@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.69

package/__tests__/runtime-storage-upload-access.test.ts

@@ -0,0 +1,255 @@
+/* tslint:disable:function-constructor */
+import { Readable } from 'stream'
+import {
+  VISITOR_MAX_FILE_BYTES,
+  VISITOR_MAX_FILES,
+  generateRuntimeStorageUploadRoute,
+} from '../src/runtime-storage-generator'
+import { AbortControllerStub } from './_helpers/abort-controller-stub'
+
+/**
+ * `/api/runtime-storage/upload` stores files on the merchant's quota at a
+ * public URL. It used to forward anything — any type, any size, a `private`
+ * flag — and the storage worker checked the file against limits the same
+ * request supplied. Executed here against the emitted route with a fake
+ * upstream: what a visitor may upload is decided by the route, by each file's
+ * own bytes; the store's server code and its admins upload as before.
+ */
+
+const SECRET = 'app-secret'
+const BOUNDARY = '----tqboundary'
+
+const PNG = Buffer.concat([
+  Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]),
+  Buffer.from('rest-of-png'),
+])
+const JPEG = Buffer.concat([Buffer.from([255, 216, 255, 224]), Buffer.from('jfif')])
+const PDF = Buffer.from('%PDF-1.7 a print file')
+const SVG = Buffer.from('<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>')
+const HTML = Buffer.from('<html><body>phish</body></html>')
+
+interface Part {
+  name: string
+  filename?: string
+  type?: string
+  data: Buffer | string
+}
+
+function multipart(parts: Part[]): Buffer {
+  const chunks: Buffer[] = []
+  for (const part of parts) {
+    const disposition =
+      'Content-Disposition: form-data; name="' +
+      part.name +
+      '"' +
+      (part.filename !== undefined ? '; filename="' + part.filename + '"' : '')
+    const header =
+      '--' +
+      BOUNDARY +
+      '\r\n' +
+      disposition +
+      '\r\n' +
+      (part.type ? 'Content-Type: ' + part.type + '\r\n' : '') +
+      '\r\n'
+    chunks.push(Buffer.from(header), Buffer.from(part.data), Buffer.from('\r\n'))
+  }
+  chunks.push(Buffer.from('--' + BOUNDARY + '--\r\n'))
+  return Buffer.concat(chunks)
+}
+
+interface Upstream {
+  url: string
+  headers: Record<string, string>
+  body: unknown
+}
+
+function bootRoute(session: { role?: string } | null) {
+  const code = generateRuntimeStorageUploadRoute()
+  const moduleObj: { exports: any } = { exports: {} }
+  const fakeRequire = (name: string): any => {
+    if (name === 'next-auth/jwt') {
+      return { getToken: async () => (session ? { sub: 'u1', role: session.role } : null) }
+    }
+    if (name === 'crypto') {
+      return require('crypto')
+    }
+    throw new Error('unexpected require: ' + name)
+  }
+  const upstream: Upstream[] = []
+  const fakeFetch = async (
+    url: string,
+    init: { headers: Record<string, string>; body: unknown }
+  ) => {
+    upstream.push({ url, headers: init.headers, body: init.body })
+    return { status: 200, text: async () => JSON.stringify({ files: [{ url: 'https://cdn/x' }] }) }
+  }
+  const quiet = (): void => undefined
+  new Function(
+    'require',
+    'module',
+    'exports',
+    'process',
+    'console',
+    'fetch',
+    'AbortController',
+    code
+  )(
+    fakeRequire,
+    moduleObj,
+    moduleObj.exports,
+    {
+      env: {
+        NEXTAUTH_SECRET: SECRET,
+        RUNTIME_STORAGE_URL: 'https://storage.test',
+        RUNTIME_STORAGE_API_KEY: 'key',
+        RUNTIME_STORAGE_PROJECT_ID: 'p1',
+      },
+    },
+    { error: quiet, warn: quiet, log: quiet },
+    fakeFetch,
+    AbortControllerStub
+  )
+  const handler = moduleObj.exports
+  return async (body: Buffer, headers: Record<string, string> = {}) => {
+    upstream.length = 0
+    const req = Object.assign(Readable.from([body]), {
+      method: 'POST',
+      headers: {
+        'content-type': 'multipart/form-data; boundary=' + BOUNDARY,
+        'content-length': String(body.length),
+        ...(session ? { cookie: 'next-auth.session-token=signed' } : {}),
+        ...headers,
+      },
+    })
+    let status = 0
+    let payload: any = null
+    const res = {
+      status(statusCode: number) {
+        status = statusCode
+        return res
+      },
+      json(value: any) {
+        payload = value
+        return res
+      },
+    }
+    await handler(req, res)
+    return { status, payload, upstream: upstream.slice() }
+  }
+}
+
+describe('/api/runtime-storage/upload — what a visitor may store', () => {
+  it('forwards a visitor’s images and PDFs, byte for byte', async () => {
+    const upload = bootRoute(null)
+    const body = multipart([
+      { name: 'file', filename: 'photo.png', type: 'image/png', data: PNG },
+      { name: 'file', filename: 'photo.jpg', type: 'image/jpg', data: JPEG },
+      { name: 'file', filename: 'print.pdf', type: 'application/pdf', data: PDF },
+      { name: 'folder', data: 'product-options' },
+    ])
+    const result = await upload(body)
+    expect(result.status).toBe(200)
+    expect(result.upstream).toHaveLength(1)
+    expect(result.upstream[0].url).toBe('https://storage.test/project/p1/upload')
+    expect(Buffer.compare(result.upstream[0].body as Buffer, body)).toBe(0)
+    expect(result.upstream[0].headers['content-length']).toBe(String(body.length))
+    expect(result.upstream[0].headers.Authorization).toBe('Bearer key')
+  })
+
+  it('refuses a file that is not what it claims, an SVG, or a page — by its bytes', async () => {
+    const upload = bootRoute({ role: 'user' })
+    for (const part of [
+      { name: 'file', filename: 'x.png', type: 'image/png', data: HTML },
+      { name: 'file', filename: 'x.svg', type: 'image/svg+xml', data: SVG },
+      { name: 'file', filename: 'x.html', type: 'text/html', data: HTML },
+      // Declared as a PDF, but the bytes are a PNG.
+      { name: 'file', filename: 'x.pdf', type: 'application/pdf', data: PNG },
+    ]) {
+      const result = await upload(multipart([part]))
+      expect(result.status).toBe(415)
+      expect(result.payload.error).toBe('FILE_TYPE_NOT_ALLOWED')
+      expect(result.upstream).toEqual([])
+    }
+  })
+
+  it('caps each file and the count, whatever limits the request states', async () => {
+    const upload = bootRoute(null)
+    const tooBig = Buffer.concat([PNG, Buffer.alloc(VISITOR_MAX_FILE_BYTES)])
+    const big = await upload(
+      multipart([
+        { name: 'file', filename: 'big.png', type: 'image/png', data: tooBig },
+        { name: 'maxFileSize', data: String(1024 * 1024 * 1024) },
+      ])
+    )
+    expect(big.status).toBe(413)
+    expect(big.upstream).toEqual([])
+
+    const many = await upload(
+      multipart(
+        Array.from({ length: VISITOR_MAX_FILES + 1 }, (_value, index) => ({
+          name: 'file',
+          filename: index + '.png',
+          type: 'image/png',
+          data: PNG,
+        }))
+      )
+    )
+    expect(many.status).toBe(413)
+    expect(many.upstream).toEqual([])
+  })
+
+  it('refuses a request whose declared size is over the cap before reading it', async () => {
+    const upload = bootRoute(null)
+    const result = await upload(multipart([{ name: 'file', filename: 'a.png', data: PNG }]), {
+      'content-length': String(VISITOR_MAX_FILES * VISITOR_MAX_FILE_BYTES * 2),
+    })
+    expect(result.status).toBe(413)
+    expect(result.upstream).toEqual([])
+  })
+
+  it('never stores a private file for a visitor', async () => {
+    const upload = bootRoute({ role: 'user' })
+    const result = await upload(
+      multipart([
+        { name: 'file', filename: 'a.pdf', type: 'application/pdf', data: PDF },
+        { name: 'private', data: 'true' },
+      ])
+    )
+    expect(result.status).toBe(403)
+    expect(result.upstream).toEqual([])
+  })
+
+  it('refuses a body that is not a file form', async () => {
+    const upload = bootRoute(null)
+    const result = await upload(Buffer.from('{"file":"x"}'), { 'content-type': 'application/json' })
+    expect(result.status).toBe(400)
+    expect(result.upstream).toEqual([])
+  })
+})
+
+describe("/api/runtime-storage/upload — the store's own uploads", () => {
+  const PRIVATE_ZIP = multipart([
+    { name: 'file', filename: 'course.zip', type: 'application/zip', data: 'PK..zip' },
+    { name: 'private', data: 'true' },
+  ])
+
+  it("streams an admin's upload through untouched — any type, private included", async () => {
+    const upload = bootRoute({ role: 'admin' })
+    const result = await upload(PRIVATE_ZIP)
+    expect(result.status).toBe(200)
+    expect(result.upstream).toHaveLength(1)
+    // The request stream itself, not a buffered copy.
+    expect(Buffer.isBuffer(result.upstream[0].body)).toBe(false)
+  })
+
+  it('serves server code presenting the app secret (the invoice PDF upload)', async () => {
+    const upload = bootRoute(null)
+    const result = await upload(PRIVATE_ZIP, { 'x-internal-data-secret': SECRET })
+    expect(result.status).toBe(200)
+    expect(result.upstream).toHaveLength(1)
+
+    const forged = await upload(PRIVATE_ZIP, { 'x-internal-data-secret': 'guess' })
+    expect(forged.status).toBe(415)
+    expect(forged.upstream).toEqual([])
+  })
+})

package/__tests__/security-runtime-shadow.test.ts

@@ -3,6 +3,7 @@ import {
   assertWorkflowsAreSecure,
   CodegenSecurityError,
   PROTECTED_ENV_NAMES,
+  PROTECTED_ENV_NAME_PATTERN,
 } from '../src/security-scanner'
 
 // Verifies the two security layers added on top of the general-custom-js
@@ -100,7 +101,51 @@ describe('assertWorkflowsAreSecure (codegen gate)', () => {
     expect(() => assertWorkflowsAreSecure(uidlWorkflows)).not.toThrow()
   })
 
-  it('PROTECTED_ENV_NAMES contains exactly the 8 documented secrets', () => {
+  it('refuses custom JS that names a payment credential, deployed or stored', () => {
+    for (const name of [
+      'STRIPE_SECRET_KEY',
+      'CONFIGURATION_MOLLIE_API_KEY2',
+      'PADDLE_WEBHOOK_SECRET',
+    ]) {
+      const uidlWorkflows = {
+        workflows: {
+          w: {
+            nodes: [
+              {
+                id: 'a',
+                type: 'general-custom-js',
+                config: { code: `return process.env['${name}']` },
+              },
+            ],
+          },
+        },
+      }
+      expect(() => assertWorkflowsAreSecure(uidlWorkflows)).toThrowError(CodegenSecurityError)
+    }
+  })
+
+  it('the payment credential pattern covers every provider and nothing else', () => {
+    for (const name of [
+      'STRIPE_WEBHOOK_SECRET',
+      'PAYPAL_CLIENT_SECRET',
+      'CONFIGURATION_RAZORPAY_KEY_SECRET',
+      'SQUARE_ACCESS_TOKEN',
+      'COINGATE_API_TOKEN',
+    ]) {
+      expect(PROTECTED_ENV_NAME_PATTERN.test(name)).toBe(true)
+    }
+    for (const name of [
+      'STRIPE',
+      'MY_STRIPE_KEY',
+      'SQUARESPACE_TOKEN',
+      'PUBLIC_FEATURE_FLAG',
+      'stripe_secret_key',
+    ]) {
+      expect(PROTECTED_ENV_NAME_PATTERN.test(name)).toBe(false)
+    }
+  })
+
+  it('PROTECTED_ENV_NAMES contains exactly the 10 documented secrets', () => {
     expect([...PROTECTED_ENV_NAMES].sort()).toEqual(
       [
         'PDF_SERVICE_API_KEY',
@@ -109,11 +154,32 @@ describe('assertWorkflowsAreSecure (codegen gate)', () => {
         'REALTIME_SERVER_URL',
         'RUNTIME_STORAGE_API_KEY',
         'RUNTIME_STORAGE_PROJECT_ID',
+        'TELEPORT_CRON_SECRET',
+        'TELEPORT_CRON_SECRET_PREVIOUS',
         'TELEPORT_DB_CONNECTION_STRING',
         'TELEPORT_PROJECT_TOKEN',
       ].sort()
     )
   })
+
+  it('refuses custom JS that reads a cron signing key', () => {
+    for (const name of ['TELEPORT_CRON_SECRET', 'TELEPORT_CRON_SECRET_PREVIOUS']) {
+      const uidlWorkflows = {
+        workflows: {
+          w: {
+            nodes: [
+              {
+                id: 'a',
+                type: 'general-custom-js',
+                config: { code: `function customHandler(){ return process.env.${name}; }` },
+              },
+            ],
+          },
+        },
+      }
+      expect(() => assertWorkflowsAreSecure(uidlWorkflows)).toThrowError(CodegenSecurityError)
+    }
+  })
 })
 
 describe('general-custom-js handler — runtime process shadow', () => {
@@ -126,6 +192,10 @@ describe('general-custom-js handler — runtime process shadow', () => {
     process.env.RUNTIME_STORAGE_API_KEY = 'secret-storage'
     process.env.TELEPORT_PROJECT_TOKEN = 'secret-token'
     process.env.PUBLIC_FEATURE_FLAG = 'allowed'
+    process.env.STRIPE_SECRET_KEY = 'sk_live_secret'
+    process.env.CONFIGURATION_PAYPAL_CLIENT_SECRET2 = 'paypal-secret'
+    process.env.TELEPORT_CRON_SECRET = 'cron-key'
+    process.env.TELEPORT_CRON_SECRET_PREVIOUS = 'old-cron-key'
   })
   afterAll(() => {
     // Restore exactly what was there.
@@ -185,6 +255,38 @@ describe('general-custom-js handler — runtime process shadow', () => {
     expect(out).toBe(false)
   })
 
+  it('hides the cron signing keys from user code', async () => {
+    const code = `function customHandler(){
+      return {
+        current: process.env.TELEPORT_CRON_SECRET,
+        previous: process.env['TELEPORT_CRON_SECRET_PREVIOUS'],
+        listed: Object.keys(process.env).filter(function (k) { return /CRON/.test(k) }),
+      }
+    }`
+    const out = (await handler({ code, __nodeId: 'a' }, {})) as Record<string, unknown>
+    expect(out).toEqual({ current: undefined, previous: undefined, listed: [] })
+  })
+
+  it('hides the merchant payment credentials from user code', async () => {
+    const code = `function customHandler(){
+      return {
+        stripe: process.env.STRIPE_SECRET_KEY,
+        paypal: process.env.CONFIGURATION_PAYPAL_CLIENT_SECRET2,
+        listed: Object.keys(process.env).filter(function (k) { return /STRIPE|PAYPAL/.test(k) }),
+        has: 'STRIPE_SECRET_KEY' in process.env,
+        described: Object.getOwnPropertyDescriptor(process.env, 'STRIPE_SECRET_KEY'),
+      }
+    }`
+    const out = (await handler({ code, __nodeId: 'a' }, {})) as Record<string, unknown>
+    expect(out).toEqual({
+      stripe: undefined,
+      paypal: undefined,
+      listed: [],
+      has: false,
+      described: undefined,
+    })
+  })
+
   it('does not break access to non-process bindings', async () => {
     const code = `function customHandler(){
       return 1 + 2;

package/__tests__/segment-reply-changed-keys.test.ts

@@ -0,0 +1,146 @@
+import { generateServerSegmentAPIRoute } from '../src'
+import type { WorkflowSegment } from '../src/types'
+import { loadServerRuntime } from './_helpers/load-server-runtime'
+
+// A server segment used to reply with its whole context: every earlier node's
+// result, the trigger, the page state the browser had just sent — so each
+// round trip carried the page back to the browser and the network tab showed
+// every node's data on every hop. The reply now carries what the run produced
+// or changed. These run the GENERATED route and read its reply.
+
+interface RouteReply {
+  status: number
+  body: { success: boolean; results?: Record<string, unknown>; error?: string }
+}
+
+function bootRoute(workflowSegment: WorkflowSegment) {
+  const source = generateServerSegmentAPIRoute(workflowSegment, 'Reply')
+  const utils = loadServerRuntime()
+  const requireStub = (id: string) => (id.endsWith('server-runtime') ? utils : {})
+  const routeModule: { exports: unknown } = { exports: {} }
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  new Function('module', 'exports', 'require', source)(
+    routeModule,
+    routeModule.exports,
+    requireStub
+  )
+  const handler = routeModule.exports as (req: unknown, res: unknown) => Promise<void>
+  return async (context: Record<string, unknown>): Promise<RouteReply> => {
+    const reply: RouteReply = { status: 0, body: { success: false } }
+    const res = {
+      status(code: number) {
+        reply.status = code
+        return this
+      },
+      json(payload: RouteReply['body']) {
+        reply.body = payload
+        return this
+      },
+    }
+    await handler({ method: 'POST', body: { context }, headers: { host: 'localhost:3000' } }, res)
+    return reply
+  }
+}
+
+const script = (body: string) => `function customHandler(params) { ${body} }`
+
+const calcNode = {
+  id: 'calc',
+  type: 'general-custom-js',
+  label: 'Calc',
+  executionEnv: 'server' as const,
+  stepNumber: 1,
+  config: { code: script('return { total: 42 }'), context: 'server' },
+}
+const gateNode = {
+  id: 'gate',
+  type: 'general-if-statement',
+  label: 'Gate',
+  executionEnv: 'server' as const,
+  stepNumber: 2,
+  config: {
+    conditionType: 'simple-comparison',
+    leftValue: { type: 'workflowContext', nodeId: 'calc', path: ['calc', 'total'] },
+    operator: '>',
+    rightValue: 100,
+  },
+}
+const bigNode = {
+  id: 'big',
+  type: 'general-custom-js',
+  label: 'Big',
+  executionEnv: 'server' as const,
+  stepNumber: 3,
+  config: { code: script('return { big: true }'), context: 'server' },
+}
+const segment: WorkflowSegment = {
+  id: 'server-1',
+  env: 'server',
+  nodeIds: ['calc', 'gate', 'big'],
+  nodes: [calcNode, gateNode, bigNode],
+  edges: [
+    { id: 'e1', source: 'calc', target: 'gate' },
+    { id: 'e2', source: 'gate', target: 'big', sourceHandle: 'true' },
+  ] as WorkflowSegment['edges'],
+  entryNodeIds: ['calc'],
+}
+
+const request = () => ({
+  trigger: { formData: { code: 'SAVE10' }, __stateValues: { countryCode: 'RO' } },
+  __stateValues: { countryCode: 'RO', countries: [{ value: 'RO' }] },
+  __locale: 'en',
+  earlier: { rows: [{ id: 1 }] },
+})
+
+describe('generated server segment — what it replies with', () => {
+  it('replies with its own results and the branch marks, not with what the caller sent', async () => {
+    const reply = await bootRoute(segment)(request())
+    expect(reply.status).toBe(200)
+    const results = reply.body.results || {}
+    expect(results.calc).toEqual({ total: 42 })
+    expect(results.gate).toEqual({ result: false })
+    // The gate closed the branch: the client learns that from the marks.
+    expect(results.__skippedNodes).toEqual({ big: true })
+    expect(results).not.toHaveProperty('big')
+    // Echoes of the request are gone: the page state, the trigger, earlier
+    // results, the locale the caller already knows.
+    expect(results).not.toHaveProperty('__stateValues')
+    expect(results).not.toHaveProperty('trigger')
+    expect(results).not.toHaveProperty('earlier')
+    expect(results).not.toHaveProperty('__internalHeaders')
+    expect(results).not.toHaveProperty('__pendingNodePromises')
+  })
+
+  it('still replies with what the route itself adds to the run', async () => {
+    const results = (await bootRoute(segment)(request())).body.results || {}
+    // The route learns the deployment's origin; a custom node called next
+    // reads it off the context.
+    expect(results.__baseUrl).toBe('http://localhost:3000')
+  })
+
+  it('replies with a locale the caller did not carry', async () => {
+    const { __locale, ...withoutLocale } = request()
+    void __locale
+    const results = (await bootRoute(segment)(withoutLocale)).body.results || {}
+    expect(typeof results.__locale).toBe('string')
+  })
+
+  it('replies with its own node result even when the caller sent the same value', async () => {
+    // A loop body re-run: the browser carries the previous iteration's result
+    // for the same node id, the run produces an identical one, and the client
+    // still resets __previousNodeResult from the reply.
+    const results =
+      (await bootRoute(segment)({ ...request(), calc: { total: 42 } })).body.results || {}
+    expect(results.calc).toEqual({ total: 42 })
+  })
+
+  it('replies with a key the run changed in place', async () => {
+    const results =
+      (await bootRoute(segment)({ ...request(), __skippedNodes: { stale: true } })).body.results ||
+      {}
+    // claimSegmentContext drops marks for ids the segment does not own only
+    // when they are inside it; a foreign stale mark survives, and the segment's
+    // own closed branch joins it: the object changed, so it is replied.
+    expect(results.__skippedNodes).toEqual({ stale: true, big: true })
+  })
+})