@teleporthq/teleport-plugin-next-workflows 0.43.55 → 0.43.58

package/__tests__/_helpers/abort-controller-stub.ts

@@ -0,0 +1,64 @@
+// jest 26's node sandbox exposes none of the browser globals the upload
+// handlers use — no `fetch`, no `FormData`, no `Blob`, no `atob` and no
+// `AbortController`. The first four have always been stubbed by the tests that
+// need them; this is the fifth, added when `file-storage-upload` grew a timeout.
+//
+// It is a TEST-ONLY absence: `AbortController` has been available in every
+// browser since 2017 and in Node since 14, which is why the generated handler
+// uses it unguarded.
+
+type AbortListener = () => void
+
+class AbortSignalStub {
+  public aborted = false
+  public reason: unknown = undefined
+  private listeners: AbortListener[] = []
+
+  public addEventListener(type: string, listener: AbortListener): void {
+    if (type === 'abort') {
+      this.listeners.push(listener)
+    }
+  }
+
+  public removeEventListener(type: string, listener: AbortListener): void {
+    if (type === 'abort') {
+      this.listeners = this.listeners.filter((entry) => entry !== listener)
+    }
+  }
+
+  /** @internal — driven by the controller, never by the code under test. */
+  public dispatchAbort(reason: unknown): void {
+    if (this.aborted) {
+      return
+    }
+    this.aborted = true
+    this.reason = reason
+    for (const listener of this.listeners.slice()) {
+      listener()
+    }
+  }
+}
+
+export class AbortControllerStub {
+  public readonly signal = new AbortSignalStub()
+
+  public abort(reason?: unknown): void {
+    this.signal.dispatchAbort(reason)
+  }
+}
+
+/** The browser globals the file-storage upload handler expects to exist. */
+export const installUploadGlobals = (overrides: Record<string, unknown> = {}): void => {
+  const globals = globalThis as Record<string, unknown>
+  globals.AbortController = AbortControllerStub
+  for (const [name, value] of Object.entries(overrides)) {
+    globals[name] = value
+  }
+}
+
+export const removeUploadGlobals = (names: string[]): void => {
+  const globals = globalThis as Record<string, unknown>
+  for (const name of ['AbortController', ...names]) {
+    delete globals[name]
+  }
+}

package/__tests__/account-refresh-session.test.ts

@@ -0,0 +1,110 @@
+import { loadHandler, HandlerFn } from './_helpers/load-handler'
+
+// After a profile save the NextAuth JWT still carries the PREVIOUS name/image:
+// the generated jwt callback only re-reads the users row once per refresh
+// interval unless next-auth passes `trigger: 'update'`, which only
+// `useSession().update()` does. `account-refresh-session` is the node that
+// calls it and then republishes the result to the two consumers that would
+// otherwise keep the stale value: the `teleport_auth_user` localStorage mirror
+// `account-get-current` falls back to, and GlobalContext's `currentUser` (which
+// the account-menu avatar binds to) via `teleport:auth-user-changed`.
+
+interface RefreshResult {
+  id?: string
+  image?: string
+  user: Record<string, unknown> | null
+  refreshed: boolean
+  error?: unknown
+}
+
+describe('account-refresh-session', () => {
+  const handler: HandlerFn = loadHandler('account-refresh-session')
+  let events: Array<{ type: string; detail: unknown }>
+  let stored: Record<string, string>
+
+  const installWindow = (refreshSession: unknown): void => {
+    events = []
+    stored = { teleport_auth_user: JSON.stringify({ id: 'u-1', image: 'https://cdn/old.png' }) }
+    ;(globalThis as any).window = {
+      __teleportNextAuth: refreshSession === undefined ? {} : { refreshSession },
+      localStorage: {
+        getItem: (k: string) => (k in stored ? stored[k] : null),
+        setItem: (k: string, v: string) => {
+          stored[k] = v
+        },
+        removeItem: (k: string) => {
+          delete stored[k]
+        },
+      },
+      dispatchEvent: (event: { type: string; detail: unknown }) => events.push(event),
+    }
+    ;(globalThis as any).CustomEvent = class {
+      public type: string
+      public detail: unknown
+      constructor(type: string, init?: { detail?: unknown }) {
+        this.type = type
+        this.detail = init ? init.detail : undefined
+      }
+    }
+  }
+
+  afterEach(() => {
+    delete (globalThis as any).window
+    delete (globalThis as any).CustomEvent
+  })
+
+  it('publishes the refreshed user to GlobalContext and the localStorage mirror', async () => {
+    const fresh = { id: 'u-1', name: 'Ada Lovelace', image: 'https://cdn/new.png', role: 'user' }
+    installWindow(async () => ({ user: fresh, expires: '2099-01-01' }))
+
+    const result = (await handler({}, {})) as RefreshResult
+
+    expect(result.refreshed).toBe(true)
+    expect(result.user).toEqual(fresh)
+    // Flat fields too — same output contract as account-get-current.
+    expect(result.image).toBe('https://cdn/new.png')
+    expect(result.id).toBe('u-1')
+    expect(JSON.parse(stored.teleport_auth_user).image).toBe('https://cdn/new.png')
+    expect(events).toHaveLength(1)
+    expect(events[0].type).toBe('teleport:auth-user-changed')
+    expect(events[0].detail).toEqual({ user: fresh })
+  })
+
+  it('never publishes a null user — that would sign the visitor out of the UI', async () => {
+    // `update()` resolves to undefined while the provider is still loading.
+    installWindow(async (): Promise<undefined> => undefined)
+
+    const result = (await handler({}, {})) as RefreshResult
+
+    expect(result.refreshed).toBe(false)
+    expect(events).toHaveLength(0)
+    expect(JSON.parse(stored.teleport_auth_user).image).toBe('https://cdn/old.png')
+  })
+
+  it('degrades quietly when the session bridge is unavailable', async () => {
+    installWindow(undefined)
+
+    const result = (await handler({}, {})) as RefreshResult
+
+    expect(result.refreshed).toBe(false)
+    expect(events).toHaveLength(0)
+  })
+
+  it('never returns a string error key (that would abort the workflow)', async () => {
+    installWindow(async () => {
+      throw new Error('network down')
+    })
+
+    const result = (await handler({}, {})) as RefreshResult
+
+    expect(result.refreshed).toBe(false)
+    expect(typeof result.error).not.toBe('string')
+    expect(events).toHaveLength(0)
+  })
+
+  it('is inert on the server', async () => {
+    const result = (await handler({}, {})) as RefreshResult
+    expect(result.refreshed).toBe(false)
+    expect(result.user).toBeNull()
+  })
+})

package/__tests__/cache-nodes.test.ts

@@ -0,0 +1,137 @@
+import { nodeRegistry } from '../src'
+
+const CACHE_NODES = ['cache-get', 'cache-set', 'cache-invalidate']
+
+const emittedFor = (nodeType: string): string => {
+  const generator = nodeRegistry[nodeType]
+  let source = generator.generateHandler()
+  if (typeof generator.generateServerHandler === 'function') {
+    source += '\n' + generator.generateServerHandler()
+  }
+  return source
+}
+
+/**
+ * Mirrors `isFatalNodeResult` in the emitted runtime: a node result carrying
+ * `success: false`, a string `error`, or `error: true` HALTS the workflow.
+ */
+const runHandler = async (nodeType: string, config: Record<string, unknown>, context = {}) => {
+  const source = nodeRegistry[nodeType].generateHandler()
+  const entry = nodeType.replace(/-/g, '_')
+  // tslint:disable-next-line:function-constructor
+  const factory = new Function('globalThis', 'window', 'fetch', `${source}; return ${entry};`)
+  const fn = factory({}, undefined, () => Promise.reject(new Error('offline')))
+  return fn(config, context)
+}
+
+describe('cache workflow nodes', () => {
+  it('registers all three', () => {
+    for (const nodeType of CACHE_NODES) {
+      expect(nodeRegistry[nodeType]).toBeDefined()
+      expect(nodeRegistry[nodeType].nodeType).toBe(nodeType)
+    }
+  })
+
+  /**
+   * `cache-invalidate` bumps the SHARED version row, which needs the server-only
+   * secret — and being server-side puts it in the same segment as the write it
+   * follows, so a CRUD workflow pays no extra round trip for it.
+   */
+  it('runs the purge on the server and the read/write anywhere', () => {
+    expect(nodeRegistry['cache-invalidate'].executionEnv).toBe('server')
+    expect(nodeRegistry['cache-get'].executionEnv).toBe('universal')
+    expect(nodeRegistry['cache-set'].executionEnv).toBe('universal')
+  })
+
+  /**
+   * Handlers ship as runtime source and are re-bundled by webpack, which
+   * rewrites `require(`. The browser must also never be handed the Postgres
+   * driver by way of the server cache runtime.
+   */
+  it('never requires a module', () => {
+    for (const nodeType of CACHE_NODES) {
+      expect(emittedFor(nodeType)).not.toMatch(/(?<![\w.])require\s*\(/)
+    }
+  })
+
+  /**
+   * THE regression that would abort an admin's save. The runtime treats
+   * `success: false` / a string `error` as FATAL, so a cache that could not be
+   * cleared would halt the workflow AFTER the row was already written — no
+   * success toast, no navigation, and an error for an action that worked.
+   */
+  describe('never reports failure in a shape the runtime treats as fatal', () => {
+    it('cache-invalidate without a configured scope', async () => {
+      const result = await runHandler('cache-invalidate', {})
+      expect(result.cleared).toBe(false)
+      expect(result.success).toBeUndefined()
+      expect(typeof result.error).not.toBe('string')
+      expect(result.error).not.toBe(true)
+    })
+
+    it('cache-invalidate with no secret configured', async () => {
+      const result = await runHandler('cache-invalidate', { scope: 'ds:products' })
+      expect(result.cleared).toBe(false)
+      expect(result.warning).toContain('TQ_CACHE_SECRET')
+      expect(result.success).toBeUndefined()
+      expect(typeof result.error).not.toBe('string')
+    })
+
+    it('cache-set with no scope', async () => {
+      const result = await runHandler('cache-set', { key: 'k', value: 1 })
+      expect(result.stored).toBe(false)
+      expect(result.success).toBeUndefined()
+      expect(typeof result.error).not.toBe('string')
+    })
+
+    it('cache-get reports a miss without any failure marker', async () => {
+      const result = await runHandler('cache-get', { scope: 'ds:products', key: 'missing' })
+      expect(result.hit).toBe(false)
+      expect(result.success).toBeUndefined()
+      expect(typeof result.error).not.toBe('string')
+    })
+  })
+
+  it('round-trips a value through the workflow cache', async () => {
+    const shared = {}
+    const set = new Function(
+      'globalThis',
+      'window',
+      `${nodeRegistry['cache-set'].generateHandler()}; return cache_set;`
+    )(shared, undefined)
+    const get = new Function(
+      'globalThis',
+      'window',
+      `${nodeRegistry['cache-get'].generateHandler()}; return cache_get;`
+    )(shared, undefined)
+
+    await set({ scope: 'rates', key: 'EUR', value: { rate: 1.1 }, ttlSeconds: 60 }, {})
+    const hit = await get({ scope: 'rates', key: 'EUR' }, {})
+
+    expect(hit.hit).toBe(true)
+    expect(hit.value).toEqual({ rate: 1.1 })
+  })
+
+  it('reports a miss once the entry has expired', async () => {
+    const shared = {}
+    const set = new Function(
+      'globalThis',
+      'window',
+      `${nodeRegistry['cache-set'].generateHandler()}; return cache_set;`
+    )(shared, undefined)
+    const get = new Function(
+      'globalThis',
+      'window',
+      `${nodeRegistry['cache-get'].generateHandler()}; return cache_get;`
+    )(shared, undefined)
+
+    await set({ scope: 'rates', key: 'EUR', value: 1, ttlSeconds: 60 }, {})
+
+    const now = Date.now()
+    const spy = jest.spyOn(Date, 'now').mockReturnValue(now + 61_000)
+    const miss = await get({ scope: 'rates', key: 'EUR' }, {})
+    spy.mockRestore()
+
+    expect(miss.hit).toBe(false)
+  })
+})

package/__tests__/cart-get-total-delivery-flags.test.ts

@@ -0,0 +1,86 @@
+/* tslint:disable:no-eval */
+import { cartGetTotal } from '../src/nodes/cart/cart-get-total'
+
+/**
+ * `cart-get-total` is the ONLY channel by which the place-order workflow learns
+ * the merchant's CURRENT delivery settings: the workflow's assemble script is
+ * baked once, when the checkout page is built, while `EcommerceProvider`
+ * re-writes `workflow_cart_settings` on every page load.
+ *
+ * Two of those settings decide whether a delivery fee may be charged at all —
+ * whether the store delivers, and whether it offers store pickup — so they have
+ * to survive the trip. And they have to survive it as `undefined` when the
+ * storefront predates them: reading a missing flag as `false` would silently
+ * stop charging delivery on a store that does deliver.
+ */
+
+function evalHandler(code: string): any {
+  return eval('(' + code + ')')
+}
+
+function withStoredSettings(settings: Record<string, unknown> | null): void {
+  const store: Record<string, string> = {
+    workflow_cart: JSON.stringify([{ price: 100, quantity: 1 }]),
+  }
+  if (settings) {
+    store.workflow_cart_settings = JSON.stringify(settings)
+  }
+  ;(global as any).localStorage = {
+    getItem: (key: string) => (key in store ? store[key] : null),
+  }
+}
+
+const runHandler = async () => evalHandler(cartGetTotal.generateHandler())()
+
+afterEach(() => {
+  delete (global as any).localStorage
+})
+
+describe('cart-get-total — fulfilment flags', () => {
+  it('surfaces deliveryEnabled and storePickupEnabled from the stored snapshot', async () => {
+    withStoredSettings({
+      deliveryConfig: {
+        deliveryPrice: 10,
+        freeDeliveryEnabled: false,
+        freeDeliveryThreshold: 0,
+        deliveryEnabled: false,
+        storePickupEnabled: true,
+      },
+    })
+
+    const out = await runHandler()
+
+    expect(out.deliveryConfig).toEqual({
+      deliveryPrice: 10,
+      freeDeliveryEnabled: false,
+      freeDeliveryThreshold: 0,
+      deliveryEnabled: false,
+      storePickupEnabled: true,
+    })
+  })
+
+  it('leaves the flags absent when the storefront predates them', async () => {
+    // The assemble script distinguishes absent from false and falls back to its
+    // own build-time snapshot — asserting the keys are missing, not `false`.
+    withStoredSettings({
+      deliveryConfig: {
+        deliveryPrice: 10,
+        freeDeliveryEnabled: false,
+        freeDeliveryThreshold: 0,
+      },
+    })
+
+    const out = await runHandler()
+
+    expect('deliveryEnabled' in out.deliveryConfig).toBe(false)
+    expect('storePickupEnabled' in out.deliveryConfig).toBe(false)
+  })
+
+  it('returns a null deliveryConfig when nothing is stored at all', async () => {
+    withStoredSettings(null)
+
+    const out = await runHandler()
+
+    expect(out.deliveryConfig).toBeNull()
+  })
+})

package/__tests__/file-storage-upload-picked-files.test.ts

@@ -7,6 +7,7 @@
 
 import { Blob as NodeBlob } from 'buffer'
 import { loadHandler, HandlerFn } from './_helpers/load-handler'
+import { installUploadGlobals, removeUploadGlobals } from './_helpers/abort-controller-stub'
 
 // jest 26's node sandbox exposes none of the browser upload globals the
 // handler uses (FormData/Blob/atob/fetch), so the test installs minimal
@@ -40,25 +41,27 @@ describe('file-storage-upload: PickedFile array from state', () => {
     handler = loadHandler('file-storage-upload')
     fetchMock = jest.fn(async () => ({
       ok: true,
-      json: async () => ({
-        files: [
-          { id: '1', name: 'a.png', url: 'https://storage.example/a.png' },
-          { id: '2', name: 'b.txt', url: 'https://storage.example/b.txt' },
-        ],
-      }),
+      status: 200,
+      // The handler reads the body as TEXT and parses it itself, so a gateway
+      // error page cannot masquerade as a JSON parse failure.
+      text: async () =>
+        JSON.stringify({
+          files: [
+            { id: '1', name: 'a.png', url: 'https://storage.example/a.png' },
+            { id: '2', name: 'b.txt', url: 'https://storage.example/b.txt' },
+          ],
+        }),
     }))
-    ;(globalThis as any).fetch = fetchMock
-    ;(globalThis as any).FormData = FormDataStub
-    ;(globalThis as any).Blob = NodeBlob
-    ;(globalThis as any).atob = (encoded: string) =>
-      Buffer.from(encoded, 'base64').toString('binary')
+    installUploadGlobals({
+      fetch: fetchMock,
+      FormData: FormDataStub,
+      Blob: NodeBlob,
+      atob: (encoded: string) => Buffer.from(encoded, 'base64').toString('binary'),
+    })
   })
 
   afterEach(() => {
-    delete (globalThis as any).fetch
-    delete (globalThis as any).FormData
-    delete (globalThis as any).Blob
-    delete (globalThis as any).atob
+    removeUploadGlobals(['fetch', 'FormData', 'Blob', 'atob'])
   })
 
   it('converts every PickedFile dataURL to a Blob and appends all of them', async () => {

package/__tests__/invoice-delivery-fee.test.ts

@@ -0,0 +1,155 @@
+import { generateInvoiceGenerateRouteCode } from '../src/invoice/api-routes-code'
+import { generatePdfGeneratorCode } from '../src/invoice/pdf-generator-code'
+import type { UIDLInvoiceSettings } from '@teleporthq/teleport-types'
+
+// The delivery fee on the invoice.
+//
+// `teleport_orders.shipping_amount` is folded into the amount the buyer was
+// actually charged, so an invoice that ignores it prints a Total its own rows
+// do not add up to — and, through `{{totalAmount}}`, asks the customer to pay
+// a different number than their card was debited.
+//
+// Two halves are covered here:
+//   1. `/api/invoices/generate` reads the fee off the order (or the caller)
+//      and adds it to the total WITHOUT taxing it — the storefront charges the
+//      configured delivery price verbatim, so the invoice has to as well.
+//   2. The PDF renderer publishes `Invoice.shippingAmount` + `Invoice.hasShipping`
+//      for the template to bind and gate on, and prints its own Delivery line in
+//      the no-template fallback.
+
+const FAKE_SETTINGS = {
+  invoicePrefix: 'INV-',
+  defaultTaxRate: 0,
+  showDiscount: false,
+  taxIncludedInPrice: false,
+  companyDetails: {},
+  template: { document: null as unknown },
+  tables: { invoicesTable: 'teleport_invoices', invoiceItemsTable: 'teleport_invoice_items' },
+  emailDelivery: { enabled: false },
+} as unknown as UIDLInvoiceSettings
+
+interface InvoiceScope {
+  invoiceData: {
+    Invoice: Record<string, string>
+  }
+}
+
+interface PdfGeneratorModule {
+  buildInvoiceDataScope: (invoiceData: Record<string, unknown>) => InvoiceScope
+  buildInvoiceHtml: (invoiceData: Record<string, unknown>) => string
+  replacePlaceholders: (template: string, data: Record<string, unknown>) => string
+  buildDataContext: (invoiceData: Record<string, unknown>) => Record<string, unknown>
+}
+
+/**
+ * Loads the emitted `utils/invoices/pdf-generator.js` as a real module so the
+ * assertions run its arithmetic instead of matching its source text. No
+ * template UIDL is passed, which is the fallback-HTML path.
+ */
+function loadPdfGenerator(): PdfGeneratorModule {
+  const code = generatePdfGeneratorCode(FAKE_SETTINGS, null, null)
+  const factory = new Function(
+    'require',
+    'module',
+    'exports',
+    `${code}; return module.exports;`
+  ) as (
+    req: NodeRequire,
+    mod: { exports: Record<string, unknown> },
+    exp: Record<string, unknown>
+  ) => PdfGeneratorModule
+  const moduleObject = { exports: {} as Record<string, unknown> }
+  return factory(require, moduleObject, moduleObject.exports)
+}
+
+describe('/api/invoices/generate — delivery fee', () => {
+  const route = generateInvoiceGenerateRouteCode(FAKE_SETTINGS)
+
+  it('reads the fee off the hydrated order, with a caller override', () => {
+    expect(route).toContain(
+      'body.shippingAmount != null ? body.shippingAmount : (orderShippingSource.shipping_amount || 0)'
+    )
+  })
+
+  it('coerces a missing / negative / unparseable fee to zero', () => {
+    // Orders placed before the column existed hydrate `undefined` here, and
+    // that has to read as "this order paid nothing for delivery" rather than
+    // poisoning the total with NaN.
+    expect(route).toContain('if (!isFinite(shippingAmount) || shippingAmount < 0) {')
+    expect(route).toContain('shippingAmount = 0;')
+  })
+
+  it('adds the fee to the total but leaves subtotal and tax to the goods', () => {
+    // The storefront never taxes the delivery price (`computeShippingMeta`
+    // uses the configured value verbatim), so taxing it here would make the
+    // invoice total disagree with `teleport_orders.total_amount`.
+    expect(route).toContain('var total = goodsTotal + shippingAmount;')
+    expect(route).toContain('subtotal: Math.round(subtotal * 100) / 100,')
+    expect(route).toContain('shippingAmount: Math.round(shippingAmount * 100) / 100,')
+  })
+})
+
+describe('invoice PDF renderer — delivery fee', () => {
+  const pdfGenerator = loadPdfGenerator()
+
+  const baseInvoice = {
+    invoiceNumber: 'INV-0001',
+    currency: 'USD',
+    currencySymbol: '$',
+    subtotal: 200,
+    taxRate: 0,
+    taxAmount: 0,
+    discountAmount: 0,
+    items: [{ name: 'Espresso Machine', quantity: 1, unitPrice: 200, totalPrice: 200 }],
+  }
+
+  it('publishes the formatted fee and turns the row flag on', () => {
+    const { invoiceData } = pdfGenerator.buildInvoiceDataScope({
+      ...baseInvoice,
+      shippingAmount: 9.99,
+      total: 209.99,
+    })
+
+    expect(invoiceData.Invoice.shippingAmount).toBe('$9.99')
+    expect(invoiceData.Invoice.hasShipping).toBe('true')
+  })
+
+  it('turns the row flag off for an order that paid nothing to be delivered', () => {
+    // Covers store-pickup orders, free-delivery orders, and every invoice
+    // generated from an order placed before the column existed (no field at
+    // all, so `Number(undefined)` is NaN and must not read as a fee).
+    const { invoiceData } = pdfGenerator.buildInvoiceDataScope({
+      ...baseInvoice,
+      total: 200,
+    })
+
+    expect(invoiceData.Invoice.shippingAmount).toBe('$0.00')
+    expect(invoiceData.Invoice.hasShipping).toBe('false')
+  })
+
+  it('prints a Delivery line in the fallback HTML only when there is a fee', () => {
+    const withFee = pdfGenerator.buildInvoiceHtml({
+      ...baseInvoice,
+      shippingAmount: 9.99,
+      total: 209.99,
+    })
+    expect(withFee).toContain('<span>Delivery</span><span>$9.99</span>')
+    expect(withFee).toContain('<span>Total</span><span>$209.99</span>')
+
+    const withoutFee = pdfGenerator.buildInvoiceHtml({ ...baseInvoice, total: 200 })
+    expect(withoutFee).not.toContain('<span>Delivery</span>')
+  })
+
+  it('fills the {{shippingAmount}} merge token in the invoice email', () => {
+    const data = pdfGenerator.buildDataContext({
+      ...baseInvoice,
+      shippingAmount: 9.99,
+      total: 209.99,
+    })
+
+    expect(pdfGenerator.replacePlaceholders('Delivery: {{shippingAmount}}', data)).toBe(
+      'Delivery: $9.99'
+    )
+    expect(pdfGenerator.replacePlaceholders('Due: {{totalAmount}}', data)).toBe('Due: $209.99')
+  })
+})

package/__tests__/invoice-generate-hydration.test.ts

@@ -90,8 +90,13 @@ describe('/api/invoices/generate — orderId hydration', () => {
   it('prefers body.items over hydrated items when both exist', () => {
     // Admin "regenerate invoice with custom items" use cases need
     // body.items to win. The condition checks length > 0 so an empty
-    // explicit array still falls back to DB-hydrated items.
-    expect(route).toContain('var items = Array.isArray(body.items) && body.items.length > 0')
+    // explicit array still falls back to DB-hydrated items. The predicate is
+    // named because the settle-wait below keys off it too — a caller that
+    // brought its own lines never waits for the DB rows to land.
+    expect(route).toContain(
+      'var callerSuppliedItems = Array.isArray(body.items) && body.items.length > 0;'
+    )
+    expect(route).toContain('var items = callerSuppliedItems')
   })
 
   it('falls back to order.billing_* / shipping_* fields for customer data', () => {