@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.69

package/__tests__/invoice-reservation.test.ts

@@ -0,0 +1,195 @@
+import { generateInvoiceGenerateRouteCode } from '../src/invoice/api-routes-code'
+import type { UIDLInvoiceSettings } from '@teleporthq/teleport-types'
+import {
+  INVOICE_TEST_APP_SECRET,
+  createInvoiceRouteRequire,
+  evaluateEmittedModule,
+  serverCallHeaders,
+} from './_helpers/load-invoice-route'
+
+// A provider delivers a slow webhook again while the first delivery is still
+// rendering the invoice, so `/api/invoices/generate` is asked twice for one
+// order at once. The route reserves the number and the row before it renders
+// (`reserveInvoice`), and a second request finds that reservation instead of
+// issuing another invoice.
+
+type Row = Record<string, unknown>
+
+const SETTINGS = {
+  invoicePrefix: 'INV-',
+  defaultTaxRate: 0,
+  showDiscount: false,
+  taxIncludedInPrice: false,
+  companyDetails: {},
+  template: { document: null as unknown },
+  tables: { invoicesTable: 'teleport_invoices', invoiceItemsTable: 'teleport_invoice_items' },
+  emailDelivery: { enabled: false },
+} as unknown as UIDLInvoiceSettings
+
+const ORDER = {
+  id: 'order-1',
+  currency: 'USD',
+  total_amount: 96,
+  billing_name: 'Jane Buyer',
+  billing_email: 'jane@example.com',
+}
+const ORDER_ITEMS = [
+  { product_id: 'p1', product_name: 'Mug', quantity: 2, unit_price: 48, total_price: 96 },
+]
+
+interface Run {
+  status: number
+  payload: Row
+  renders: number
+  stored: Array<{ id: string; bytes: number }>
+  staleClaims: string[]
+}
+
+async function run(
+  reservation: (invoiceData: Row) => { invoice: Row; created: boolean },
+  stale = false
+): Promise<Run> {
+  let renders = 0
+  const stored: Array<{ id: string; bytes: number }> = []
+  const staleClaims: string[] = []
+  const dataAccess = {
+    getOrderWithItems: async () => ({ order: ORDER, items: ORDER_ITEMS }),
+    reserveInvoice: async (invoiceData: Row) => reservation(invoiceData),
+    claimStaleInvoice: async (id: string) => {
+      staleClaims.push(id)
+      return stale
+    },
+    storeInvoicePdf: async (id: string, pdf: Buffer) => {
+      stored.push({ id, bytes: pdf.length })
+      return {}
+    },
+    updateInvoice: async () => ({}),
+  }
+  const pdfGenerator = {
+    generateInvoicePdf: async (invoiceData: Row) => {
+      renders += 1
+      return Buffer.from('%PDF-1.4 ' + String(invoiceData.invoiceNumber))
+    },
+    COMPANY_DETAILS: {},
+  }
+  const handler = evaluateEmittedModule<(req: unknown, res: unknown) => Promise<void>>(
+    generateInvoiceGenerateRouteCode(SETTINGS),
+    createInvoiceRouteRequire(SETTINGS, { dataAccess, pdfGenerator })
+  )
+  let status = 0
+  let payload: Row = {}
+  const res = {
+    status(code: number) {
+      status = code
+      return this
+    },
+    json(value: Row) {
+      payload = value
+      return this
+    },
+    setHeader: () => undefined,
+    end: () => undefined,
+  }
+  const savedSecret = process.env.NEXTAUTH_SECRET
+  process.env.NEXTAUTH_SECRET = INVOICE_TEST_APP_SECRET
+  const quiet = [
+    jest.spyOn(console, 'info').mockImplementation(() => undefined),
+    jest.spyOn(console, 'warn').mockImplementation(() => undefined),
+  ]
+  try {
+    await handler(
+      { method: 'POST', headers: serverCallHeaders(), body: { orderId: 'order-1' } },
+      res
+    )
+  } finally {
+    quiet.forEach((spy) => spy.mockRestore())
+    if (savedSecret === undefined) {
+      delete process.env.NEXTAUTH_SECRET
+    } else {
+      process.env.NEXTAUTH_SECRET = savedSecret
+    }
+  }
+  return { status, payload, renders, stored, staleClaims }
+}
+
+describe('/api/invoices/generate — one invoice per order, one number per invoice', () => {
+  it('issues a new invoice under the number the reservation took', async () => {
+    const result = await run((invoiceData) => {
+      invoiceData.invoiceNumber = 'INV-0007'
+      return { invoice: { id: invoiceData.id }, created: true }
+    })
+    expect(result.status).toBe(200)
+    expect(result.payload).toMatchObject({ success: true, invoiceNumber: 'INV-0007' })
+    expect(result.renders).toBe(1)
+    expect(result.stored).toEqual([{ id: result.payload.invoiceId, bytes: expect.any(Number) }])
+    expect(result.staleClaims).toEqual([])
+  })
+
+  it('returns the invoice the order already has, without rendering or storing another', async () => {
+    const result = await run(() => ({
+      invoice: {
+        id: 'inv-1',
+        invoice_number: 'INV-0001',
+        pdf_size_bytes: 2048,
+        pdf_url: 'https://cdn.test/INV-0001.pdf',
+        total: '96.00',
+        currency: 'USD',
+      },
+      created: false,
+    }))
+    expect(result.status).toBe(200)
+    expect(result.payload).toEqual({
+      success: true,
+      alreadyIssued: true,
+      invoiceId: 'inv-1',
+      invoiceNumber: 'INV-0001',
+      storageUrl: 'https://cdn.test/INV-0001.pdf',
+      pdfUrl: 'https://cdn.test/INV-0001.pdf',
+      total: 96,
+      currency: 'USD',
+    })
+    expect(result.renders).toBe(0)
+    expect(result.stored).toEqual([])
+  })
+
+  it('names no storage URL for an invoice only the database serves', async () => {
+    const result = await run(() => ({
+      invoice: { id: 'inv-1', invoice_number: 'INV-0001', pdf_size_bytes: 2048, pdf_url: null },
+      created: false,
+    }))
+    expect(result.payload).toMatchObject({
+      storageUrl: '',
+      pdfUrl: '/api/invoices/inv-1/pdf',
+    })
+  })
+
+  it('refuses while another request is still rendering the same invoice', async () => {
+    const result = await run(() => ({
+      invoice: { id: 'inv-1', invoice_number: 'INV-0001', pdf_size_bytes: null },
+      created: false,
+    }))
+    expect(result.status).toBe(409)
+    expect(result.payload).toMatchObject({ success: false, inProgress: true })
+    expect(result.staleClaims).toEqual(['inv-1'])
+    expect(result.renders).toBe(0)
+    expect(result.stored).toEqual([])
+  })
+
+  it('finishes a reservation whose request died, under its own id and number', async () => {
+    const result = await run(
+      () => ({
+        invoice: { id: 'inv-1', invoice_number: 'INV-0001', pdf_size_bytes: null },
+        created: false,
+      }),
+      true
+    )
+    expect(result.status).toBe(200)
+    expect(result.payload).toMatchObject({
+      success: true,
+      invoiceId: 'inv-1',
+      invoiceNumber: 'INV-0001',
+    })
+    expect(result.renders).toBe(1)
+    expect(result.stored).toEqual([{ id: 'inv-1', bytes: expect.any(Number) }])
+  })
+})

package/__tests__/invoice-route-access.test.ts

@@ -0,0 +1,275 @@
+import type { UIDLInvoiceSettings } from '@teleporthq/teleport-types'
+import {
+  generateInvoiceGenerateRouteCode,
+  generateInvoicePdfRouteCode,
+} from '../src/invoice/api-routes-code'
+import {
+  INVOICE_TEST_APP_SECRET,
+  createInvoiceRouteRequire,
+  evaluateEmittedModule,
+  serverCallHeaders,
+} from './_helpers/load-invoice-route'
+import { loadHandler } from './_helpers/load-handler'
+
+/**
+ * Who may issue an invoice, and who may download one — executed against the
+ * emitted routes.
+ *
+ * `/api/invoices/generate` was open: anyone could print invoices on the
+ * merchant's letterhead, burn invoice numbers, claim an order's invoice for
+ * good (the order keeps the first invoice id it is given), and, naming another
+ * buyer's order id, read their personal data back. It now issues only for the
+ * store's own server code (the invoice node and the payment webhooks, which
+ * present the app secret) or a signed-in admin.
+ *
+ * `/api/invoices/[id]/pdf` served any invoice to whoever knew its id. It now
+ * serves the order's own buyer, an admin, or the server — and answers anyone
+ * else exactly as it answers an invoice that does not exist.
+ */
+
+type Row = Record<string, unknown>
+
+const SETTINGS = {
+  enabled: true,
+  invoicePrefix: 'INV-',
+  emailDelivery: { enabled: false },
+} as unknown as UIDLInvoiceSettings
+
+interface Session {
+  id: string
+  role?: string
+}
+
+interface Response {
+  status: number
+  payload: Row | null
+  headers: Record<string, unknown>
+  sent: Buffer | null
+}
+
+const SESSION_COOKIE = 'next-auth.session-token=signed'
+
+function fakeResponse(): { res: unknown; result: Response } {
+  const result: Response = { status: 0, payload: null, headers: {}, sent: null }
+  const res = {
+    status(code: number) {
+      result.status = code
+      return res
+    },
+    json(value: Row) {
+      result.payload = value
+      return res
+    },
+    setHeader(name: string, value: unknown) {
+      result.headers[name] = value
+    },
+    end(buffer: Buffer) {
+      result.sent = buffer
+    },
+  }
+  return { res, result }
+}
+
+const nextAuthJwt = (session: Session | null) => ({
+  getToken: async () => (session ? { sub: session.id, id: session.id, role: session.role } : null),
+})
+
+describe('/api/invoices/generate — issued by the store only', () => {
+  const savedSecret = process.env.NEXTAUTH_SECRET
+  beforeEach(() => {
+    process.env.NEXTAUTH_SECRET = INVOICE_TEST_APP_SECRET
+  })
+  afterEach(() => {
+    if (savedSecret === undefined) {
+      delete process.env.NEXTAUTH_SECRET
+    } else {
+      process.env.NEXTAUTH_SECRET = savedSecret
+    }
+  })
+
+  const boot = (session: Session | null) => {
+    const reads: string[] = []
+    const dataAccess = {
+      getOrderWithItems: async (orderId: string) => {
+        reads.push(orderId)
+        return null
+      },
+      reserveInvoice: async (invoiceData: Row) => ({ invoice: invoiceData, created: true }),
+    }
+    const handler = evaluateEmittedModule<(req: unknown, res: unknown) => Promise<void>>(
+      generateInvoiceGenerateRouteCode(SETTINGS),
+      createInvoiceRouteRequire(SETTINGS, {
+        dataAccess,
+        pdfGenerator: {},
+        modules: { 'next-auth/jwt': nextAuthJwt(session) },
+      })
+    )
+    return async (headers: Record<string, string>, body: Row = { orderId: 'order-1' }) => {
+      const { res, result } = fakeResponse()
+      await handler({ method: 'POST', headers, body }, res)
+      return { ...result, reads: reads.slice() }
+    }
+  }
+
+  it('refuses a visitor before it reads any order', async () => {
+    const result = await boot(null)({ host: 'localhost:3000' })
+    expect(result.status).toBe(401)
+    expect(result.reads).toEqual([])
+  })
+
+  it('refuses a signed-in shopper, whoever the order belongs to', async () => {
+    const result = await boot({ id: 'u1', role: 'user' })({
+      host: 'localhost:3000',
+      cookie: SESSION_COOKIE,
+    })
+    expect(result.status).toBe(403)
+    expect(result.reads).toEqual([])
+  })
+
+  it('refuses a wrong or empty app secret', async () => {
+    for (const secret of ['nope', '', INVOICE_TEST_APP_SECRET + 'x']) {
+      const result = await boot(null)({ host: 'localhost:3000', 'x-internal-data-secret': secret })
+      expect(result.status).toBe(401)
+      expect(result.reads).toEqual([])
+    }
+  })
+
+  it("serves the store's server code and a signed-in admin", async () => {
+    // Past the gate, an order with no lines is a 400 — the answer of a request
+    // that was let in.
+    const server = await boot(null)(serverCallHeaders())
+    expect(server.status).toBe(400)
+    expect(server.reads).toEqual(['order-1'])
+
+    const admin = await boot({ id: 'a1', role: 'admin' })({
+      host: 'localhost:3000',
+      cookie: SESSION_COOKIE,
+    })
+    expect(admin.status).toBe(400)
+    expect(admin.reads).toEqual(['order-1'])
+  })
+
+  it('is called by the invoice node with the app secret', async () => {
+    const handler = loadHandler('ecommerce-generate-invoice')
+    const calls: Array<{ url: string; init: { headers: Record<string, string> } }> = []
+    const savedFetch = (globalThis as any).fetch
+    ;(globalThis as any).fetch = async (url: string, init: { headers: Record<string, string> }) => {
+      calls.push({ url, init })
+      return { ok: true, json: async () => ({ invoiceId: 'i1', invoiceNumber: 'INV-0001' }) }
+    }
+    try {
+      const result = (await handler(
+        { orderId: 'order-1' },
+        {
+          __baseUrl: 'https://shop.test',
+          __internalHeaders: { 'x-vercel-protection-bypass': 'bypass' },
+        }
+      )) as Row
+      expect(result.invoiceNumber).toBe('INV-0001')
+    } finally {
+      ;(globalThis as any).fetch = savedFetch
+    }
+    expect(calls).toHaveLength(1)
+    expect(calls[0].url).toBe('https://shop.test/api/invoices/generate')
+    expect(calls[0].init.headers['x-internal-data-secret']).toBe(INVOICE_TEST_APP_SECRET)
+    expect(calls[0].init.headers['x-vercel-protection-bypass']).toBe('bypass')
+  })
+})
+
+describe('/api/invoices/[id]/pdf — served to its buyer and the store', () => {
+  const savedSecret = process.env.NEXTAUTH_SECRET
+  beforeEach(() => {
+    process.env.NEXTAUTH_SECRET = INVOICE_TEST_APP_SECRET
+  })
+  afterEach(() => {
+    if (savedSecret === undefined) {
+      delete process.env.NEXTAUTH_SECRET
+    } else {
+      process.env.NEXTAUTH_SECRET = savedSecret
+    }
+  })
+
+  const INVOICE = {
+    id: 'inv-1',
+    order_id: 'order-1',
+    invoice_number: 'INV-0001',
+    pdf_data: Buffer.from('%PDF-1.4 invoice'),
+  }
+
+  const boot = (session: Session | null, options: { lookupError?: Error } = {}) => {
+    const lookups: string[] = []
+    const dataAccess = {
+      getInvoiceById: async (id: string) => {
+        lookups.push(id)
+        if (options.lookupError) {
+          throw options.lookupError
+        }
+        return id === INVOICE.id ? INVOICE : null
+      },
+      getOrderWithItems: async (orderId: string) =>
+        orderId === 'order-1' ? { order: { id: 'order-1', user_id: 'buyer-1' }, items: [] } : null,
+    }
+    const handler = evaluateEmittedModule<(req: unknown, res: unknown) => Promise<void>>(
+      generateInvoicePdfRouteCode(),
+      createInvoiceRouteRequire(SETTINGS, {
+        dataAccess,
+        pdfGenerator: {},
+        modules: { 'next-auth/jwt': nextAuthJwt(session) },
+      })
+    )
+    return async (id: string, headers: Record<string, string> = {}) => {
+      const { res, result } = fakeResponse()
+      const quiet = jest.spyOn(console, 'error').mockImplementation(() => undefined)
+      try {
+        await handler({ method: 'GET', query: { id }, headers }, res)
+      } finally {
+        quiet.mockRestore()
+      }
+      return { ...result, lookups: lookups.slice() }
+    }
+  }
+
+  const signedIn = { host: 'localhost:3000', cookie: SESSION_COOKIE }
+
+  it('refuses a visitor before it looks the invoice up', async () => {
+    const result = await boot(null)('inv-1', { host: 'localhost:3000' })
+    expect(result.status).toBe(401)
+    expect(result.lookups).toEqual([])
+    expect(result.sent).toBeNull()
+  })
+
+  it("serves the order's own buyer, privately", async () => {
+    const result = await boot({ id: 'buyer-1', role: 'user' })('inv-1', signedIn)
+    expect(result.status).toBe(200)
+    expect(String(result.sent)).toBe('%PDF-1.4 invoice')
+    expect(result.headers['Cache-Control']).toBe('private, no-store')
+  })
+
+  it('answers another signed-in shopper exactly like a missing invoice', async () => {
+    const other = await boot({ id: 'someone-else', role: 'user' })('inv-1', signedIn)
+    const missing = await boot({ id: 'someone-else', role: 'user' })('inv-404', signedIn)
+    expect(other.status).toBe(404)
+    expect(other.sent).toBeNull()
+    expect(other.payload).toEqual(missing.payload)
+  })
+
+  it('serves an admin and the store server code any invoice', async () => {
+    expect((await boot({ id: 'a1', role: 'admin' })('inv-1', signedIn)).status).toBe(200)
+    expect((await boot(null)('inv-1', serverCallHeaders())).status).toBe(200)
+  })
+
+  it('reads a malformed id as missing, and an outage as a generic 500', async () => {
+    const malformed = Object.assign(new Error('invalid input syntax for type uuid'), {
+      code: '22P02',
+    })
+    expect((await boot(null, { lookupError: malformed })('x', serverCallHeaders())).status).toBe(
+      404
+    )
+
+    const outage = await boot(null, {
+      lookupError: new Error('connect ECONNREFUSED 10.0.0.5:5432'),
+    })('inv-1', serverCallHeaders())
+    expect(outage.status).toBe(500)
+    expect(JSON.stringify(outage.payload)).not.toContain('ECONNREFUSED')
+  })
+})

package/__tests__/invoice-self-call-origin.test.ts

@@ -0,0 +1,117 @@
+import { Blob as NodeBlob } from 'buffer'
+import type { UIDLInvoiceSettings } from '@teleporthq/teleport-types'
+import { createInvoiceRouteRequire } from './_helpers/load-invoice-route'
+
+/**
+ * The invoice routes upload the rendered PDF through the store's own
+ * `/api/runtime-storage/upload`, presenting the app secret. The origin used to
+ * be built from the request's Host header, which outside Vercel is whatever the
+ * caller sent — so a forged Host sent the PDF, and NEXTAUTH_SECRET, to the
+ * caller's server. It now follows the server runtime's trustedBaseUrl rule.
+ * Executed against the emitted `utils/invoices/invoice-assembly.js`.
+ */
+
+const SETTINGS = {
+  enabled: true,
+  invoicePrefix: 'INV-',
+  emailDelivery: { enabled: false },
+} as unknown as UIDLInvoiceSettings
+
+interface Assembly {
+  requestBaseUrl: (req: unknown) => string
+  uploadInvoicePdfToRuntimeStorage: (
+    pdf: Buffer,
+    fileName: string,
+    baseUrl: string
+  ) => Promise<{ storageUrl: string }>
+}
+
+const ENV_KEYS = ['NEXTAUTH_URL', 'VERCEL', 'NEXTAUTH_SECRET']
+
+describe('invoice self-calls go to the store, never to a host the request named', () => {
+  const saved: Record<string, string | undefined> = {}
+  beforeEach(() => {
+    ENV_KEYS.forEach((key) => {
+      saved[key] = process.env[key]
+      delete process.env[key]
+    })
+  })
+  afterEach(() => {
+    ENV_KEYS.forEach((key) => {
+      if (saved[key] === undefined) {
+        delete process.env[key]
+      } else {
+        process.env[key] = saved[key]
+      }
+    })
+  })
+
+  const assembly = (): Assembly =>
+    createInvoiceRouteRequire(SETTINGS, { dataAccess: {}, pdfGenerator: {} })(
+      '../../../utils/invoices/invoice-assembly'
+    ) as Assembly
+
+  it("takes NEXTAUTH_URL's origin over a forged Host header", () => {
+    process.env.NEXTAUTH_URL = 'https://shop.example/any/path'
+    const { requestBaseUrl } = assembly()
+    expect(requestBaseUrl({ headers: { host: 'evil.test' } })).toBe('https://shop.example')
+    expect(requestBaseUrl({ headers: { host: 'evil.test', 'x-forwarded-proto': 'http' } })).toBe(
+      'https://shop.example'
+    )
+  })
+
+  it("keeps the routed host on Vercel, and a local server's own port", () => {
+    process.env.NEXTAUTH_URL = 'https://shop.example'
+    process.env.VERCEL = '1'
+    expect(assembly().requestBaseUrl({ headers: { host: 'shop.vercel.app' } })).toBe(
+      'https://shop.vercel.app'
+    )
+
+    delete process.env.VERCEL
+    process.env.NEXTAUTH_URL = 'http://localhost:3000'
+    expect(assembly().requestBaseUrl({ headers: { host: 'localhost:3001' } })).toBe(
+      'http://localhost:3001'
+    )
+  })
+
+  it('sends the upload, secret included, to the trusted origin', async () => {
+    process.env.NEXTAUTH_URL = 'https://shop.example'
+    process.env.NEXTAUTH_SECRET = 'app-secret'
+    const { requestBaseUrl, uploadInvoicePdfToRuntimeStorage } = assembly()
+    const calls: Array<{ url: string; headers: Record<string, string> }> = []
+    const globals = globalThis as any
+    const original = { fetch: globals.fetch, Blob: globals.Blob, FormData: globals.FormData }
+    // The upload builds a multipart form; the jest environment lacks Node's own.
+    globals.Blob = globals.Blob || NodeBlob
+    globals.FormData =
+      globals.FormData ||
+      class {
+        public append(): void {
+          return
+        }
+      }
+    globals.fetch = async (url: string, init: { headers: Record<string, string> }) => {
+      calls.push({ url, headers: init.headers })
+      return {
+        ok: true,
+        status: 200,
+        json: async () => ({ files: [{ url: 'https://cdn.test/inv.pdf', id: 'f1' }] }),
+      }
+    }
+    try {
+      const result = await uploadInvoicePdfToRuntimeStorage(
+        Buffer.from('%PDF-1.4'),
+        'INV-0001.pdf',
+        requestBaseUrl({ headers: { host: 'evil.test' } })
+      )
+      expect(result.storageUrl).toBe('https://cdn.test/inv.pdf')
+    } finally {
+      globals.fetch = original.fetch
+      globals.Blob = original.Blob
+      globals.FormData = original.FormData
+    }
+    expect(calls).toHaveLength(1)
+    expect(calls[0].url).toBe('https://shop.example/api/runtime-storage/upload')
+    expect(calls[0].headers['x-internal-data-secret']).toBe('app-secret')
+  })
+})