@teleporthq/teleport-plugin-next-workflows 0.43.45 → 0.43.47

package/__tests__/workflow-auth-guard.test.ts

@@ -0,0 +1,277 @@
+import {
+  generateWorkflowAuthHelperFile,
+  buildWorkflowAuthInjection,
+} from '../src/workflow-auth-generator'
+import {
+  generateServerSegmentAPIRoute,
+  generateStreamingServerSegmentAPIRoute,
+} from '../src/api-route-generator'
+import { UIDLWorkflowProtection } from '@teleporthq/teleport-types'
+import { WorkflowSegment } from '../src/types'
+
+// The generated workflow-auth.js guard is the single stateless enforcement
+// point. Booting it with a mocked next-auth/jwt proves the runtime behaviour;
+// the route generators prove the guard is wired in BEFORE any node runs.
+
+type Guard = (
+  req: any,
+  context: any,
+  policy: any
+) => Promise<{ status: number; message: string } | null>
+
+/** Boots the emitted guard file with getToken stubbed to read `req.__token`. */
+function bootGuard(secret: string | undefined): Guard {
+  const code = generateWorkflowAuthHelperFile()
+  const moduleObj: { exports: any } = { exports: {} }
+  const fakeRequire = (name: string): any => {
+    if (name === 'next-auth/jwt') {
+      return { getToken: async ({ req }: any) => (req && req.__token) || null }
+    }
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    return require(name)
+  }
+  // tslint:disable-next-line:function-constructor
+  new Function('require', 'module', 'exports', 'process', code)(
+    fakeRequire,
+    moduleObj,
+    moduleObj.exports,
+    { env: { NEXTAUTH_SECRET: secret } }
+  )
+  return moduleObj.exports.guardWorkflowRequest as Guard
+}
+
+const reqWith = (extra: Record<string, unknown> = {}): any => ({ headers: {}, ...extra })
+
+describe('guardWorkflowRequest (runtime enforcement)', () => {
+  const guard = bootGuard('server-secret')
+
+  it('is a no-op when there is no policy', async () => {
+    const context = { n: { userId: 'victim' } }
+    expect(await guard(reqWith(), context, null)).toBeNull()
+    expect(context.n.userId).toBe('victim')
+  })
+
+  it('rejects with 401 when auth is required and there is no session', async () => {
+    const res = await guard(reqWith(), {}, { requiresAuth: true, allowedRoles: [] })
+    expect(res).toEqual({ status: 401, message: 'Unauthenticated' })
+  })
+
+  it('allows any authenticated user when allowedRoles is empty', async () => {
+    const res = await guard(
+      reqWith({ __token: { id: 'u1', role: 'user' } }),
+      {},
+      {
+        requiresAuth: true,
+        allowedRoles: [],
+      }
+    )
+    expect(res).toBeNull()
+  })
+
+  it('rejects with 403 when the session role is not allowed', async () => {
+    const res = await guard(
+      reqWith({ __token: { id: 'u1', role: 'user' } }),
+      {},
+      {
+        requiresAuth: true,
+        allowedRoles: ['admin'],
+      }
+    )
+    expect(res).toEqual({ status: 403, message: 'Forbidden' })
+  })
+
+  it('allows a matching role (incl. roleName / roles[] spellings)', async () => {
+    for (const token of [
+      { id: 'u1', role: 'admin' },
+      { id: 'u1', roleName: 'admin' },
+      { id: 'u1', roles: ['admin'] },
+    ]) {
+      expect(
+        await guard(
+          reqWith({ __token: token }),
+          {},
+          { requiresAuth: true, allowedRoles: ['admin'] }
+        )
+      ).toBeNull()
+    }
+  })
+
+  it('OVERWRITES a forged user id with the session id (the IDOR fix)', async () => {
+    const context = { resolver: { userId: 'victim-id', email: 'x' } }
+    const res = await guard(reqWith({ __token: { id: 'attacker-real-id' } }), context, {
+      requiresAuth: true,
+      allowedRoles: [],
+      userScoped: { ownerColumn: 'user_id', bindings: [{ nodeId: 'resolver', path: ['userId'] }] },
+    })
+    expect(res).toBeNull()
+    expect(context.resolver.userId).toBe('attacker-real-id') // forced to the caller
+    expect(context.resolver.email).toBe('x') // other fields untouched
+  })
+
+  it('binds a nested path and creates missing context nodes', async () => {
+    const context: any = {}
+    await guard(reqWith({ __token: { id: 'sess-1' } }), context, {
+      requiresAuth: false,
+      allowedRoles: [],
+      userScoped: { ownerColumn: 'user_id', bindings: [{ nodeId: 'n', path: ['user', 'id'] }] },
+    })
+    expect(context.n.user.id).toBe('sess-1')
+  })
+
+  it('falls back to token.sub when token.id is absent', async () => {
+    const context = { n: { userId: 'victim' } }
+    await guard(reqWith({ __token: { sub: 'sub-id' } }), context, {
+      requiresAuth: false,
+      allowedRoles: [],
+      userScoped: { ownerColumn: 'user_id', bindings: [{ nodeId: 'n', path: ['userId'] }] },
+    })
+    expect(context.n.userId).toBe('sub-id')
+  })
+
+  it('leaves the client value for a GUEST (no session) on a non-required userScoped write', async () => {
+    // Guest checkout: no token, requiresAuth false → the anonymous client id is
+    // kept (there is no server session to bind), and the request proceeds.
+    const context = { n: { userId: 'guest-anon-uuid' } }
+    const res = await guard(reqWith(), context, {
+      requiresAuth: false,
+      allowedRoles: [],
+      userScoped: { ownerColumn: 'user_id', bindings: [{ nodeId: 'n', path: ['userId'] }] },
+    })
+    expect(res).toBeNull()
+    expect(context.n.userId).toBe('guest-anon-uuid')
+  })
+
+  it('honours the internal server-to-server secret bypass', async () => {
+    const res = await guard(
+      reqWith({ headers: { 'x-internal-data-secret': 'server-secret' } }),
+      {},
+      { requiresAuth: true, allowedRoles: ['admin'] }
+    )
+    expect(res).toBeNull()
+  })
+
+  it('does not treat a wrong internal secret as a bypass', async () => {
+    const res = await guard(
+      reqWith({ headers: { 'x-internal-data-secret': 'wrong' } }),
+      {},
+      { requiresAuth: true, allowedRoles: [] }
+    )
+    expect(res).toEqual({ status: 401, message: 'Unauthenticated' })
+  })
+})
+
+describe('guardWorkflowRequest with next-auth absent / no secret', () => {
+  it('treats a missing NEXTAUTH_SECRET as no session (401 when required)', async () => {
+    const guard = bootGuard(undefined)
+    const res = await guard(
+      reqWith({ __token: { id: 'u1' } }),
+      {},
+      { requiresAuth: true, allowedRoles: [] }
+    )
+    expect(res).toEqual({ status: 401, message: 'Unauthenticated' })
+  })
+})
+
+// ---------------------------------------------------------------------------
+// Route wiring
+// ---------------------------------------------------------------------------
+
+const dataSegment = (): WorkflowSegment =>
+  ({
+    id: 'server-1',
+    env: 'server',
+    nodes: [
+      {
+        id: 'w1',
+        type: 'data-create-item',
+        label: 'Write',
+        config: { tableName: 'teleport_favourites' },
+        stepNumber: 1,
+      },
+    ],
+    edges: [],
+  } as unknown as WorkflowSegment)
+
+const protection: UIDLWorkflowProtection = {
+  requiresAuth: true,
+  allowedRoles: ['admin'],
+  derivedFrom: 'page',
+}
+
+describe('route generators wire the guard in', () => {
+  it('injects the guard into a protected non-streaming route BEFORE the node loop', () => {
+    const code = generateServerSegmentAPIRoute(dataSegment(), 'Admin CRUD', protection)
+    expect(code).toContain("require('../../../utils/workflows/workflow-auth')")
+    expect(code).toContain('const __WF_AUTH = {')
+    expect(code).toContain('__wfAuth.guardWorkflowRequest(req, context, __WF_AUTH)')
+    // The guard (and its early 401/403 return) must precede the node loop.
+    expect(code.indexOf('guardWorkflowRequest')).toBeLessThan(
+      code.indexOf('SEGMENT_CONFIG.nodes.slice()')
+    )
+    // The baked policy carries the runtime fields, not the build-only derivedFrom.
+    expect(code).toContain('"requiresAuth":true')
+    expect(code).toContain('"allowedRoles":["admin"]')
+    expect(code).not.toContain('derivedFrom')
+  })
+
+  it('injects the guard into a protected streaming route BEFORE the stream starts', () => {
+    const code = generateStreamingServerSegmentAPIRoute(dataSegment(), 'Streaming', {
+      requiresAuth: true,
+      allowedRoles: [],
+      derivedFrom: 'graph',
+    })
+    expect(code).toContain('__wfAuth.guardWorkflowRequest(req, context, __WF_AUTH)')
+    // The guard runs before the node loop. `ensureStream()` (which calls
+    // res.writeHead for the event-stream) is only invoked DURING node execution,
+    // so a 401/403 is sent as an HTTP status before the stream ever starts.
+    expect(code.indexOf('guardWorkflowRequest')).toBeLessThan(
+      code.indexOf('SEGMENT_CONFIG.nodes.slice()')
+    )
+    // The only ensureStream CALL (not its definition) is inside the node loop.
+    expect(code.indexOf('guardWorkflowRequest')).toBeLessThan(code.lastIndexOf('ensureStream()'))
+  })
+
+  it('emits NOTHING guard-related for an unprotected route (byte-compatible)', () => {
+    const code = generateServerSegmentAPIRoute(dataSegment(), 'Public')
+    expect(code).not.toContain('workflow-auth')
+    expect(code).not.toContain('__WF_AUTH')
+    expect(code).not.toContain('guardWorkflowRequest')
+  })
+
+  it('bakes the userScoped bindings into the policy', () => {
+    const code = generateServerSegmentAPIRoute(dataSegment(), 'Favourites', {
+      requiresAuth: true,
+      allowedRoles: [],
+      userScoped: { ownerColumn: 'user_id', bindings: [{ nodeId: 'resolve', path: ['userId'] }] },
+      derivedFrom: 'graph',
+    })
+    expect(code).toContain('"userScoped"')
+    expect(code).toContain('"nodeId":"resolve"')
+    expect(code).toContain('"path":["userId"]')
+  })
+})
+
+describe('buildWorkflowAuthInjection', () => {
+  it('returns empty pieces when there is no meaningful policy', () => {
+    expect(buildWorkflowAuthInjection(undefined)).toEqual({
+      requireLine: '',
+      policyConst: '',
+      guardCall: '',
+    })
+    expect(
+      buildWorkflowAuthInjection({ requiresAuth: false, allowedRoles: [], derivedFrom: 'default' })
+    ).toEqual({ requireLine: '', policyConst: '', guardCall: '' })
+  })
+
+  it('emits pieces for a userScoped-only (guest-capable) policy', () => {
+    const injection = buildWorkflowAuthInjection({
+      requiresAuth: false,
+      allowedRoles: [],
+      userScoped: { ownerColumn: 'user_id', bindings: [{ nodeId: 'n', path: ['userId'] }] },
+      derivedFrom: 'graph',
+    })
+    expect(injection.requireLine).toContain('workflow-auth')
+    expect(injection.policyConst).toContain('"userScoped"')
+    expect(injection.guardCall).toContain('guardWorkflowRequest')
+  })
+})

package/dist/cjs/api-route-generator.d.ts

@@ -1,8 +1,8 @@
-import { UIDLWorkflow, UIDLCustomWorkflowNode } from '@teleporthq/teleport-types';
+import { UIDLWorkflow, UIDLCustomWorkflowNode, UIDLWorkflowProtection } from '@teleporthq/teleport-types';
 import { WorkflowSegment } from './types';
-export declare const generateServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string) => string;
+export declare const generateServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string, protection?: UIDLWorkflowProtection) => string;
 export declare const hasStreamingAINode: (segment: WorkflowSegment) => boolean;
-export declare const generateStreamingServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string) => string;
+export declare const generateStreamingServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string, protection?: UIDLWorkflowProtection) => string;
 export declare const generateCronAPIRoute: (workflow: UIDLWorkflow, customNodes?: Record<string, UIDLCustomWorkflowNode>) => string;
 export declare const getAPIRouteFileName: (workflowId: string, segmentId: string, workflowName?: string) => string;
 export declare const getCronRouteFileName: (workflow: UIDLWorkflow) => string;

package/dist/cjs/api-route-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-route-generator.d.ts","sourceRoot":"","sources":["../../src/api-route-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAIZ,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAoBzC,eAAO,MAAM,6BAA6B,YAC/B,eAAe,iBACT,MAAM,KACpB,MAwUF,CAAA;AAED,eAAO,MAAM,kBAAkB,YAAa,eAAe,KAAG,OAE7D,CAAA;AAED,eAAO,MAAM,sCAAsC,YACxC,eAAe,iBACT,MAAM,KACpB,MAwYF,CAAA;AA0HD,eAAO,MAAM,oBAAoB,aACrB,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MAoFF,CAAA;AAED,eAAO,MAAM,mBAAmB,eAClB,MAAM,aACP,MAAM,iBACF,MAAM,KACpB,MAuBF,CAAA;AAED,eAAO,MAAM,oBAAoB,aAAc,YAAY,KAAG,MAa7D,CAAA;AAkQD,eAAO,MAAM,+BAA+B,aAChC,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MA6LF,CAAA;AAED,eAAO,MAAM,uBAAuB,aAAc,YAAY,KAAG,MAiBhE,CAAA;AAED,eAAO,MAAM,mBAAmB,aAAc,YAAY,KAAG,MAAM,EAqBlE,CAAA"}
+{"version":3,"file":"api-route-generator.d.ts","sourceRoot":"","sources":["../../src/api-route-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAIZ,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAqBzC,eAAO,MAAM,6BAA6B,YAC/B,eAAe,iBACT,MAAM,eACR,sBAAsB,KAClC,MAgXF,CAAA;AAED,eAAO,MAAM,kBAAkB,YAAa,eAAe,KAAG,OAE7D,CAAA;AAED,eAAO,MAAM,sCAAsC,YACxC,eAAe,iBACT,MAAM,eACR,sBAAsB,KAClC,MAsbF,CAAA;AA0HD,eAAO,MAAM,oBAAoB,aACrB,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MAuFF,CAAA;AAED,eAAO,MAAM,mBAAmB,eAClB,MAAM,aACP,MAAM,iBACF,MAAM,KACpB,MAuBF,CAAA;AAED,eAAO,MAAM,oBAAoB,aAAc,YAAY,KAAG,MAa7D,CAAA;AA4RD,eAAO,MAAM,+BAA+B,aAChC,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MAsMF,CAAA;AAED,eAAO,MAAM,uBAAuB,aAAc,YAAY,KAAG,MAiBhE,CAAA;AAED,eAAO,MAAM,mBAAmB,aAAc,YAAY,KAAG,MAAM,EAqBlE,CAAA"}

package/dist/cjs/api-route-generator.js

@@ -5,6 +5,7 @@ const nodes_1 = require("./nodes");
 const types_1 = require("./nodes/types");
 const graph_utils_1 = require("./graph-utils");
 const webhook_signature_verification_1 = require("./webhook-signature-verification");
+const workflow_auth_generator_1 = require("./workflow-auth-generator");
 // Workflow/segment names, cron schedules, and webhook paths are free-form
 // UIDL data — never guaranteed not to contain `*/`. Every generated route
 // file opens with a `/** ... */` JSDoc header interpolating these values
@@ -15,10 +16,11 @@ const webhook_signature_verification_1 = require("./webhook-signature-verificati
 // breaks parsing outright). Breaking up any `*/` sequence keeps the comment
 // intact; this is purely cosmetic (header text only, never evaluated).
 const sanitizeForBlockComment = (value) => value.replace(/\*\//g, '* /');
-const generateServerSegmentAPIRoute = (segment, workflowName) => {
+const generateServerSegmentAPIRoute = (segment, workflowName, protection) => {
     const usedNodeTypes = new Set(segment.nodes.map((n) => n.type));
     const nodeHandlersEntries = generateNodeHandlersForSegment(usedNodeTypes, true);
     const hasRateLimiter = usedNodeTypes.has('general-rate-limiter');
+    const auth = (0, workflow_auth_generator_1.buildWorkflowAuthInjection)(protection);
     const segmentConfig = JSON.stringify({
         nodes: segment.nodes.map((n) => ({
             id: n.id,
@@ -53,10 +55,10 @@ const generateServerSegmentAPIRoute = (segment, workflowName) => {
         : '';
     return `${header}
 const utils = require('../../../utils/workflows/server-runtime');
-const resolveConfig = utils.resolveConfig;
+${auth.requireLine}const resolveConfig = utils.resolveConfig;
 
 const SEGMENT_CONFIG = ${segmentConfig};
-
+${auth.policyConst}
 const nodeHandlers = {
 ${nodeHandlersEntries}
 };
@@ -66,18 +68,32 @@ module.exports = async function handler(req, res) {
     res.status(405).json({ error: 'Method not allowed' });
     return;
   }
+  // Kept outside the try so the catch below can still drain any fire-and-forget
+  // query this segment started before it failed.
+  var __wfContext = null;
   try {
     const body = typeof req.body === 'string' ? JSON.parse(req.body) : req.body;
     const incomingContext = body.context || {};
 
-    const context = Object.assign({}, incomingContext);${requestInjection}
+    const context = Object.assign({}, incomingContext);
+    __wfContext = context;
+    // Created eagerly so a custom node invoked from here shares the SAME
+    // fire-and-forget queue (it shallow-copies this context) and its queries
+    // are drained by the settle below rather than being lost when we reply.
+    context.__pendingNodePromises = [];${requestInjection}
     var __proto = req.headers['x-forwarded-proto'] || (req.headers.host && (req.headers.host.startsWith('localhost') || req.headers.host.startsWith('127.0.0.1')) ? 'http' : 'https');
-    context.__baseUrl = __proto + '://' + req.headers.host;
+    context.__baseUrl = __proto + '://' + req.headers.host;${auth.guardCall}
     const sortedNodes = SEGMENT_CONFIG.nodes.slice().sort(function(a, b) { return a.stepNumber - b.stepNumber; });
 
     for (let i = 0; i < sortedNodes.length; i++) {
       const node = sortedNodes[i];
       const resolved = resolveConfig(node.config, context);
+      // Every data node lives in a SERVER segment, so this guard — which turns an
+      // unresolved {{…}} into a validation error instead of letting the literal
+      // token reach SQL — was doing nothing at all: it ran only in the CLIENT
+      // executor. Run 02783f65 shipped 55 route files, none of which called it.
+      const __configError = utils.finalizeResolvedConfig(node.type, resolved);
+      if (__configError) { throw new Error(__configError); }
       resolved.__nodeId = node.id;
 
       // If-statement nodes must be evaluated using the runtime's evaluateCondition
@@ -178,6 +194,11 @@ module.exports = async function handler(req, res) {
             }
             var bHandler = nodeHandlers[bNode.type];
             if (!bHandler) continue;
+            if (utils.isFireAndForgetNode(bNode)) {
+              utils.registerPendingNodePromise(context, utils.startFireAndForgetNode(bNode, bHandler, bResolved, context));
+              context[bNode.id] = null;
+              continue;
+            }
             var bResult = await bHandler(bResolved, context);
             if (bResult && (bResult.success === false || (typeof bResult.error === 'string' && bResult.error))) {
               throw new Error(bResult.error || 'Loop body node execution failed');
@@ -263,6 +284,13 @@ module.exports = async function handler(req, res) {
               pRes.__nodeId = pNode.id;
               var pHandler = nodeHandlers[pNode.type];
               if (!pHandler) continue;
+              if (utils.isFireAndForgetNode(pNode)) {
+                // Registered on the ROUTE context (not the branch copy) so the
+                // response still waits for the query to land.
+                utils.registerPendingNodePromise(context, utils.startFireAndForgetNode(pNode, pHandler, pRes, branchCtx));
+                branchCtx[pNode.id] = null;
+                continue;
+              }
               var pResult = await pHandler(pRes, branchCtx);
               branchCtx[pNode.id] = pResult;
             }
@@ -310,6 +338,11 @@ module.exports = async function handler(req, res) {
         console.warn('No handler for node type: ' + node.type);
         continue;
       }
+      if (utils.isFireAndForgetNode(node)) {
+        utils.registerPendingNodePromise(context, utils.startFireAndForgetNode(node, handler, resolved, context));
+        context[node.id] = null;
+        continue;
+      }
       const result = await handler(resolved, context);
       if (result && result.__earlyResponse) {
         var earlyRes = result.__earlyResponse;
@@ -317,6 +350,7 @@ module.exports = async function handler(req, res) {
         for (var h = 0; h < hKeys.length; h++) {
           res.setHeader(hKeys[h], earlyRes.headers[hKeys[h]]);
         }
+        await utils.settlePendingNodePromises(context);
         res.status(earlyRes.status || 500).json(earlyRes.body || {});
         return;
       }
@@ -327,10 +361,17 @@ module.exports = async function handler(req, res) {
       if (result && result.__terminal) break;
     }
 
+    // Land every fire-and-forget query BEFORE replying: the platform may freeze
+    // this function the moment the response is sent, which would drop the write.
+    // The visitor does not pay for this — the client dispatched this segment
+    // without awaiting it (see seg.fireAndForget in the client runtime).
+    await utils.settlePendingNodePromises(context);
     delete context.__request;
+    delete context.__pendingNodePromises;
     res.status(200).json({ success: true, results: context });
   } catch (error) {
     console.error('Workflow segment error:', error);
+    if (__wfContext) { await utils.settlePendingNodePromises(__wfContext); }
     res.status(500).json({ success: false, error: error.message || 'Internal server error' });
   }
 };
@@ -341,10 +382,11 @@ const hasStreamingAINode = (segment) => {
     return segment.nodes.some((n) => { var _a; return graph_utils_1.AI_NODE_TYPES.has(n.type) && ((_a = n.config) === null || _a === void 0 ? void 0 : _a.streaming) === true; });
 };
 exports.hasStreamingAINode = hasStreamingAINode;
-const generateStreamingServerSegmentAPIRoute = (segment, workflowName) => {
+const generateStreamingServerSegmentAPIRoute = (segment, workflowName, protection) => {
     const usedNodeTypes = new Set(segment.nodes.map((n) => n.type));
     const nodeHandlersEntries = generateNodeHandlersForSegment(usedNodeTypes, true);
     const hasRateLimiter = usedNodeTypes.has('general-rate-limiter');
+    const auth = (0, workflow_auth_generator_1.buildWorkflowAuthInjection)(protection);
     const segmentConfig = JSON.stringify({
         nodes: segment.nodes.map((n) => ({
             id: n.id,
@@ -371,10 +413,10 @@ const generateStreamingServerSegmentAPIRoute = (segment, workflowName) => {
         : '';
     return `${header}
 const utils = require('../../../utils/workflows/server-runtime');
-const resolveConfig = utils.resolveConfig;
+${auth.requireLine}const resolveConfig = utils.resolveConfig;
 
 const SEGMENT_CONFIG = ${segmentConfig};
-
+${auth.policyConst}
 const nodeHandlers = {
 ${nodeHandlersEntries}
 };
@@ -420,11 +462,17 @@ module.exports = async function handler(req, res) {
     }
   }
 
+  // Kept outside the try so the catch below can still drain any fire-and-forget
+  // query this segment started before it failed.
+  var __wfContext = null;
   try {
     const body = typeof req.body === 'string' ? JSON.parse(req.body) : req.body;
-    const context = Object.assign({}, body.context || {});${requestInjection}
+    const context = Object.assign({}, body.context || {});
+    __wfContext = context;
+    // See the non-streaming segment route — shared queue for nested custom nodes.
+    context.__pendingNodePromises = [];${requestInjection}
     var __proto = req.headers['x-forwarded-proto'] || (req.headers.host && (req.headers.host.startsWith('localhost') || req.headers.host.startsWith('127.0.0.1')) ? 'http' : 'https');
-    context.__baseUrl = __proto + '://' + req.headers.host;
+    context.__baseUrl = __proto + '://' + req.headers.host;${auth.guardCall}
     const sortedNodes = SEGMENT_CONFIG.nodes.slice().sort(function(a, b) { return a.stepNumber - b.stepNumber; });
     const executed = {};
 
@@ -432,6 +480,10 @@ module.exports = async function handler(req, res) {
       const node = sortedNodes[i];
       if (executed[node.id]) continue;
       const resolved = resolveConfig(node.config, context);
+      // See the non-streaming segment above — without this the unresolved-token
+      // guard never runs on the server, which is where every data node executes.
+      const __configError = utils.finalizeResolvedConfig(node.type, resolved);
+      if (__configError) { throw new Error(__configError); }
       resolved.__nodeId = node.id;
 
       // If-statement nodes must be evaluated using the runtime's evaluateCondition
@@ -490,6 +542,11 @@ module.exports = async function handler(req, res) {
             }
             var ssbHandler = nodeHandlers[ssbNode.type];
             if (!ssbHandler) continue;
+            if (utils.isFireAndForgetNode(ssbNode)) {
+              utils.registerPendingNodePromise(context, utils.startFireAndForgetNode(ssbNode, ssbHandler, ssbRes, context));
+              context[ssbNode.id] = null;
+              continue;
+            }
             var ssbResult = await ssbHandler(ssbRes, context);
             context[ssbNode.id] = ssbResult;
           }
@@ -573,6 +630,13 @@ module.exports = async function handler(req, res) {
               sspRes.__nodeId = sspNode.id;
               var sspHandler = nodeHandlers[sspNode.type];
               if (!sspHandler) continue;
+              if (utils.isFireAndForgetNode(sspNode)) {
+                // Registered on the ROUTE context (not the branch copy) so the
+                // response still waits for the query to land.
+                utils.registerPendingNodePromise(context, utils.startFireAndForgetNode(sspNode, sspHandler, sspRes, ssPBranchCtx));
+                ssPBranchCtx[sspNode.id] = null;
+                continue;
+              }
               var sspResult = await sspHandler(sspRes, ssPBranchCtx);
               ssPBranchCtx[sspNode.id] = sspResult;
             }
@@ -646,6 +710,11 @@ module.exports = async function handler(req, res) {
             const snHandler = nodeHandlers[sn.type];
             if (!snHandler) continue;
             const snResolved = resolveConfig(sn.config, context);
+            if (utils.isFireAndForgetNode(sn)) {
+              utils.registerPendingNodePromise(context, utils.startFireAndForgetNode(sn, snHandler, snResolved, context));
+              context[sn.id] = null;
+              continue;
+            }
             const snResult = await snHandler(snResolved, context);
             context[sn.id] = snResult;
             res.write('data: ' + JSON.stringify({ type: 'node-result', nodeId: sn.id, result: snResult }) + '\\n\\n');
@@ -665,6 +734,12 @@ module.exports = async function handler(req, res) {
           const enHandler = nodeHandlers[en.type];
           if (!enHandler) continue;
           const enResolved = resolveConfig(en.config, context);
+          if (utils.isFireAndForgetNode(en)) {
+            utils.registerPendingNodePromise(context, utils.startFireAndForgetNode(en, enHandler, enResolved, context));
+            context[en.id] = null;
+            executed[en.id] = true;
+            continue;
+          }
           const enResult = await enHandler(enResolved, context);
           context[en.id] = enResult;
           res.write('data: ' + JSON.stringify({ type: 'node-result', nodeId: en.id, result: enResult }) + '\\n\\n');
@@ -674,8 +749,14 @@ module.exports = async function handler(req, res) {
           executed[onStreamNodes[si2].id] = true;
         }
       } else {
+        if (utils.isFireAndForgetNode(node)) {
+          utils.registerPendingNodePromise(context, utils.startFireAndForgetNode(node, nodeHandler, resolved, context));
+          context[node.id] = null;
+          continue;
+        }
         const result = await nodeHandler(resolved, context);
         if (result && result.__earlyResponse) {
+          await utils.settlePendingNodePromises(context);
           if (streamStarted) {
             res.write('data: ' + JSON.stringify({ type: 'error', error: (result.__earlyResponse.body && result.__earlyResponse.body.message) || 'Request rejected' }) + '\\n\\n');
             res.end();
@@ -700,7 +781,12 @@ module.exports = async function handler(req, res) {
       }
     }
 
+    // See the non-streaming segment route: land every fire-and-forget query
+    // before the response completes, or the platform may freeze this function
+    // with the write still in flight.
+    await utils.settlePendingNodePromises(context);
     delete context.__request;
+    delete context.__pendingNodePromises;
     if (streamStarted) {
       res.write('data: ' + JSON.stringify({ type: 'done', success: true, results: context }) + '\\n\\n');
       res.end();
@@ -709,6 +795,7 @@ module.exports = async function handler(req, res) {
     }
   } catch (error) {
     console.error('Streaming workflow segment error:', error);
+    if (__wfContext) { await utils.settlePendingNodePromises(__wfContext); }
     if (streamStarted) {
       try {
         res.write('data: ' + JSON.stringify({ type: 'error', error: error.message || 'Internal server error' }) + '\\n\\n');
@@ -900,6 +987,9 @@ module.exports = async function handler(req, res) {
   try {
     const triggerContext = { timestamp: Date.now(), schedule: '${workflow.trigger.config.schedule || ''}' };
     const context = {};
+    // Shared fire-and-forget queue (see the segment routes) — drained by the
+    // execution loop before this route responds.
+    context.__pendingNodePromises = [];
     context[WORKFLOW_CONFIG.triggerNodeId] = triggerContext;${requestInjection}
 
 ${executionLoop}
@@ -974,6 +1064,10 @@ const generateNodeExecutionLoop = (configVar, options) => {
     for (var i = 0; i < sortedNodes.length; i++) {
       var node = sortedNodes[i];
       var resolved = resolveConfig(node.config, context);
+      // See the other segment executors — the unresolved-token guard must run
+      // wherever data nodes execute, and they all execute on the server.
+      var __configError = utils.finalizeResolvedConfig(node.type, resolved);
+      if (__configError) { throw new Error(__configError); }
       resolved.__nodeId = node.id;
       if (resolved && Array.isArray(resolved.templateParams)) {
         if (typeof resolved.body === 'string') { resolved.body = utils.applyTemplateParams(resolved.body, resolved.templateParams); }
@@ -1059,6 +1153,11 @@ const generateNodeExecutionLoop = (configVar, options) => {
             }
             var bHandler = nodeHandlers[bNode.type];
             if (!bHandler) continue;
+            if (utils.isFireAndForgetNode(bNode)) {
+              utils.registerPendingNodePromise(context, utils.startFireAndForgetNode(bNode, bHandler, bResolved, context));
+              context[bNode.id] = null;
+              continue;
+            }
             var bResult = await bHandler(bResolved, context);
             if (bResult && (bResult.success === false || (typeof bResult.error === 'string' && bResult.error))) {
               throw new Error(bResult.error || 'Loop body node execution failed');
@@ -1140,6 +1239,13 @@ const generateNodeExecutionLoop = (configVar, options) => {
               wlpRes.__nodeId = wlpNode.id;
               var wlpHandler = nodeHandlers[wlpNode.type];
               if (!wlpHandler) continue;
+              if (utils.isFireAndForgetNode(wlpNode)) {
+                // Registered on the ROUTE context (not the branch copy) so the
+                // response still waits for the query to land.
+                utils.registerPendingNodePromise(context, utils.startFireAndForgetNode(wlpNode, wlpHandler, wlpRes, wlBranchCtx));
+                wlBranchCtx[wlpNode.id] = null;
+                continue;
+              }
               var wlpResult = await wlpHandler(wlpRes, wlBranchCtx);
               wlBranchCtx[wlpNode.id] = wlpResult;
             }
@@ -1187,6 +1293,11 @@ const generateNodeExecutionLoop = (configVar, options) => {
         console.warn('No handler for node type: ' + node.type);
         continue;
       }
+      if (utils.isFireAndForgetNode(node)) {
+        utils.registerPendingNodePromise(context, utils.startFireAndForgetNode(node, handler, resolved, context));
+        context[node.id] = null;
+        continue;
+      }
       var result = await handler(resolved, context);
       if (result && result.__earlyResponse) {
         var earlyRes = result.__earlyResponse;
@@ -1194,6 +1305,7 @@ const generateNodeExecutionLoop = (configVar, options) => {
         for (var h = 0; h < hKeys.length; h++) {
           res.setHeader(hKeys[h], earlyRes.headers[hKeys[h]]);
         }
+        await utils.settlePendingNodePromises(context);
         res.status(earlyRes.status || 500).json(earlyRes.body || {});
         return;
       }${customNodeBlock}
@@ -1202,7 +1314,11 @@ const generateNodeExecutionLoop = (configVar, options) => {
       }
       context[node.id] = result;
       if (result && result.__terminal) break;
-    }`;
+    }
+
+    // Land every fire-and-forget query before this route responds — a
+    // serverless function can be frozen the instant it replies.
+    await utils.settlePendingNodePromises(context);`;
 };
 const generateWebhookWorkflowAPIRoute = (workflow, customNodes) => {
     var _a;
@@ -1327,6 +1443,9 @@ ${generateSignatureVerificationBlock(webhookConfig)}
     };
 
     var context = {};
+    // Shared fire-and-forget queue (see the segment routes) — drained by the
+    // execution loop before this route responds.
+    context.__pendingNodePromises = [];
     context[WORKFLOW_CONFIG.triggerNodeId] = triggerContext;
     var __proto = req.headers['x-forwarded-proto'] || (req.headers.host && (req.headers.host.startsWith('localhost') || req.headers.host.startsWith('127.0.0.1')) ? 'http' : 'https');
     context.__baseUrl = __proto + '://' + req.headers.host;${requestInjection}
@@ -1351,10 +1470,16 @@ ${executionLoop}
           eResolved.__nodeId = eNode.id;
           var eHandler = nodeHandlers[eNode.type];
           if (eHandler) {
+            if (utils.isFireAndForgetNode(eNode)) {
+              utils.registerPendingNodePromise(errCtx, utils.startFireAndForgetNode(eNode, eHandler, eResolved, errCtx));
+              errCtx[eNode.id] = null;
+              continue;
+            }
             var eResult = await eHandler(eResolved, errCtx);
             errCtx[eNode.id] = eResult;
           }
         }
+        await utils.settlePendingNodePromises(errCtx);
       } catch (innerErr) {
         console.error('Webhook error handler failed:', innerErr);
       }