@teleporthq/teleport-plugin-next-workflows 0.43.26 → 0.43.30

package/src/nodes/integrations/integration-salesforce.ts

@@ -246,11 +246,14 @@ async function integration_salesforce(config: any, context: Record<string, unkno
     }
     case 'update-opportunity': {
       const body = config.fields || {}
-      const response = await fetch(baseUrl + 'sobjects/Opportunity/' + config.oppId, {
-        method: 'PATCH',
-        headers,
-        body: JSON.stringify(body),
-      })
+      const response = await fetch(
+        baseUrl + 'sobjects/Opportunity/' + (config.opportunityId || config.oppId),
+        {
+          method: 'PATCH',
+          headers,
+          body: JSON.stringify(body),
+        }
+      )
       if (!response.ok) {
         const data = await __readJson(response)
         return {
@@ -261,10 +264,13 @@ async function integration_salesforce(config: any, context: Record<string, unkno
       return { success: true }
     }
     case 'get-opportunity': {
-      const response = await fetch(baseUrl + 'sobjects/Opportunity/' + config.oppId, {
-        method: 'GET',
-        headers,
-      })
+      const response = await fetch(
+        baseUrl + 'sobjects/Opportunity/' + (config.opportunityId || config.oppId),
+        {
+          method: 'GET',
+          headers,
+        }
+      )
       const data = await __readJson(response)
       if (!response.ok) {
         return {
@@ -275,10 +281,13 @@ async function integration_salesforce(config: any, context: Record<string, unkno
       return { success: true, opportunity: data }
     }
     case 'delete-opportunity': {
-      const response = await fetch(baseUrl + 'sobjects/Opportunity/' + config.oppId, {
-        method: 'DELETE',
-        headers,
-      })
+      const response = await fetch(
+        baseUrl + 'sobjects/Opportunity/' + (config.opportunityId || config.oppId),
+        {
+          method: 'DELETE',
+          headers,
+        }
+      )
       if (!response.ok) {
         const data = await __readJson(response)
         return {

package/src/workflow-component-plugin.ts

@@ -327,7 +327,14 @@ export const createNextWorkflowPlugin: ComponentPluginFactory<WorkflowPluginConf
     const hasCurrentUserGlobalRefs = activeWorkflows.some((wf) =>
       hasGlobalContextStateRefTransitively(wf.nodes, workflows.customNodes, new Set<string>())
     )
-    const needsGlobalContextBridge = hasAuthNodes || hasCurrentUserGlobalRefs
+    // Node configs may also reference the logged-in user via a literal
+    // {{Current User.id}} template token (resolved at runtime from the
+    // __stateValues.currentUser bridge) — those pages need the same
+    // GlobalContext plumbing even without a state-get/update node.
+    const hasCurrentUserToken = activeWorkflows.some((wf) =>
+      wf.nodes.some((n) => JSON.stringify(n.config || {}).includes('{{Current User.'))
+    )
+    const needsGlobalContextBridge = hasAuthNodes || hasCurrentUserGlobalRefs || hasCurrentUserToken
 
     const hasAudioNodes = activeWorkflows.some((wf) =>
       wf.nodes.some((n) => n.type === 'audio-play' || n.type === 'audio-stop')
@@ -399,6 +406,15 @@ export const createNextWorkflowPlugin: ComponentPluginFactory<WorkflowPluginConf
       (!pageProtection.allowedRoles || pageProtection.allowedRoles.length === 0)
     )
 
+    const dynamicRouteAttributeRaw = (uidl as any).outputOptions?.dynamicRouteAttribute as
+      | string
+      | undefined
+    const dynamicRouteAttribute =
+      typeof dynamicRouteAttributeRaw === 'string' &&
+      /^[A-Za-z_][A-Za-z0-9_-]*$/.test(dynamicRouteAttributeRaw)
+        ? dynamicRouteAttributeRaw
+        : undefined
+
     const moduleCode = generateModuleLevelCode(
       activeWorkflows,
       matchedElementTriggers,
@@ -408,7 +424,8 @@ export const createNextWorkflowPlugin: ComponentPluginFactory<WorkflowPluginConf
       globalStateChangeWorkflows,
       hasAudioNodes,
       needsAdminFormHydration,
-      isRowOwnedSelfGuardedPage
+      isRowOwnedSelfGuardedPage,
+      dynamicRouteAttribute
     )
 
     if (moduleCode) {
@@ -558,6 +575,14 @@ export const createNextWorkflowPlugin: ComponentPluginFactory<WorkflowPluginConf
         path: `${pathPrefix}utils/workflows/runtime`,
       }
 
+      // Router singleton for {{urlDifferentiator}}-style token resolution in
+      // __execWf (route params are only reachable client-side at call time).
+      dependencies.Router = {
+        type: 'library',
+        path: 'next/router',
+        version: '12.1.0',
+      }
+
       dependencies.workflowClientHandlers = {
         type: 'local',
         path: `${pathPrefix}utils/workflows/node-handlers-client`,
@@ -1160,7 +1185,8 @@ const generateModuleLevelCode = (
   globalStateChangeWorkflows: UIDLWorkflow[],
   hasAudioNodes?: boolean,
   includeAdminFormHydrationHelper?: boolean,
-  isRowOwnedSelfGuardedPage?: boolean
+  isRowOwnedSelfGuardedPage?: boolean,
+  dynamicRouteAttribute?: string
 ): string => {
   if (allWorkflows.length === 0) {
     return ''
@@ -1451,6 +1477,26 @@ function __createWorkflowHandlers(stateSetters, stateTypes, stateValuesRef) {
     ) {
       value = value.value;
     }
+    // Array-typed states must never receive a non-array payload — one
+    // poisoned write (e.g. a ref resolving to a custom-js node's whole
+    // { result: [...] } return object instead of its array property)
+    // bricks every downstream consumer: the mapper renders nothing and
+    // the next add-row spread throws "is not iterable". Mirrors the
+    // GUI-side guard: unwrap an object with a single array-valued
+    // property, otherwise fall back to an empty array.
+    if (type === 'array' && !Array.isArray(value)) {
+      console.warn(
+        '[workflow] non-array value written to array state "' + property + '"; coercing',
+        value
+      );
+      if (value && typeof value === 'object') {
+        var arrayKeys = Object.keys(value);
+        if (arrayKeys.length === 1 && Array.isArray(value[arrayKeys[0]])) {
+          return value[arrayKeys[0]];
+        }
+      }
+      return [];
+    }
     if (type === 'boolean') return value === 'true' || value === true;
     if (type === 'number' && typeof value === 'string') {
       const parsed = Number(value);
@@ -1552,6 +1598,18 @@ function __createWorkflowHandlers(stateSetters, stateTypes, stateValuesRef) {
 
   function __execWf(config, triggerContext, serverUrls) {
     triggerContext.__stateValues = Object.assign({}, stateValuesRef.current);
+    // Route context for {{urlDifferentiator}} / {{Current Page Entity.id}}
+    // template tokens in node configs — resolved by the shared runtime's
+    // resolveTemplateTokenString. Read at call time (not render time) so the
+    // handlers survive client-side navigation between dynamic routes.
+    if (typeof window !== 'undefined' && Router && Router.router && Router.router.query) {
+      triggerContext.__routeParams = Object.assign({}, Router.router.query);
+    }
+${
+  dynamicRouteAttribute
+    ? `    triggerContext.__dynamicRouteParam = '${dynamicRouteAttribute}';\n`
+    : ''
+}
     var fullConfig = typeof workflowCustomNodes !== 'undefined'
       ? Object.assign({}, config, { customNodes: workflowCustomNodes })
       : config;

package/src/workflow-project-plugin.ts

@@ -413,10 +413,35 @@ export class NextWorkflowProjectPlugin implements ProjectPlugin {
     }
 
     if (needsDataAPIRoute(usedNodeTypes)) {
-      const authUsersTableName =
-        uidl.authentication?.enabled && uidl.authentication?.tables
-          ? Object.keys(uidl.authentication.tables)[0] || 'users'
-          : undefined
+      // Resolve the actual IDENTITY (users) table, not just the first auth-table
+      // key. Getting this wrong is a security hole: the /api/data guard only
+      // protects AUTH_USERS_TABLE, so if it points at an auxiliary table like
+      // `password_reset_tokens`, the real `users` table is left mutable
+      // unauthenticated. The identity table is the one storing credentials
+      // (an email/login column AND a password column).
+      const authUsersTableName = ((): string | undefined => {
+        if (!uidl.authentication?.enabled || !uidl.authentication?.tables) {
+          return undefined
+        }
+        const tables = uidl.authentication.tables
+        const names = Object.keys(tables)
+        if (names.length === 0) return 'users'
+        const cols = (n: string) => (tables[n] || []).map((c) => (c.name || '').toLowerCase())
+        const has = (n: string, re: RegExp) => cols(n).some((c) => re.test(c))
+        const identity = names.find(
+          (n) =>
+            has(n, /^(email|e_mail|username|user_name|login|user_email)$/) &&
+            has(n, /pass(word)?|pwd|password_hash|hashed_password/)
+        )
+        if (identity) return identity
+        const named = names.find((n) =>
+          /^(app_)?users?$|^members?$|^customers?$|^accounts?$/i.test(n)
+        )
+        if (named) return named
+        const AUX = /token|session|verification|reset|oauth|provider|magic|otp|account_link/i
+        const nonAux = names.find((n) => !AUX.test(n))
+        return nonAux || names[0]
+      })()
       // Low-stock auto-fire: the data-api wakes up the
       // /api/ecommerce/low-stock-alert endpoint on the place-order
       // workflow's stock-check SELECT. Both flags are sourced from