@teleporthq/teleport-plugin-next-workflows 0.43.54 → 0.43.57

package/__tests__/_helpers/abort-controller-stub.ts

@@ -0,0 +1,64 @@
+// jest 26's node sandbox exposes none of the browser globals the upload
+// handlers use — no `fetch`, no `FormData`, no `Blob`, no `atob` and no
+// `AbortController`. The first four have always been stubbed by the tests that
+// need them; this is the fifth, added when `file-storage-upload` grew a timeout.
+//
+// It is a TEST-ONLY absence: `AbortController` has been available in every
+// browser since 2017 and in Node since 14, which is why the generated handler
+// uses it unguarded.
+
+type AbortListener = () => void
+
+class AbortSignalStub {
+  public aborted = false
+  public reason: unknown = undefined
+  private listeners: AbortListener[] = []
+
+  public addEventListener(type: string, listener: AbortListener): void {
+    if (type === 'abort') {
+      this.listeners.push(listener)
+    }
+  }
+
+  public removeEventListener(type: string, listener: AbortListener): void {
+    if (type === 'abort') {
+      this.listeners = this.listeners.filter((entry) => entry !== listener)
+    }
+  }
+
+  /** @internal — driven by the controller, never by the code under test. */
+  public dispatchAbort(reason: unknown): void {
+    if (this.aborted) {
+      return
+    }
+    this.aborted = true
+    this.reason = reason
+    for (const listener of this.listeners.slice()) {
+      listener()
+    }
+  }
+}
+
+export class AbortControllerStub {
+  public readonly signal = new AbortSignalStub()
+
+  public abort(reason?: unknown): void {
+    this.signal.dispatchAbort(reason)
+  }
+}
+
+/** The browser globals the file-storage upload handler expects to exist. */
+export const installUploadGlobals = (overrides: Record<string, unknown> = {}): void => {
+  const globals = globalThis as Record<string, unknown>
+  globals.AbortController = AbortControllerStub
+  for (const [name, value] of Object.entries(overrides)) {
+    globals[name] = value
+  }
+}
+
+export const removeUploadGlobals = (names: string[]): void => {
+  const globals = globalThis as Record<string, unknown>
+  for (const name of ['AbortController', ...names]) {
+    delete globals[name]
+  }
+}

package/__tests__/account-refresh-session.test.ts

@@ -0,0 +1,110 @@
+import { loadHandler, HandlerFn } from './_helpers/load-handler'
+
+// After a profile save the NextAuth JWT still carries the PREVIOUS name/image:
+// the generated jwt callback only re-reads the users row once per refresh
+// interval unless next-auth passes `trigger: 'update'`, which only
+// `useSession().update()` does. `account-refresh-session` is the node that
+// calls it and then republishes the result to the two consumers that would
+// otherwise keep the stale value: the `teleport_auth_user` localStorage mirror
+// `account-get-current` falls back to, and GlobalContext's `currentUser` (which
+// the account-menu avatar binds to) via `teleport:auth-user-changed`.
+
+interface RefreshResult {
+  id?: string
+  image?: string
+  user: Record<string, unknown> | null
+  refreshed: boolean
+  error?: unknown
+}
+
+describe('account-refresh-session', () => {
+  const handler: HandlerFn = loadHandler('account-refresh-session')
+  let events: Array<{ type: string; detail: unknown }>
+  let stored: Record<string, string>
+
+  const installWindow = (refreshSession: unknown): void => {
+    events = []
+    stored = { teleport_auth_user: JSON.stringify({ id: 'u-1', image: 'https://cdn/old.png' }) }
+    ;(globalThis as any).window = {
+      __teleportNextAuth: refreshSession === undefined ? {} : { refreshSession },
+      localStorage: {
+        getItem: (k: string) => (k in stored ? stored[k] : null),
+        setItem: (k: string, v: string) => {
+          stored[k] = v
+        },
+        removeItem: (k: string) => {
+          delete stored[k]
+        },
+      },
+      dispatchEvent: (event: { type: string; detail: unknown }) => events.push(event),
+    }
+    ;(globalThis as any).CustomEvent = class {
+      public type: string
+      public detail: unknown
+      constructor(type: string, init?: { detail?: unknown }) {
+        this.type = type
+        this.detail = init ? init.detail : undefined
+      }
+    }
+  }
+
+  afterEach(() => {
+    delete (globalThis as any).window
+    delete (globalThis as any).CustomEvent
+  })
+
+  it('publishes the refreshed user to GlobalContext and the localStorage mirror', async () => {
+    const fresh = { id: 'u-1', name: 'Ada Lovelace', image: 'https://cdn/new.png', role: 'user' }
+    installWindow(async () => ({ user: fresh, expires: '2099-01-01' }))
+
+    const result = (await handler({}, {})) as RefreshResult
+
+    expect(result.refreshed).toBe(true)
+    expect(result.user).toEqual(fresh)
+    // Flat fields too — same output contract as account-get-current.
+    expect(result.image).toBe('https://cdn/new.png')
+    expect(result.id).toBe('u-1')
+    expect(JSON.parse(stored.teleport_auth_user).image).toBe('https://cdn/new.png')
+    expect(events).toHaveLength(1)
+    expect(events[0].type).toBe('teleport:auth-user-changed')
+    expect(events[0].detail).toEqual({ user: fresh })
+  })
+
+  it('never publishes a null user — that would sign the visitor out of the UI', async () => {
+    // `update()` resolves to undefined while the provider is still loading.
+    installWindow(async (): Promise<undefined> => undefined)
+
+    const result = (await handler({}, {})) as RefreshResult
+
+    expect(result.refreshed).toBe(false)
+    expect(events).toHaveLength(0)
+    expect(JSON.parse(stored.teleport_auth_user).image).toBe('https://cdn/old.png')
+  })
+
+  it('degrades quietly when the session bridge is unavailable', async () => {
+    installWindow(undefined)
+
+    const result = (await handler({}, {})) as RefreshResult
+
+    expect(result.refreshed).toBe(false)
+    expect(events).toHaveLength(0)
+  })
+
+  it('never returns a string error key (that would abort the workflow)', async () => {
+    installWindow(async () => {
+      throw new Error('network down')
+    })
+
+    const result = (await handler({}, {})) as RefreshResult
+
+    expect(result.refreshed).toBe(false)
+    expect(typeof result.error).not.toBe('string')
+    expect(events).toHaveLength(0)
+  })
+
+  it('is inert on the server', async () => {
+    const result = (await handler({}, {})) as RefreshResult
+    expect(result.refreshed).toBe(false)
+    expect(result.user).toBeNull()
+  })
+})

package/__tests__/cache-nodes.test.ts

@@ -0,0 +1,137 @@
+import { nodeRegistry } from '../src'
+
+const CACHE_NODES = ['cache-get', 'cache-set', 'cache-invalidate']
+
+const emittedFor = (nodeType: string): string => {
+  const generator = nodeRegistry[nodeType]
+  let source = generator.generateHandler()
+  if (typeof generator.generateServerHandler === 'function') {
+    source += '\n' + generator.generateServerHandler()
+  }
+  return source
+}
+
+/**
+ * Mirrors `isFatalNodeResult` in the emitted runtime: a node result carrying
+ * `success: false`, a string `error`, or `error: true` HALTS the workflow.
+ */
+const runHandler = async (nodeType: string, config: Record<string, unknown>, context = {}) => {
+  const source = nodeRegistry[nodeType].generateHandler()
+  const entry = nodeType.replace(/-/g, '_')
+  // tslint:disable-next-line:function-constructor
+  const factory = new Function('globalThis', 'window', 'fetch', `${source}; return ${entry};`)
+  const fn = factory({}, undefined, () => Promise.reject(new Error('offline')))
+  return fn(config, context)
+}
+
+describe('cache workflow nodes', () => {
+  it('registers all three', () => {
+    for (const nodeType of CACHE_NODES) {
+      expect(nodeRegistry[nodeType]).toBeDefined()
+      expect(nodeRegistry[nodeType].nodeType).toBe(nodeType)
+    }
+  })
+
+  /**
+   * `cache-invalidate` bumps the SHARED version row, which needs the server-only
+   * secret — and being server-side puts it in the same segment as the write it
+   * follows, so a CRUD workflow pays no extra round trip for it.
+   */
+  it('runs the purge on the server and the read/write anywhere', () => {
+    expect(nodeRegistry['cache-invalidate'].executionEnv).toBe('server')
+    expect(nodeRegistry['cache-get'].executionEnv).toBe('universal')
+    expect(nodeRegistry['cache-set'].executionEnv).toBe('universal')
+  })
+
+  /**
+   * Handlers ship as runtime source and are re-bundled by webpack, which
+   * rewrites `require(`. The browser must also never be handed the Postgres
+   * driver by way of the server cache runtime.
+   */
+  it('never requires a module', () => {
+    for (const nodeType of CACHE_NODES) {
+      expect(emittedFor(nodeType)).not.toMatch(/(?<![\w.])require\s*\(/)
+    }
+  })
+
+  /**
+   * THE regression that would abort an admin's save. The runtime treats
+   * `success: false` / a string `error` as FATAL, so a cache that could not be
+   * cleared would halt the workflow AFTER the row was already written — no
+   * success toast, no navigation, and an error for an action that worked.
+   */
+  describe('never reports failure in a shape the runtime treats as fatal', () => {
+    it('cache-invalidate without a configured scope', async () => {
+      const result = await runHandler('cache-invalidate', {})
+      expect(result.cleared).toBe(false)
+      expect(result.success).toBeUndefined()
+      expect(typeof result.error).not.toBe('string')
+      expect(result.error).not.toBe(true)
+    })
+
+    it('cache-invalidate with no secret configured', async () => {
+      const result = await runHandler('cache-invalidate', { scope: 'ds:products' })
+      expect(result.cleared).toBe(false)
+      expect(result.warning).toContain('TQ_CACHE_SECRET')
+      expect(result.success).toBeUndefined()
+      expect(typeof result.error).not.toBe('string')
+    })
+
+    it('cache-set with no scope', async () => {
+      const result = await runHandler('cache-set', { key: 'k', value: 1 })
+      expect(result.stored).toBe(false)
+      expect(result.success).toBeUndefined()
+      expect(typeof result.error).not.toBe('string')
+    })
+
+    it('cache-get reports a miss without any failure marker', async () => {
+      const result = await runHandler('cache-get', { scope: 'ds:products', key: 'missing' })
+      expect(result.hit).toBe(false)
+      expect(result.success).toBeUndefined()
+      expect(typeof result.error).not.toBe('string')
+    })
+  })
+
+  it('round-trips a value through the workflow cache', async () => {
+    const shared = {}
+    const set = new Function(
+      'globalThis',
+      'window',
+      `${nodeRegistry['cache-set'].generateHandler()}; return cache_set;`
+    )(shared, undefined)
+    const get = new Function(
+      'globalThis',
+      'window',
+      `${nodeRegistry['cache-get'].generateHandler()}; return cache_get;`
+    )(shared, undefined)
+
+    await set({ scope: 'rates', key: 'EUR', value: { rate: 1.1 }, ttlSeconds: 60 }, {})
+    const hit = await get({ scope: 'rates', key: 'EUR' }, {})
+
+    expect(hit.hit).toBe(true)
+    expect(hit.value).toEqual({ rate: 1.1 })
+  })
+
+  it('reports a miss once the entry has expired', async () => {
+    const shared = {}
+    const set = new Function(
+      'globalThis',
+      'window',
+      `${nodeRegistry['cache-set'].generateHandler()}; return cache_set;`
+    )(shared, undefined)
+    const get = new Function(
+      'globalThis',
+      'window',
+      `${nodeRegistry['cache-get'].generateHandler()}; return cache_get;`
+    )(shared, undefined)
+
+    await set({ scope: 'rates', key: 'EUR', value: 1, ttlSeconds: 60 }, {})
+
+    const now = Date.now()
+    const spy = jest.spyOn(Date, 'now').mockReturnValue(now + 61_000)
+    const miss = await get({ scope: 'rates', key: 'EUR' }, {})
+    spy.mockRestore()
+
+    expect(miss.hit).toBe(false)
+  })
+})

package/__tests__/cart-clear-db-mirror.test.ts

@@ -0,0 +1,45 @@
+import { cartClear } from '../src/nodes/cart/cart-clear'
+
+// Regression: after a cash-on-delivery order the buyer's cart came back.
+//
+// `cart-clear` only emptied `localStorage.workflow_cart`. The database copy
+// (`teleport_cart` / `teleport_cart_items`) stayed active, and
+// `EcommerceProvider` re-hydrates from `/api/cart/load` on any mount where the
+// local cart is empty — so the very next full page load (the post-order
+// redirect, or a plain refresh) restored the cart the shopper had just ordered
+// and wrote it straight back into localStorage.
+
+describe('cart-clear mirrors the empty cart into the database cart', () => {
+  const handlerCode = cartClear.generateHandler()
+
+  it('still clears localStorage first — the DB mirror is best-effort on top', () => {
+    expect(handlerCode).toContain("localStorage.setItem('workflow_cart'")
+    expect(handlerCode).toContain("dispatchEvent(new CustomEvent('teleport:cart-changed'))")
+  })
+
+  it('pushes an empty cart through /api/cart/sync with the guest session id', () => {
+    expect(handlerCode).toContain("'/api/cart/sync'")
+    expect(handlerCode).toContain("localStorage.getItem('workflow_cart_session_id')")
+    expect(handlerCode).toMatch(/items:\s*\[\s*\]/)
+  })
+
+  it('never awaits the sync and never lets it fail the node', () => {
+    // The route only exists for Postgres datasources, so a 404 here is a
+    // normal outcome — it must not surface to the shopper or abort the
+    // workflow (which would strand the order mid-chain).
+    const syncSection = handlerCode.slice(handlerCode.indexOf("'/api/cart/sync'"))
+    expect(syncSection).not.toMatch(/await\s+fetch/)
+    expect(syncSection).toContain('.catch(')
+  })
+
+  it('does NOT mark the cart as ordered — this handler also backs "Clear cart"', () => {
+    // `mark-ordered` is the checkout-only signal and stays owned by
+    // data-create-item. Flipping the status here would mislabel a cart the
+    // shopper simply emptied by hand.
+    expect(handlerCode).not.toContain('mark-ordered')
+  })
+
+  it('stamps the clear so the provider can tell it apart from a first visit', () => {
+    expect(handlerCode).toContain("localStorage.setItem('workflow_cart_cleared_at'")
+  })
+})

package/__tests__/cart-get-total-delivery-flags.test.ts

@@ -0,0 +1,86 @@
+/* tslint:disable:no-eval */
+import { cartGetTotal } from '../src/nodes/cart/cart-get-total'
+
+/**
+ * `cart-get-total` is the ONLY channel by which the place-order workflow learns
+ * the merchant's CURRENT delivery settings: the workflow's assemble script is
+ * baked once, when the checkout page is built, while `EcommerceProvider`
+ * re-writes `workflow_cart_settings` on every page load.
+ *
+ * Two of those settings decide whether a delivery fee may be charged at all —
+ * whether the store delivers, and whether it offers store pickup — so they have
+ * to survive the trip. And they have to survive it as `undefined` when the
+ * storefront predates them: reading a missing flag as `false` would silently
+ * stop charging delivery on a store that does deliver.
+ */
+
+function evalHandler(code: string): any {
+  return eval('(' + code + ')')
+}
+
+function withStoredSettings(settings: Record<string, unknown> | null): void {
+  const store: Record<string, string> = {
+    workflow_cart: JSON.stringify([{ price: 100, quantity: 1 }]),
+  }
+  if (settings) {
+    store.workflow_cart_settings = JSON.stringify(settings)
+  }
+  ;(global as any).localStorage = {
+    getItem: (key: string) => (key in store ? store[key] : null),
+  }
+}
+
+const runHandler = async () => evalHandler(cartGetTotal.generateHandler())()
+
+afterEach(() => {
+  delete (global as any).localStorage
+})
+
+describe('cart-get-total — fulfilment flags', () => {
+  it('surfaces deliveryEnabled and storePickupEnabled from the stored snapshot', async () => {
+    withStoredSettings({
+      deliveryConfig: {
+        deliveryPrice: 10,
+        freeDeliveryEnabled: false,
+        freeDeliveryThreshold: 0,
+        deliveryEnabled: false,
+        storePickupEnabled: true,
+      },
+    })
+
+    const out = await runHandler()
+
+    expect(out.deliveryConfig).toEqual({
+      deliveryPrice: 10,
+      freeDeliveryEnabled: false,
+      freeDeliveryThreshold: 0,
+      deliveryEnabled: false,
+      storePickupEnabled: true,
+    })
+  })
+
+  it('leaves the flags absent when the storefront predates them', async () => {
+    // The assemble script distinguishes absent from false and falls back to its
+    // own build-time snapshot — asserting the keys are missing, not `false`.
+    withStoredSettings({
+      deliveryConfig: {
+        deliveryPrice: 10,
+        freeDeliveryEnabled: false,
+        freeDeliveryThreshold: 0,
+      },
+    })
+
+    const out = await runHandler()
+
+    expect('deliveryEnabled' in out.deliveryConfig).toBe(false)
+    expect('storePickupEnabled' in out.deliveryConfig).toBe(false)
+  })
+
+  it('returns a null deliveryConfig when nothing is stored at all', async () => {
+    withStoredSettings(null)
+
+    const out = await runHandler()
+
+    expect(out.deliveryConfig).toBeNull()
+  })
+})

package/__tests__/cron-route-loop-templateparams.test.ts

@@ -4,6 +4,7 @@
 // into its component body — the cron route previously used a naive inline loop
 // that did neither, so a per-cart reminder email would ship raw {{token}} merge
 // fields and its loop body would never run.
+import { generateSharedRuntimeUtilsCode } from '../src/executor-generator'
 import { generateCronAPIRoute } from '../src/api-route-generator'
 
 const TRIGGER_ID = 'cron-1'
@@ -123,12 +124,20 @@ describe('generateCronAPIRoute — loop + templateParams support', () => {
   })
 
   it('merges templateParams into email body + subject', () => {
-    // Both the top-level and loop-body execution paths apply the merge; the
-    // email node lives in the loop body here.
-    expect(route).toContain('utils.applyTemplateParams(bResolved.body, bResolved.templateParams)')
-    expect(route).toContain(
-      'utils.applyTemplateParams(bResolved.subject, bResolved.templateParams)'
-    )
+    // The merge lives in the SHARED runtime's `resolveConfig`, not pasted at
+    // each call site. That is the whole point: `resolveConfig` is the single
+    // function every execution path — main loop, loop body, parallel branch,
+    // error branch, across all four route generators and the client executor —
+    // funnels a node config through. Pasting it per site is what left the main
+    // loop of `generateServerSegmentAPIRoute` (where every ordinary page
+    // workflow's email node runs) without it, shipping literal `{{token}}`s.
+    const runtime = generateSharedRuntimeUtilsCode()
+    expect(runtime).toContain('applyTemplateParams(resolved.body, resolved.templateParams)')
+    expect(runtime).toContain('applyTemplateParams(resolved.subject, resolved.templateParams)')
+    // …and the route reaches it simply by calling resolveConfig.
+    expect(route).toContain('const resolveConfig = utils.resolveConfig')
+    // No stale per-site copy left behind to drift out of sync.
+    expect(route).not.toContain('utils.applyTemplateParams(')
   })
 
   it('bakes the scan + loop + email nodes into the server WORKFLOW_CONFIG', () => {

package/__tests__/data-create-item-order-notification.test.ts

@@ -106,3 +106,36 @@ describe('data_create_item — order-notification piggyback payload', () => {
 // cover the contract (which fields are read, where they default,
 // fire-and-forget shape, etc.). The full integration is exercised
 // by the existing end-to-end test in the dist project.
+
+describe('data-create-item stands down when the workflow owns the send', () => {
+  const suppressionHandlerCode = dataCreateItem.generateHandler()
+
+  it('gates the auto-fire on the builder-set suppressOrderNotification flag', () => {
+    // The place-order workflow sets this on its create-order node whenever it
+    // also carries a "Send Order-Notification Email" node. Without the gate
+    // the merchant receives the SAME order twice — once from here with a NULL
+    // order_number (rendered as the raw UUID) and a flat-filled body, once
+    // from the workflow with the real order number and the fully expanded
+    // template.
+    expect(suppressionHandlerCode).toContain('suppressOrderNotification')
+    expect(suppressionHandlerCode).toMatch(/suppressOrderNotification\s*!==\s*true/)
+  })
+
+  it('keeps firing when the flag is absent, so exported projects are unaffected', () => {
+    // `!== true` (not a truthiness check) is what makes "flag missing" mean
+    // "behave exactly as before".
+    expect(suppressionHandlerCode).not.toMatch(/config\.suppressOrderNotification\s*\)/)
+  })
+
+  it('sends both the {{itemsList}} and the array-mapper row keys per item', () => {
+    // One payload feeds the endpoint's own <ul> builder AND a builder email
+    // template's `tq:each` row block, so neither renderer needs to know which
+    // template style the merchant is on.
+    for (const key of ['product_name', 'unit_price', 'line_total', 'image_url']) {
+      expect(suppressionHandlerCode).toContain(key)
+    }
+    expect(suppressionHandlerCode).toMatch(
+      /it\.image \|\| it\.image_url \|\| it\.imageUrl \|\| it\.thumbnail/
+    )
+  })
+})

package/__tests__/file-storage-upload-picked-files.test.ts

@@ -7,6 +7,7 @@
 
 import { Blob as NodeBlob } from 'buffer'
 import { loadHandler, HandlerFn } from './_helpers/load-handler'
+import { installUploadGlobals, removeUploadGlobals } from './_helpers/abort-controller-stub'
 
 // jest 26's node sandbox exposes none of the browser upload globals the
 // handler uses (FormData/Blob/atob/fetch), so the test installs minimal
@@ -40,25 +41,27 @@ describe('file-storage-upload: PickedFile array from state', () => {
     handler = loadHandler('file-storage-upload')
     fetchMock = jest.fn(async () => ({
       ok: true,
-      json: async () => ({
-        files: [
-          { id: '1', name: 'a.png', url: 'https://storage.example/a.png' },
-          { id: '2', name: 'b.txt', url: 'https://storage.example/b.txt' },
-        ],
-      }),
+      status: 200,
+      // The handler reads the body as TEXT and parses it itself, so a gateway
+      // error page cannot masquerade as a JSON parse failure.
+      text: async () =>
+        JSON.stringify({
+          files: [
+            { id: '1', name: 'a.png', url: 'https://storage.example/a.png' },
+            { id: '2', name: 'b.txt', url: 'https://storage.example/b.txt' },
+          ],
+        }),
     }))
-    ;(globalThis as any).fetch = fetchMock
-    ;(globalThis as any).FormData = FormDataStub
-    ;(globalThis as any).Blob = NodeBlob
-    ;(globalThis as any).atob = (encoded: string) =>
-      Buffer.from(encoded, 'base64').toString('binary')
+    installUploadGlobals({
+      fetch: fetchMock,
+      FormData: FormDataStub,
+      Blob: NodeBlob,
+      atob: (encoded: string) => Buffer.from(encoded, 'base64').toString('binary'),
+    })
   })
 
   afterEach(() => {
-    delete (globalThis as any).fetch
-    delete (globalThis as any).FormData
-    delete (globalThis as any).Blob
-    delete (globalThis as any).atob
+    removeUploadGlobals(['fetch', 'FormData', 'Blob', 'atob'])
   })
 
   it('converts every PickedFile dataURL to a Blob and appends all of them', async () => {