREATE FUNCTION'],
+    ['\\bcreate\\s+(?:or\\s+replace\\s+)?procedure\\b', 'CREATE PROCEDURE'],
+    ['\\bcreate\\s+database\\b', 'CREATE DATABASE'],
+    ['\\bcreate\\s+schema\\b', 'CREATE SCHEMA'],
+    ['\\bcreate\\s+sequence\\b', 'CREATE SEQUENCE'],
+    ['\\bcreate\\s+extension\\b', 'CREATE EXTENSION'],
+    ['\\bcreate\\s+type\\b', 'CREATE TYPE'],
+    ['\\bcreate\\s+role\\b', 'CREATE ROLE'],
+    ['\\bcreate\\s+user\\b', 'CREATE USER'],
+    // ── ALTER operations ─────────────────────────────────────────────────
+    ['\\balter\\s+table\\b', 'ALTER TABLE'],
+    ['\\balter\\s+index\\b', 'ALTER INDEX'],
+    ['\\balter\\s+(?:materialized\\s+)?view\\b', 'ALTER VIEW'],
+    ['\\balter\\s+database\\b', 'ALTER DATABASE'],
+    ['\\balter\\s+schema\\b', 'ALTER SCHEMA'],
+    ['\\balter\\s+sequence\\b', 'ALTER SEQUENCE'],
+    ['\\balter\\s+extension\\b', 'ALTER EXTENSION'],
+    ['\\balter\\s+type\\b', 'ALTER TYPE'],
+    ['\\balter\\s+role\\b', 'ALTER ROLE'],
+    ['\\balter\\s+user\\b', 'ALTER USER'],
+    // ── DROP operations ──────────────────────────────────────────────────
+    ['\\bdrop\\s+(?:temporary\\s+|temp\\s+)?table\\b', 'DROP TABLE'],
+    ['\\bdrop\\s+index\\b', 'DROP INDEX'],
+    ['\\bdrop\\s+(?:materialized\\s+)?view\\b', 'DROP VIEW'],
+    ['\\bdrop\\s+trigger\\b', 'DROP TRIGGER'],
+    ['\\bdrop\\s+(?:aggregate\\s+)?function\\b', 'DROP FUNCTION'],
+    ['\\bdrop\\s+procedure\\b', 'DROP PROCEDURE'],
+    ['\\bdrop\\s+database\\b', 'DROP DATABASE'],
+    ['\\bdrop\\s+schema\\b', 'DROP SCHEMA'],
+    ['\\bdrop\\s+sequence\\b', 'DROP SEQUENCE'],
+    ['\\bdrop\\s+extension\\b', 'DROP EXTENSION'],
+    ['\\bdrop\\s+type\\b', 'DROP TYPE'],
+    ['\\bdrop\\s+role\\b', 'DROP ROLE'],
+    ['\\bdrop\\s+user\\b', 'DROP USER'],
+    // ── TRUNCATE ─────────────────────────────────────────────────────────
+    ['\\btruncate\\b', 'TRUNCATE'],
+    // ── RENAME ───────────────────────────────────────────────────────────
+    ['\\brename\\s+table\\b', 'RENAME TABLE'],
+    // ── Permission / DCL ─────────────────────────────────────────────────
+    ['\\bgrant\\s+', 'GRANT'],
+    ['\\brevoke\\s+', 'REVOKE'],
+    // ── Metadata ─────────────────────────────────────────────────────────
+    [
+        '\\bcomment\\s+on\\s+(?:table|column|index|view|function|procedure|trigger|schema|database|sequence|type|role|extension)\\b',
+        'COMMENT ON',
+    ],
+    // ── SELECT INTO (creates a new table from query results) ─────────────
+    // Anchored to statement start to avoid matching INSERT INTO ... SELECT
+    ['^select\\b[\\s\\S]*\\binto\\b', 'SELECT INTO'],
+    // ── DO blocks (PL/pgSQL anonymous blocks can hide forbidden ops) ─────
+    // After string-literal stripping, DO $$ ... $$ becomes DO ''
+    // We must block DO blocks because their contents are invisible after
+    // stripping and could contain any forbidden operation.
+    ['^do\\b', 'DO (anonymous code block)'],
+    // ── Dangerous session / config changes ───────────────────────────────
+    ['\\bset\\s+role\\b', 'SET ROLE'],
+    ['\\breset\\s+role\\b', 'RESET ROLE'],
+    ['\\bset\\s+session\\s+authorization\\b', 'SET SESSION AUTHORIZATION'],
+    // ── COPY (file-system access) ────────────────────────────────────────
+    // Anchored to statement start to avoid false positives with column
+    // names like "copy" in SELECT queries.
+    ['^copy\\b', 'COPY'],
+    // ── EXECUTE / PREPARE / DEALLOCATE (prepared statements / dynamic SQL)
+    // Anchored to statement start to avoid false positives with identifiers.
+    ['^execute\\b', 'EXECUTE'],
+    ['^prepare\\b', 'PREPARE'],
+    ['^deallocate\\b', 'DEALLOCATE'],
+    // ── VACUUM / REINDEX (maintenance ops that can affect performance) ───
+    // Anchored to statement start to avoid false positives.
+    ['^vacuum\\b', 'VACUUM'],
+    ['^reindex\\b', 'REINDEX'],
+];
+// ---------------------------------------------------------------------------
+// Code generator
+// ---------------------------------------------------------------------------
+/**
+ * Returns a JS code string containing:
+ *   - stripSqlComments(sql)
+ *   - stripStringLiterals(sql)
+ *   - cleanSqlForValidation(sql)
+ *   - validateSqlQuery(sql)          → { valid, error?, matchedOperation? }
+ *   - validateIdentifier(name)       → { valid, error? }
+ *   - assertQuerySafe(sql)           → throws on forbidden ops
+ *   - assertIdentifierSafe(name, label) → throws on bad identifiers
+ */
+export function generateSqlValidatorCode() {
+    // Build the forbidden-patterns array as a JS literal
+    const patternsJS = FORBIDDEN_PATTERNS.map(([src, label]) => `  [/${src}/i, ${JSON.stringify(label)}]`).join(',\n');
+    return `
+// ═══════════════════════════════════════════════════════════════════════════
+// SQL Validation – generated by teleport-plugin-next-workflows
+// ═══════════════════════════════════════════════════════════════════════════
+
+var FORBIDDEN_SQL_PATTERNS = [
+${patternsJS}
+];
+
+/**
+ * Remove single-line (--) and multi-line comments from SQL.
+ */
+function stripSqlComments(sql) {
+  var result = '';
+  var i = 0;
+  var len = sql.length;
+  while (i < len) {
+    // Single-line comment
+    if (sql[i] === '-' && i + 1 < len && sql[i + 1] === '-') {
+      // Skip until newline
+      while (i < len && sql[i] !== '\\n') i++;
+      continue;
+    }
+    // Multi-line comment (supports nesting)
+    if (sql[i] === '/' && i + 1 < len && sql[i + 1] === '*') {
+      i += 2;
+      var depth = 1;
+      while (i < len && depth > 0) {
+        if (sql[i] === '/' && i + 1 < len && sql[i + 1] === '*') {
+          depth++;
+          i += 2;
+        } else if (sql[i] === '*' && i + 1 < len && sql[i + 1] === '/') {
+          depth--;
+          i += 2;
+        } else {
+          i++;
+        }
+      }
+      result += ' ';
+      continue;
+    }
+    result += sql[i];
+    i++;
+  }
+  return result;
+}
+
+/**
+ * Replace all string literals with empty placeholders so they
+ * don't trigger false positives.
+ *
+ * Handles:  'single'  "double"  $$dollar$$  $tag$dollar$tag$
+ */
+function stripStringLiterals(sql) {
+  var result = '';
+  var i = 0;
+  var len = sql.length;
+  while (i < len) {
+    // Single-quoted string
+    if (sql[i] === "'") {
+      i++;
+      while (i < len) {
+        if (sql[i] === "'" && i + 1 < len && sql[i + 1] === "'") {
+          i += 2; // escaped quote
+        } else if (sql[i] === "'") {
+          i++;
+          break;
+        } else {
+          i++;
+        }
+      }
+      result += "''";
+      continue;
+    }
+    // Dollar-quoted string (PostgreSQL)
+    if (sql[i] === '$') {
+      var tagStart = i;
+      i++;
+      // Collect optional tag name: $tag$ or just $$
+      while (i < len && sql[i] !== '$' && /[a-zA-Z0-9_]/.test(sql[i])) i++;
+      if (i < len && sql[i] === '$') {
+        var tag = sql.substring(tagStart, i + 1); // e.g. "$$" or "$tag$"
+        i++;
+        var endIdx = sql.indexOf(tag, i);
+        if (endIdx !== -1) {
+          i = endIdx + tag.length;
+          result += "''";
+          continue;
+        }
+        // No closing tag found – treat as literal $
+        result += tag;
+        continue;
+      }
+      // Not a dollar-quote, just a dollar sign
+      result += sql.substring(tagStart, i);
+      continue;
+    }
+    // Double-quoted identifier – keep it (it's an identifier, not a string value)
+    if (sql[i] === '"') {
+      result += sql[i];
+      i++;
+      while (i < len) {
+        if (sql[i] === '"' && i + 1 < len && sql[i + 1] === '"') {
+          result += '""';
+          i += 2;
+        } else if (sql[i] === '"') {
+          result += sql[i];
+          i++;
+          break;
+        } else {
+          result += sql[i];
+          i++;
+        }
+      }
+      continue;
+    }
+    result += sql[i];
+    i++;
+  }
+  return result;
+}
+
+/**
+ * Full pre-processing pipeline: strip comments, strip string literals,
+ * collapse whitespace.
+ */
+function cleanSqlForValidation(sql) {
+  var cleaned = stripSqlComments(sql);
+  cleaned = stripStringLiterals(cleaned);
+  cleaned = cleaned.replace(/[\\s]+/g, ' ').trim();
+  return cleaned;
+}
+
+/**
+ * Validate a full SQL string (may contain multiple statements).
+ * Returns { valid: true } or { valid: false, error, matchedOperation }.
+ */
+function validateSqlQuery(sql) {
+  if (!sql || typeof sql !== 'string') {
+    return { valid: true };
+  }
+
+  var cleaned = cleanSqlForValidation(sql);
+  if (!cleaned) return { valid: true };
+
+  // Split on semicolons and check each statement
+  var statements = cleaned.split(';').map(function(s) { return s.trim(); }).filter(Boolean);
+
+  for (var si = 0; si < statements.length; si++) {
+    var stmt = statements[si];
+    for (var pi = 0; pi < FORBIDDEN_SQL_PATTERNS.length; pi++) {
+      var pattern = FORBIDDEN_SQL_PATTERNS[pi][0];
+      var label = FORBIDDEN_SQL_PATTERNS[pi][1];
+      if (pattern.test(stmt)) {
+        return {
+          valid: false,
+          error: label + ' operations are not allowed. This operation could damage the database schema or data integrity.',
+          matchedOperation: label
+        };
+      }
+    }
+  }
+
+  return { valid: true };
+}
+
+/**
+ * Validate a SQL identifier (table name, column name, sort field, etc.).
+ * Only allows safe characters to prevent SQL injection through identifier
+ * interpolation.
+ *
+ * Allowed formats:
+ *   - Simple:           users, my_table, _private
+ *   - Schema-qualified: public.users, my_schema.my_table
+ *   - Wildcard:         * (for SELECT *)
+ *   - Double-quoted:    "my-table", "public"."my-table"
+ *   - Cast expressions: column::type (PostgreSQL)
+ *   - Function calls:   count(*), lower(name)
+ */
+var SAFE_IDENTIFIER_RE = /^(?:(?:"[^"]*"|[a-zA-Z_][a-zA-Z0-9_]*)(?:\\.(?:"[^"]*"|[a-zA-Z_][a-zA-Z0-9_]*))*(?:::(?:[a-zA-Z_][a-zA-Z0-9_[\\]]*))?)$/;
+var SAFE_COLUMN_EXPR_RE = /^(?:\\*|(?:"[^"]*"|[a-zA-Z_][a-zA-Z0-9_]*)(?:\\.(?:\\*|"[^"]*"|[a-zA-Z_][a-zA-Z0-9_]*))*(?:::(?:[a-zA-Z_][a-zA-Z0-9_[\\]]*))?)$/;
+var SAFE_FUNCTION_CALL_RE = /^[a-zA-Z_][a-zA-Z0-9_]*\\((?:\\*|(?:"[^"]*"|[a-zA-Z_][a-zA-Z0-9_.]*)(?:,\\s*(?:"[^"]*"|[a-zA-Z_][a-zA-Z0-9_.]*))*)\\)(?:::(?:[a-zA-Z_][a-zA-Z0-9_[\\]]*))?$/;
+
+function validateIdentifier(name) {
+  if (!name || typeof name !== 'string') {
+    return { valid: false, error: 'Identifier is empty or not a string' };
+  }
+
+  var trimmed = name.trim();
+  if (!trimmed) {
+    return { valid: false, error: 'Identifier is empty' };
+  }
+
+  if (trimmed === '*') {
+    return { valid: true };
+  }
+
+  if (SAFE_IDENTIFIER_RE.test(trimmed) || SAFE_COLUMN_EXPR_RE.test(trimmed) || SAFE_FUNCTION_CALL_RE.test(trimmed)) {
+    return { valid: true };
+  }
+
+  return {
+    valid: false,
+    error: 'Invalid SQL identifier: ' + trimmed.substring(0, 50) + '. Only alphanumeric characters, underscores, dots, and double-quoted identifiers are allowed.'
+  };
+}
+
+/**
+ * Throws a structured error if the SQL query contains forbidden operations.
+ */
+function assertQuerySafe(sql) {
+  var result = validateSqlQuery(sql);
+  if (!result.valid) {
+    var err = new Error(result.error);
+    err.code = 'FORBIDDEN_SQL_OPERATION';
+    err.matchedOperation = result.matchedOperation;
+    err.status = 403;
+    throw err;
+  }
+}
+
+/**
+ * Throws a structured error if the identifier is not safe for interpolation.
+ * @param {string} name  The identifier to validate
+ * @param {string} label A human-readable label for error messages (e.g. "table name")
+ */
+function assertIdentifierSafe(name, label) {
+  var result = validateIdentifier(name);
+  if (!result.valid) {
+    var err = new Error('Invalid ' + (label || 'identifier') + ': ' + result.error);
+    err.code = 'INVALID_SQL_IDENTIFIER';
+    err.status = 400;
+    throw err;
+  }
+}
+`;
+}
+//# sourceMappingURL=sql-validator.js.map

package/dist/esm/sql-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-validator.js","sourceRoot":"","sources":["../../src/sql-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAC9E,yEAAyE;AACzE,6EAA6E;AAC7E,yBAAyB;AAEzB,MAAM,kBAAkB,GAA4B;IAClD,wEAAwE;IACxE;QACE,oFAAoF;QACpF,cAAc;KACf;IACD,CAAC,sCAAsC,EAAE,cAAc,CAAC;IACxD,CAAC,iEAAiE,EAAE,aAAa,CAAC;IAClF,CAAC,+CAA+C,EAAE,gBAAgB,CAAC;IACnE,CAAC,kEAAkE,EAAE,iBAAiB,CAAC;IACvF,CAAC,iDAAiD,EAAE,kBAAkB,CAAC;IACvE,CAAC,0BAA0B,EAAE,iBAAiB,CAAC;IAC/C,CAAC,wBAAwB,EAAE,eAAe,CAAC;IAC3C,CAAC,0BAA0B,EAAE,iBAAiB,CAAC;IAC/C,CAAC,2BAA2B,EAAE,kBAAkB,CAAC;IACjD,CAAC,sBAAsB,EAAE,aAAa,CAAC;IACvC,CAAC,sBAAsB,EAAE,aAAa,CAAC;IACvC,CAAC,sBAAsB,EAAE,aAAa,CAAC;IAEvC,wEAAwE;IACxE,CAAC,sBAAsB,EAAE,aAAa,CAAC;IACvC,CAAC,sBAAsB,EAAE,aAAa,CAAC;IACvC,CAAC,0CAA0C,EAAE,YAAY,CAAC;IAC1D,CAAC,yBAAyB,EAAE,gBAAgB,CAAC;IAC7C,CAAC,uBAAuB,EAAE,cAAc,CAAC;IACzC,CAAC,yBAAyB,EAAE,gBAAgB,CAAC;IAC7C,CAAC,0BAA0B,EAAE,iBAAiB,CAAC;IAC/C,CAAC,qBAAqB,EAAE,YAAY,CAAC;IACrC,CAAC,qBAAqB,EAAE,YAAY,CAAC;IACrC,CAAC,qBAAqB,EAAE,YAAY,CAAC;IAErC,wEAAwE;IACxE,CAAC,gDAAgD,EAAE,YAAY,CAAC;IAChE,CAAC,qBAAqB,EAAE,YAAY,CAAC;IACrC,CAAC,yCAAyC,EAAE,WAAW,CAAC;IACxD,CAAC,uBAAuB,EAAE,cAAc,CAAC;IACzC,CAAC,0CAA0C,EAAE,eAAe,CAAC;IAC7D,CAAC,yBAAyB,EAAE,gBAAgB,CAAC;IAC7C,CAAC,wBAAwB,EAAE,eAAe,CAAC;IAC3C,CAAC,sBAAsB,EAAE,aAAa,CAAC;IACvC,CAAC,wBAAwB,EAAE,eAAe,CAAC;IAC3C,CAAC,yBAAyB,EAAE,gBAAgB,CAAC;IAC7C,CAAC,oBAAoB,EAAE,WAAW,CAAC;IACnC,CAAC,oBAAoB,EAAE,WAAW,CAAC;IACnC,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAEnC,wEAAwE;IACxE,CAAC,gBAAgB,EAAE,UAAU,CAAC;IAE9B,wEAAwE;IACxE,CAAC,uBAAuB,EAAE,cAAc,CAAC;IAEzC,wEAAwE;IACxE,CAAC,cAAc,EAAE,OAAO,CAAC;IACzB,CAAC,eAAe,EAAE,QAAQ,CAAC;IAE3B,wEAAwE;IACxE;QACE,4HAA4H;QAC5H,YAAY;KACb;IAED,wEAAwE;IACxE,uEAAuE;IACvE,CAAC,+BAA+B,EAAE,aAAa,CAAC;IAEhD,wEAAwE;IACxE,6DAA6D;IAC7D,qEAAqE;IACrE,uDAAuD;IACvD,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAEvC,wEAAwE;IACxE,CAAC,mBAAmB,EAAE,UAAU,CAAC;IACjC,CAAC,qBAAqB,EAAE,YAAY,CAAC;IACrC,CAAC,uCAAuC,EAAE,2BAA2B,CAAC;IAEtE,wEAAwE;IACxE,mEAAmE;IACnE,uCAAuC;IACvC,CAAC,UAAU,EAAE,MAAM,CAAC;IAEpB,wEAAwE;IACxE,yEAAyE;IACzE,CAAC,aAAa,EAAE,SAAS,CAAC;IAC1B,CAAC,aAAa,EAAE,SAAS,CAAC;IAC1B,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAEhC,wEAAwE;IACxE,wDAAwD;IACxD,CAAC,YAAY,EAAE,QAAQ,CAAC;IACxB,CAAC,aAAa,EAAE,SAAS,CAAC;CAC3B,CAAA;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB;IACtC,qDAAqD;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CACvC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,GAAG,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAC5D,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAEb,OAAO;;;;;;EAMP,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqOX,CAAA;AACD,CAAC"}

package/dist/esm/trigger-generator.d.ts

@@ -0,0 +1,24 @@
+import { UIDLWorkflow } from '@teleporthq/teleport-types';
+/**
+ * For DOM events whose `target` is a form control (select, input, textarea,
+ * checkbox/radio, file input), the user-visible value lives on `.value` /
+ * `.checked` / `.files`. The workflow executor's `resolveContextRef`
+ * resolves `Trigger.value` by reading `triggerContext.value`, so an
+ * `event-element-event` handler that does NOT capture these fields turns
+ * every `state-update-local-state` node bound to `[triggerNodeId, 'value']`
+ * (the GUI's default for "set state to dropdown selection") into a no-op
+ * — the dropdown/input change fires the workflow, but it writes `undefined`
+ * to the state.
+ *
+ * Capturing these three fields unconditionally is safe: on non-form
+ * elements they all evaluate to `undefined`, costing only a few extra
+ * JS-object property writes per event.
+ *
+ * @param elementRef A JS expression that evaluates to the event target —
+ *   typically `'__te'` (= `event.currentTarget || event.target`, used by
+ *   the JSX-on-* handlers) or `'event.target'` (used by document-level
+ *   `addEventListener` fallbacks).
+ */
+export declare const formControlPropertyReads: (elementRef: string) => string;
+export declare const generateTriggerCode: (workflow: UIDLWorkflow, workflowVarName: string) => string;
+//# sourceMappingURL=trigger-generator.d.ts.map

package/dist/esm/trigger-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trigger-generator.d.ts","sourceRoot":"","sources":["../../src/trigger-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAEzD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,wBAAwB,eAAgB,MAAM,KAAG,MAC4B,CAAA;AAE1F,eAAO,MAAM,mBAAmB,aAAc,YAAY,mBAAmB,MAAM,KAAG,MAsDrF,CAAA"}