@teleporthq/teleport-plugin-next-workflows 0.43.1

package/dist/cjs/ecommerce/order-ownership.js

@@ -0,0 +1,146 @@
+"use strict";
+// Rewriter for the AI's `orders-list` / `order-details` ownership SQL.
+//
+// The AI generates customHandlers (in orders-list page load, orders-list
+// search, order-details page load, and similar workflows) that build a
+// raw SQL WHERE clause to scope orders to "the current user". The shape
+// the AI emits is:
+//
+//   if (role === "admin") {
+//     __ownership = "1=1";
+//   } else if (anonymousUserId && anonymousUserId !== userId) {
+//     __ownership = "(o.user_id::text = '" + safeUserId + "' OR " +
+//                    "o.user_id::text = '" + safeAnonUserId + "')";
+//   } else {
+//     __ownership = "o.user_id::text = '" + safeUserId + "'";
+//   }
+//
+// This has two issues:
+//
+//   1. SECURITY — `anonymousUserId` is read by an upstream customHandler
+//      from \`window.localStorage\`. It is fully client-controlled. A
+//      logged-in user can paste any UUID into their localStorage and
+//      see THAT anonymous user's orders. The OR-with-anon clause is the
+//      attack surface.
+//
+//   2. CORRECTNESS — when both `userId` and `anonymousUserId` are
+//      missing strings, the else branch emits `o.user_id::text = ''`,
+//      which matches any row whose `user_id` is the literal empty
+//      string. That's a defence-in-depth concern (such rows shouldn't
+//      exist in a well-seeded DB) but it's the kind of footgun that
+//      bites in production.
+//
+// The fix below replaces the construction block with a strict variant:
+//
+//   * admin               → see everything
+//   * authenticated user  → see ONLY orders whose user_id matches their
+//                           authenticated UUID
+//   * pure-anonymous user → see ONLY orders whose user_id matches the
+//                           browser's anon UUID (still client-controlled,
+//                           but the worst case is the user seeing their
+//                           OWN previous anonymous orders)
+//   * no identity at all  → `1=0` so the query matches no rows
+//
+// We intentionally drop the "merge anonymous orders after sign-in"
+// behaviour: it's the load-bearing source of the leak the user reported
+// and recovering pre-login anonymous orders should be an explicit "claim
+// previous orders" flow, not a passive SQL-level OR.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildOrderOwnershipReplacement = exports.looksLikeOrderOwnershipHandler = void 0;
+const stock_decrement_1 = require("./stock-decrement");
+// The exact AI-generated block we're replacing. Matching the whole
+// 5-line block is intentional — we want to be 100% sure we're rewriting
+// the right thing, not a coincidentally-similar fragment.
+//
+// The regex tolerates the typical whitespace shapes the AI emits
+// (`if (...)` vs `if (...)`, single-quote vs double-quote inside the
+// SQL, and the `safeAnonUserId !== userId` order on the OR branch). It
+// does NOT tolerate any change to the variable names — by intent, since
+// a future AI variant that renames things should produce a freshly-
+// reviewable pattern, not a silently-rewritten one.
+const AI_OWNERSHIP_BLOCK_RE = /var\s+__ownership\s*;\s*if\s*\(\s*role\s*===\s*["']admin["']\s*\)\s*\{\s*__ownership\s*=\s*["']1=1["']\s*;\s*\}\s*else\s+if\s*\(\s*anonymousUserId\s*&&\s*anonymousUserId\s*!==\s*userId\s*\)\s*\{\s*__ownership\s*=\s*["']\(o\.user_id::text\s*=\s*\\?'["']\s*\+\s*safeUserId\s*\+\s*\\?["']'\s*OR\s*o\.user_id::text\s*=\s*\\?'["']\s*\+\s*safeAnonUserId\s*\+\s*\\?["']'\)["']\s*;\s*\}\s*else\s*\{\s*__ownership\s*=\s*["']o\.user_id::text\s*=\s*\\?'["']\s*\+\s*safeUserId\s*\+\s*\\?["']'["']\s*;\s*\}/;
+// Distinguishing signature: the customHandler must mention all four —
+// the per-row user_id comparison, the ownership variable, both safe-id
+// variables, AND the literal SQL fragment "user_id::text". This catches
+// the four AI variants (orders-list page-load, orders-list search,
+// order-details, plus the gym-owners bulk-orders flow) and nothing else.
+const looksLikeOrderOwnershipHandler = (code) => {
+    if (typeof code !== 'string') {
+        return false;
+    }
+    if (code.indexOf(stock_decrement_1.STOCK_DECREMENT_MARKER) >= 0) {
+        return false;
+    }
+    if (code.indexOf('user_id::text') < 0) {
+        return false;
+    }
+    if (code.indexOf('__ownership') < 0) {
+        return false;
+    }
+    if (code.indexOf('safeUserId') < 0) {
+        return false;
+    }
+    if (code.indexOf('safeAnonUserId') < 0) {
+        return false;
+    }
+    // Bail when the AI shifts away from the OR-merge shape — a future AI
+    // version that already does the strict thing should pass through.
+    if (!AI_OWNERSHIP_BLOCK_RE.test(code)) {
+        return false;
+    }
+    return true;
+};
+exports.looksLikeOrderOwnershipHandler = looksLikeOrderOwnershipHandler;
+// The strict replacement block. Kept tight and well-commented because
+// it's the actual SECURITY boundary — every byte gets review.
+//
+// Note: there is intentionally NO \`role === "admin"\` bypass here. The
+// AI's original handler had one, but this customHandler is wired into
+// the BUYER-facing "/orders-list" page (and its order-details +
+// search variants) — the page literally titled "My Orders". An admin
+// landing on that page should see THEIR own purchases as a customer,
+// not every customer's orders. The admin-wide view lives at
+// /admin/orders, which is generated by a separate workflow that
+// doesn't go through this rewriter.
+const STRICT_OWNERSHIP_REPLACEMENT = `var __ownership;
+  if (safeUserId.length > 0) {
+    // Authenticated user: scope to their auth UUID ONLY. We deliberately
+    // do NOT OR-merge the localStorage-supplied anonymousUserId — that
+    // value is client-controlled and a malicious user could paste any
+    // UUID into it to see another anonymous user's orders. The trade
+    // -off is that orders the same browser placed BEFORE sign-up are
+    // no longer surfaced; that should be a deliberate "claim my old
+    // orders" flow, not a passive SQL-level OR.
+    //
+    // The admin-role bypass that lived here in the AI's original
+    // handler has been removed: this page is the BUYER's "My Orders"
+    // view (the page is literally titled "My Orders"), so an admin
+    // who logs in and lands here should see their own personal
+    // purchases, not every customer's orders. The admin-wide view
+    // lives at /admin/orders and is generated by a separate workflow.
+    __ownership = "o.user_id::text = '" + safeUserId + "'";
+  } else if (safeAnonUserId.length > 0) {
+    // Pure-anonymous browser: scope to the anonymous UUID this browser
+    // tracks. Still client-controlled, but the worst case here is the
+    // user seeing their OWN previous anonymous orders.
+    __ownership = "o.user_id::text = '" + safeAnonUserId + "'";
+  } else {
+    // No identity at all — match no rows. Without this guard an empty
+    // userId would produce \`o.user_id::text = ''\` and leak any row
+    // whose user_id is accidentally empty.
+    __ownership = "1=0";
+  }`;
+// We re-emit the FULL customHandler code with the ownership block
+// surgically replaced. The detector regex already verified the exact
+// AI shape, so a single \`replace()\` is sufficient.
+const buildOrderOwnershipReplacement = (originalCode) => {
+    const rewritten = originalCode.replace(AI_OWNERSHIP_BLOCK_RE, STRICT_OWNERSHIP_REPLACEMENT);
+    // Stamp the marker at the very top so subsequent rewriter passes (and
+    // the auditor) recognise this as already-handled and short-circuit.
+    // The runtime's general-custom-js regex tolerates leading comments
+    // before the `function` declaration thanks to the
+    // skip-leading-comments fix landed earlier in this codebase.
+    return `${stock_decrement_1.STOCK_DECREMENT_MARKER}\n${rewritten}`;
+};
+exports.buildOrderOwnershipReplacement = buildOrderOwnershipReplacement;
+//# sourceMappingURL=order-ownership.js.map

package/dist/cjs/ecommerce/order-ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"order-ownership.js","sourceRoot":"","sources":["../../../src/ecommerce/order-ownership.ts"],"names":[],"mappings":";AAAA,uEAAuE;AACvE,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,wEAAwE;AACxE,mBAAmB;AACnB,EAAE;AACF,4BAA4B;AAC5B,2BAA2B;AAC3B,gEAAgE;AAChE,oEAAoE;AACpE,oEAAoE;AACpE,aAAa;AACb,8DAA8D;AAC9D,MAAM;AACN,EAAE;AACF,uBAAuB;AACvB,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,qEAAqE;AACrE,wEAAwE;AACxE,uBAAuB;AACvB,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,kEAAkE;AAClE,sEAAsE;AACtE,oEAAoE;AACpE,4BAA4B;AAC5B,EAAE;AACF,uEAAuE;AACvE,EAAE;AACF,2CAA2C;AAC3C,wEAAwE;AACxE,+CAA+C;AAC/C,sEAAsE;AACtE,0EAA0E;AAC1E,wEAAwE;AACxE,2DAA2D;AAC3D,+DAA+D;AAC/D,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,yEAAyE;AACzE,qDAAqD;;;AAErD,uDAA0D;AAE1D,mEAAmE;AACnE,wEAAwE;AACxE,0DAA0D;AAC1D,EAAE;AACF,iEAAiE;AACjE,qEAAqE;AACrE,uEAAuE;AACvE,wEAAwE;AACxE,oEAAoE;AACpE,oDAAoD;AACpD,MAAM,qBAAqB,GACzB,+eAA+e,CAAA;AAEjf,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,mEAAmE;AACnE,yEAAyE;AAClE,MAAM,8BAA8B,GAAG,CAAC,IAAY,EAAW,EAAE;IACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;QAC5B,OAAO,KAAK,CAAA;KACb;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,wCAAsB,CAAC,IAAI,CAAC,EAAE;QAC7C,OAAO,KAAK,CAAA;KACb;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE;QACrC,OAAO,KAAK,CAAA;KACb;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE;QACnC,OAAO,KAAK,CAAA;KACb;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE;QAClC,OAAO,KAAK,CAAA;KACb;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE;QACtC,OAAO,KAAK,CAAA;KACb;IACD,qEAAqE;IACrE,kEAAkE;IAClE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACrC,OAAO,KAAK,CAAA;KACb;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAzBY,QAAA,8BAA8B,kCAyB1C;AAED,sEAAsE;AACtE,8DAA8D;AAC9D,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,gEAAgE;AAChE,qEAAqE;AACrE,qEAAqE;AACrE,4DAA4D;AAC5D,gEAAgE;AAChE,oCAAoC;AACpC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2BjC,CAAA;AAEJ,kEAAkE;AAClE,qEAAqE;AACrE,qDAAqD;AAC9C,MAAM,8BAA8B,GAAG,CAAC,YAAoB,EAAU,EAAE;IAC7E,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,qBAAqB,EAAE,4BAA4B,CAAC,CAAA;IAC3F,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,kDAAkD;IAClD,6DAA6D;IAC7D,OAAO,GAAG,wCAAsB,KAAK,SAAS,EAAE,CAAA;AAClD,CAAC,CAAA;AARY,QAAA,8BAA8B,kCAQ1C"}

package/dist/cjs/ecommerce/stock-decrement.d.ts

@@ -0,0 +1,40 @@
+import { ProjectUIDL } from '@teleporthq/teleport-types';
+export declare const STOCK_DECREMENT_MARKER = "/* teleport:rewritten-low-stock */";
+export declare const looksLikeStockDecrementBuilder: (code: string) => boolean;
+export declare const AGGREGATE_CART_DELTAS_HELPER = "  function aggregateCartDeltas(cartItems) {\n    // Sum quantities per-id so a cart with the same product twice\n    // (\"clicked Add To Cart, then clicked Add again\") decrements\n    // by the TOTAL number ordered, not just the last entry's qty.\n    // Returns { idToDelta: { '<safeId>': <qty> }, idList: ['<safeId>',\u2026] }.\n    var idToDelta = {};\n    var idList = [];\n    for (var i = 0; i < cartItems.length; i++) {\n      var it = cartItems[i];\n      if (!it) continue;\n      var pid = it.productId || it.product_id;\n      if (!pid) continue;\n      var qty = parseInt(it.quantity, 10);\n      if (isNaN(qty) || qty <= 0) qty = 1;\n      var safeId = String(pid).replace(/'/g, \"''\");\n      if (idToDelta[safeId] == null) {\n        idToDelta[safeId] = 0;\n        idList.push(safeId);\n      }\n      idToDelta[safeId] += qty;\n    }\n    return { idToDelta: idToDelta, idList: idList };\n  }";
+export declare const buildStockDecrementBuilder: (allowBackorders: boolean) => string;
+export interface StockWriteSite {
+    workflowId: string;
+    workflowName: string;
+    workflowKind: 'workflow' | 'customNode';
+    nodeId: string;
+    nodeType: string;
+    stepNumber: number | undefined;
+    category: 'admin' | 'order-decrement' | 'unknown';
+    sqlSnippet: string;
+}
+export declare const classifyStockWriteSite: (workflowName: string, node: {
+    type?: string;
+    config?: {
+        code?: string;
+    };
+}) => {
+    category: StockWriteSite['category'];
+    sqlSnippet: string;
+};
+export declare const findStockWriteSites: (uidl: ProjectUIDL) => StockWriteSite[];
+export interface StockWriteAudit {
+    sites: StockWriteSite[];
+    admin: StockWriteSite[];
+    orderDecrement: StockWriteSite[];
+    unknown: StockWriteSite[];
+}
+export declare const auditStockWriteSites: (uidl: ProjectUIDL) => StockWriteAudit;
+export declare const reportStockWriteAudit: (uidl: ProjectUIDL) => StockWriteAudit;
+interface HoistSummary {
+    hoistedWorkflows: number;
+    skippedWorkflows: number;
+}
+export declare const hoistStockDecrementOutOfCodBranch: (uidl: ProjectUIDL) => HoistSummary;
+export {};
+//# sourceMappingURL=stock-decrement.d.ts.map

package/dist/cjs/ecommerce/stock-decrement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stock-decrement.d.ts","sourceRoot":"","sources":["../../../src/ecommerce/stock-decrement.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAKxD,eAAO,MAAM,sBAAsB,uCAAuC,CAAA;AAU1E,eAAO,MAAM,8BAA8B,SAAU,MAAM,KAAG,OAiB7D,CAAA;AAsBD,eAAO,MAAM,4BAA4B,q5BAsBrC,CAAA;AA8BJ,eAAO,MAAM,0BAA0B,oBAAqB,OAAO,KAAG,MAiHrE,CAAA;AAsBD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,UAAU,GAAG,YAAY,CAAA;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,QAAQ,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CAAA;IAGjD,UAAU,EAAE,MAAM,CAAA;CACnB;AAiED,eAAO,MAAM,sBAAsB,iBACnB,MAAM,QACd;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,KAClD;IAAE,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAuC5D,CAAA;AAID,eAAO,MAAM,mBAAmB,SAAU,WAAW,KAAG,cAAc,EAwErE,CAAA;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,KAAK,EAAE,cAAc,EAAE,CAAA;IACvB,cAAc,EAAE,cAAc,EAAE,CAAA;IAChC,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAID,eAAO,MAAM,oBAAoB,SAAU,WAAW,KAAG,eAQxD,CAAA;AAMD,eAAO,MAAM,qBAAqB,SAAU,WAAW,KAAG,eAmEzD,CAAA;AAuMD,UAAU,YAAY;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,eAAO,MAAM,iCAAiC,SAAU,WAAW,KAAG,YA6BrE,CAAA"}