@teleporthq/teleport-plugin-next-workflows 0.43.35 → 0.43.37

package/__tests__/ai-error-contract.test.ts

@@ -0,0 +1,149 @@
+// Regression guard for "AI provider/auth failures treated as success".
+//
+// Every AI node handler (src/nodes/ai/*) signals failure with
+// `{ error: true, message, code }` — a BOOLEAN error flag — while the executor
+// error gates only tested `typeof result.error === 'string'`. A missing
+// OPENAI key therefore sailed through as a successful node result and the
+// pipeline limped into a downstream NOT NULL 500 (e.g. persisting a NULL chat
+// answer). The gates now treat `result.error === true` as fatal too, via the
+// shared isFatalNodeResult / fatalNodeResultMessage runtime helpers.
+
+import { generateSharedRuntimeUtilsCode } from '../src/executor-generator'
+import {
+  generateServerSegmentAPIRoute,
+  generateStreamingServerSegmentAPIRoute,
+} from '../src/api-route-generator'
+import type { WorkflowSegment } from '../src/types'
+
+type UtilsModule = {
+  isFatalNodeResult: (result: unknown) => boolean
+  fatalNodeResultMessage: (result: Record<string, unknown>) => string
+  executeNodes: (
+    nodes: unknown[],
+    edges: unknown[],
+    context: Record<string, unknown>,
+    nodeHandlers: Record<string, unknown>,
+    workflowConfig: unknown,
+    callServerSegment: unknown,
+    executionId: string
+  ) => Promise<void>
+}
+
+function loadUtils(): UtilsModule {
+  const utilsModule = { exports: {} as unknown as UtilsModule }
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  new Function('module', 'exports', 'require', generateSharedRuntimeUtilsCode())(
+    utilsModule,
+    utilsModule.exports,
+    () => ({})
+  )
+  return utilsModule.exports
+}
+
+describe('isFatalNodeResult — error contract normalization', () => {
+  const utils = loadUtils()
+
+  it('treats the AI-node contract { error: true, message, code } as fatal', () => {
+    expect(
+      utils.isFatalNodeResult({ error: true, message: 'No API key', code: 'authentication_error' })
+    ).toBeTruthy()
+  })
+
+  it('keeps the legacy string-error contract fatal', () => {
+    expect(utils.isFatalNodeResult({ error: 'boom' })).toBeTruthy()
+    expect(utils.isFatalNodeResult({ success: false })).toBeTruthy()
+  })
+
+  it('does not flag successful results', () => {
+    expect(utils.isFatalNodeResult({ result: 'ok' })).toBeFalsy()
+    expect(utils.isFatalNodeResult({ error: false })).toBeFalsy()
+    expect(utils.isFatalNodeResult({ error: '' })).toBeFalsy()
+    expect(utils.isFatalNodeResult(null)).toBeFalsy()
+    expect(utils.isFatalNodeResult(undefined)).toBeFalsy()
+  })
+
+  it('surfaces the AI-node message when error is boolean', () => {
+    expect(
+      utils.fatalNodeResultMessage({ error: true, message: 'Incorrect API key provided' })
+    ).toBe('Incorrect API key provided')
+    expect(utils.fatalNodeResultMessage({ error: 'raw string error' })).toBe('raw string error')
+    expect(utils.fatalNodeResultMessage({ success: false })).toBe('Node execution failed')
+  })
+})
+
+describe('executeNodes halts on { error: true } and never reaches downstream nodes', () => {
+  const utils = loadUtils()
+
+  const nodes = [
+    { id: 'ai-1', type: 'ai-custom-prompt', config: {}, stepNumber: 1 },
+    { id: 'persist-1', type: 'data-create-item', config: {}, stepNumber: 2 },
+  ]
+  const edges = [{ id: 'e1', source: 'ai-1', target: 'persist-1' }]
+
+  it('throws with the provider message and skips the downstream persist node', async () => {
+    const persistCalls: unknown[] = []
+    const handlers = {
+      'ai-custom-prompt': async () => ({
+        error: true,
+        message: 'AI provider authentication failed',
+        code: 'authentication_error',
+      }),
+      'data-create-item': async () => {
+        persistCalls.push('persist')
+        return { success: true }
+      },
+    }
+
+    await expect(
+      utils.executeNodes(nodes, edges, {}, handlers, { nodes, edges }, null, 'exec-1')
+    ).rejects.toThrow('AI provider authentication failed')
+    expect(persistCalls).toHaveLength(0)
+  })
+
+  it('still runs downstream nodes for successful AI results', async () => {
+    const persistCalls: unknown[] = []
+    const handlers = {
+      'ai-custom-prompt': async () => ({ response: 'hello', model: 'gpt-4o' }),
+      'data-create-item': async () => {
+        persistCalls.push('persist')
+        return { success: true }
+      },
+    }
+
+    await utils.executeNodes(nodes, edges, {}, handlers, { nodes, edges }, null, 'exec-2')
+    expect(persistCalls).toHaveLength(1)
+  })
+})
+
+describe('generated server routes gate node results through the shared helpers', () => {
+  const segment: WorkflowSegment = {
+    id: 'server-1',
+    env: 'server',
+    nodeIds: ['ai-1'],
+    nodes: [
+      {
+        id: 'ai-1',
+        type: 'ai-custom-prompt',
+        config: { prompt: 'hi', streaming: true },
+        stepNumber: 1,
+      } as never,
+    ],
+    edges: [],
+  }
+
+  it('non-streaming segment route uses isFatalNodeResult', () => {
+    const route = generateServerSegmentAPIRoute(
+      { ...segment, nodes: [{ ...segment.nodes[0], config: { prompt: 'hi' } } as never] },
+      'Chat'
+    )
+    expect(route).toContain('utils.isFatalNodeResult(result)')
+    expect(route).toContain('utils.fatalNodeResultMessage(result)')
+  })
+
+  it('streaming segment route gates the streaming AI result itself before running on-end nodes', () => {
+    const route = generateStreamingServerSegmentAPIRoute(segment, 'Chat')
+    // Two gates: the streaming AI node's own result + the non-streaming path.
+    const occurrences = route.split('utils.isFatalNodeResult(result)').length - 1
+    expect(occurrences).toBeGreaterThanOrEqual(2)
+  })
+})

package/__tests__/data-api-safe-query.test.ts

@@ -98,30 +98,30 @@ describe('data-api safeQuery wrapper — defends against Postgres type-coercion
 
 describe('data-api safeQuery — runtime semantics', () => {
   const code = generateDataAPIRoute()
-  // Eval the safeQuery helper out of the emitted file and verify it
-  // behaves as we expect against a fake client.
-  const evalFn = () => {
-    const startTag = 'async function safeQuery'
-    const start = code.indexOf(startTag)
-    // Find the matching closing brace via depth counting
+  const extractFunctionBlock = (src: string, tag: string): string => {
+    const start = src.indexOf(tag)
     let depth = 0
-    let i = code.indexOf('{', start)
-    for (; i < code.length; i++) {
-      if (code[i] === '{') {
+    let i = src.indexOf('{', start)
+    for (; i < src.length; i++) {
+      if (src[i] === '{') {
         depth++
-      } else if (code[i] === '}') {
+      } else if (src[i] === '}') {
         depth--
         if (depth === 0) {
           break
         }
       }
     }
-    const fnSrc = code.slice(start, i + 1)
-    // Also extract the SAFE_COERCION_ERROR_CODES constant
-    const codesStart = code.indexOf('var SAFE_COERCION_ERROR_CODES')
-    const codesEnd = code.indexOf(';', codesStart)
-    const codesSrc = code.slice(codesStart, codesEnd + 1)
-    return new Function(codesSrc + '\n' + fnSrc + '\nreturn safeQuery;')() as any
+    return src.slice(start, i + 1)
+  }
+  // Eval the safeQuery helper out of the emitted file and verify it
+  // behaves as we expect against a fake client.
+  const evalFn = () => {
+    const blockStart = code.indexOf('var SAFE_COERCION_ERROR_CODES')
+    const safeQueryStart = code.indexOf('async function safeQuery')
+    const preamble = code.slice(blockStart, safeQueryStart)
+    const safeQueryFn = extractFunctionBlock(code, 'async function safeQuery')
+    return new Function(preamble + safeQueryFn + '\nreturn safeQuery;')() as any
   }
   const safeQuery = evalFn()
 

package/__tests__/node-handler-file-inline-map.test.ts

@@ -0,0 +1,114 @@
+import { NextWorkflowProjectPlugin } from '../src/workflow-project-plugin'
+import { nodeRegistry } from '../src/nodes'
+
+/**
+ * Regression (Vercel "ReferenceError: state_update_local_state is not defined" at
+ * "Collecting page data"): node-handlers-client.js / node-handlers-server.js used
+ * to emit separate top-level `async function <name>` declarations plus a
+ * `module.exports` map that referenced them by name. That forward-reference shape
+ * can dangle in production — a bundler/minifier that drops a single-use
+ * declaration, or a handler whose emitted name drifts from its map key, leaves the
+ * top-level map referencing an undefined identifier, which throws at MODULE-EVAL.
+ * The emitter now inlines each handler as its map value (a named function
+ * expression), so a dangling reference is structurally impossible.
+ */
+describe('generateNodeHandlerFile — inline handler map (dangling-proof)', () => {
+  const plugin = new NextWorkflowProjectPlugin()
+  const code: string = (plugin as any).generateNodeHandlerFile(
+    new Set(['state-update-local-state', 'toast-show', 'general-extract-form-data']),
+    'client'
+  )
+
+  it('inlines each handler inside a self-invoking function map value (no bare forward reference)', () => {
+    // The value is an IIFE that runs the handler (possibly multi-statement) and
+    // returns its entry function — never a bare top-level declaration reference.
+    expect(code).toMatch(/'state-update-local-state':\s*\(function \(\) \{/)
+    expect(code).toMatch(/return state_update_local_state;\s*\}\)\(\)/)
+    // The old fragile shape — a bare `'x-y': x_y` identifier reference — must be gone.
+    expect(code).not.toMatch(/'state-update-local-state':\s*state_update_local_state\s*[,}]/)
+  })
+
+  it('has no dangling map reference (every value is defined at its own site)', () => {
+    const entry = /['"]([a-z0-9]+(?:-[a-z0-9]+)+)['"]\s*:\s*([a-z0-9]+(?:_[a-z0-9]+)+)\b/g
+    const dangling: string[] = []
+    let m: RegExpExecArray | null = entry.exec(code)
+    while (m !== null) {
+      const [, key, ident] = m
+      if (key.replace(/-/g, '_') === ident && !new RegExp(`function ${ident}\\b`).test(code)) {
+        dangling.push(ident)
+      }
+      m = entry.exec(code)
+    }
+    expect(dangling).toEqual([])
+  })
+
+  it('evaluates as a CommonJS module without ReferenceError and exposes callable handlers', () => {
+    const moduleObj = { exports: {} as Record<string, unknown> }
+    // Simulate Next.js module-eval (the "Collecting page data" require). If a map
+    // value referenced an undefined identifier this would throw ReferenceError.
+    // eslint-disable-next-line no-new-func
+    new Function('module', 'exports', code)(moduleObj, moduleObj.exports)
+    expect(typeof moduleObj.exports['state-update-local-state']).toBe('function')
+    expect(typeof moduleObj.exports['toast-show']).toBe('function')
+    expect(typeof moduleObj.exports['general-extract-form-data']).toBe('function')
+  })
+})
+
+/**
+ * Whole-registry contract: EVERY node type must produce a syntactically valid,
+ * module-eval-safe handler file in BOTH environments. The narrow 3-handler test
+ * above only exercised single-function CLIENT handlers, so it missed the class
+ * of handlers that emit MULTIPLE top-level statements — AI nodes
+ * (`generateAIProviderUtils() + '\n\n' + <fn>`), `payment-charge-user` and
+ * `general-rate-limiter` (function + appended helper declarations). Inlining
+ * those as a bare object-literal value produced `'ai-custom-prompt': var … `,
+ * a SyntaxError that crashed `require()` of node-handlers-server.js. This test
+ * evaluates the generated file for every registry type in both envs — the exact
+ * loop that surfaced the regression — so any future multi-statement or
+ * name-drifting handler fails CI here instead of at a Vercel build.
+ */
+describe('generateNodeHandlerFile — every registry node type is eval-safe in both envs', () => {
+  const plugin = new NextWorkflowProjectPlugin()
+  const allTypes = Object.keys(nodeRegistry)
+
+  for (const env of ['client', 'server'] as const) {
+    it(`compiles + evaluates a file containing every node type (${env})`, () => {
+      const code: string = (plugin as any).generateNodeHandlerFile(new Set(allTypes), env)
+      // Empty is legal only if no handler is relevant to this env — never here.
+      expect(code.length).toBeGreaterThan(0)
+
+      const moduleObj = { exports: {} as Record<string, unknown> }
+      expect(() => {
+        // eslint-disable-next-line no-new-func
+        new Function('module', 'exports', code)(moduleObj, moduleObj.exports)
+      }).not.toThrow()
+
+      // Each emitted map value must resolve to a callable handler (the IIFE
+      // returned the entry function, not `undefined` from a name drift).
+      for (const key of Object.keys(moduleObj.exports)) {
+        expect(typeof moduleObj.exports[key]).toBe('function')
+      }
+    })
+
+    it(`emits an eval-safe single-type file for each node type individually (${env})`, () => {
+      const offenders: string[] = []
+      for (const type of allTypes) {
+        const code: string = (plugin as any).generateNodeHandlerFile(new Set([type]), env)
+        if (!code) {
+          continue // handler not relevant to this env — nothing emitted
+        }
+        try {
+          const moduleObj = { exports: {} as Record<string, unknown> }
+          // eslint-disable-next-line no-new-func
+          new Function('module', 'exports', code)(moduleObj, moduleObj.exports)
+          if (typeof moduleObj.exports[type] !== 'function') {
+            offenders.push(`${type} (value not callable)`)
+          }
+        } catch (err) {
+          offenders.push(`${type} (${(err as Error).message})`)
+        }
+      }
+      expect(offenders).toEqual([])
+    })
+  }
+})

package/__tests__/raw-query-param-binding.test.ts

@@ -144,27 +144,28 @@ describe('raw-query param binding — generated data-API route binds, never inte
   })
 
   it('handleRawQuery actually passes params to a parameterized client.query at runtime', async () => {
-    // Eval just the safeQuery helper (as data-api-safe-query.test.ts does) and
-    // confirm it forwards (sql, params) to client.query verbatim.
-    const start = code.indexOf('async function safeQuery')
-    let depth = 0
-    let i = code.indexOf('{', start)
-    for (; i < code.length; i++) {
-      if (code[i] === '{') {
-        depth++
-      } else if (code[i] === '}') {
-        depth--
-        if (depth === 0) {
-          break
+    const extractFunctionBlock = (src: string, tag: string): string => {
+      const start = src.indexOf(tag)
+      let depth = 0
+      let i = src.indexOf('{', start)
+      for (; i < src.length; i++) {
+        if (src[i] === '{') {
+          depth++
+        } else if (src[i] === '}') {
+          depth--
+          if (depth === 0) {
+            break
+          }
         }
       }
+      return src.slice(start, i + 1)
     }
-    const fnSrc = code.slice(start, i + 1)
-    const codesStart = code.indexOf('var SAFE_COERCION_ERROR_CODES')
-    const codesEnd = code.indexOf(';', codesStart)
-    const codesSrc = code.slice(codesStart, codesEnd + 1)
+    const blockStart = code.indexOf('var SAFE_COERCION_ERROR_CODES')
+    const safeQueryStart = code.indexOf('async function safeQuery')
+    const preamble = code.slice(blockStart, safeQueryStart)
+    const safeQueryFn = extractFunctionBlock(code, 'async function safeQuery')
     // eslint-disable-next-line @typescript-eslint/no-implied-eval
-    const safeQuery = new Function(codesSrc + '\n' + fnSrc + '\nreturn safeQuery;')() as any
+    const safeQuery = new Function(preamble + safeQueryFn + '\nreturn safeQuery;')() as any
 
     const calls: Array<{ sql: string; params: unknown[] }> = []
     const fakeClient = {