@teleporthq/teleport-plugin-next-workflows 0.43.1

package/__tests__/middleware-row-owned-pages.test.ts

@@ -0,0 +1,181 @@
+import { generateMiddlewareFile } from '../src/auth-generator'
+
+// Guarding the regression where a guest checkout buyer lands on
+// `/order-details/<order_number>` after Stripe redirect and the
+// Next.js middleware bounces them to `/sign-in?callbackUrl=...`
+// before the page's page-load workflow can run the
+// `userId OR anonymousUserId` SQL ownership clause.
+//
+// `generateMiddlewareFile` is the canonical entry point for the
+// generated `middleware.js`. These tests pin the contract: any
+// page that ships row-owner metadata AND no role requirement is
+// considered self-guarded by SQL and MUST NOT be added to the
+// route-level `protectedRoutes` table. Role-gated pages keep their
+// middleware protection regardless of row ownership — role
+// membership cannot be reproduced by a row-level WHERE clause.
+
+const baseAuth: any = {
+  enabled: true,
+  dataSourceId: 'ds-1',
+  dataSourceType: 'postgres',
+  passwordAuthEnabled: true,
+  providers: [],
+  roles: ['admin'],
+  tables: {},
+  folderProtection: {},
+  authPages: {
+    signIn: { pageId: 'sign-in', pageName: 'sign-in', route: '/sign-in' },
+    signUp: { pageId: 'sign-up', pageName: 'sign-up', route: '/sign-up' },
+  },
+  callbackBaseUrl: '',
+  envKeys: {},
+  customUserProperties: [],
+}
+
+describe('generateMiddlewareFile: row-owned self-guarded pages', () => {
+  it('skips a row-owned page with empty allowedRoles', () => {
+    const code = generateMiddlewareFile({
+      ...baseAuth,
+      pageProtection: {
+        OD: {
+          requiresAuth: true,
+          allowedRoles: [],
+          pageName: 'order-details',
+          route: '/order-details',
+          rowOwnerColumn: 'user_id',
+          rowOwnerTable: 'teleport_orders',
+          rowOwnerDifferentiator: 'order_number',
+        },
+      },
+    } as any)
+
+    // /order-details must NOT appear in protectedRoutes — the
+    // page-load SQL `user_id = userId OR user_id = anonymousUserId`
+    // is the source of truth for ownership.
+    expect(code).not.toContain('"/order-details"')
+  })
+
+  it('still protects a row-owned page that requires a specific role', () => {
+    // Role gating is an absolute check that the row-level SQL
+    // ownership clause cannot reproduce: a non-admin shouldn't get
+    // to enumerate admin-only pages even if the SQL would refuse
+    // their rows. Keep middleware in place for these.
+    const code = generateMiddlewareFile({
+      ...baseAuth,
+      pageProtection: {
+        AD: {
+          requiresAuth: true,
+          allowedRoles: ['admin'],
+          pageName: 'admin-order-details',
+          route: '/admin/orders/[id]',
+          rowOwnerColumn: 'user_id',
+          rowOwnerTable: 'teleport_orders',
+        },
+      },
+    } as any)
+
+    expect(code).toContain('"/admin/orders/[id]"')
+    expect(code).toContain('"admin"')
+  })
+
+  it('keeps non-row-owned pages protected as before', () => {
+    // The pure regression guard: orders-list ("collection" view,
+    // no rowOwnerColumn) keeps requiresAuth so a logged-out
+    // visitor can't see the empty-but-existing /orders-list shell.
+    const code = generateMiddlewareFile({
+      ...baseAuth,
+      pageProtection: {
+        OL: {
+          requiresAuth: true,
+          allowedRoles: [],
+          pageName: 'orders-list',
+          route: '/orders-list',
+        },
+      },
+    } as any)
+
+    expect(code).toContain('"/orders-list"')
+  })
+
+  it('honours folder-level role gating even when a child page is row-owned', () => {
+    // A folder that adds the `staff` role to its children imposes
+    // a hard gate the SQL ownership check cannot mirror — staff
+    // membership is not encoded on the row. The page must stay in
+    // protectedRoutes with the merged role.
+    const code = generateMiddlewareFile({
+      ...baseAuth,
+      pageProtection: {
+        TD: {
+          requiresAuth: true,
+          allowedRoles: [],
+          pageName: 'ticket-details',
+          route: '/tickets/[id]',
+          rowOwnerColumn: 'user_id',
+        },
+      },
+      folderProtection: {
+        STAFF: {
+          requiresAuth: true,
+          allowedRoles: ['staff'],
+          folderName: 'staff',
+          parentId: null,
+          children: { TD: 'page' },
+        },
+      },
+    } as any)
+
+    expect(code).toContain('"/tickets/[id]"')
+    expect(code).toContain('"staff"')
+  })
+
+  it('skips a row-owned page even when wrapped in a role-less folder', () => {
+    // A "logged-in only" folder that lists everyone — no
+    // distinguishing role — should not re-promote a row-owned
+    // page back into protectedRoutes. The SQL still guards it
+    // per-row and the page-load workflow lets the guest in via
+    // the anonymous fallback.
+    const code = generateMiddlewareFile({
+      ...baseAuth,
+      pageProtection: {
+        OD: {
+          requiresAuth: true,
+          allowedRoles: [],
+          pageName: 'order-details',
+          route: '/order-details',
+          rowOwnerColumn: 'user_id',
+        },
+      },
+      folderProtection: {
+        USERS: {
+          requiresAuth: true,
+          allowedRoles: [],
+          folderName: 'users',
+          parentId: null,
+          children: { OD: 'page' },
+        },
+      },
+    } as any)
+
+    expect(code).not.toContain('"/order-details"')
+  })
+
+  it('treats `rowOwnerColumn` as the sole signal — pages without it stay protected', () => {
+    // Defensive: an empty-string rowOwnerColumn or a missing key
+    // must not opt into the bypass; only a non-empty column name
+    // counts as "self-guarded by SQL".
+    const code = generateMiddlewareFile({
+      ...baseAuth,
+      pageProtection: {
+        ZZ: {
+          requiresAuth: true,
+          allowedRoles: [],
+          pageName: 'something',
+          route: '/something',
+          rowOwnerColumn: '',
+        },
+      },
+    } as any)
+
+    expect(code).toContain('"/something"')
+  })
+})

package/__tests__/navigation-go-to-page.test.ts

@@ -0,0 +1,247 @@
+/* tslint:disable:no-eval */
+import { navigationGoToPage } from '../src/nodes/navigation/navigation-go-to-page'
+
+function createHandler() {
+  const fnStr = navigationGoToPage.generateHandler()
+  return eval('(' + fnStr + ')')
+}
+
+interface FakeWindow {
+  location: { href: string }
+  open: jest.Mock
+}
+
+function withWindow(): FakeWindow {
+  const fake: FakeWindow = {
+    location: { href: '' },
+    open: jest.fn(),
+  }
+  ;(global as any).window = fake
+  return fake
+}
+
+describe('navigation-go-to-page', () => {
+  let handler: any
+  let win: FakeWindow
+
+  beforeAll(() => {
+    handler = createHandler()
+  })
+
+  beforeEach(() => {
+    win = withWindow()
+  })
+
+  afterEach(() => {
+    delete (global as any).window
+  })
+
+  describe('legacy UIDL (no targetPage)', () => {
+    it('navigates to the rewritten pageId', async () => {
+      const result = await handler({ pageId: '/about', openInNewTab: false }, {})
+      expect(win.location.href).toBe('/about')
+      expect(result).toEqual({ __terminal: true })
+    })
+
+    it('opens the rewritten pageId in a new tab when requested', async () => {
+      await handler({ pageId: '/about', openInNewTab: true }, {})
+      expect(win.open).toHaveBeenCalledWith('/about', '_blank')
+      expect(win.location.href).toBe('')
+    })
+
+    it('falls back to "/" when pageId is empty', async () => {
+      await handler({ pageId: '', openInNewTab: false }, {})
+      expect(win.location.href).toBe('/')
+    })
+  })
+
+  describe('static target page', () => {
+    // For NON-details pages, pageId wins: the project plugin's `runBefore`
+    // step rewrites `pageId` to the authoritative Next.js route, while
+    // `targetPage.staticUrl` is a mapper best-guess that can diverge from
+    // the real route (e.g. home ships as `/home` but Next serves it at `/`).
+    it('uses pageId in preference to targetPage.staticUrl for non-details pages', async () => {
+      await handler(
+        {
+          pageId: '/about-us',
+          openInNewTab: false,
+          targetPage: {
+            pageId: 'page_about',
+            staticUrl: '/should-be-ignored',
+            isDetailsPage: false,
+          },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/about-us')
+    })
+
+    it('falls back to targetPage.staticUrl when pageId is missing', async () => {
+      await handler(
+        {
+          openInNewTab: false,
+          targetPage: {
+            pageId: 'page_about',
+            staticUrl: '/about-us',
+            isDetailsPage: false,
+          },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/about-us')
+    })
+  })
+
+  describe('details page differentiator', () => {
+    it('appends a static differentiator as an encoded path segment', async () => {
+      await handler(
+        {
+          openInNewTab: false,
+          differentiator: 'ORD-000042',
+          targetPage: {
+            staticUrl: '/order-success',
+            isDetailsPage: true,
+            differentiatorColumn: 'order_number',
+          },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/order-success/ORD-000042')
+    })
+
+    it('URL-encodes a differentiator that contains reserved characters', async () => {
+      await handler(
+        {
+          openInNewTab: false,
+          differentiator: 'order #42/?',
+          targetPage: { staticUrl: '/order-success', isDetailsPage: true },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/order-success/order%20%2342%2F%3F')
+    })
+
+    it('falls back to the static prefix when the differentiator is missing', async () => {
+      await handler(
+        {
+          openInNewTab: false,
+          targetPage: { staticUrl: '/order-success', isDetailsPage: true },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/order-success')
+    })
+
+    it('falls back to the static prefix when the differentiator resolved to undefined', async () => {
+      // Simulates the case where the upstream workflowContext ref pointed at a
+      // node that failed at runtime — `resolveConfig` would have left the
+      // differentiator as `undefined` after resolution.
+      await handler(
+        {
+          openInNewTab: false,
+          differentiator: undefined,
+          targetPage: { staticUrl: '/order-success', isDetailsPage: true },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/order-success')
+    })
+
+    it('coerces non-string differentiators to strings', async () => {
+      await handler(
+        {
+          openInNewTab: false,
+          differentiator: 42,
+          targetPage: { staticUrl: '/order-success', isDetailsPage: true },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/order-success/42')
+    })
+  })
+
+  describe('queryParams', () => {
+    it('appends a single static query param', async () => {
+      await handler(
+        {
+          openInNewTab: false,
+          queryParams: [{ key: 'ref', value: 'checkout' }],
+          targetPage: { staticUrl: '/about', isDetailsPage: false },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/about?ref=checkout')
+    })
+
+    it('joins multiple query params with &', async () => {
+      await handler(
+        {
+          openInNewTab: false,
+          queryParams: [
+            { key: 'ref', value: 'checkout' },
+            { key: 'utm_source', value: 'email' },
+          ],
+          targetPage: { staticUrl: '/about', isDetailsPage: false },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/about?ref=checkout&utm_source=email')
+    })
+
+    it('URL-encodes query keys and values', async () => {
+      await handler(
+        {
+          openInNewTab: false,
+          queryParams: [{ key: 'q+1', value: 'hello world&more' }],
+          targetPage: { staticUrl: '/search', isDetailsPage: false },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/search?q%2B1=hello%20world%26more')
+    })
+
+    it('skips entries with an empty key', async () => {
+      await handler(
+        {
+          openInNewTab: false,
+          queryParams: [
+            { key: '', value: 'ignored' },
+            { key: 'ref', value: 'checkout' },
+          ],
+          targetPage: { staticUrl: '/about', isDetailsPage: false },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/about?ref=checkout')
+    })
+
+    it('keeps entries with empty values (emits key=)', async () => {
+      await handler(
+        {
+          openInNewTab: false,
+          queryParams: [{ key: 'ref', value: '' }],
+          targetPage: { staticUrl: '/about', isDetailsPage: false },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/about?ref=')
+    })
+
+    it('combines a details-page differentiator with query params', async () => {
+      await handler(
+        {
+          openInNewTab: false,
+          differentiator: 'ORD-000042',
+          queryParams: [{ key: 'ref', value: 'checkout' }],
+          targetPage: {
+            staticUrl: '/order-success',
+            isDetailsPage: true,
+            differentiatorColumn: 'order_number',
+          },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/order-success/ORD-000042?ref=checkout')
+    })
+  })
+})

package/__tests__/order-number-generator.test.ts

@@ -0,0 +1,190 @@
+import {
+  looksLikeOrderNumberGenerator,
+  buildOrderNumberGenerator,
+} from '../src/ecommerce/order-number-generator'
+import { STOCK_DECREMENT_MARKER } from '../src/ecommerce/stock-decrement'
+import { rewriteLowStockCustomHandlers } from '../src/ecommerce-customhandler-rewriter'
+
+// Verbatim copy of the AI's step-19 customHandler from the place-order
+// workflow seg-server-3.js. Contains the load-bearing bug we're
+// fixing: `params[14]` is positional, so any shift in the workflow's
+// upstream node ordering reads the wrong value and emits `"ORD-"`
+// with no token.
+const AI_VERBATIM = `function customHandler(params) {
+  var createOrderResult = params[14] || {};
+  var seq = createOrderResult.order_seq;
+  var fallback = createOrderResult.id != null ? String(createOrderResult.id) : "";
+  var token = seq != null && seq !== "" ? String(seq) : fallback;
+  return { result: "ORD-" + token };
+}`
+
+// Helper: evaluate the emitted customHandler with a stub previousContext
+// and a controlled `params` array, the same way the runtime calls it.
+const evalHandler = (params: unknown[]): { result: string } => {
+  const code = buildOrderNumberGenerator()
+  // The emitted code starts with `function customHandler(...)`; pull
+  // the body out and call it directly the way the runtime does.
+  const match = code.match(/function\s+customHandler\s*\(([^)]*)\)/)
+  expect(match).not.toBeNull()
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  const fn = new Function(
+    'previousContext',
+    'params',
+    code + '\nreturn customHandler(previousContext, params);'
+  )
+  return fn({}, params) as { result: string }
+}
+
+describe('looksLikeOrderNumberGenerator — pattern detection', () => {
+  it('matches the AI verbatim customHandler shape', () => {
+    expect(looksLikeOrderNumberGenerator(AI_VERBATIM)).toBe(true)
+  })
+
+  it('rejects already-rewritten code (marker present)', () => {
+    const rewritten = buildOrderNumberGenerator()
+    expect(rewritten).toContain(STOCK_DECREMENT_MARKER)
+    expect(looksLikeOrderNumberGenerator(rewritten)).toBe(false)
+  })
+
+  it('rejects unrelated customHandlers', () => {
+    expect(looksLikeOrderNumberGenerator('function customHandler() { return {}; }')).toBe(false)
+    expect(
+      looksLikeOrderNumberGenerator(
+        'function customHandler(params) { return { result: "ORD-1234" }; }'
+      )
+    ).toBe(false)
+  })
+
+  it('rejects non-string inputs without throwing', () => {
+    expect(looksLikeOrderNumberGenerator(null as unknown as string)).toBe(false)
+    expect(looksLikeOrderNumberGenerator(undefined as unknown as string)).toBe(false)
+    expect(looksLikeOrderNumberGenerator(42 as unknown as string)).toBe(false)
+  })
+})
+
+describe('buildOrderNumberGenerator — runtime semantics', () => {
+  it('returns ORD-<seq> when order_seq is present', () => {
+    const result = evalHandler([
+      { unrelated: 'thing' },
+      { id: '37d7971e-c0fe-4e8c-bc7e-40c9809bd5e8', order_seq: 42, total_amount: '100.00' },
+    ])
+    expect(result.result).toBe('ORD-42')
+  })
+
+  it('falls back to existing order_number column when already prefixed', () => {
+    const result = evalHandler([
+      { id: 'abc-uuid', order_number: 'ORD-99', customer_email: 'x@y.com' },
+    ])
+    expect(result.result).toBe('ORD-99')
+  })
+
+  it('falls back to the first 8 chars of the UUID id when no seq or order_number', () => {
+    const result = evalHandler([
+      { id: '37d7971e-c0fe-4e8c-bc7e-40c9809bd5e8', total_amount: '100.00' },
+    ])
+    expect(result.result).toBe('ORD-37d7971e')
+  })
+
+  it('walks past unrelated params to find the order row by shape', () => {
+    const result = evalHandler([
+      { settingsCtx: true }, // not an order row
+      ['some', 'array'], // not an object
+      null, // null entry
+      { id: 'x', order_seq: 7, total_amount: '50' }, // THIS is the order row
+      { foundCtx: true },
+    ])
+    expect(result.result).toBe('ORD-7')
+  })
+
+  it('handles missing order row gracefully (returns ORD-unknown so URL is non-empty)', () => {
+    const result = evalHandler([{ unrelated: 'thing' }, { another: 'thing' }])
+    expect(result.result).toBe('ORD-unknown')
+  })
+
+  it('does not double-prefix an existing ORD- order_number', () => {
+    const result = evalHandler([
+      { id: 'abc', order_seq: 5, order_number: 'ORD-12345', customer_email: 'x@y.com' },
+    ])
+    // order_number wins over order_seq when it's already prefixed
+    expect(result.result).toBe('ORD-12345')
+  })
+
+  it('rejects garbage order_number values and falls through to seq', () => {
+    const result = evalHandler([{ id: 'abc', order_seq: 8, order_number: '', total_amount: '10' }])
+    expect(result.result).toBe('ORD-8')
+  })
+
+  it('handles params with non-string id correctly', () => {
+    // looksLikeOrderRow REQUIRES id to be a non-empty string — a numeric
+    // id should not be picked as the order row.
+    const result = evalHandler([
+      { id: 42, order_seq: 99, total_amount: '100' }, // numeric id - skipped
+      { id: 'real-uuid', order_seq: 7, total_amount: '100' },
+    ])
+    expect(result.result).toBe('ORD-7')
+  })
+
+  it('emits the STOCK_DECREMENT_MARKER for idempotent re-runs', () => {
+    const code = buildOrderNumberGenerator()
+    expect(code).toContain(STOCK_DECREMENT_MARKER)
+  })
+
+  it('emits customHandler as the FIRST function declaration so the runtime regex picks it up', () => {
+    const code = buildOrderNumberGenerator()
+    // After the marker comment, the first `function …` token must be `customHandler`.
+    const afterMarker = code.slice(
+      code.indexOf(STOCK_DECREMENT_MARKER) + STOCK_DECREMENT_MARKER.length
+    )
+    const firstFn = afterMarker.match(/function\s+(\w+)/)
+    expect(firstFn).not.toBeNull()
+    expect(firstFn![1]).toBe('customHandler')
+  })
+})
+
+describe('rewriteLowStockCustomHandlers — orchestrator integration', () => {
+  const fixtureUidl = (handlerCode: string) =>
+    ({
+      settings: {
+        ecommerce: {
+          stockManagement: true,
+          stockManagementConfig: { allowBackorders: false, lowStockThreshold: 5 },
+        },
+      },
+      workflows: {
+        workflows: {
+          'place-order-1': {
+            nodes: [{ id: 'n1', type: 'general-custom-js', config: { code: handlerCode } }],
+          },
+        },
+        customNodes: {},
+      },
+    } as unknown as Parameters<typeof rewriteLowStockCustomHandlers>[0])
+
+  it('rewrites the AI orderNumber generator on first run', () => {
+    const uidl = fixtureUidl(AI_VERBATIM)
+    const summary = rewriteLowStockCustomHandlers(uidl)
+    expect(summary.orderNumberGeneratorRewrites).toBe(1)
+    const wf = uidl.workflows!.workflows as Record<
+      string,
+      { nodes: Array<{ config: { code: string } }> }
+    >
+    expect(wf['place-order-1'].nodes[0].config.code).toContain(STOCK_DECREMENT_MARKER)
+  })
+
+  it('is idempotent — running twice does not rewrite again', () => {
+    const uidl = fixtureUidl(AI_VERBATIM)
+    rewriteLowStockCustomHandlers(uidl)
+    const summary2 = rewriteLowStockCustomHandlers(uidl)
+    expect(summary2.orderNumberGeneratorRewrites).toBe(0)
+  })
+
+  it('rewrites even when stockManagement is off (the orderNumber bug exists regardless)', () => {
+    const uidl = fixtureUidl(AI_VERBATIM)
+    // Force stockManagement off
+    const settings = (uidl as unknown as { settings: { ecommerce: { stockManagement: boolean } } })
+      .settings.ecommerce
+    settings.stockManagement = false
+    const summary = rewriteLowStockCustomHandlers(uidl)
+    expect(summary.orderNumberGeneratorRewrites).toBe(1)
+  })
+})