@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.68

package/src/session-cookie-resolver.ts

@@ -1,280 +1,12 @@
-/**
- * Resolving the NextAuth session token in a generated route, WITHOUT asking
- * `process.env.NEXTAUTH_URL` what the session cookie is called.
- *
- * ## ⛔ THE REPORTED DEFECT
- *
- * A published project showed "Failed to load dashboard data. Please refresh."
- * on the home page, "Failed to load meeting data." on the list page and "could
- * not fetch the templates" on a third — for a user who was signed in, on a page
- * whose own `/api/auth/session` returned that user. The failing call was the
- * page-load workflow's server segment, answering **401 `Unauthenticated`** from
- * `guardWorkflowRequest`. Reloading sometimes fixed it; fanning 50 concurrent
- * requests at the same route returned **33 × 401 and 17 × 200**, while 40
- * concurrent `/api/auth/session` calls resolved the user 40/40.
- *
- * ## The mechanism
- *
- * next-auth v4's `getToken()` derives the cookie it reads from an env var:
- *
- * ```js
- * secureCookie = process.env.NEXTAUTH_URL?.startsWith('https://') ?? !!process.env.VERCEL,
- * cookieName   = secureCookie ? '__Secure-next-auth.session-token' : 'next-auth.session-token',
- * ```
- *
- * A generated project ships `NEXTAUTH_URL=http://localhost:3000` — the build
- * cannot know the domain it will be published to, so `pages/api/auth/[...nextauth].js`
- * repairs `process.env.NEXTAUTH_URL` **from the incoming request** instead. That
- * repair is process-local: it fixes the value for whichever serverless instance
- * happened to serve an auth request, and for no other. Every other instance
- * still holds `http://localhost:3000`, so `startsWith('https://')` is `false`
- * (NOT `undefined` — the `??` fallback to `!!process.env.VERCEL` never runs),
- * `getToken` looks for `next-auth.session-token`, the browser is holding
- * `__Secure-next-auth.session-token`, nothing is found, and a signed-in user is
- * reported as anonymous.
- *
- * Hence the coin-flip: it depends on whether the instance that served your
- * request had previously served an auth request. Nothing about the session, the
- * secret or the cookie is wrong.
- *
- * The same defect is why the generated middleware carries a `hasSessionCookie`
- * fallback and a round trip to `/api/auth/session`, attributed there to an
- * "Edge runtime quirk" — the Edge process holds that same localhost value.
- *
- * ## The rule
- *
- * ⭐ **A request must be authenticated from the REQUEST, never from an ambient
- * env var that describes the deployment.** So this resolver reads which session
- * cookie the caller actually sent, and tells `getToken` exactly that — falling
- * back to the request's own protocol when the cookie header is unavailable.
- *
- * Emitted as plain ES5 text and inlined into each generated route: a route that
- * carries its own copy cannot be broken by a missing sibling module or an
- * untraced dependency, and every call site gets the identical implementation
- * from this one definition.
- */
-
-/** The `__tq`-prefixed globals the emitted snippet declares. */
-export const SESSION_TOKEN_RESOLVER_FN = '__tqResolveSessionToken'
-
-/**
- * Session-cookie names next-auth/Auth.js writes, with the `secureCookie` flag
- * that produces each. Order within a protocol is irrelevant — only ONE of these
- * is ever present — but the https/http split decides which pair is tried first.
- *
- * `__Host-` is deliberately absent: next-auth uses it only for the CSRF and
- * callback cookies, never for the session token.
- */
-const KNOWN_SESSION_COOKIES: ReadonlyArray<{ name: string; secure: boolean }> = [
-  { name: '__Secure-next-auth.session-token', secure: true },
-  { name: 'next-auth.session-token', secure: false },
-  { name: '__Secure-authjs.session-token', secure: true },
-  { name: 'authjs.session-token', secure: false },
-]
-
-/**
- * ES5 source for the shared session-token resolver, safe to inline into any
- * generated CommonJS route or ESM middleware.
- *
- * Declares:
- *  - `__tqCookieNamesPresent(req)` — the set of cookie names on the request,
- *    parsed properly (a substring test would see `next-auth.session-token`
- *    inside `__Secure-next-auth.session-token` and pick the wrong one).
- *  - `__tqRequestIsSecure(req)` — https as the REQUEST reports it.
- *  - `__tqSessionTokenCandidates(req)` — `{cookieName, secureCookie}` pairs to try.
- *  - `__tqResolveSessionToken(getToken, req, secret)` — the token, or null.
- *
- * `getToken` is passed IN rather than required here, so the same body serves a
- * CommonJS route (lazy `require('next-auth/jwt')`) and the Edge middleware
- * (static `import`). Pure, total, never throws, no env reads.
- */
-export const generateSessionTokenResolverCode = (): string => {
-  return `// GENERATED — see generateSessionTokenResolverCode in
-// @teleporthq/teleport-plugin-next-workflows/src/session-cookie-resolver.ts.
-//
-// next-auth's getToken() picks the session cookie name from
-// process.env.NEXTAUTH_URL, which a generated project ships as a localhost
-// default — so on a published https domain it looks for the non-secure cookie
-// and reports a signed-in user as anonymous. These helpers read the cookie the
-// request actually carries and tell getToken exactly which one it is.
-var __TQ_SESSION_COOKIES = ${JSON.stringify(KNOWN_SESSION_COOKIES.map((c) => [c.name, c.secure]))};
-
-// Every cookie NAME on the request. Parsed on the "; " separator rather than
-// matched as a substring: "next-auth.session-token" occurs inside
-// "__Secure-next-auth.session-token", so a substring test reports the plain
-// cookie as present whenever the secure one is, and getToken then decodes the
-// wrong (missing) cookie.
-function __tqCookieNamesPresent(req) {
-  var present = {};
-  var raw = '';
-  try {
-    var headers = req && req.headers;
-    if (headers && typeof headers.get === 'function') {
-      // Edge / fetch Headers.
-      raw = headers.get('cookie') || '';
-    } else if (headers) {
-      var value = headers.cookie || headers.Cookie;
-      raw = Array.isArray(value) ? value.join('; ') : value || '';
-    }
-  } catch (e) {
-    raw = '';
-  }
-  var parts = String(raw).split(';');
-  for (var i = 0; i < parts.length; i++) {
-    var eq = parts[i].indexOf('=');
-    if (eq > 0) {
-      present[parts[i].slice(0, eq).trim()] = true;
-    }
-  }
-  // Second source: the runtime's own parsed cookies. A Next.js API route hands
-  // over a plain object; the Edge RequestCookies exposes getAll().
-  try {
-    var cookies = req && req.cookies;
-    if (cookies && typeof cookies.getAll === 'function') {
-      var all = cookies.getAll() || [];
-      for (var a = 0; a < all.length; a++) {
-        if (all[a] && all[a].name) {
-          present[all[a].name] = true;
-        }
-      }
-    } else if (cookies && typeof cookies === 'object') {
-      for (var key in cookies) {
-        if (Object.prototype.hasOwnProperty.call(cookies, key)) {
-          present[key] = true;
-        }
-      }
-    }
-  } catch (e) {
-    /* the header pass above is enough */
-  }
-  return present;
-}
-
-// Is this request https? Read from the proxy header the platform sets, then the
-// socket, then the URL — never from an env var describing the deployment.
-function __tqRequestIsSecure(req) {
-  try {
-    var headers = (req && req.headers) || {};
-    var proto =
-      typeof headers.get === 'function'
-        ? headers.get('x-forwarded-proto')
-        : headers['x-forwarded-proto'];
-    if (Array.isArray(proto)) {
-      proto = proto[0];
-    }
-    if (typeof proto === 'string' && proto) {
-      // A chain of proxies appends: "https,http" — the client-facing hop is first.
-      return proto.split(',')[0].trim().toLowerCase() === 'https';
-    }
-    if (req && req.nextUrl && req.nextUrl.protocol === 'https:') {
-      return true;
-    }
-    if (req && req.socket && req.socket.encrypted) {
-      return true;
-    }
-    if (req && req.connection && req.connection.encrypted) {
-      return true;
-    }
-    if (typeof (req && req.url) === 'string' && req.url.indexOf('https://') === 0) {
-      return true;
-    }
-  } catch (e) {
-    /* fall through to false */
-  }
-  return false;
-}
-
-// The { cookieName, secureCookie } pairs worth trying, most likely first.
-// Normally exactly one cookie is present and this returns a single entry; the
-// list only grows when a site has been reached over both http and https.
-function __tqSessionTokenCandidates(req) {
-  var present = __tqCookieNamesPresent(req);
-  var secure = __tqRequestIsSecure(req);
-  var candidates = [];
-  for (var i = 0; i < __TQ_SESSION_COOKIES.length; i++) {
-    var name = __TQ_SESSION_COOKIES[i][0];
-    var isSecureName = __TQ_SESSION_COOKIES[i][1];
-    if (present[name] || present[name + '.0']) {
-      candidates.push({ cookieName: name, secureCookie: isSecureName });
-    }
-  }
-  candidates.sort(function (a, b) {
-    if (a.secureCookie === b.secureCookie) {
-      return 0;
-    }
-    return a.secureCookie === secure ? -1 : 1;
-  });
-  if (candidates.length === 0) {
-    // No cookie we recognise. The project may configure a custom cookie name in
-    // authOptions, so hand getToken the request's own protocol and let it apply
-    // its defaults — same behaviour as before this resolver existed, minus the
-    // localhost env var.
-    candidates.push({ secureCookie: secure });
-  }
-  return candidates;
-}
-
-// The decoded session token, or null. Tries each candidate cookie in turn so a
-// project that renamed its cookie, or one reached over both protocols, still
-// resolves. Never throws.
-function ${SESSION_TOKEN_RESOLVER_FN}(getToken, req, secret) {
-  if (!secret || typeof getToken !== 'function') {
-    return Promise.resolve(null);
-  }
-  var candidates = __tqSessionTokenCandidates(req);
-  var attempt = function (index) {
-    if (index >= candidates.length) {
-      return Promise.resolve(null);
-    }
-    var candidate = candidates[index];
-    var params = { req: req, secret: secret, secureCookie: candidate.secureCookie };
-    if (candidate.cookieName) {
-      params.cookieName = candidate.cookieName;
-    }
-    return Promise.resolve()
-      .then(function () {
-        return getToken(params);
-      })
-      .catch(function () {
-        return null;
-      })
-      .then(function (token) {
-        return token || attempt(index + 1);
-      });
-  };
-  return attempt(0);
-}
-`
-}
+import { SessionCookieResolver } from '@teleporthq/teleport-shared'
 
 /**
- * The resolver plus a lazy `require('next-auth/jwt')`, for a CommonJS route.
- *
- * The require is lazy and guarded because a project generated WITHOUT
- * authentication does not ship `next-auth`; such a project also has no session
- * to read, so resolving to `null` there is the correct answer rather than a
- * module-load crash.
+ * The session-cookie resolver lives in teleport-shared so the per-table data
+ * routes (teleport-plugin-next-data-source) decode a session exactly the way
+ * the workflow routes do. This module keeps the plugin's public export path.
  */
-export const generateCommonJsSessionTokenResolverCode = (): string => {
-  return `${generateSessionTokenResolverCode()}
-// Lazy + guarded: a project generated without authentication has no next-auth
-// installed, and no session to read either — null is the right answer there.
-function __tqGetTokenFn() {
-  try {
-    var jwt = require('next-auth/jwt');
-    return jwt && typeof jwt.getToken === 'function' ? jwt.getToken : null;
-  } catch (e) {
-    return null;
-  }
-}
-
-// The session token for this request, or null. Reads NEXTAUTH_SECRET itself.
-function __tqSessionToken(req) {
-  var secret = process.env.NEXTAUTH_SECRET;
-  if (!secret) {
-    return Promise.resolve(null);
-  }
-  return ${SESSION_TOKEN_RESOLVER_FN}(__tqGetTokenFn(), req, secret);
-}
-`
-}
+export const SESSION_TOKEN_RESOLVER_FN = SessionCookieResolver.SESSION_TOKEN_RESOLVER_FN
+export const generateSessionTokenResolverCode =
+  SessionCookieResolver.generateSessionTokenResolverCode
+export const generateCommonJsSessionTokenResolverCode =
+  SessionCookieResolver.generateCommonJsSessionTokenResolverCode

package/src/subscriber-access-route-generator.ts

@@ -0,0 +1,351 @@
+/**
+ * Subscriber-only pages: the entitlement check a generated store runs for a
+ * page whose protection carries `requiresSubscription`.
+ *
+ * Two files, emitted together whenever at least one page is subscriber-only:
+ *
+ *  - `utils/auth/subscriber-access.js` — the ONE parameterised query that
+ *    decides entitlement (`SUBSCRIPTION_ENTITLEMENT_SQL` from teleport-shared,
+ *    statuses baked from `SUBSCRIPTION_ENTITLED_STATUSES`) plus the lookup of
+ *    the storefront page of the first product a page names. Shared by the
+ *    route below and by the workflow-route guard (`workflow-auth.js`), so the
+ *    middleware and a page's workflow routes can never disagree.
+ *  - `pages/api/auth/subscriber-access.js` — what the Edge middleware asks
+ *    (it has no database): `GET ?products=<comma ids>` with the visitor's
+ *    cookie forwarded → 401 without a session, else
+ *    `{ entitled: boolean, redirectTo?: string }`, never cached.
+ *
+ * The middleware itself lives in `auth-generator.ts` (`generateMiddlewareFile`).
+ */
+import { ProjectUIDL, UIDLAuthentication } from '@teleporthq/teleport-types'
+import { SubscriptionAccess } from '@teleporthq/teleport-shared'
+import { generatePgClientCode } from './pg-client-code'
+import { generateCommonJsSessionTokenResolverCode } from './session-cookie-resolver'
+
+const PRODUCTS_TABLE = 'teleport_products'
+const MAX_PRODUCT_IDS = 50
+const IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/
+
+/** Where the storefront serves a single product from, read off the UIDL's route table. */
+export interface ProductDetailsRoute {
+  // `/products` for a page emitted at `/products/[slug]`; `/` when the details
+  // page sits at the root.
+  staticBase: string
+  // The product column the dynamic segment carries (`slug`, `id`).
+  differentiatorColumn: string
+}
+
+export const hasSubscriberOnlyPages = (auth: UIDLAuthentication | undefined): boolean => {
+  if (!auth || !auth.pageProtection) {
+    return false
+  }
+  return Object.values(auth.pageProtection).some(
+    (protection) => !!protection && protection.requiresSubscription === true
+  )
+}
+
+const routeValuesOf = (uidl: ProjectUIDL | undefined): any[] => {
+  const values = (uidl as any)?.root?.stateDefinitions?.route?.values
+  return Array.isArray(values) ? values : []
+}
+
+/** The feature identifier every storefront product page exposes its product under. */
+const STOREFRONT_PRODUCT_FEATURE = 'ecommerceProduct'
+
+const toProductRoute = (route: unknown, attribute: unknown): ProductDetailsRoute | null => {
+  const staticBase = typeof route === 'string' && route.startsWith('/') ? route : ''
+  const column = typeof attribute === 'string' ? attribute : ''
+  return staticBase && IDENTIFIER_RE.test(column)
+    ? { staticBase, differentiatorColumn: column }
+    : null
+}
+
+/**
+ * The STANDARD product-details page. When the store has custom product pages
+ * the UIDL names it (`ecommerceSettings.productPages.standard`). Otherwise it is
+ * the route value whose `detailsPageInfo` reads the products table — a
+ * storefront product page first, since the write-a-review page reads that table
+ * too. Its `navLink` is `<base>/[<column>]`; the base is what the list page
+ * shares with it by platform convention.
+ */
+export const resolveProductDetailsRoute = (
+  uidl: ProjectUIDL | undefined
+): ProductDetailsRoute | null => {
+  const standard = uidl?.ecommerceSettings?.productPages?.standard
+  if (standard) {
+    const route = toProductRoute(standard.route, standard.attribute)
+    if (route) {
+      return route
+    }
+  }
+  const candidates: Array<{ route: ProductDetailsRoute; storefront: boolean }> = []
+  for (const routeValue of routeValuesOf(uidl)) {
+    const pageOptions = routeValue?.pageOptions
+    const info = pageOptions?.detailsPageInfo
+    if (!info || String(info.tableName || '').toLowerCase() !== PRODUCTS_TABLE) {
+      continue
+    }
+    const navLink = String(pageOptions.navLink || '')
+    const column = String(info.differentiatorColumn || pageOptions.dynamicRouteAttribute || '')
+    const route = toProductRoute(navLink.replace(/\/\[[^\]]*\]$/, '') || '/', column)
+    if (navLink.startsWith('/') && route) {
+      candidates.push({ route, storefront: info.featureIdentifier === STOREFRONT_PRODUCT_FEATURE })
+    }
+  }
+  const chosen = candidates.find((candidate) => candidate.storefront) || candidates[0]
+  return chosen ? chosen.route : null
+}
+
+/**
+ * Every custom product page by key (`ecommerceSettings.productPages.pages`),
+ * so a product that opens on one is sent there. Empty on a store without
+ * custom product pages.
+ */
+export const resolveCustomProductPageRoutes = (
+  uidl: ProjectUIDL | undefined
+): Record<string, ProductDetailsRoute> => {
+  const pages = uidl?.ecommerceSettings?.productPages?.pages || {}
+  const routes: Record<string, ProductDetailsRoute> = {}
+  for (const key of Object.keys(pages)) {
+    const route = toProductRoute(pages[key]?.route, pages[key]?.attribute)
+    if (route) {
+      routes[key] = route
+    }
+  }
+  return routes
+}
+
+/**
+ * Where the middleware sends a visitor who lacks the subscription when the
+ * route could name no product page: the products listing when the store has
+ * one (a page served at the details page's static base), else the home page.
+ */
+export const resolveSubscriptionFallbackRoute = (uidl: ProjectUIDL | undefined): string => {
+  const details = resolveProductDetailsRoute(uidl)
+  if (!details || details.staticBase === '/') {
+    return '/'
+  }
+  const hasListing = routeValuesOf(uidl).some(
+    (routeValue) => String(routeValue?.pageOptions?.navLink || '') === details.staticBase
+  )
+  return hasListing ? details.staticBase : '/'
+}
+
+// The storefront page of the FIRST product a page names, on the standard page.
+const STANDARD_PAGE_REDIRECT = `async function resolveProductRedirect(productIds) {
+  var ids = normalizeProductIds(productIds);
+  if (!PRODUCT_DETAILS || ids.length === 0) {
+    return null;
+  }
+  try {
+    return await withClient(async function (client) {
+      var result = await client.query(
+        'SELECT "' + PRODUCT_DETAILS.differentiatorColumn + '" AS value FROM ' + PRODUCTS_TABLE + ' WHERE id::text = $1 LIMIT 1',
+        [ids[0]]
+      );
+      var value = result && result.rows && result.rows[0] ? result.rows[0].value : null;
+      if (value == null || String(value) === '') {
+        return null;
+      }
+      var base = PRODUCT_DETAILS.staticBase === '/' ? '' : PRODUCT_DETAILS.staticBase;
+      return base + '/' + encodeURIComponent(String(value));
+    });
+  } catch (e) {
+    return null;
+  }
+}`
+
+// The same, on a store with custom product pages: the product's own page — the
+// custom one its product_page names while that page exists, else the standard
+// one. The row is read whole (to_jsonb) so a store whose table lacks one of the
+// columns still answers.
+const PRODUCT_PAGE_AWARE_REDIRECT = `async function resolveProductRedirect(productIds) {
+  var ids = normalizeProductIds(productIds);
+  if (!PRODUCT_DETAILS || ids.length === 0) {
+    return null;
+  }
+  try {
+    return await withClient(async function (client) {
+      var result = await client.query(
+        'SELECT to_jsonb(p) AS row FROM ' + PRODUCTS_TABLE + ' p WHERE p.id::text = $1 LIMIT 1',
+        [ids[0]]
+      );
+      var row = result && result.rows && result.rows[0] ? result.rows[0].row : null;
+      if (!row) {
+        return null;
+      }
+      var key = typeof row.product_page === 'string' ? row.product_page.trim() : '';
+      var page =
+        key !== '' && Object.prototype.hasOwnProperty.call(PRODUCT_PAGES, key)
+          ? PRODUCT_PAGES[key]
+          : PRODUCT_DETAILS;
+      var value = row[page.differentiatorColumn];
+      if (value == null || String(value) === '') {
+        return null;
+      }
+      var base = page.staticBase === '/' ? '' : page.staticBase;
+      return base + '/' + encodeURIComponent(String(value));
+    });
+  } catch (e) {
+    return null;
+  }
+}`
+
+export interface SubscriberAccessHelperOptions {
+  productDetails: ProductDetailsRoute | null
+  /** Custom product pages by key (`resolveCustomProductPageRoutes`); absent or empty = none. */
+  productPages?: Record<string, ProductDetailsRoute>
+}
+
+/**
+ * `utils/auth/subscriber-access.js` (CommonJS). Exports:
+ *  - `normalizeProductIds(value)` — trimmed, de-duplicated ids from an array
+ *    or a comma-separated string, capped.
+ *  - `isSubscriberEntitled(userId, productIds)` — the entitlement query; an
+ *    empty list means any product. Throws on a database failure so a caller
+ *    can fail closed on its own terms.
+ *  - `resolveProductRedirect(productIds)` — the storefront page of the FIRST
+ *    product, or null (no product page, unknown product, database failure).
+ */
+export const generateSubscriberAccessHelperModule = (
+  options: SubscriberAccessHelperOptions
+): string => {
+  const details =
+    options.productDetails && IDENTIFIER_RE.test(options.productDetails.differentiatorColumn)
+      ? options.productDetails
+      : null
+  const productPages = options.productPages || {}
+  const hasProductPages = !!details && Object.keys(productPages).length > 0
+
+  return `'use strict';
+
+// GENERATED — see generateSubscriberAccessHelperModule in
+// @teleporthq/teleport-plugin-next-workflows/src/subscriber-access-route-generator.ts.
+//
+// Whether a signed-in visitor holds an entitled subscription: the one query the
+// subscriber-access route (for the middleware) and the workflow-route guard
+// share, so a page and its workflows can never disagree about who may read.
+${generatePgClientCode()}
+
+var SUBSCRIPTION_ENTITLED_STATUSES = ${JSON.stringify(
+    SubscriptionAccess.SUBSCRIPTION_ENTITLED_STATUSES
+  )};
+var ENTITLEMENT_SQL = ${JSON.stringify(SubscriptionAccess.SUBSCRIPTION_ENTITLEMENT_SQL)};
+var MAX_PRODUCT_IDS = ${MAX_PRODUCT_IDS};
+// The product-details page, when the store has one: its static base and the
+// product column its dynamic segment carries.
+var PRODUCT_DETAILS = ${JSON.stringify(details)};
+var PRODUCTS_TABLE = ${JSON.stringify(PRODUCTS_TABLE)};${
+    hasProductPages
+      ? `
+// The custom product pages by key: a product whose product_page names one
+// opens there instead of on the standard product page.
+var PRODUCT_PAGES = ${JSON.stringify(productPages)};`
+      : ''
+  }
+
+function normalizeProductIds(value) {
+  var raw = Array.isArray(value) ? value : typeof value === 'string' ? value.split(',') : [];
+  var ids = [];
+  for (var i = 0; i < raw.length && ids.length < MAX_PRODUCT_IDS; i++) {
+    var id = String(raw[i] == null ? '' : raw[i]).trim();
+    if (id && ids.indexOf(id) === -1) {
+      ids.push(id);
+    }
+  }
+  return ids;
+}
+
+async function withClient(run) {
+  var client = getClient();
+  try {
+    await client.connect();
+    return await run(client);
+  } finally {
+    try { await client.end(); } catch (e) {}
+  }
+}
+
+// true when the user holds a subscription in an entitled status to one of the
+// products — to any product when the list is empty.
+async function isSubscriberEntitled(userId, productIds) {
+  var id = String(userId == null ? '' : userId).trim();
+  if (!id) {
+    return false;
+  }
+  var ids = normalizeProductIds(productIds);
+  return withClient(async function (client) {
+    var result = await client.query(ENTITLEMENT_SQL, [id, SUBSCRIPTION_ENTITLED_STATUSES, ids]);
+    return !!(result && result.rows && result.rows.length > 0);
+  });
+}
+
+// The storefront page of the first product a page names, or null.
+${hasProductPages ? PRODUCT_PAGE_AWARE_REDIRECT : STANDARD_PAGE_REDIRECT}
+
+module.exports = {
+  SUBSCRIPTION_ENTITLED_STATUSES: SUBSCRIPTION_ENTITLED_STATUSES,
+  normalizeProductIds: normalizeProductIds,
+  isSubscriberEntitled: isSubscriberEntitled,
+  resolveProductRedirect: resolveProductRedirect,
+};
+`
+}
+
+/**
+ * `pages/api/auth/subscriber-access.js`: GET only, the session read from the
+ * forwarded cookie exactly as the workflow routes read it, then the shared
+ * helper. A failed query answers 500 — the middleware treats anything but an
+ * `entitled: true` body as "not entitled", so the page fails closed.
+ */
+export const generateSubscriberAccessRoute = (): string => {
+  return `'use strict';
+
+// GENERATED — see generateSubscriberAccessRoute in
+// @teleporthq/teleport-plugin-next-workflows/src/subscriber-access-route-generator.ts.
+//
+// Asked by the middleware for a subscriber-only page: does the visitor behind
+// this cookie hold an entitled subscription to one of ?products (any, when
+// none are named)? Never cached — a subscription can end between two requests.
+${generateCommonJsSessionTokenResolverCode()}
+var __subscriberAccess = require('../../../utils/auth/subscriber-access');
+
+module.exports = async function handler(req, res) {
+  res.setHeader('Cache-Control', 'no-store');
+  if (req.method !== 'GET') {
+    res.setHeader('Allow', 'GET');
+    return res.status(405).json({ error: 'Method not allowed' });
+  }
+
+  var token = null;
+  try {
+    token = await __tqSessionToken(req);
+  } catch (e) {
+    token = null;
+  }
+  var userId = token && (token.id != null ? token.id : token.sub);
+  if (userId == null || String(userId) === '') {
+    return res.status(401).json({ error: 'Unauthenticated' });
+  }
+
+  var productIds = __subscriberAccess.normalizeProductIds(req.query && req.query.products);
+  var entitled = false;
+  try {
+    entitled = await __subscriberAccess.isSubscriberEntitled(String(userId), productIds);
+  } catch (e) {
+    console.error('[subscriber-access] entitlement check failed:', e && e.message ? e.message : e);
+    return res.status(500).json({ error: 'Subscription check failed' });
+  }
+  if (entitled) {
+    return res.status(200).json({ entitled: true });
+  }
+
+  var body = { entitled: false };
+  var redirectTo = await __subscriberAccess.resolveProductRedirect(productIds);
+  if (redirectTo) {
+    body.redirectTo = redirectTo;
+  }
+  return res.status(200).json(body);
+};
+`
+}

package/src/types.ts

@@ -8,6 +8,12 @@ export interface WorkflowSegment {
   nodeIds: string[]
   nodes: UIDLWorkflowNode[]
   edges: UIDLWorkflowEdge[]
+  /**
+   * The nodes a branch decided outside this segment can start at: those with a
+   * predecessor outside it, or with none. Only there may a client's skip mark
+   * take effect (see `claimSegmentContext` in the runtime).
+   */
+  entryNodeIds?: string[]
 }
 
 export interface SecretEntry {