@teleporthq/teleport-plugin-next-workflows 0.43.45 → 0.43.47

package/__tests__/_helpers/run-generated-middleware.ts

@@ -0,0 +1,130 @@
+import { UIDLAuthentication } from '@teleporthq/teleport-types'
+import { generateMiddlewareFile } from '../../src/auth-generator'
+
+/**
+ * Loads the middleware `generateMiddlewareFile` emits and runs it against a
+ * synthetic request, so tests can assert on BEHAVIOUR ("does a guest reach
+ * /orders/ORD-42?") instead of grepping the generated source.
+ *
+ * The emitted file is an ES module that imports `next/server` and
+ * `next-auth/jwt`; neither is installed in this package, so the loader strips
+ * the module boundary and injects the pieces the middleware actually uses.
+ * `getToken` always resolves to `null` — the generated code then falls back to
+ * cookie presence plus `/api/auth/session`, which the fetch stub answers, so
+ * both the authenticated and the anonymous path stay exercisable.
+ */
+
+export interface MiddlewareResult {
+  kind: 'next' | 'redirect'
+  /** Only set for `kind: 'redirect'`. */
+  location?: string
+}
+
+export interface MiddlewareSessionUser {
+  id?: string
+  role?: string
+}
+
+export interface MiddlewareRequestOptions {
+  /** Session user the stubbed `/api/auth/session` returns; omit for a guest. */
+  sessionUser?: MiddlewareSessionUser | null
+  origin?: string
+}
+
+interface RawMiddlewareResult {
+  __kind: 'next' | 'redirect'
+  __location?: string
+}
+
+type MiddlewareFn = (request: unknown) => Promise<RawMiddlewareResult>
+
+type MiddlewareFactory = (
+  nextResponse: unknown,
+  getToken: unknown,
+  fetchImpl: unknown
+) => MiddlewareFn
+
+const stripModuleSyntax = (code: string): string =>
+  code
+    .replace("import { NextResponse } from 'next/server';", '')
+    .replace("import { getToken } from 'next-auth/jwt';", '')
+    .replace('export default middleware;', '')
+    .replace('export const config = {', 'const config = {')
+
+/**
+ * The route table the generated middleware gates on. Parsed out of the emitted
+ * source so assertions can target the actual map instead of substring-matching
+ * a file that also contains comments and the self-guarded route list.
+ */
+export const extractProtectedRoutes = (
+  code: string
+): Record<string, { requiresAuth: boolean; allowedRoles: string[] }> => {
+  // Non-greedy up to the first `};`. `JSON.stringify(…, null, 2)` never emits
+  // that sequence inside the object, so the first hit is the real terminator —
+  // and the empty-map case (`= {};`) is covered by the same pattern.
+  const match = code.match(/const protectedRoutes = (\{[\s\S]*?\});/)
+  if (!match) {
+    throw new Error('generated middleware has no protectedRoutes declaration')
+  }
+  return JSON.parse(match[1])
+}
+
+/** Route patterns whose page-load SQL is the access control. */
+export const extractSelfGuardedRoutes = (code: string): string[] => {
+  const match = code.match(/const selfGuardedRoutes = (\[[\s\S]*?\]);/)
+  if (!match) {
+    throw new Error('generated middleware has no selfGuardedRoutes declaration')
+  }
+  return JSON.parse(match[1])
+}
+
+const NEXT_RESPONSE_STUB = {
+  next: (): RawMiddlewareResult => ({ __kind: 'next' }),
+  redirect: (url: URL): RawMiddlewareResult => ({
+    __kind: 'redirect',
+    __location: String(url),
+  }),
+}
+
+/**
+ * Compiles the middleware once for an auth config. Reuse the returned function
+ * across requests in a test to avoid re-generating the file per assertion.
+ */
+export const compileGeneratedMiddleware = (auth: UIDLAuthentication) => {
+  const factory = new Function(
+    'NextResponse',
+    'getToken',
+    'fetch',
+    `${stripModuleSyntax(generateMiddlewareFile(auth))}; return middleware;`
+  ) as unknown as MiddlewareFactory
+
+  return async (
+    pathname: string,
+    options: MiddlewareRequestOptions = {}
+  ): Promise<MiddlewareResult> => {
+    const origin = options.origin || 'https://shop.test'
+    const sessionUser = options.sessionUser ?? null
+    const cookieHeader = sessionUser ? 'next-auth.session-token=stub' : ''
+
+    const fetchImpl = async () => ({
+      ok: true,
+      json: async () => ({ user: sessionUser }),
+    })
+
+    const getTokenStub = async (): Promise<null> => null
+    const middleware = factory(NEXT_RESPONSE_STUB, getTokenStub, fetchImpl)
+    const result = await middleware({
+      nextUrl: { pathname },
+      url: `${origin}${pathname}`,
+      cookies: {
+        get: (name: string) =>
+          sessionUser && name === 'next-auth.session-token' ? { name, value: 'stub' } : undefined,
+      },
+      headers: { get: (name: string) => (name === 'cookie' ? cookieHeader : '') },
+    })
+
+    return result.__kind === 'redirect'
+      ? { kind: 'redirect', location: result.__location }
+      : { kind: 'next' }
+  }
+}

package/__tests__/auth-env-secret-preservation.test.ts

@@ -118,4 +118,39 @@ describe('resolveAuthEnvValue', () => {
     expect(resolveAuthEnvValue('TELEPORT_DB_SSL', 'true', oauthKeys)).toBe('true')
     expect(resolveAuthEnvValue('AUTH_CREDENTIALS_ENABLED', 'true', oauthKeys)).toBe('true')
   })
+
+  // Regression: next-auth v4 `react/index.js` runs `parseUrl(process.env.NEXTAUTH_URL)`
+  // at module load, and `new URL('')` throws "Invalid URL" — crashing SSR for
+  // every page that mounts SessionProvider. `createEnvFiles` writes every key,
+  // so a BLANK NEXTAUTH_URL serializes as the crashing `NEXTAUTH_URL=`. The
+  // blank case is self-perpetuating (the standalone harness re-injects the
+  // on-disk empty value), so the resolver must heal it, not pass it through.
+  describe('blank auth-critical keys heal to their local default', () => {
+    it.each(['', '   ', undefined as unknown as string])(
+      'NEXTAUTH_URL=%p becomes the localhost default rather than an empty assignment',
+      (blank) => {
+        expect(resolveAuthEnvValue('NEXTAUTH_URL', blank, oauthKeys)).toBe('http://localhost:3000')
+      }
+    )
+
+    it('a blank NEXTAUTH_SECRET heals to the placeholder default', () => {
+      expect(resolveAuthEnvValue('NEXTAUTH_SECRET', '', oauthKeys)).toBe(
+        'CHANGE_ME_TO_A_RANDOM_SECRET'
+      )
+    })
+
+    it('a real configured NEXTAUTH_URL / NEXTAUTH_SECRET is left untouched', () => {
+      expect(resolveAuthEnvValue('NEXTAUTH_URL', 'https://shop.example.com', oauthKeys)).toBe(
+        'https://shop.example.com'
+      )
+      expect(
+        resolveAuthEnvValue('NEXTAUTH_SECRET', 'a-real-32-char-secret-value-xxxxx', oauthKeys)
+      ).toBe('a-real-32-char-secret-value-xxxxx')
+    })
+
+    it('a blank NON-auth key still serializes blank — no behavior change outside the two auth keys', () => {
+      expect(resolveAuthEnvValue('TELEPORT_DB_SSL', '', oauthKeys)).toBe('')
+      expect(resolveAuthEnvValue('SOME_OTHER_KEY', '', oauthKeys)).toBe('')
+    })
+  })
 })

package/__tests__/auth-nextauth-url.test.ts

@@ -56,4 +56,32 @@ describe('generated NextAuth route — dynamic NEXTAUTH_URL', () => {
     handler({ headers: { host: 'localhost:3000' } }, {})
     expect(process.env.NEXTAUTH_URL).toBe('http://localhost:3000')
   })
+
+  // Project a62338f9 published with `NEXTAUTH_URL=teleporthq.secrets.NEXTAUTH_URL`.
+  // The old check saw a non-empty, non-localhost string and treated it as
+  // explicitly configured, so NextAuth normalised it to
+  // `https://teleporthq.secrets.nextauth_url`, advertised that as the sign-in
+  // origin and issued `__Host-`/`__Secure-` cookies against it. Sign-in failed
+  // with a bare `credentialsSignin`. An unresolved placeholder is now treated
+  // as unset, so an already-published site self-heals on its next request.
+  it('overrides an unresolved secret placeholder on a published domain', () => {
+    process.env.NEXTAUTH_URL = 'teleporthq.secrets.NEXTAUTH_URL'
+    handler(
+      { headers: { host: 'rare-last-dunlin.teleporthq.dev', 'x-forwarded-proto': 'https' } },
+      {}
+    )
+    expect(process.env.NEXTAUTH_URL).toBe('https://rare-last-dunlin.teleporthq.dev')
+  })
+
+  it('falls back to an http origin locally, so cookies are not Secure-prefixed', () => {
+    process.env.NEXTAUTH_URL = 'teleporthq.secrets.NEXTAUTH_URL'
+    handler({ headers: { host: 'localhost:3001' } }, {})
+    expect(process.env.NEXTAUTH_URL).toBe('http://localhost:3001')
+  })
+
+  it('overrides any value that is not an absolute http(s) origin', () => {
+    process.env.NEXTAUTH_URL = 'my-app.teleporthq.dev'
+    handler({ headers: { host: 'my-app.teleporthq.dev', 'x-forwarded-proto': 'https' } }, {})
+    expect(process.env.NEXTAUTH_URL).toBe('https://my-app.teleporthq.dev')
+  })
 })