@teleporthq/teleport-plugin-next-workflows 0.43.1

package/src/security-scanner.ts

@@ -0,0 +1,201 @@
+/**
+ * Codegen-time security gate. Run from `NextWorkflowProjectPlugin.runBefore`
+ * over every `general-custom-js` node's `config.code`. Refuses to generate
+ * code containing obvious protected-env-var access or sandbox-escape
+ * primitives so the codegen pipeline can't be coerced into shipping
+ * dangerous workflow code even if the GUI and services-worker layers were
+ * bypassed.
+ *
+ * Intentionally narrow + regex-based: the GUI runs the full AST scan
+ * (workflow-schema/src/security/scan-custom-js.ts) before the project
+ * reaches codegen, and the services-worker re-runs it on the publish
+ * payload. This file is the cheap third checkpoint — it catches the
+ * obvious naïve patterns and is cheap enough to run inside the codegen
+ * pipeline without pulling @babel/parser into this package.
+ *
+ * SINGLE SOURCE OF TRUTH for the protected names — keep in sync with:
+ *   - teleport-gui/packages/workflow-schema/src/security/protected-env-names.ts
+ *   - teleport-services-worker/src/modules/vercel/security/protected-env-names.ts
+ */
+
+export const PROTECTED_ENV_NAMES = [
+  'TELEPORT_DB_CONNECTION_STRING',
+  'RUNTIME_STORAGE_API_KEY',
+  'RUNTIME_STORAGE_PROJECT_ID',
+  'TELEPORT_PROJECT_TOKEN',
+  'REALTIME_SERVER_API_KEY',
+  'REALTIME_SERVER_URL',
+  'PDF_SERVICE_URL',
+  'PDF_SERVICE_API_KEY',
+] as const
+
+export interface CodegenSecurityViolation {
+  workflowId: string
+  workflowName?: string
+  nodeId: string
+  rule: string
+  message: string
+}
+
+export class CodegenSecurityError extends Error {
+  constructor(public readonly violations: CodegenSecurityViolation[]) {
+    super(
+      `Codegen blocked by ${violations.length} security violation${
+        violations.length === 1 ? '' : 's'
+      }`
+    )
+    this.name = 'CodegenSecurityError'
+    // ES5 target breaks the prototype chain when extending built-ins like
+    // Error — restore it so `instanceof CodegenSecurityError` works.
+    Object.setPrototypeOf(this, CodegenSecurityError.prototype)
+  }
+}
+
+interface WorkflowNodeLike {
+  id?: string
+  config?: { code?: string }
+}
+
+interface WorkflowLike {
+  id?: string
+  name?: string
+  nodes?: WorkflowNodeLike[]
+}
+
+interface WorkflowsContainer {
+  workflows?: Record<string, WorkflowLike>
+}
+
+/**
+ * Walks the UIDL workflow definitions and throws `CodegenSecurityError` if
+ * any `general-custom-js` body trips the scanner.
+ *
+ * Per `general-custom-js` the only place a user can write JS is the `code`
+ * config field, so we look only there. Other node types use structured
+ * configs we don't touch.
+ */
+export function assertWorkflowsAreSecure(workflowsContainer: WorkflowsContainer | undefined): void {
+  if (!workflowsContainer?.workflows) return
+  const violations: CodegenSecurityViolation[] = []
+  for (const [wfId, wf] of Object.entries(workflowsContainer.workflows)) {
+    if (!wf || !Array.isArray(wf.nodes)) continue
+    for (const node of wf.nodes) {
+      const nodeAsUnknown = node as unknown as {
+        type?: string
+        config?: { code?: string }
+        id?: string
+      }
+      if (nodeAsUnknown?.type !== 'general-custom-js') continue
+      const code = nodeAsUnknown.config?.code
+      if (typeof code !== 'string' || !code.trim()) continue
+      const findings = scanForObviousViolations(code)
+      for (const finding of findings) {
+        violations.push({
+          workflowId: wfId,
+          workflowName: wf.name,
+          nodeId: nodeAsUnknown.id ?? '?',
+          rule: finding.rule,
+          message: finding.message,
+        })
+      }
+    }
+  }
+  if (violations.length > 0) throw new CodegenSecurityError(violations)
+}
+
+interface ScannerFinding {
+  rule: string
+  message: string
+}
+
+/**
+ * Regex-based scan. Sufficient at the codegen layer because:
+ *   - the GUI's AST scanner has already vetted the code.
+ *   - the services-worker re-runs the full AST scan on the publish payload.
+ *   - the runtime `process` Proxy preamble denies even successful escapes.
+ */
+function scanForObviousViolations(rawCode: string): ScannerFinding[] {
+  const out: ScannerFinding[] = []
+  const code = stripCommentsAndDecodeEscapes(rawCode)
+
+  for (const name of PROTECTED_ENV_NAMES) {
+    if (new RegExp(`\\b${name}\\b`).test(code)) {
+      out.push({
+        rule: 'protected-env-access',
+        message: `references protected platform secret "${name}"`,
+      })
+    }
+  }
+  if (/\beval\s*\(/.test(code)) {
+    out.push({ rule: 'sandbox-escape-eval', message: 'calls eval(...)' })
+  }
+  if (/\b(?:new\s+)?Function\s*\(/.test(code)) {
+    out.push({
+      rule: 'sandbox-escape-function',
+      message: 'uses Function(...) or new Function(...)',
+    })
+  }
+  if (/\bwith\s*\(/.test(code)) {
+    out.push({ rule: 'sandbox-escape-with', message: 'uses a with statement' })
+  }
+  if (
+    /\brequire\s*\(\s*["'`](?:fs(?:\/promises)?|child_process|cluster|worker_threads|process|vm|inspector|dgram|v8|node:[^"'`]+)["'`]/.test(
+      code
+    )
+  ) {
+    out.push({
+      rule: 'forbidden-require',
+      message: 'requires a forbidden Node.js module',
+    })
+  }
+  if (
+    /\bimport\s*\(\s*["'`](?:fs(?:\/promises)?|child_process|cluster|worker_threads|process|vm|inspector|dgram|v8|node:[^"'`]+)["'`]/.test(
+      code
+    )
+  ) {
+    out.push({
+      rule: 'forbidden-dynamic-import',
+      message: 'dynamically imports a forbidden Node.js module',
+    })
+  }
+  if (/\b(?:globalThis|global)\s*[\.\[]\s*["'`]?process\b/.test(code)) {
+    out.push({
+      rule: 'indirect-process-access',
+      message: 'reaches process via globalThis / global',
+    })
+  }
+  // Mass enumeration of process.env
+  if (
+    /\bObject\.(?:keys|values|entries|assign|fromEntries|getOwnProperty(?:Names|Symbols|Descriptors))\s*\(\s*(?:[^)]*,\s*)?process\.env\b/.test(
+      code
+    ) ||
+    /\bJSON\.stringify\s*\(\s*process\.env\b/.test(code) ||
+    /\bReflect\.ownKeys\s*\(\s*process\.env\b/.test(code) ||
+    /\{\s*\.\.\.process\.env\b/.test(code) ||
+    /\bfor\s*\(\s*(?:var|let|const)?\s*\w+\s+(?:in|of)\s+process\.env\b/.test(code)
+  ) {
+    out.push({
+      rule: 'mass-env-enumeration',
+      message: 'enumerates or copies the entire process.env',
+    })
+  }
+  return out
+}
+
+function stripCommentsAndDecodeEscapes(input: string): string {
+  let stripped = input.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '')
+  stripped = stripped
+    .replace(/\\u\{([0-9a-fA-F]+)\}/g, (_, hex) => safeFromCodePoint(parseInt(hex, 16)))
+    .replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => safeFromCodePoint(parseInt(hex, 16)))
+    .replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) => safeFromCodePoint(parseInt(hex, 16)))
+  return stripped
+}
+
+function safeFromCodePoint(code: number): string {
+  if (!Number.isFinite(code) || code < 0 || code > 0x10ffff) return ''
+  try {
+    return String.fromCodePoint(code)
+  } catch {
+    return ''
+  }
+}

package/src/segment-splitter.ts

@@ -0,0 +1,288 @@
+import { UIDLWorkflow, UIDLWorkflowNode, UIDLWorkflowEdge } from '@teleporthq/teleport-types'
+import { WorkflowSegment, WorkflowExecutionEnv } from './types'
+import { getLoopBodyNodes, getNodeById, getTopologicalOrder } from './graph-utils'
+import { nodeRegistry } from './nodes'
+
+const CLIENT_ONLY_NODE_TYPES = new Set([
+  'account-login',
+  'account-signup',
+  'account-logout',
+  'account-social-login',
+])
+
+const resolveExecutionEnv = (
+  node: UIDLWorkflowNode,
+  prevEnv: WorkflowExecutionEnv | null
+): WorkflowExecutionEnv => {
+  if (CLIENT_ONLY_NODE_TYPES.has(node.type)) {
+    return 'client'
+  }
+
+  // general-custom-node returns an opaque marker from its handler and relies on
+  // the client runtime to recognise it and invoke the nested custom node
+  // function (which has its own client/server segments). The server handler is
+  // a stub — if this node is placed in a server segment the nested workflow
+  // never runs and downstream references to its output resolve to the marker.
+  if (node.type === 'general-custom-node') {
+    return 'client'
+  }
+
+  const registered = nodeRegistry[node.type]
+  if (registered?.executionEnv === 'client') {
+    return 'client'
+  }
+
+  if (node.executionEnv === 'client') {
+    return 'client'
+  }
+  if (node.executionEnv === 'server') {
+    return 'server'
+  }
+
+  if (registered?.executionEnv === 'server') {
+    return 'server'
+  }
+
+  if (node.type === 'general-custom-js') {
+    const ctx = node.config?.context as string | undefined
+    if (ctx === 'server') {
+      return 'server'
+    }
+    return 'client'
+  }
+
+  if (node.type === 'transform-geolocation') {
+    const op = node.config?.operation as string | undefined
+    if (op === 'geocode' || op === 'reverse-geocode' || op === 'get-timezone') {
+      return 'server'
+    }
+    if (op === 'current-location') {
+      return 'client'
+    }
+  }
+
+  if (node.type === 'transform-image' || node.type === 'transform-color') {
+    const op = node.config?.operation as string | undefined
+    if (node.type === 'transform-image') {
+      return 'server'
+    }
+    if (op === 'extract-from-image') {
+      return 'server'
+    }
+  }
+
+  return prevEnv || 'client'
+}
+
+const collectErrorBranchNodeIds = (
+  errorHandlerNodeId: string,
+  nodes: UIDLWorkflowNode[],
+  edges: UIDLWorkflowEdge[]
+): Set<string> => {
+  const ids = new Set<string>()
+  const queue: string[] = []
+  for (const e of edges) {
+    if (e.source === errorHandlerNodeId) {
+      queue.push(e.target)
+    }
+  }
+  const nodeIdSet = new Set(nodes.map((n) => n.id))
+  while (queue.length > 0) {
+    const cur = queue.shift()!
+    if (ids.has(cur) || !nodeIdSet.has(cur)) {
+      continue
+    }
+    ids.add(cur)
+    for (const e of edges) {
+      if (e.source === cur) {
+        queue.push(e.target)
+      }
+    }
+  }
+  return ids
+}
+
+export const splitIntoSegments = (workflow: UIDLWorkflow): WorkflowSegment[] => {
+  if (workflow.nodes.length === 0) {
+    return []
+  }
+
+  // Collect every node that belongs to an error-handler branch. Prefer the
+  // explicit `workflow.errorHandler` pointer, but also scan for nodes that
+  // declare themselves as error handlers (`event-workflow-error` nodes or any
+  // node with `config.isErrorHandler === true`) so custom-node workflows —
+  // whose pseudo-workflow has no errorHandler pointer wired — still have their
+  // error branches excluded from normal execution.
+  const errorBranchIds = new Set<string>()
+  if (workflow.errorHandler) {
+    for (const id of collectErrorBranchNodeIds(
+      workflow.errorHandler.nodeId,
+      workflow.nodes,
+      workflow.edges
+    )) {
+      errorBranchIds.add(id)
+    }
+  }
+  for (const n of workflow.nodes) {
+    const cfg = (n.config || {}) as Record<string, unknown>
+    if (n.type === 'event-workflow-error' || cfg.isErrorHandler === true) {
+      errorBranchIds.add(n.id)
+      for (const id of collectErrorBranchNodeIds(n.id, workflow.nodes, workflow.edges)) {
+        errorBranchIds.add(id)
+      }
+    }
+  }
+
+  const mainNodes =
+    errorBranchIds.size > 0
+      ? workflow.nodes.filter((n) => !errorBranchIds.has(n.id))
+      : workflow.nodes
+  const mainEdges =
+    errorBranchIds.size > 0
+      ? workflow.edges.filter((e) => !errorBranchIds.has(e.source) && !errorBranchIds.has(e.target))
+      : workflow.edges
+
+  const order = getTopologicalOrder(mainNodes, mainEdges)
+  // Loop bodies must execute as a single unit at runtime. The split-by-env
+  // walk below would otherwise drop AI/server steps in one segment and the
+  // client-only post-processing into another, leaving the loop's body half-
+  // executed for every iteration. We reorder the topo so all body nodes sit
+  // immediately after their owning loop, and we record a single forced env
+  // (server if any body or the loop itself needs server, else client) so the
+  // forthcoming env walk emits one segment for the loop + body.
+  const { reorderedOrder, forcedEnvByNodeId } = enforceLoopBodyIntegrity(
+    order,
+    mainNodes,
+    mainEdges
+  )
+  const segments: WorkflowSegment[] = []
+  let currentEnv: WorkflowExecutionEnv | null = null
+  let currentNodeIds: string[] = []
+  let segClientCount = 0
+  let segServerCount = 0
+
+  const flushSegment = () => {
+    if (currentNodeIds.length === 0 || currentEnv === null) {
+      return
+    }
+    const id = currentEnv === 'client' ? `client-${++segClientCount}` : `server-${++segServerCount}`
+
+    const nodes = currentNodeIds
+      .map((nid) => getNodeById(workflow.nodes, nid))
+      .filter(Boolean) as UIDLWorkflowNode[]
+
+    const nodeIdSet = new Set(currentNodeIds)
+    const edges = workflow.edges.filter(
+      (e: UIDLWorkflowEdge) => nodeIdSet.has(e.source) && nodeIdSet.has(e.target)
+    )
+
+    segments.push({ id, env: currentEnv, nodeIds: [...currentNodeIds], nodes, edges })
+    currentNodeIds = []
+  }
+
+  for (const nodeId of reorderedOrder) {
+    const node = getNodeById(workflow.nodes, nodeId)
+    if (!node) {
+      continue
+    }
+
+    const forced = forcedEnvByNodeId.get(nodeId)
+    const nodeEnv = forced ?? resolveExecutionEnv(node, currentEnv)
+
+    if (currentEnv !== null && nodeEnv !== currentEnv) {
+      flushSegment()
+    }
+    currentEnv = nodeEnv
+    currentNodeIds.push(nodeId)
+  }
+
+  flushSegment()
+  return segments
+}
+
+/**
+ * Re-arrange the topological node order so every loop's body nodes sit
+ * directly after the loop, and pick a single execution env for the
+ * (loop + body) cluster. Nested loops are processed inner-first so the outer
+ * loop's body window already contains the inner body in the right order.
+ *
+ * Why an explicit env override is needed: a body that mixes universal /
+ * server / client nodes (e.g. fetch → AI prompt → custom-js with
+ * `context: 'client'`) would naturally split into multiple segments. The
+ * server-side runtime then sees only the body nodes that landed in the same
+ * segment as the loop and silently produces an empty `loop.results`.
+ *
+ * Server is preferred when any cluster member is server-classified because
+ * server segments can host universal nodes and `general-custom-js` (which
+ * runs the same string of JS regardless of where it executes); the inverse
+ * is not true for AI / HTTP-with-secret nodes. When no member is server, we
+ * keep the cluster on the client so DOM- or window-bound bodies still work.
+ */
+const enforceLoopBodyIntegrity = (
+  order: string[],
+  mainNodes: UIDLWorkflowNode[],
+  mainEdges: UIDLWorkflowEdge[]
+): {
+  reorderedOrder: string[]
+  forcedEnvByNodeId: Map<string, WorkflowExecutionEnv>
+} => {
+  const forcedEnvByNodeId = new Map<string, WorkflowExecutionEnv>()
+  const loopNodes = mainNodes.filter((n) => n.type === 'general-loop')
+  if (loopNodes.length === 0) {
+    return { reorderedOrder: order, forcedEnvByNodeId }
+  }
+
+  // Process inner loops before outer ones: an inner loop's body is a subset
+  // of its enclosing loop's body, and we want the outer pass to see the
+  // already-clustered inner body as a contiguous block.
+  const loopOrder = order.filter((id) => loopNodes.some((n) => n.id === id))
+
+  let working = order.slice()
+  for (let li = loopOrder.length - 1; li >= 0; li--) {
+    const loopId = loopOrder[li]
+    const bodyIds = getLoopBodyNodes(loopId, mainEdges)
+    if (bodyIds.length === 0) {
+      continue
+    }
+
+    const clusterIds = new Set<string>([loopId, ...bodyIds])
+    const clusterMembers = Array.from(clusterIds)
+      .map((id) => getNodeById(mainNodes, id))
+      .filter((n): n is UIDLWorkflowNode => Boolean(n))
+
+    let clusterEnv: WorkflowExecutionEnv = 'client'
+    for (const member of clusterMembers) {
+      if (resolveExecutionEnv(member, null) === 'server') {
+        clusterEnv = 'server'
+        break
+      }
+    }
+    for (const member of clusterMembers) {
+      forcedEnvByNodeId.set(member.id, clusterEnv)
+    }
+
+    // Hoist body nodes (preserving their existing relative order) immediately
+    // after the loop. Other nodes keep their relative position.
+    const bodyInOrder = working.filter((id) => id !== loopId && clusterIds.has(id))
+    const withoutBody = working.filter((id) => id === loopId || !clusterIds.has(id))
+    const loopIdxAfterRemoval = withoutBody.indexOf(loopId)
+    if (loopIdxAfterRemoval < 0) {
+      continue
+    }
+    working = [
+      ...withoutBody.slice(0, loopIdxAfterRemoval + 1),
+      ...bodyInOrder,
+      ...withoutBody.slice(loopIdxAfterRemoval + 1),
+    ]
+  }
+
+  return { reorderedOrder: working, forcedEnvByNodeId }
+}
+
+export const getServerSegments = (segments: WorkflowSegment[]): WorkflowSegment[] => {
+  return segments.filter((s) => s.env === 'server')
+}
+
+export const getClientSegments = (segments: WorkflowSegment[]): WorkflowSegment[] => {
+  return segments.filter((s) => s.env === 'client')
+}