@teleporthq/teleport-plugin-next-workflows 0.43.33 → 0.43.35

package/__tests__/client-config-redaction.test.ts

@@ -0,0 +1,192 @@
+// SECURITY regression guard: a generated app must never ship a server node's
+// raw SQL (or any other server-only config) inside the CLIENT page bundle.
+//
+// Data nodes (data-select / data-raw-query / data-count / data-create-item /
+// …) and AI nodes run in their own server API route. Before this guard the
+// workflow component plugin serialized the FULL workflow — every segment's
+// nodes AND the top-level node list — with each node's `config` verbatim into
+// the module-level `__wfConfig_*` constant that ships to the browser, leaking
+// the SQL text (confirmed live: a published page chunk contained
+// `SELECT * FROM vehicles WHERE ... license_plate ILIKE ...`).
+//
+// The plugin now redacts every server node's config down to a client-safe
+// whitelist (only the AI-streaming flag). This test proves the raw SQL is
+// ABSENT from the emitted client module while the server API route still
+// carries it, and that the metadata the client executor DOES need
+// (streaming flag + id/type/stepNumber/edges for branch-skip bookkeeping) and
+// client node config are preserved.
+
+import { createNextWorkflowPlugin } from '../src/workflow-component-plugin'
+import { splitIntoSegments } from '../src/segment-splitter'
+import {
+  generateServerSegmentAPIRoute,
+  generateStreamingServerSegmentAPIRoute,
+  hasStreamingAINode,
+} from '../src/api-route-generator'
+
+const RAW_SQL = "SELECT * FROM vehicles WHERE ($1 = '' OR license_plate ILIKE '%' || $1 || '%')"
+const DATA_SOURCE_ID = 'vehicles-datasource-id'
+const AI_PROMPT = 'Summarize this SENSITIVE_SERVER_PROMPT'
+const AI_MODEL = 'gpt-4o-secret-model'
+const CLIENT_MARKER = 'CLIENT_VISIBLE_VALUE'
+
+const TRIGGER_ID = 'trigger-1'
+const DATA_ID = 'data-1'
+const AI_ID = 'ai-1'
+const CLIENT_ID = 'client-1'
+
+const buildWorkflow = (): any => ({
+  id: 'wf-1',
+  name: 'Vehicles Page Load',
+  trigger: {
+    type: 'event-page-loaded',
+    nodeId: TRIGGER_ID,
+    scope: 'page',
+    config: { pageId: 'page-1' },
+  },
+  nodes: [
+    {
+      id: DATA_ID,
+      type: 'data-raw-query',
+      config: {
+        dataSourceId: DATA_SOURCE_ID,
+        query: RAW_SQL,
+        params: ['secret-plate'],
+      },
+      executionEnv: 'server',
+      stepNumber: 1,
+      label: 'Fetch vehicles',
+    },
+    {
+      id: AI_ID,
+      type: 'ai-custom-prompt',
+      config: {
+        prompt: AI_PROMPT,
+        model: AI_MODEL,
+        streaming: true,
+      },
+      executionEnv: 'server',
+      stepNumber: 2,
+      label: 'Summarize',
+    },
+    {
+      id: CLIENT_ID,
+      type: 'state-update-local-state',
+      config: { property: 'summary', value: CLIENT_MARKER },
+      executionEnv: 'client',
+      stepNumber: 3,
+      label: 'Write summary',
+    },
+  ],
+  edges: [
+    { id: 'e1', source: TRIGGER_ID, target: DATA_ID },
+    { id: 'e2', source: DATA_ID, target: AI_ID },
+    { id: 'e3', source: AI_ID, target: CLIENT_ID },
+  ],
+})
+
+const buildStructure = (): any => ({
+  uidl: {
+    name: 'Page',
+    outputOptions: { pageId: 'page-1', fileName: 'page-1' },
+    node: { type: 'element', content: { elementType: 'container', name: 'Container' } },
+    stateDefinitions: {
+      summary: { type: 'string', defaultValue: '' },
+    },
+  },
+  chunks: [
+    {
+      type: 'chunk-type-ast',
+      name: 'jsx-component',
+      content: {
+        type: 'VariableDeclaration',
+        declarations: [
+          {
+            type: 'VariableDeclarator',
+            init: {
+              type: 'ArrowFunctionExpression',
+              body: {
+                type: 'BlockStatement',
+                body: [{ type: 'ReturnStatement', argument: null }],
+              },
+            },
+          },
+        ],
+      },
+    },
+  ],
+  options: {
+    workflows: { workflows: { 'wf-1': buildWorkflow() }, customNodes: {} },
+  },
+  dependencies: {},
+})
+
+const getModuleCode = async (): Promise<string> => {
+  const plugin = createNextWorkflowPlugin({ isPage: true })
+  const structure = buildStructure()
+  await plugin(structure as any)
+  const moduleChunk = (structure.chunks as any[]).find((c: any) => c.name === 'workflow-module')
+  if (!moduleChunk) {
+    throw new Error('workflow-module chunk not emitted by plugin')
+  }
+  return String(moduleChunk.content)
+}
+
+describe('client bundle redacts server node config', () => {
+  let moduleCode: string
+
+  beforeAll(async () => {
+    moduleCode = await getModuleCode()
+  })
+
+  it('does NOT leak the raw SQL query into the client module', () => {
+    expect(moduleCode).not.toContain(RAW_SQL)
+    expect(moduleCode).not.toContain('license_plate')
+    expect(moduleCode).not.toContain('SELECT * FROM vehicles')
+  })
+
+  it('drops every server-only data field from the client copy', () => {
+    // Field names + values that only the server API route may see.
+    expect(moduleCode).not.toContain(DATA_SOURCE_ID)
+    expect(moduleCode).not.toContain('dataSourceId')
+    expect(moduleCode).not.toContain('secret-plate')
+    // AI server node's prompt/model are server-only too.
+    expect(moduleCode).not.toContain(AI_PROMPT)
+    expect(moduleCode).not.toContain(AI_MODEL)
+  })
+
+  it('preserves the AI streaming flag so streaming detection still works', () => {
+    // findStreamingAINodes reads config.streaming off the top-level node list.
+    expect(moduleCode).toContain('"streaming":true')
+  })
+
+  it('preserves server node identity/edges for branch-skip bookkeeping', () => {
+    // The client executor needs { id, type, stepNumber } + edges of server
+    // nodes to skip non-taken branches and sort segment results.
+    expect(moduleCode).toContain('"data-raw-query"')
+    expect(moduleCode).toContain('"ai-custom-prompt"')
+    expect(moduleCode).toContain(DATA_ID)
+    expect(moduleCode).toContain(AI_ID)
+    expect(moduleCode).toContain('"stepNumber"')
+  })
+
+  it('keeps client node config intact (only server nodes are redacted)', () => {
+    expect(moduleCode).toContain(CLIENT_MARKER)
+  })
+})
+
+describe('server API route still carries the SQL', () => {
+  it('embeds the raw SQL + data source in the generated server route', () => {
+    const segments = splitIntoSegments(buildWorkflow())
+    const serverSegment = segments.find((s) => s.env === 'server')
+    expect(serverSegment).toBeDefined()
+
+    const route = hasStreamingAINode(serverSegment!)
+      ? generateStreamingServerSegmentAPIRoute(serverSegment!, 'Vehicles Page Load')
+      : generateServerSegmentAPIRoute(serverSegment!, 'Vehicles Page Load')
+
+    // The server copy is legitimate and must remain.
+    expect(route).toContain(RAW_SQL)
+    expect(route).toContain(DATA_SOURCE_ID)
+  })
+})

package/__tests__/data-api-boolean-checkbox-coercion.test.ts

@@ -0,0 +1,143 @@
+import { generateDataAPIRoute } from '../src/data-api-route-generator'
+
+// Regression guard for "Edit Press Item" data loss: an unchecked HTML
+// checkbox is omitted from FormData entirely, so `general-extract-form-data`
+// resolves it to '' / undefined — never `false`. Before this fix,
+// `coerceValueForPgColumn` had no `boolean` branch, so that '' fell through
+// to the generic empty-string-to-null guard and was written as SQL NULL: a
+// silent "not featured" -> NULL corruption when the column is nullable, and a
+// hard 23502 not-null-violation (surfaced to the user as "update failed")
+// when the boolean column is NOT NULL.
+describe('data-api route generator: coerceValueForPgColumn boolean column handling', () => {
+  const code = generateDataAPIRoute()
+
+  it('emits an explicit boolean branch ahead of the ARRAY / generic handling', () => {
+    expect(code).toContain('function coerceValueForPgColumn')
+    expect(code).toMatch(/if \(dt === 'boolean'\)/)
+  })
+
+  it('is invoked from both handleCreate and handleUpdate', () => {
+    const handleCreateIdx = code.indexOf('async function handleCreate')
+    const handleUpdateIdx = code.indexOf('async function handleUpdate')
+    const handleDeleteIdx = code.indexOf('async function handleDelete')
+    expect(handleCreateIdx).toBeGreaterThan(0)
+    expect(handleUpdateIdx).toBeGreaterThan(handleCreateIdx)
+    expect(handleDeleteIdx).toBeGreaterThan(handleUpdateIdx)
+
+    const handleCreateBody = code.slice(handleCreateIdx, handleUpdateIdx)
+    const handleUpdateBody = code.slice(handleUpdateIdx, handleDeleteIdx)
+    expect(handleCreateBody).toContain('coerceValueForPgColumn(col, val, colTypes)')
+    expect(handleUpdateBody).toContain('coerceValueForPgColumn(col, val, colTypes)')
+  })
+})
+
+// Behaviour tests: spin up the emitted helper in a fresh JS sandbox and
+// exercise every boolean coercion path, mirroring the pattern established by
+// data-api-uuid-coercion.test.ts (the generated file is one big template
+// literal, so the helper is extracted by balanced-brace matching rather than
+// imported directly).
+describe('data-api route generator: coerceValueForPgColumn runtime behaviour', () => {
+  const code = generateDataAPIRoute()
+
+  const extractFunctionSource = (haystack: string, funcDecl: string): string => {
+    const startIdx = haystack.indexOf(funcDecl)
+    if (startIdx === -1) {
+      throw new Error('Helper not found in generated code: ' + funcDecl)
+    }
+    let depth = 0
+    let i = haystack.indexOf('{', startIdx)
+    if (i === -1) {
+      throw new Error('No opening brace after ' + funcDecl)
+    }
+    for (; i < haystack.length; i++) {
+      const ch = haystack.charAt(i)
+      if (ch === '{') {
+        depth++
+      } else if (ch === '}') {
+        depth--
+        if (depth === 0) {
+          return haystack.slice(startIdx, i + 1)
+        }
+      }
+    }
+    throw new Error('Unbalanced braces for ' + funcDecl)
+  }
+
+  const varDeclSource = (haystack: string, varDecl: string): string => {
+    const startIdx = haystack.indexOf(varDecl)
+    if (startIdx === -1) {
+      throw new Error('Var declaration not found in generated code: ' + varDecl)
+    }
+    const endIdx = haystack.indexOf(';', startIdx)
+    return haystack.slice(startIdx, endIdx + 1)
+  }
+
+  const booleanTrueStringsSource = varDeclSource(code, 'var BOOLEAN_TRUE_STRINGS')
+  const splitCommaSource = extractFunctionSource(code, 'function splitCommaOrPgArrayString')
+  const helperSource = extractFunctionSource(code, 'function coerceValueForPgColumn')
+
+  const factory = new Function(
+    booleanTrueStringsSource +
+      '\n' +
+      splitCommaSource +
+      '\n' +
+      helperSource +
+      '\nreturn coerceValueForPgColumn;'
+  )
+  const coerceValueForPgColumn = factory() as (
+    col: string,
+    val: unknown,
+    colTypes: Record<string, string>
+  ) => unknown
+
+  const boolCol = 'is_featured'
+  const colTypes: Record<string, string> = {
+    is_featured: 'boolean',
+    tags: 'ARRAY',
+    name: 'text',
+  }
+
+  it('coerces an unchecked-checkbox empty string to false (not NULL)', () => {
+    expect(coerceValueForPgColumn(boolCol, '', colTypes)).toBe(false)
+  })
+
+  it('coerces undefined (field never present in the submitted body) to false', () => {
+    expect(coerceValueForPgColumn(boolCol, undefined, colTypes)).toBe(false)
+  })
+
+  it('coerces null to false', () => {
+    expect(coerceValueForPgColumn(boolCol, null, colTypes)).toBe(false)
+  })
+
+  it('coerces checkbox truthy strings ("on", "true", "1") to true', () => {
+    expect(coerceValueForPgColumn(boolCol, 'on', colTypes)).toBe(true)
+    expect(coerceValueForPgColumn(boolCol, 'true', colTypes)).toBe(true)
+    expect(coerceValueForPgColumn(boolCol, '1', colTypes)).toBe(true)
+  })
+
+  it('is case-insensitive and trims whitespace on truthy strings', () => {
+    expect(coerceValueForPgColumn(boolCol, 'On', colTypes)).toBe(true)
+    expect(coerceValueForPgColumn(boolCol, ' TRUE ', colTypes)).toBe(true)
+  })
+
+  it('coerces falsy strings ("off", "false", "0") to false', () => {
+    expect(coerceValueForPgColumn(boolCol, 'off', colTypes)).toBe(false)
+    expect(coerceValueForPgColumn(boolCol, 'false', colTypes)).toBe(false)
+    expect(coerceValueForPgColumn(boolCol, '0', colTypes)).toBe(false)
+  })
+
+  it('passes real booleans through unchanged', () => {
+    expect(coerceValueForPgColumn(boolCol, true, colTypes)).toBe(true)
+    expect(coerceValueForPgColumn(boolCol, false, colTypes)).toBe(false)
+  })
+
+  it('treats any non-zero number as true and zero as false', () => {
+    expect(coerceValueForPgColumn(boolCol, 1, colTypes)).toBe(true)
+    expect(coerceValueForPgColumn(boolCol, 0, colTypes)).toBe(false)
+  })
+
+  it('does not affect non-boolean columns (ARRAY / text untouched)', () => {
+    expect(coerceValueForPgColumn('tags', 'a,b,c', colTypes)).toEqual(['a', 'b', 'c'])
+    expect(coerceValueForPgColumn('name', '', colTypes)).toBe('')
+  })
+})

package/__tests__/data-api-safe-query.test.ts

@@ -75,7 +75,9 @@ describe('data-api safeQuery wrapper — defends against Postgres type-coercion
   })
 
   it('handleRawQuery routes through safeQuery so workflow-level raw SELECTs also degrade gracefully', () => {
-    expect(code).toMatch(/safeQuery\(client,\s*query,\s*\[\s*\],\s*'raw-query'\)/)
+    // Now binds the resolved `params` array (positional $N binds) rather than a
+    // hardcoded empty array — see raw-query-param-binding.test.ts.
+    expect(code).toMatch(/safeQuery\(client,\s*query,\s*params,\s*'raw-query'\)/)
   })
 
   it('handleCreate is NOT wrapped (an INSERT failing on a bad UUID is a real error, not "no match")', () => {

package/__tests__/data-update-item-runtime.test.ts

@@ -0,0 +1,116 @@
+import { loadHandler, HandlerFn } from './_helpers/load-handler'
+
+// Regression guards for the data-update-item runtime output contract (run
+// d9a24741):
+//  - the gate `if (updateNode.affected > 0)` read `undefined` because the
+//    handler only returned `updatedCount` → every successful edit fell to its
+//    "record may have been deleted" branch. The handler now aliases `affected`.
+//  - an un-prefilled form field is OMITTED by general-extract-form-data, so its
+//    columnMapping value resolves to `undefined`; sending it wrote NULL into a
+//    NOT-NULL column (`guests.full_name`). The handler now omits undefined
+//    columnMappings so the column keeps its stored value.
+
+type FetchCall = { url: string; body: Record<string, unknown> }
+
+function installFetch(response: Record<string, unknown>, ok = true): FetchCall[] {
+  const calls: FetchCall[] = []
+  ;(globalThis as any).fetch = async (url: string, opts: { body: string }) => {
+    calls.push({ url, body: JSON.parse(opts.body) })
+    return { ok, json: async () => response }
+  }
+  return calls
+}
+
+function uninstallFetch(): void {
+  delete (globalThis as any).fetch
+}
+
+describe('data-update-item runtime output + null-safety', () => {
+  let handler: HandlerFn
+
+  beforeAll(() => {
+    handler = loadHandler('data-update-item')
+  })
+
+  afterEach(() => {
+    uninstallFetch()
+  })
+
+  it('aliases `affected` to `updatedCount` on a successful update', async () => {
+    installFetch({ id: 'r1', updatedCount: 1, item: { id: 'r1' } })
+    const result = (await handler(
+      {
+        tableName: 'events',
+        filters: [{ field: 'id', operator: '=', value: 'e1' }],
+        columnMappings: [{ column: 'title', value: 'New title' }],
+      },
+      {}
+    )) as Record<string, unknown>
+    expect(result.updatedCount).toBe(1)
+    expect(result.affected).toBe(1)
+  })
+
+  it('reports affected:0 on the no-op (unresolved route-param) degrade', async () => {
+    const result = (await handler(
+      {
+        tableName: 'events',
+        filters: [{ field: 'id', operator: '=', value: '__TQ_UNRESOLVED_ROUTE_PARAM__' }],
+        columnMappings: [{ column: 'title', value: 'x' }],
+      },
+      {}
+    )) as Record<string, unknown>
+    expect(result.updatedCount).toBe(0)
+    expect(result.affected).toBe(0)
+  })
+
+  it('omits an undefined-resolving columnMapping so it never writes NULL', async () => {
+    const calls = installFetch({ id: 'r1', updatedCount: 1 })
+    await handler(
+      {
+        tableName: 'guests',
+        filters: [{ field: 'id', operator: '=', value: 'g1' }],
+        columnMappings: [
+          { column: 'full_name', value: undefined },
+          { column: 'phone', value: '555-1234' },
+        ],
+      },
+      {}
+    )
+    expect(calls).toHaveLength(1)
+    const sentMappings = calls[0].body.columnMappings as Array<{ column: string }>
+    expect(sentMappings.map((m) => m.column)).toEqual(['phone'])
+  })
+
+  it('never sends an empty UPDATE when every columnMapping is undefined', async () => {
+    const calls = installFetch({ id: 'r1', updatedCount: 1 })
+    const result = (await handler(
+      {
+        tableName: 'guests',
+        filters: [{ field: 'id', operator: '=', value: 'g1' }],
+        columnMappings: [
+          { column: 'full_name', value: undefined },
+          { column: 'phone', value: undefined },
+        ],
+      },
+      {}
+    )) as Record<string, unknown>
+    expect(calls).toHaveLength(0)
+    expect(result.updatedCount).toBe(0)
+    expect(result.affected).toBe(0)
+  })
+
+  it('preserves an explicit null columnMapping (intentional clear ≠ undefined)', async () => {
+    const calls = installFetch({ id: 'r1', updatedCount: 1 })
+    await handler(
+      {
+        tableName: 'guests',
+        filters: [{ field: 'id', operator: '=', value: 'g1' }],
+        columnMappings: [{ column: 'notes', value: null }],
+      },
+      {}
+    )
+    expect(calls).toHaveLength(1)
+    const sentMappings = calls[0].body.columnMappings as Array<{ column: string; value: unknown }>
+    expect(sentMappings).toEqual([{ column: 'notes', value: null }])
+  })
+})

package/__tests__/global-workflows-handler-map-integrity.test.ts

@@ -0,0 +1,85 @@
+import { NextWorkflowProjectPlugin } from '../src/workflow-project-plugin'
+
+/**
+ * Regression: `generateGlobalWorkflowsHook` must never emit a `clientNodeHandlers`
+ * map entry that references a handler function it did not also define.
+ *
+ * Bug: `handlers` (the function definitions) was gated on `if (nodeRegistry[t])`,
+ * while `handlerEntries` (the map) mapped over EVERY collected client node type.
+ * A client-segment node whose type has no registry generator — e.g. a
+ * `general-comment`, or an `event-*` trigger node that got collected into the
+ * type set — therefore produced a map value `'general-comment': general_comment`
+ * with no `general_comment` defined anywhere in the file. That is a bare
+ * reference to an undefined identifier; it throws `ReferenceError: general_comment
+ * is not defined` when the module/hook is evaluated in production, crashing the
+ * Vercel build (global-workflows.js is pulled into the global client bundle for
+ * every page via `useGlobalWorkflows()`). The two lists must stay paired.
+ */
+
+// A GLOBAL workflow (custom-triggered) whose client segment mixes a REGISTERED
+// handler node (`state-update-local-state`) with an UNREGISTERED node type
+// (`general-comment`, which has no entry in `nodeRegistry`). `general-comment`
+// resolves to a client segment by default, so it lands in the handler type set.
+const globalWorkflowWithUnregisteredNode = {
+  id: 'global-wf-unregistered',
+  trigger: { type: 'event-custom-triggered', config: { eventName: 'store-locations-loaded' } },
+  nodes: [
+    {
+      id: 'node-registered',
+      type: 'state-update-local-state',
+      config: { property: 'selectedPickupStore', value: '' },
+      stepNumber: 1,
+    },
+    {
+      id: 'node-unregistered',
+      type: 'general-comment',
+      config: { text: 'a designer note that must not become a handler' },
+      stepNumber: 2,
+    },
+  ],
+  edges: [{ id: 'edge-1', source: 'node-registered', target: 'node-unregistered' }],
+}
+
+function generateHook(): string {
+  const plugin = new NextWorkflowProjectPlugin()
+  // generateGlobalWorkflowsHook is private; call it directly for a unit test.
+  return (plugin as any).generateGlobalWorkflowsHook([globalWorkflowWithUnregisteredNode])
+}
+
+describe('generateGlobalWorkflowsHook — clientNodeHandlers map integrity', () => {
+  const code = generateHook()
+
+  it('defines a function for every identifier referenced in the handler map', () => {
+    // Match handler-map entries of the shape `'node-type': node_type` (the value
+    // identifier is the key with hyphens turned to underscores).
+    const entry = /['"]([a-z0-9]+(?:-[a-z0-9]+)+)['"]\s*:\s*([a-z0-9]+(?:_[a-z0-9]+)+)\b/g
+    const dangling: string[] = []
+    let m: RegExpExecArray | null = entry.exec(code)
+    while (m !== null) {
+      const [, key, ident] = m
+      if (key.replace(/-/g, '_') !== ident) {
+        m = entry.exec(code)
+        continue // not a handler-map entry
+      }
+      const isDefined = new RegExp(
+        `(?:async\\s+function|function|const|let|var)\\s+${ident}\\b`
+      ).test(code)
+      if (!isDefined) {
+        dangling.push(ident)
+      }
+      m = entry.exec(code)
+    }
+    expect(dangling).toEqual([])
+  })
+
+  it('keeps the registered handler in the map with its definition', () => {
+    expect(code).toContain("'state-update-local-state': state_update_local_state")
+    expect(code).toMatch(/(?:async\s+)?function state_update_local_state\s*\(/)
+  })
+
+  it('omits an unregistered node type (general-comment) entirely — no dangling reference', () => {
+    // Neither a definition nor a map entry for the unregistered type may appear.
+    expect(code).not.toContain('general_comment')
+    expect(code).not.toContain("'general-comment'")
+  })
+})