@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.69

package/src/webhook-signature-verification.ts

@@ -1,4 +1,5 @@
-export const generateGetRawBodyCode = (): string => {
+/** The raw request body, and the object it stands for (JSON or form-encoded). */
+export const generateWebhookBodyCode = (): string => {
   return `
 function getRawBody(req) {
   return new Promise(function(resolve, reject) {
@@ -11,6 +12,29 @@ function getRawBody(req) {
     req.on('end', function() { resolve(Buffer.concat(chunks)); });
     req.on('error', function(err) { reject(err); });
   });
+}
+
+// Some providers (Mollie, CoinGate) post \`application/x-www-form-urlencoded\`.
+function parseWebhookBody(req, rawBody) {
+  var text = rawBody.toString('utf-8');
+  var contentType = String(req.headers['content-type'] || '').toLowerCase();
+  if (contentType.indexOf('application/x-www-form-urlencoded') === -1) {
+    try { return JSON.parse(text); } catch (_e) { return {}; }
+  }
+  var result = {};
+  var pairs = text ? text.split('&') : [];
+  for (var i = 0; i < pairs.length; i++) {
+    if (!pairs[i]) continue;
+    var eq = pairs[i].indexOf('=');
+    var key = eq >= 0 ? pairs[i].slice(0, eq) : pairs[i];
+    var value = eq >= 0 ? pairs[i].slice(eq + 1) : '';
+    try {
+      result[decodeURIComponent(key.replace(/\\+/g, ' '))] = decodeURIComponent(value.replace(/\\+/g, ' '));
+    } catch (_e) {
+      result[key] = value;
+    }
+  }
+  return result;
 }`
 }
 
@@ -60,16 +84,47 @@ function verifyStripeSignature(rawBody, sigHeader, secret) {
 }`
 }
 
+// The credentials are read through the same fallback chain the payment nodes
+// use: the canonical name the deploy writes, then the CONFIGURATION_* name the
+// provider panel stores locally (a standalone run has only that one). The
+// environment to verify against is the one that signed the event — PayPal
+// names it in the cert URL. Both environments issue client ids starting with
+// "A", so the id says nothing; the earlier "sb-" prefix check sent every
+// sandbox verification to the live API, which rejected it.
 export const generatePaypalSignatureVerificationCode = (): string => {
   return `
+function resolvePaypalEnv(candidates, prefix) {
+  var env = process.env;
+  for (var i = 0; i < candidates.length; i++) {
+    var value = candidates[i] ? env[candidates[i]] : '';
+    if (value && String(value).length > 0) return String(value);
+  }
+  var keys = Object.keys(env);
+  for (var k = 0; k < keys.length; k++) {
+    if (keys[k].indexOf(prefix) === 0 && env[keys[k]] && String(env[keys[k]]).length > 0) {
+      return String(env[keys[k]]);
+    }
+  }
+  return '';
+}
+
 async function verifyPaypalSignature(req, rawBody, webhookConfig) {
   try {
-    var clientId = process.env.PAYPAL_CLIENT_ID || '';
-    var clientSecret = process.env.PAYPAL_CLIENT_SECRET || '';
-    if (!clientId || !clientSecret) return false;
+    var clientId = resolvePaypalEnv(['PAYPAL_CLIENT_ID', 'CONFIGURATION_PAYPAL_CLIENT_ID'], 'CONFIGURATION_PAYPAL_CLIENT_ID');
+    var clientSecret = resolvePaypalEnv(['PAYPAL_CLIENT_SECRET', 'CONFIGURATION_PAYPAL_CLIENT_SECRET'], 'CONFIGURATION_PAYPAL_CLIENT_SECRET');
+    var webhookId = resolvePaypalEnv([webhookConfig.signatureSecret || '', 'PAYPAL_WEBHOOK_ID', 'CONFIGURATION_PAYPAL_WEBHOOK_ID'], 'CONFIGURATION_PAYPAL_WEBHOOK_ID');
+    if (!clientId || !clientSecret) {
+      console.error('PayPal webhook rejected: PAYPAL_CLIENT_ID / PAYPAL_CLIENT_SECRET are not configured');
+      return false;
+    }
+    if (!webhookId) {
+      console.error('PayPal webhook rejected: the webhook id (PAYPAL_WEBHOOK_ID) is not configured');
+      return false;
+    }
 
-    var isLive = !clientId.startsWith('sb-');
-    var baseUrl = isLive ? 'https://api-m.paypal.com' : 'https://api-m.sandbox.paypal.com';
+    var certUrl = String(req.headers['paypal-cert-url'] || '');
+    var isSandbox = certUrl.indexOf('sandbox.paypal.com') !== -1;
+    var baseUrl = isSandbox ? 'https://api-m.sandbox.paypal.com' : 'https://api-m.paypal.com';
 
     var authResponse = await fetch(baseUrl + '/v1/oauth2/token', {
       method: 'POST',
@@ -80,29 +135,39 @@ async function verifyPaypalSignature(req, rawBody, webhookConfig) {
       body: 'grant_type=client_credentials',
     });
     var authData = await authResponse.json();
-    if (!authData.access_token) return false;
-
-    var webhookId = process.env[webhookConfig.signatureSecret] || '';
+    if (!authData.access_token) {
+      console.error('PayPal webhook rejected: authentication against ' + baseUrl + ' failed — ' + (authData.error_description || authData.error || 'no token'));
+      return false;
+    }
 
+    // PayPal checks the signature over the event EXACTLY as it was sent, so
+    // the raw text is spliced in by position before the closing brace: parsed
+    // and serialised again, a number or a character escape can come back
+    // spelled differently and the signature no longer matches.
+    var fields = JSON.stringify({
+      auth_algo: req.headers['paypal-auth-algo'] || '',
+      cert_url: req.headers['paypal-cert-url'] || '',
+      transmission_id: req.headers['paypal-transmission-id'] || '',
+      transmission_sig: req.headers['paypal-transmission-sig'] || '',
+      transmission_time: req.headers['paypal-transmission-time'] || '',
+      webhook_id: webhookId,
+    });
     var verifyResponse = await fetch(baseUrl + '/v1/notifications/verify-webhook-signature', {
       method: 'POST',
       headers: {
         'Authorization': 'Bearer ' + authData.access_token,
         'Content-Type': 'application/json',
       },
-      body: JSON.stringify({
-        auth_algo: req.headers['paypal-auth-algo'] || '',
-        cert_url: req.headers['paypal-cert-url'] || '',
-        transmission_id: req.headers['paypal-transmission-id'] || '',
-        transmission_sig: req.headers['paypal-transmission-sig'] || '',
-        transmission_time: req.headers['paypal-transmission-time'] || '',
-        webhook_id: webhookId,
-        webhook_event: JSON.parse(rawBody.toString('utf-8')),
-      }),
+      body: fields.slice(0, -1) + ',"webhook_event":' + rawBody.toString('utf-8') + '}',
     });
     var verifyData = await verifyResponse.json();
-    return verifyData.verification_status === 'SUCCESS';
-  } catch (_e) {
+    var ok = verifyData.verification_status === 'SUCCESS';
+    if (!ok) {
+      console.error('PayPal webhook rejected by ' + baseUrl + ': verification_status=' + (verifyData.verification_status || '(missing)') + ', name=' + (verifyData.name || '(none)') + ', message=' + (verifyData.message || '(none)'));
+    }
+    return ok;
+  } catch (e) {
+    console.error('PayPal webhook verification failed:', e && e.message);
     return false;
   }
 }`
@@ -139,23 +204,37 @@ function verifyHmac${
 }`
 }
 
+// Fails CLOSED: a scheme it does not know, or a shared-secret scheme whose
+// secret is not configured, is a refusal — an HMAC keyed with an empty string
+// is one anybody can compute. `custom` is the author verifying the request in
+// the workflow itself (headers and body are on the trigger context); payment
+// webhooks never use it (see `generatePaymentWebhookVerificationCode`).
 export const generateSignatureDispatcherCode = (): string => {
   return `
 async function verifyWebhookSignature(req, rawBody, webhookConfig) {
   var algorithm = webhookConfig.signatureAlgorithm || 'hmac-sha256';
   var sigHeader = webhookConfig.signatureHeader || '';
   var sigSecret = webhookConfig.signatureSecret || '';
-  var secret = process.env[sigSecret] || '';
+  var secret = sigSecret ? process.env[sigSecret] || '' : '';
 
-  if (algorithm === 'stripe-v1') {
-    var sig = req.headers[sigHeader || 'stripe-signature'] || '';
-    return verifyStripeSignature(rawBody, sig, secret);
+  if (algorithm === 'custom') {
+    return true;
   }
 
   if (algorithm === 'paypal-v1') {
     return await verifyPaypalSignature(req, rawBody, webhookConfig);
   }
 
+  if (!secret) {
+    console.error('Webhook rejected: the signing secret (' + (sigSecret || 'none named') + ') is not configured.');
+    return false;
+  }
+
+  if (algorithm === 'stripe-v1') {
+    var sig = req.headers[sigHeader || 'stripe-signature'] || '';
+    return verifyStripeSignature(rawBody, sig, secret);
+  }
+
   if (algorithm === 'hmac-sha256') {
     var hmacSig = req.headers[(sigHeader || '').toLowerCase()] || '';
     return verifyHmacSignature(rawBody, hmacSig, secret);
@@ -166,7 +245,83 @@ async function verifyWebhookSignature(req, rawBody, webhookConfig) {
     return verifyHmacSha1Signature(rawBody, hmacSha1Sig, secret);
   }
 
-  return true;
+  console.error('Webhook rejected: unknown signature algorithm "' + algorithm + '".');
+  return false;
+}`
+}
+
+/**
+ * A PAYMENT webhook is verified by the store's driver for its provider (see
+ * `src/payments`): a signature, or the event read back from the provider
+ * with the store's own key. The answer carries the AUTHORITATIVE body — the
+ * copy the provider gave back, where there is one — and whether the provider
+ * should try again (an outage) rather than drop the delivery.
+ *
+ * The store's own server may also ask the route to SETTLE a payment it just
+ * confirmed with the provider (a PayPal buyer's return): a body naming
+ * `teleportReconcile`, accepted only with the runtime's internal-call token.
+ * The driver reads the payment from the provider and answers the event the
+ * provider sends for it; nothing but the provider's id is taken from the
+ * request, and any other caller is refused outright.
+ */
+export const generatePaymentWebhookVerificationCode = (): string => {
+  return `
+async function settlePaymentFromProvider(req, body, provider, driver) {
+  var internal = typeof utils !== 'undefined' && utils && typeof utils.isInternalCall === 'function' && utils.isInternalCall(req);
+  if (!internal || typeof driver.reconcile !== 'function') {
+    console.error('Payment webhook rejected (' + provider + '): a settlement request that did not come from this store.');
+    return { ok: false, retry: false };
+  }
+  try {
+    var settled = await driver.reconcile(body.teleportReconcile);
+    if (!settled || !settled.ok) {
+      console.error('Payment settlement skipped (' + provider + '): ' + ((settled && settled.reason) || 'not settled'));
+      return { ok: false, retry: !!(settled && settled.retry) };
+    }
+    return { ok: true, body: settled.body };
+  } catch (e) {
+    console.error('Payment settlement failed (' + provider + '):', e && e.message);
+    return { ok: false, retry: true };
+  }
+}
+
+async function verifyPaymentWebhook(req, rawBody, body, webhookConfig) {
+  var provider = webhookConfig.paymentProvider;
+  var driver = typeof __paymentDrivers !== 'undefined' && __paymentDrivers ? __paymentDrivers.get(provider) : null;
+  if (!driver || typeof driver.verifyWebhook !== 'function') {
+    console.error('Payment webhook rejected: this store has no ' + provider + ' payment driver.');
+    return { ok: false, retry: false };
+  }
+  if (body && typeof body === 'object' && body.teleportReconcile) {
+    return settlePaymentFromProvider(req, body, provider, driver);
+  }
+  var host = String(req.headers['x-forwarded-host'] || req.headers.host || '').split(',')[0].trim();
+  var proto = String(req.headers['x-forwarded-proto'] || '').split(',')[0].trim() ||
+    (host.indexOf('localhost') === 0 || host.indexOf('127.0.0.1') === 0 ? 'http' : 'https');
+  var sigSecret = webhookConfig.signatureSecret || '';
+  var sigSecretValue = sigSecret ? String(process.env[sigSecret] || '') : '';
+  try {
+    var result = await driver.verifyWebhook({
+      headers: req.headers || {},
+      rawBody: rawBody,
+      body: body,
+      query: req.query || {},
+      // The whole URL the provider posted to, query string included: Square
+      // signs the notification URL exactly as it was registered.
+      url: host ? proto + '://' + host + String(req.url || '') : '',
+      // A placeholder the deploy never resolved (a local run) is no secret:
+      // the driver then reads the saved credential itself.
+      secret: sigSecretValue.indexOf('teleporthq.secrets.') === 0 ? '' : sigSecretValue,
+    });
+    if (!result || !result.ok) {
+      console.error('Payment webhook rejected (' + provider + '): ' + ((result && result.reason) || 'not verified'));
+      return { ok: false, retry: !!(result && result.retry) };
+    }
+    return { ok: true, body: result.body || body };
+  } catch (e) {
+    console.error('Payment webhook verification failed (' + provider + '):', e && e.message);
+    return { ok: false, retry: true };
+  }
 }`
 }
 

package/src/workflow-auth-generator.ts

@@ -1,6 +1,27 @@
 import { UIDLWorkflowProtection } from '@teleporthq/teleport-types'
 import { generateCommonJsSessionTokenResolverCode } from './session-cookie-resolver'
 
+/**
+ * `roleOf(token)` — the role a decoded session token carries (`role`,
+ * `roleName`, or the first of `roles`), or null. Shared by every generated
+ * guard that authorises by role, so they can never read the claim differently.
+ */
+export const ROLE_OF_TOKEN_CODE = `function roleOf(token) {
+  if (!token || typeof token !== 'object') {
+    return null;
+  }
+  if (typeof token.role === 'string') {
+    return token.role;
+  }
+  if (typeof token.roleName === 'string') {
+    return token.roleName;
+  }
+  if (Array.isArray(token.roles) && token.roles.length > 0 && typeof token.roles[0] === 'string') {
+    return token.roles[0];
+  }
+  return null;
+}`
+
 /**
  * The shared, stateless auth guard for generated workflow API routes, emitted
  * once at `utils/workflows/workflow-auth.js`.
@@ -19,7 +40,9 @@ import { generateCommonJsSessionTokenResolverCode } from './session-cookie-resol
  * serverless instance that had not yet served an auth request was reported
  * anonymous, and the page-load workflow answered 401.
  */
-export const generateWorkflowAuthHelperFile = (): string => {
+export const generateWorkflowAuthHelperFile = (
+  options: { withSubscriberAccess?: boolean } = {}
+): string => {
   return `'use strict';
 
 // GENERATED — see generateWorkflowAuthHelperFile in
@@ -42,20 +65,22 @@ function sessionUserId(token) {
   return token.id != null ? token.id : (token.sub != null ? token.sub : null);
 }
 
-function roleOf(token) {
-  if (!token || typeof token !== 'object') {
-    return null;
-  }
-  if (typeof token.role === 'string') {
-    return token.role;
-  }
-  if (typeof token.roleName === 'string') {
-    return token.roleName;
+${ROLE_OF_TOKEN_CODE}
+
+${generateSubscriberAccessLoader(options.withSubscriberAccess === true)}
+
+// true only when the session user holds an entitled subscription to one of the
+// products (any product for an empty list). Every failure fails closed.
+async function isEntitledSubscriber(token, productIds) {
+  var userId = sessionUserId(token);
+  if (userId == null || String(userId) === '') {
+    return false;
   }
-  if (Array.isArray(token.roles) && token.roles.length > 0 && typeof token.roles[0] === 'string') {
-    return token.roles[0];
+  try {
+    return (await subscriberAccessModule().isSubscriberEntitled(String(userId), productIds || [])) === true;
+  } catch (e) {
+    return false;
   }
-  return null;
 }
 
 // Overwrites context[nodeId] drilled down \`path\` with the session user id.
@@ -76,16 +101,35 @@ function bindPath(root, path, value) {
 
 // Returns null when the request may proceed, or { status, message } to reject.
 // Mutates \`context\` in place to bind user-owned columns to the session user.
+function sameSecret(given, expected) {
+  if (typeof given !== 'string' || typeof expected !== 'string' || given.length !== expected.length) {
+    return false;
+  }
+  return require('crypto').timingSafeEqual(Buffer.from(given), Buffer.from(expected));
+}
+
 async function guardWorkflowRequest(req, context, policy) {
   if (!policy) {
     return null;
   }
 
+  // This deployment's own server code (a webhook or cron route running a
+  // custom node) carries the internal-call token and passes every gate. A route
+  // only such code may call (serverOnly) answers nothing to anyone else — not a
+  // browser, not a signed-in admin.
+  var internalCall = require('./server-runtime').isInternalCall(req);
+  if (policy.serverOnly) {
+    return internalCall ? null : { status: 401, message: 'Unauthenticated' };
+  }
+  if (internalCall) {
+    return null;
+  }
+
   // Trusted internal server-to-server calls (e.g. password reset, server jobs)
   // present the app secret in a header; only server code can read
   // NEXTAUTH_SECRET, so a browser cannot forge it. These bypass the check.
   var internal = req && req.headers && req.headers['x-internal-data-secret'];
-  if (internal && process.env.NEXTAUTH_SECRET && internal === process.env.NEXTAUTH_SECRET) {
+  if (internal && process.env.NEXTAUTH_SECRET && sameSecret(internal, process.env.NEXTAUTH_SECRET)) {
     return null;
   }
 
@@ -103,23 +147,53 @@ async function guardWorkflowRequest(req, context, policy) {
     }
   }
 
+  // Subscriber-only page: the route runs the same entitlement check the
+  // middleware asks the subscriber-access route for, after the session and the
+  // role are settled.
+  if (policy.requiresSubscription) {
+    if (!token) {
+      return { status: 401, message: 'Unauthenticated' };
+    }
+    if (!(await isEntitledSubscriber(token, policy.subscriptionProductIds || []))) {
+      return { status: 403, message: 'Subscription required' };
+    }
+  }
+
   // Identity binding: force every user-owned column to the AUTHENTICATED session
-  // id so a caller can never act on another user's rows. Only when a session is
-  // present — a guest keeps their (anonymous) client identity, which is why a
-  // guest-capable public write is not blocked here.
+  // id so a caller can never act on another user's rows.
+  //  - A plain user-id binding only applies when a session is present — a guest
+  //    keeps their (anonymous) client identity, which is why a guest-capable
+  //    public write is not blocked here.
+  //  - A \`claim: 'role'\` binding (a raw query's admin check) ALWAYS gets the
+  //    session's role, '' for a guest or a session without one, so a browser
+  //    can never claim a role it does not hold. Skipping it for a guest would
+  //    let a signed-out request post \`role: 'admin'\` and read every row.
+  //  - A \`claim: 'signedInUserId'\` binding always gets the session user id,
+  //    '' for a guest: a statement that must only ever touch the signed-in
+  //    caller's own row matches nothing for anybody else.
   if (policy.userScoped && context) {
     var sid = sessionUserId(token);
-    if (sid != null) {
-      var bindings = (policy.userScoped && policy.userScoped.bindings) || [];
-      for (var i = 0; i < bindings.length; i++) {
-        var b = bindings[i];
-        if (b && b.nodeId) {
-          if (context[b.nodeId] == null || typeof context[b.nodeId] !== 'object') {
-            context[b.nodeId] = {};
-          }
-          bindPath(context[b.nodeId], b.path || [], sid);
-        }
+    var sessionRole = roleOf(token) || '';
+    var bindings = (policy.userScoped && policy.userScoped.bindings) || [];
+    for (var i = 0; i < bindings.length; i++) {
+      var b = bindings[i];
+      if (!b || !b.nodeId) {
+        continue;
+      }
+      var value;
+      if (b.claim === 'role') {
+        value = sessionRole;
+      } else if (b.claim === 'signedInUserId') {
+        value = sid != null ? sid : '';
+      } else if (sid != null) {
+        value = sid;
+      } else {
+        continue;
+      }
+      if (context[b.nodeId] == null || typeof context[b.nodeId] !== 'object') {
+        context[b.nodeId] = {};
       }
+      bindPath(context[b.nodeId], b.path || [], value);
     }
   }
 
@@ -135,6 +209,26 @@ module.exports = { guardWorkflowRequest: guardWorkflowRequest };
  * generated API-route handler. Empty strings when the workflow has no policy,
  * so an unprotected route is byte-identical to before.
  */
+/**
+ * The entitlement query lives in `utils/auth/subscriber-access.js`, which the
+ * auth plugin emits only when a page is subscriber-only. A `require` of it is a
+ * static import to the bundler even inside a function, so it may only appear
+ * when that file exists — otherwise every project without such a page fails
+ * its build with "Module not found". Without the file the loader throws, and
+ * `isEntitledSubscriber` reads that as "not entitled" (fail closed).
+ */
+const generateSubscriberAccessLoader = (withSubscriberAccess: boolean): string =>
+  withSubscriberAccess
+    ? `// Entitlement query emitted with the subscriber-access route.
+function subscriberAccessModule() {
+  return require('../auth/subscriber-access');
+}`
+    : `// No page is subscriber-only, so no entitlement query was emitted: a policy
+// that still asks for a subscription fails closed.
+function subscriberAccessModule() {
+  throw new Error('No subscriber-only pages in this project');
+}`
+
 export interface WorkflowAuthInjection {
   // `require(...)` of the shared helper (placed with the other requires).
   requireLine: string
@@ -150,7 +244,10 @@ const EMPTY_INJECTION: WorkflowAuthInjection = { requireLine: '', policyConst: '
 export const buildWorkflowAuthInjection = (
   protection: UIDLWorkflowProtection | undefined
 ): WorkflowAuthInjection => {
-  if (!protection || (!protection.requiresAuth && !protection.userScoped)) {
+  if (
+    !protection ||
+    (!protection.requiresAuth && !protection.userScoped && !protection.serverOnly)
+  ) {
     return EMPTY_INJECTION
   }
 
@@ -158,14 +255,26 @@ export const buildWorkflowAuthInjection = (
   const policy: {
     requiresAuth: boolean
     allowedRoles: string[]
+    serverOnly?: boolean
     userScoped?: UIDLWorkflowProtection['userScoped']
+    requiresSubscription?: boolean
+    subscriptionProductIds?: string[]
   } = {
     requiresAuth: !!protection.requiresAuth,
     allowedRoles: protection.allowedRoles || [],
   }
+  if (protection.serverOnly) {
+    policy.serverOnly = true
+  }
   if (protection.userScoped) {
     policy.userScoped = protection.userScoped
   }
+  if (protection.requiresSubscription) {
+    policy.requiresSubscription = true
+    policy.subscriptionProductIds = (protection.subscriptionProductIds || [])
+      .map((id) => String(id).trim())
+      .filter((id) => id.length > 0)
+  }
 
   return {
     requireLine: `const __wfAuth = require('../../../utils/workflows/workflow-auth');\n`,