@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.68

package/__tests__/segment-state-keys-emission.test.ts

@@ -0,0 +1,185 @@
+import { createNextWorkflowPlugin } from '../src/workflow-component-plugin'
+import { NextWorkflowProjectPlugin } from '../src/workflow-project-plugin'
+
+// Every server segment descriptor a page, a custom node runner or a global
+// workflow ships carries `stateKeys`: the page state the segment (and the
+// custom nodes it calls) can read. The client runtime prunes the request to
+// it. A client segment carries none — it never leaves the browser.
+
+const TRIGGER_ID = 'trigger-1'
+
+const buildWorkflow = (): any => ({
+  id: 'wf-1',
+  name: 'Country Load',
+  trigger: {
+    type: 'event-page-loaded',
+    nodeId: TRIGGER_ID,
+    scope: 'page',
+    config: { pageId: 'page-1' },
+  },
+  nodes: [
+    {
+      id: 'call',
+      type: 'general-custom-node',
+      config: { customNodeId: 'cn-resolve', parameters: [] },
+      executionEnv: 'client',
+      stepNumber: 1,
+      label: 'Resolve',
+    },
+    {
+      id: 'query',
+      type: 'data-raw-query',
+      config: {
+        dataSourceId: 'ds',
+        query: 'SELECT 1',
+        params: [
+          '{{state.countryCode}}',
+          { type: 'workflowContext', nodeId: 'call', path: ['call', 'id'] },
+        ],
+      },
+      executionEnv: 'server',
+      stepNumber: 2,
+      label: 'Query',
+    },
+    {
+      id: 'write',
+      type: 'state-update-local-state',
+      config: {
+        property: 'rows',
+        value: { type: 'workflowContext', nodeId: 'query', path: ['query', 'rows'] },
+      },
+      executionEnv: 'client',
+      stepNumber: 3,
+      label: 'Write',
+    },
+  ],
+  edges: [
+    { id: 'e1', source: TRIGGER_ID, target: 'call' },
+    { id: 'e2', source: 'call', target: 'query' },
+    { id: 'e3', source: 'query', target: 'write' },
+  ],
+})
+
+const customNodes: Record<string, any> = {
+  'cn-resolve': {
+    id: 'cn-resolve',
+    name: 'Resolve',
+    parameters: [],
+    nodes: [
+      {
+        id: 'inner-query',
+        type: 'data-raw-query',
+        label: 'Inner',
+        config: { dataSourceId: 'ds', query: 'SELECT 1', params: ['{{Current User.id}}'] },
+        executionEnv: 'server',
+        stepNumber: 0,
+      },
+    ],
+    edges: [],
+  },
+}
+
+const buildStructure = (workflow: any): any => ({
+  uidl: {
+    name: 'Page',
+    outputOptions: { pageId: 'page-1', fileName: 'page-1' },
+    node: { type: 'element', content: { elementType: 'container', name: 'Container' } },
+    stateDefinitions: { rows: { type: 'array', defaultValue: [] } },
+  },
+  chunks: [
+    {
+      type: 'chunk-type-ast',
+      name: 'jsx-component',
+      content: {
+        type: 'VariableDeclaration',
+        declarations: [
+          {
+            type: 'VariableDeclarator',
+            init: {
+              type: 'ArrowFunctionExpression',
+              body: { type: 'BlockStatement', body: [{ type: 'ReturnStatement', argument: null }] },
+            },
+          },
+        ],
+      },
+    },
+  ],
+  options: { workflows: { workflows: { 'wf-1': workflow }, customNodes } },
+  dependencies: {},
+})
+
+const pageModuleCode = async (workflow: any): Promise<string> => {
+  const structure = buildStructure(workflow)
+  await createNextWorkflowPlugin({ isPage: true })(structure)
+  const chunk = (structure.chunks as any[]).find((c: any) => c.name === 'workflow-module')
+  if (!chunk) {
+    throw new Error('workflow-module chunk not emitted')
+  }
+  return String(chunk.content)
+}
+
+const segmentDescriptors = (code: string): Array<Record<string, unknown>> => {
+  const match = code.match(/segments:\s*(\[[\s\S]*?\]),\n\s*nodes:/)
+  if (!match) {
+    throw new Error('segments literal not found')
+  }
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  return new Function(`return ${match[1]};`)() as Array<Record<string, unknown>>
+}
+
+describe('server segment descriptors carry the page state they read', () => {
+  it('a page workflow: the segment names its own tokens and those of the custom node it calls', async () => {
+    const segments = segmentDescriptors(await pageModuleCode(buildWorkflow()))
+    const server = segments.filter((s) => s.env === 'server')
+    const client = segments.filter((s) => s.env === 'client')
+    expect(server).toHaveLength(1)
+    expect(server[0].stateKeys).toEqual(['countryCode'])
+    expect(client.length).toBeGreaterThan(0)
+    for (const seg of client) {
+      expect(seg).not.toHaveProperty('stateKeys')
+    }
+  })
+
+  it('a page workflow whose server segment calls the custom node carries what the node reads', async () => {
+    const workflow = buildWorkflow()
+    // Move the call next to the query: the call node's env is decided by its
+    // handler, so make it a server-side custom-js that names the custom node
+    // through a nested config the walk still reaches.
+    workflow.nodes[1].config.params.push({
+      type: 'workflowContext',
+      nodeId: 'call',
+      path: ['call', '__stateValues', 'cartId'],
+    })
+    const segments = segmentDescriptors(await pageModuleCode(workflow))
+    const server = segments.find((s) => s.env === 'server') as Record<string, unknown>
+    expect(server.stateKeys).toEqual(['cartId', 'countryCode'])
+  })
+
+  it('a custom node runner: each inner server segment names what it reads', () => {
+    const plugin = new NextWorkflowProjectPlugin() as unknown as {
+      generateCustomNodesFile: (
+        nodes: Record<string, unknown>,
+        urls: Record<string, Record<string, string>>
+      ) => string
+    }
+    const source = plugin.generateCustomNodesFile(customNodes, {
+      'cn-resolve': { 'server-1': '/api/workflows/resolve-seg-1' },
+    })
+    expect(source).toContain('"stateKeys":["currentUser"]')
+  })
+
+  it('a global workflow: its server segments name what they read', () => {
+    const plugin = new NextWorkflowProjectPlugin() as unknown as {
+      generateGlobalWorkflowsHook: (workflows: unknown[], nodes: Record<string, unknown>) => string
+    }
+    const workflow = buildWorkflow()
+    workflow.trigger = {
+      type: 'event-custom-triggered',
+      nodeId: TRIGGER_ID,
+      scope: 'global',
+      config: { eventName: 'ping' },
+    }
+    const source = plugin.generateGlobalWorkflowsHook([workflow], customNodes)
+    expect(source).toContain('"stateKeys":["countryCode"]')
+  })
+})

package/__tests__/segment-state-needs.test.ts

@@ -0,0 +1,102 @@
+import { ALL_STATE_KEYS, collectSegmentStateKeys } from '../src/segment-context-needs'
+import type { UIDLCustomWorkflowNode, UIDLWorkflowNode } from '@teleporthq/teleport-types'
+
+// The page state a server segment may read is decided at generation time from
+// the ways a server node can reach `__stateValues`. These pin each way, and
+// that a custom-JS node — whose handler never exposes the bag — adds nothing.
+
+const node = (id: string, type: string, config: Record<string, unknown>): UIDLWorkflowNode =>
+  ({ id, type, config, stepNumber: 1, label: id } as unknown as UIDLWorkflowNode)
+
+const ref = (nodeId: string, path: string[]) => ({ type: 'workflowContext', nodeId, path })
+
+describe('collectSegmentStateKeys', () => {
+  it('names nothing for nodes that read no page state', () => {
+    const nodes = [
+      node('q', 'data-raw-query', {
+        query: 'SELECT 1',
+        params: [ref('trigger', ['trigger', 'formData', 'email'])],
+      }),
+      node('js', 'general-custom-js', {
+        code: 'function customHandler(params) { return { state: params[0] } }',
+      }),
+    ]
+    expect(collectSegmentStateKeys(nodes, {})).toEqual([])
+  })
+
+  it('reads the state a whole-string template token names, wherever it sits in the config', () => {
+    const nodes = [
+      node('q', 'data-raw-query', {
+        query: 'SELECT 1',
+        params: ['{{state.countryCode}}', { nested: { deeper: '{{ state.cart.items }}' } }],
+      }),
+    ]
+    expect(collectSegmentStateKeys(nodes, {})).toEqual(['cart', 'countryCode'])
+  })
+
+  it('reads currentUser for the {{Current User.id}} tokens', () => {
+    expect(
+      collectSegmentStateKeys([node('q', 'data-select', { filters: ['{{Current User.id}}'] })], {})
+    ).toEqual(['currentUser'])
+    expect(
+      collectSegmentStateKeys([node('q', 'data-select', { filters: ['{{ currentUser.id }}'] })], {})
+    ).toEqual(['currentUser'])
+  })
+
+  it('reads the state a context reference walks into through the bag', () => {
+    const nodes = [
+      node('q', 'data-select', {
+        filters: [{ field: 'id', value: ref('trigger', ['trigger', '__stateValues', 'orderId']) }],
+      }),
+    ]
+    expect(collectSegmentStateKeys(nodes, {})).toEqual(['orderId'])
+  })
+
+  it('keeps the whole bag for a reference that stops at the bag', () => {
+    const nodes = [
+      node('q', 'data-select', { value: ref('trigger', ['trigger', '__stateValues']) }),
+    ]
+    expect(collectSegmentStateKeys(nodes, {})).toBe(ALL_STATE_KEYS)
+  })
+
+  it('keeps the whole bag for an expression that may read it', () => {
+    const nodes = [
+      node('gate', 'general-if-statement', {
+        conditionType: 'expression',
+        condition: 'context.__stateValues.total > 10',
+      }),
+    ]
+    expect(collectSegmentStateKeys(nodes, {})).toBe(ALL_STATE_KEYS)
+  })
+
+  it('follows a custom node call into its inner nodes, once, cycles included', () => {
+    const customNodes: Record<string, UIDLCustomWorkflowNode> = {
+      'cn-a': {
+        id: 'cn-a',
+        name: 'A',
+        nodes: [
+          node('inner', 'data-raw-query', { query: 'SELECT 1', params: ['{{state.locale}}'] }),
+          node('again', 'general-custom-node', { customNodeId: 'cn-b' }),
+        ],
+        edges: [],
+      } as unknown as UIDLCustomWorkflowNode,
+      'cn-b': {
+        id: 'cn-b',
+        name: 'B',
+        nodes: [
+          node('back', 'general-custom-node', { customNodeId: 'cn-a' }),
+          node('deep', 'data-raw-query', { query: 'SELECT 1', params: ['{{state.currency}}'] }),
+        ],
+        edges: [],
+      } as unknown as UIDLCustomWorkflowNode,
+    }
+    const nodes = [node('call', 'general-custom-node', { customNodeId: 'cn-a', parameters: [] })]
+    expect(collectSegmentStateKeys(nodes, customNodes)).toEqual(['currency', 'locale'])
+  })
+
+  it('ignores a custom node the index does not hold', () => {
+    const nodes = [node('call', 'general-custom-node', { customNodeId: 'missing' })]
+    expect(collectSegmentStateKeys(nodes, {})).toEqual([])
+    expect(collectSegmentStateKeys(nodes, undefined)).toEqual([])
+  })
+})

package/__tests__/server-segment-context-integrity.test.ts

@@ -0,0 +1,210 @@
+import { generateServerSegmentAPIRoute } from '../src'
+import { splitIntoSegments } from '../src/segment-splitter'
+import type { WorkflowSegment } from '../src/types'
+import { loadServerRuntime } from './_helpers/load-server-runtime'
+import type { ServerSegmentRouteOptions } from '../src/api-route-generator'
+
+// A server segment's nodes run inside the route, and whatever the request says
+// about them arrives from the browser. A crafted POST used to be able to hand
+// a later node a forged result by marking the real producer skipped, to skip a
+// node in the middle of the segment (a sanitizer, a guard) while its
+// successors ran, and to point a custom node's inner custom-js at an injected
+// context key. These run the GENERATED route against such requests.
+
+interface RouteReply {
+  status: number
+  body: { success: boolean; results?: Record<string, unknown>; error?: string }
+}
+
+function bootRoute(segment: WorkflowSegment, options?: ServerSegmentRouteOptions) {
+  const source = generateServerSegmentAPIRoute(segment, 'Integrity', undefined, options)
+  const utils = loadServerRuntime()
+  const requireStub = (id: string) => (id.endsWith('server-runtime') ? utils : {})
+  const routeModule: { exports: unknown } = { exports: {} }
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  new Function('module', 'exports', 'require', source)(
+    routeModule,
+    routeModule.exports,
+    requireStub
+  )
+  const handler = routeModule.exports as (req: unknown, res: unknown) => Promise<void>
+  return async (context: Record<string, unknown>): Promise<RouteReply> => {
+    const reply: RouteReply = { status: 0, body: { success: false } }
+    const res = {
+      status(code: number) {
+        reply.status = code
+        return this
+      },
+      json(payload: RouteReply['body']) {
+        reply.body = payload
+        return this
+      },
+    }
+    await handler({ method: 'POST', body: { context }, headers: { host: 'localhost:3000' } }, res)
+    return reply
+  }
+}
+
+const script = (body: string) => `function customHandler(params) { ${body} }`
+
+// load → price → withhold: the shape of a server step that must not be steered.
+const loadNode = {
+  id: 'load',
+  type: 'general-custom-js',
+  label: 'Load Lines',
+  executionEnv: 'server' as const,
+  stepNumber: 1,
+  config: { code: script('return { rows: [{ amount: 10 }] }'), context: 'server' },
+}
+const priceNode = {
+  id: 'price',
+  type: 'general-custom-js',
+  label: 'Price Lines',
+  executionEnv: 'server' as const,
+  stepNumber: 2,
+  config: {
+    code: script(
+      'var named = params[params.length - 1] || {}; var rows = named.rows || []; return { total: rows.reduce(function (s, r) { return s + r.amount; }, 0), secret: "code-123" }'
+    ),
+    context: 'server',
+    params: { rows: { type: 'workflowContext', nodeId: 'load', path: ['rows'] } },
+  },
+}
+const withholdNode = {
+  id: 'withhold',
+  type: 'general-custom-js',
+  label: 'Withhold Secret',
+  executionEnv: 'server' as const,
+  stepNumber: 3,
+  config: {
+    code: script('return { withheld: true }'),
+    context: 'server',
+  },
+}
+const chain: WorkflowSegment = {
+  id: 'server-1',
+  env: 'server',
+  nodeIds: ['load', 'price', 'withhold'],
+  nodes: [loadNode, priceNode, withholdNode],
+  edges: [
+    { id: 'e1', source: 'load', target: 'price' },
+    { id: 'e2', source: 'price', target: 'withhold' },
+  ] as WorkflowSegment['edges'],
+  entryNodeIds: ['load'],
+}
+
+describe('generated server segment — what the request says about its own nodes', () => {
+  it('drops a forged result for a node it runs itself', async () => {
+    const run = bootRoute(chain)
+    const reply = await run({ load: { rows: [{ amount: 100000 }] } })
+    expect(reply.status).toBe(200)
+    expect(reply.body.results?.load).toEqual({ rows: [{ amount: 10 }] })
+    expect(reply.body.results?.price).toMatchObject({ total: 10 })
+  })
+
+  it('cannot keep a forged result alive by marking its producer skipped', async () => {
+    const run = bootRoute(chain)
+    const reply = await run({
+      load: { rows: [{ amount: 100000 }] },
+      __skippedNodes: { load: true },
+    })
+    expect(reply.status).toBe(200)
+    // A skip where the branch enters the segment covers everything it
+    // reaches inside it, as the client's own branch walk marks it.
+    expect(reply.body.results?.load).toBeUndefined()
+    expect(reply.body.results?.price).toBeUndefined()
+    expect(reply.body.results?.withhold).toBeUndefined()
+  })
+
+  it('ignores a skip mark on a node in the middle of the segment', async () => {
+    const run = bootRoute(chain)
+    const reply = await run({ __skippedNodes: { withhold: true, price: true } })
+    expect(reply.body.results?.price).toMatchObject({ total: 10 })
+    expect(reply.body.results?.withhold).toEqual({ withheld: true })
+  })
+
+  it('ignores a loop-body mark the request puts on one of its own nodes', async () => {
+    // The route skips loop-body nodes in its main pass; only its own loop
+    // handling may mark them.
+    const run = bootRoute(chain)
+    const reply = await run({ __loopBodyNodeIds: { withhold: true, price: true } })
+    expect(reply.body.results?.price).toMatchObject({ total: 10 })
+    expect(reply.body.results?.withhold).toEqual({ withheld: true })
+  })
+
+  it('still skips a branch the client decided where it enters the segment', async () => {
+    // A client if-node upstream chose the other branch: both of its targets
+    // landed in this segment, and only the untaken one is marked.
+    const other = { ...withholdNode, id: 'other', label: 'Other Branch', stepNumber: 2 }
+    const branches: WorkflowSegment = {
+      id: 'server-1',
+      env: 'server',
+      nodeIds: ['load', 'other'],
+      nodes: [loadNode, other],
+      edges: [],
+      entryNodeIds: ['load', 'other'],
+    }
+    const reply = await bootRoute(branches)({ __skippedNodes: { other: true } })
+    expect(reply.body.results?.load).toEqual({ rows: [{ amount: 10 }] })
+    expect(reply.body.results?.other).toBeUndefined()
+  })
+
+  it('reads a custom node inner results by the ids baked into the route', async () => {
+    const readFirst = {
+      id: 'read',
+      type: 'general-custom-js',
+      label: 'Read First Param',
+      executionEnv: 'server' as const,
+      stepNumber: 2,
+      config: {
+        code: 'function customHandler(previous, params) { return { first: params[0] } }',
+        context: 'server',
+      },
+    }
+    const segment: WorkflowSegment = {
+      id: 'server-1',
+      env: 'server',
+      nodeIds: ['load', 'read'],
+      nodes: [loadNode, readFirst],
+      edges: [{ id: 'e1', source: 'load', target: 'read' }] as WorkflowSegment['edges'],
+      entryNodeIds: ['load'],
+    }
+    const run = bootRoute(segment, { customNodeIds: ['load', 'read'] })
+    const reply = await run({
+      __isInsideCustomNode: true,
+      __customNodeIds: ['injected', 'load', 'read'],
+      injected: { rows: [{ amount: 100000 }] },
+    })
+    expect(reply.body.results?.read).toEqual({ first: { rows: [{ amount: 10 }] } })
+  })
+})
+
+describe('splitIntoSegments — entry nodes', () => {
+  it('marks where a branch from outside the segment can begin, convergence included', () => {
+    const node = (id: string, type: string, stepNumber: number) => ({
+      id,
+      type,
+      label: id,
+      stepNumber,
+      config: {},
+    })
+    const segments = splitIntoSegments({
+      nodes: [
+        node('gate', 'general-if-statement', 1),
+        node('a', 'data-select', 2),
+        node('b', 'data-select', 3),
+        node('join', 'data-select', 4),
+      ],
+      edges: [
+        { id: 'e1', source: 'gate', target: 'a', sourceHandle: 'true' },
+        { id: 'e2', source: 'gate', target: 'b', sourceHandle: 'false' },
+        { id: 'e3', source: 'a', target: 'join' },
+        { id: 'e4', source: 'gate', target: 'join', sourceHandle: 'true' },
+      ],
+      trigger: { type: 'manual' },
+    } as never)
+    const server = segments.find((s) => s.env === 'server')
+    expect(server?.nodeIds).toEqual(expect.arrayContaining(['a', 'b', 'join']))
+    expect(server?.entryNodeIds).toEqual(expect.arrayContaining(['a', 'b', 'join']))
+  })
+})