@teleporthq/teleport-plugin-next-workflows 0.43.46 → 0.43.48

package/__tests__/runtime-stringified-boolean-truthiness.test.ts

@@ -0,0 +1,76 @@
+import { generateSharedRuntimeUtilsCode } from '../src'
+
+// Producers that cannot type their output emit booleans as the strings
+// "true"/"false" — the evaluate-auth custom-js most notably (see
+// is-logged-in-gate.ts), plus any inspector text input. `is-true`/`is-false`
+// and coerceForComparison already read those as booleans, but `is-truthy` was
+// plain `!!left`, and the string "false" is truthy in JS: an is-truthy gate on
+// isLoggedIn admitted EVERY visitor, and an is-falsy check never fired.
+
+type SharedUtils = {
+  evaluateSingleComparison: (cfg: unknown, ctx: Record<string, unknown>) => boolean
+}
+
+function loadSharedRuntime(): SharedUtils {
+  const src = generateSharedRuntimeUtilsCode()
+  const wrapper: { exports: Record<string, unknown> } = { exports: {} }
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  new Function('module', 'exports', src)(wrapper, wrapper.exports)
+  return wrapper.exports as unknown as SharedUtils
+}
+
+describe('workflow runtime truthiness of stringified booleans', () => {
+  const utils = loadSharedRuntime()
+
+  const isTruthy = (leftValue: unknown) =>
+    utils.evaluateSingleComparison({ leftValue, operator: 'is-truthy' }, {})
+  const isFalsy = (leftValue: unknown) =>
+    utils.evaluateSingleComparison({ leftValue, operator: 'is-falsy' }, {})
+
+  it('treats the string "false" as false, matching is-false and coerceForComparison', () => {
+    expect(isTruthy('false')).toBe(false)
+    expect(isFalsy('false')).toBe(true)
+  })
+
+  it('keeps the string "true" true', () => {
+    expect(isTruthy('true')).toBe(true)
+    expect(isFalsy('true')).toBe(false)
+  })
+
+  it('agrees with is-true/is-false on the same value', () => {
+    for (const value of ['true', 'false', true, false]) {
+      expect(isTruthy(value)).toBe(
+        utils.evaluateSingleComparison({ leftValue: value, operator: 'is-true' }, {})
+      )
+      expect(isFalsy(value)).toBe(
+        utils.evaluateSingleComparison({ leftValue: value, operator: 'is-false' }, {})
+      )
+    }
+  })
+
+  it('leaves ordinary JS truthiness untouched', () => {
+    expect(isTruthy(true)).toBe(true)
+    expect(isTruthy(false)).toBe(false)
+    expect(isTruthy('anything')).toBe(true)
+    expect(isTruthy('')).toBe(false)
+    expect(isTruthy(0)).toBe(false)
+    expect(isTruthy(1)).toBe(true)
+    expect(isTruthy(null)).toBe(false)
+    expect(isTruthy(undefined)).toBe(false)
+    expect(isFalsy('')).toBe(true)
+    expect(isFalsy(0)).toBe(true)
+    expect(isFalsy('anything')).toBe(false)
+  })
+
+  it('normalizes the snake_case and camelCase spellings the same way', () => {
+    expect(utils.evaluateSingleComparison({ leftValue: 'false', operator: 'is_truthy' }, {})).toBe(
+      false
+    )
+    expect(utils.evaluateSingleComparison({ leftValue: 'false', operator: 'isTruthy' }, {})).toBe(
+      false
+    )
+    expect(utils.evaluateSingleComparison({ leftValue: 'false', operator: 'is_falsy' }, {})).toBe(
+      true
+    )
+  })
+})

package/__tests__/strip-event-handler-attrs.test.ts

@@ -0,0 +1,59 @@
+import { stripEventHandlerAttrs } from '../src/workflow-project-plugin'
+
+// UIDL `attrs` hold data, never functions — an `on*`-named attr (the alerts
+// fixture shipped `onClick: ""` on the Resolved pill) becomes a non-function
+// JSX event prop that React invokes on click: `func.apply is not a function`.
+// runBefore strips them so behavior stays on `events` / workflow triggers.
+
+const element = (name: string, attrs: Record<string, unknown>, children: unknown[] = []) => ({
+  type: 'element',
+  content: { elementType: 'button', name, attrs, children },
+})
+
+const projectUidl = (): any => ({
+  root: {
+    name: 'Root',
+    stateDefinitions: {},
+    node: element('Page', { id: { type: 'static', content: 'page' } }, [
+      element('ResolvedPill', {
+        id: { type: 'static', content: 'status-resolved-btn' },
+        'data-value': { type: 'static', content: 'Resolved' },
+        onClick: { type: 'static', content: '' },
+      }),
+    ]),
+  },
+  components: {
+    Card: {
+      name: 'Card',
+      node: element('Card', {
+        onMouseEnter: { type: 'static', content: 'highlight()' },
+        // lowercase second letter — NOT an event handler pattern, must survive
+        onboarding: { type: 'static', content: 'step-1' },
+      }),
+    },
+  },
+})
+
+describe('stripEventHandlerAttrs', () => {
+  it('removes on[A-Z]* attrs from pages and components, keeps everything else', () => {
+    const uidl = projectUidl()
+    stripEventHandlerAttrs(uidl)
+
+    const pill = uidl.root.node.content.children[0].content
+    expect(pill.attrs.onClick).toBeUndefined()
+    expect(pill.attrs.id.content).toBe('status-resolved-btn')
+    expect(pill.attrs['data-value'].content).toBe('Resolved')
+
+    const card = uidl.components.Card.node.content
+    expect(card.attrs.onMouseEnter).toBeUndefined()
+    expect(card.attrs.onboarding.content).toBe('step-1')
+  })
+
+  it('tolerates projects without components or attrs', () => {
+    const uidl: any = {
+      root: { name: 'Root', node: element('Bare', undefined as any) },
+    }
+    delete uidl.root.node.content.attrs
+    expect(() => stripEventHandlerAttrs(uidl)).not.toThrow()
+  })
+})

package/__tests__/workflow-auth-guard.test.ts

@@ -0,0 +1,277 @@
+import {
+  generateWorkflowAuthHelperFile,
+  buildWorkflowAuthInjection,
+} from '../src/workflow-auth-generator'
+import {
+  generateServerSegmentAPIRoute,
+  generateStreamingServerSegmentAPIRoute,
+} from '../src/api-route-generator'
+import { UIDLWorkflowProtection } from '@teleporthq/teleport-types'
+import { WorkflowSegment } from '../src/types'
+
+// The generated workflow-auth.js guard is the single stateless enforcement
+// point. Booting it with a mocked next-auth/jwt proves the runtime behaviour;
+// the route generators prove the guard is wired in BEFORE any node runs.
+
+type Guard = (
+  req: any,
+  context: any,
+  policy: any
+) => Promise<{ status: number; message: string } | null>
+
+/** Boots the emitted guard file with getToken stubbed to read `req.__token`. */
+function bootGuard(secret: string | undefined): Guard {
+  const code = generateWorkflowAuthHelperFile()
+  const moduleObj: { exports: any } = { exports: {} }
+  const fakeRequire = (name: string): any => {
+    if (name === 'next-auth/jwt') {
+      return { getToken: async ({ req }: any) => (req && req.__token) || null }
+    }
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    return require(name)
+  }
+  // tslint:disable-next-line:function-constructor
+  new Function('require', 'module', 'exports', 'process', code)(
+    fakeRequire,
+    moduleObj,
+    moduleObj.exports,
+    { env: { NEXTAUTH_SECRET: secret } }
+  )
+  return moduleObj.exports.guardWorkflowRequest as Guard
+}
+
+const reqWith = (extra: Record<string, unknown> = {}): any => ({ headers: {}, ...extra })
+
+describe('guardWorkflowRequest (runtime enforcement)', () => {
+  const guard = bootGuard('server-secret')
+
+  it('is a no-op when there is no policy', async () => {
+    const context = { n: { userId: 'victim' } }
+    expect(await guard(reqWith(), context, null)).toBeNull()
+    expect(context.n.userId).toBe('victim')
+  })
+
+  it('rejects with 401 when auth is required and there is no session', async () => {
+    const res = await guard(reqWith(), {}, { requiresAuth: true, allowedRoles: [] })
+    expect(res).toEqual({ status: 401, message: 'Unauthenticated' })
+  })
+
+  it('allows any authenticated user when allowedRoles is empty', async () => {
+    const res = await guard(
+      reqWith({ __token: { id: 'u1', role: 'user' } }),
+      {},
+      {
+        requiresAuth: true,
+        allowedRoles: [],
+      }
+    )
+    expect(res).toBeNull()
+  })
+
+  it('rejects with 403 when the session role is not allowed', async () => {
+    const res = await guard(
+      reqWith({ __token: { id: 'u1', role: 'user' } }),
+      {},
+      {
+        requiresAuth: true,
+        allowedRoles: ['admin'],
+      }
+    )
+    expect(res).toEqual({ status: 403, message: 'Forbidden' })
+  })
+
+  it('allows a matching role (incl. roleName / roles[] spellings)', async () => {
+    for (const token of [
+      { id: 'u1', role: 'admin' },
+      { id: 'u1', roleName: 'admin' },
+      { id: 'u1', roles: ['admin'] },
+    ]) {
+      expect(
+        await guard(
+          reqWith({ __token: token }),
+          {},
+          { requiresAuth: true, allowedRoles: ['admin'] }
+        )
+      ).toBeNull()
+    }
+  })
+
+  it('OVERWRITES a forged user id with the session id (the IDOR fix)', async () => {
+    const context = { resolver: { userId: 'victim-id', email: 'x' } }
+    const res = await guard(reqWith({ __token: { id: 'attacker-real-id' } }), context, {
+      requiresAuth: true,
+      allowedRoles: [],
+      userScoped: { ownerColumn: 'user_id', bindings: [{ nodeId: 'resolver', path: ['userId'] }] },
+    })
+    expect(res).toBeNull()
+    expect(context.resolver.userId).toBe('attacker-real-id') // forced to the caller
+    expect(context.resolver.email).toBe('x') // other fields untouched
+  })
+
+  it('binds a nested path and creates missing context nodes', async () => {
+    const context: any = {}
+    await guard(reqWith({ __token: { id: 'sess-1' } }), context, {
+      requiresAuth: false,
+      allowedRoles: [],
+      userScoped: { ownerColumn: 'user_id', bindings: [{ nodeId: 'n', path: ['user', 'id'] }] },
+    })
+    expect(context.n.user.id).toBe('sess-1')
+  })
+
+  it('falls back to token.sub when token.id is absent', async () => {
+    const context = { n: { userId: 'victim' } }
+    await guard(reqWith({ __token: { sub: 'sub-id' } }), context, {
+      requiresAuth: false,
+      allowedRoles: [],
+      userScoped: { ownerColumn: 'user_id', bindings: [{ nodeId: 'n', path: ['userId'] }] },
+    })
+    expect(context.n.userId).toBe('sub-id')
+  })
+
+  it('leaves the client value for a GUEST (no session) on a non-required userScoped write', async () => {
+    // Guest checkout: no token, requiresAuth false → the anonymous client id is
+    // kept (there is no server session to bind), and the request proceeds.
+    const context = { n: { userId: 'guest-anon-uuid' } }
+    const res = await guard(reqWith(), context, {
+      requiresAuth: false,
+      allowedRoles: [],
+      userScoped: { ownerColumn: 'user_id', bindings: [{ nodeId: 'n', path: ['userId'] }] },
+    })
+    expect(res).toBeNull()
+    expect(context.n.userId).toBe('guest-anon-uuid')
+  })
+
+  it('honours the internal server-to-server secret bypass', async () => {
+    const res = await guard(
+      reqWith({ headers: { 'x-internal-data-secret': 'server-secret' } }),
+      {},
+      { requiresAuth: true, allowedRoles: ['admin'] }
+    )
+    expect(res).toBeNull()
+  })
+
+  it('does not treat a wrong internal secret as a bypass', async () => {
+    const res = await guard(
+      reqWith({ headers: { 'x-internal-data-secret': 'wrong' } }),
+      {},
+      { requiresAuth: true, allowedRoles: [] }
+    )
+    expect(res).toEqual({ status: 401, message: 'Unauthenticated' })
+  })
+})
+
+describe('guardWorkflowRequest with next-auth absent / no secret', () => {
+  it('treats a missing NEXTAUTH_SECRET as no session (401 when required)', async () => {
+    const guard = bootGuard(undefined)
+    const res = await guard(
+      reqWith({ __token: { id: 'u1' } }),
+      {},
+      { requiresAuth: true, allowedRoles: [] }
+    )
+    expect(res).toEqual({ status: 401, message: 'Unauthenticated' })
+  })
+})
+
+// ---------------------------------------------------------------------------
+// Route wiring
+// ---------------------------------------------------------------------------
+
+const dataSegment = (): WorkflowSegment =>
+  ({
+    id: 'server-1',
+    env: 'server',
+    nodes: [
+      {
+        id: 'w1',
+        type: 'data-create-item',
+        label: 'Write',
+        config: { tableName: 'teleport_favourites' },
+        stepNumber: 1,
+      },
+    ],
+    edges: [],
+  } as unknown as WorkflowSegment)
+
+const protection: UIDLWorkflowProtection = {
+  requiresAuth: true,
+  allowedRoles: ['admin'],
+  derivedFrom: 'page',
+}
+
+describe('route generators wire the guard in', () => {
+  it('injects the guard into a protected non-streaming route BEFORE the node loop', () => {
+    const code = generateServerSegmentAPIRoute(dataSegment(), 'Admin CRUD', protection)
+    expect(code).toContain("require('../../../utils/workflows/workflow-auth')")
+    expect(code).toContain('const __WF_AUTH = {')
+    expect(code).toContain('__wfAuth.guardWorkflowRequest(req, context, __WF_AUTH)')
+    // The guard (and its early 401/403 return) must precede the node loop.
+    expect(code.indexOf('guardWorkflowRequest')).toBeLessThan(
+      code.indexOf('SEGMENT_CONFIG.nodes.slice()')
+    )
+    // The baked policy carries the runtime fields, not the build-only derivedFrom.
+    expect(code).toContain('"requiresAuth":true')
+    expect(code).toContain('"allowedRoles":["admin"]')
+    expect(code).not.toContain('derivedFrom')
+  })
+
+  it('injects the guard into a protected streaming route BEFORE the stream starts', () => {
+    const code = generateStreamingServerSegmentAPIRoute(dataSegment(), 'Streaming', {
+      requiresAuth: true,
+      allowedRoles: [],
+      derivedFrom: 'graph',
+    })
+    expect(code).toContain('__wfAuth.guardWorkflowRequest(req, context, __WF_AUTH)')
+    // The guard runs before the node loop. `ensureStream()` (which calls
+    // res.writeHead for the event-stream) is only invoked DURING node execution,
+    // so a 401/403 is sent as an HTTP status before the stream ever starts.
+    expect(code.indexOf('guardWorkflowRequest')).toBeLessThan(
+      code.indexOf('SEGMENT_CONFIG.nodes.slice()')
+    )
+    // The only ensureStream CALL (not its definition) is inside the node loop.
+    expect(code.indexOf('guardWorkflowRequest')).toBeLessThan(code.lastIndexOf('ensureStream()'))
+  })
+
+  it('emits NOTHING guard-related for an unprotected route (byte-compatible)', () => {
+    const code = generateServerSegmentAPIRoute(dataSegment(), 'Public')
+    expect(code).not.toContain('workflow-auth')
+    expect(code).not.toContain('__WF_AUTH')
+    expect(code).not.toContain('guardWorkflowRequest')
+  })
+
+  it('bakes the userScoped bindings into the policy', () => {
+    const code = generateServerSegmentAPIRoute(dataSegment(), 'Favourites', {
+      requiresAuth: true,
+      allowedRoles: [],
+      userScoped: { ownerColumn: 'user_id', bindings: [{ nodeId: 'resolve', path: ['userId'] }] },
+      derivedFrom: 'graph',
+    })
+    expect(code).toContain('"userScoped"')
+    expect(code).toContain('"nodeId":"resolve"')
+    expect(code).toContain('"path":["userId"]')
+  })
+})
+
+describe('buildWorkflowAuthInjection', () => {
+  it('returns empty pieces when there is no meaningful policy', () => {
+    expect(buildWorkflowAuthInjection(undefined)).toEqual({
+      requireLine: '',
+      policyConst: '',
+      guardCall: '',
+    })
+    expect(
+      buildWorkflowAuthInjection({ requiresAuth: false, allowedRoles: [], derivedFrom: 'default' })
+    ).toEqual({ requireLine: '', policyConst: '', guardCall: '' })
+  })
+
+  it('emits pieces for a userScoped-only (guest-capable) policy', () => {
+    const injection = buildWorkflowAuthInjection({
+      requiresAuth: false,
+      allowedRoles: [],
+      userScoped: { ownerColumn: 'user_id', bindings: [{ nodeId: 'n', path: ['userId'] }] },
+      derivedFrom: 'graph',
+    })
+    expect(injection.requireLine).toContain('workflow-auth')
+    expect(injection.policyConst).toContain('"userScoped"')
+    expect(injection.guardCall).toContain('guardWorkflowRequest')
+  })
+})

package/dist/cjs/api-route-generator.d.ts

@@ -1,8 +1,8 @@
-import { UIDLWorkflow, UIDLCustomWorkflowNode } from '@teleporthq/teleport-types';
+import { UIDLWorkflow, UIDLCustomWorkflowNode, UIDLWorkflowProtection } from '@teleporthq/teleport-types';
 import { WorkflowSegment } from './types';
-export declare const generateServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string) => string;
+export declare const generateServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string, protection?: UIDLWorkflowProtection) => string;
 export declare const hasStreamingAINode: (segment: WorkflowSegment) => boolean;
-export declare const generateStreamingServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string) => string;
+export declare const generateStreamingServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string, protection?: UIDLWorkflowProtection) => string;
 export declare const generateCronAPIRoute: (workflow: UIDLWorkflow, customNodes?: Record<string, UIDLCustomWorkflowNode>) => string;
 export declare const getAPIRouteFileName: (workflowId: string, segmentId: string, workflowName?: string) => string;
 export declare const getCronRouteFileName: (workflow: UIDLWorkflow) => string;

package/dist/cjs/api-route-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-route-generator.d.ts","sourceRoot":"","sources":["../../src/api-route-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAIZ,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAoBzC,eAAO,MAAM,6BAA6B,YAC/B,eAAe,iBACT,MAAM,KACpB,MAwUF,CAAA;AAED,eAAO,MAAM,kBAAkB,YAAa,eAAe,KAAG,OAE7D,CAAA;AAED,eAAO,MAAM,sCAAsC,YACxC,eAAe,iBACT,MAAM,KACpB,MAwYF,CAAA;AA0HD,eAAO,MAAM,oBAAoB,aACrB,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MAoFF,CAAA;AAED,eAAO,MAAM,mBAAmB,eAClB,MAAM,aACP,MAAM,iBACF,MAAM,KACpB,MAuBF,CAAA;AAED,eAAO,MAAM,oBAAoB,aAAc,YAAY,KAAG,MAa7D,CAAA;AAkQD,eAAO,MAAM,+BAA+B,aAChC,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MA6LF,CAAA;AAED,eAAO,MAAM,uBAAuB,aAAc,YAAY,KAAG,MAiBhE,CAAA;AAED,eAAO,MAAM,mBAAmB,aAAc,YAAY,KAAG,MAAM,EAqBlE,CAAA"}
+{"version":3,"file":"api-route-generator.d.ts","sourceRoot":"","sources":["../../src/api-route-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAIZ,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAqBzC,eAAO,MAAM,6BAA6B,YAC/B,eAAe,iBACT,MAAM,eACR,sBAAsB,KAClC,MAgXF,CAAA;AAED,eAAO,MAAM,kBAAkB,YAAa,eAAe,KAAG,OAE7D,CAAA;AAED,eAAO,MAAM,sCAAsC,YACxC,eAAe,iBACT,MAAM,eACR,sBAAsB,KAClC,MAsbF,CAAA;AA0HD,eAAO,MAAM,oBAAoB,aACrB,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MAuFF,CAAA;AAED,eAAO,MAAM,mBAAmB,eAClB,MAAM,aACP,MAAM,iBACF,MAAM,KACpB,MAuBF,CAAA;AAED,eAAO,MAAM,oBAAoB,aAAc,YAAY,KAAG,MAa7D,CAAA;AA4RD,eAAO,MAAM,+BAA+B,aAChC,YAAY,gBACR,OAAO,MAAM,EAAE,sBAAsB,CAAC,KACnD,MAsMF,CAAA;AAED,eAAO,MAAM,uBAAuB,aAAc,YAAY,KAAG,MAiBhE,CAAA;AAED,eAAO,MAAM,mBAAmB,aAAc,YAAY,KAAG,MAAM,EAqBlE,CAAA"}