@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.69

package/__tests__/webhook-delivery-lease.test.ts

@@ -0,0 +1,316 @@
+import { generateWebhookDeliveryLeaseCode } from '../src/webhook-delivery-lease/webhook-delivery-lease-code'
+import { generateWebhookWorkflowAPIRoute } from '../src/api-route-generator'
+import { loadServerRuntime } from './_helpers/load-server-runtime'
+import { withFetch } from './_helpers/fake-fetch'
+
+/**
+ * One payment webhook delivery at a time. The lease module and the route that
+ * uses it are EXECUTED: the module against a stubbed `pg`, the route with a
+ * stubbed lease, so a twin delivery is proven to be turned away while the
+ * first runs and every claim to be released before the route replies.
+ */
+
+interface StubQuery {
+  sql: string
+  values: unknown[]
+}
+
+const noop = (): void => undefined
+const silentConsole = { warn: noop, error: noop, log: noop, info: noop }
+
+const loadLease = (options: {
+  queryImpl?: (sql: string, values: unknown[]) => Promise<unknown>
+  pgAvailable?: boolean
+  pgSupported?: boolean
+}) => {
+  const queries: StubQuery[] = []
+  const queryImpl =
+    options.queryImpl ||
+    (async (sql: string, values: unknown[]) =>
+      sql.startsWith('INSERT') ? { rows: [{ claim_token: values[1] }] } : { rows: [] })
+  class Client {
+    async connect(): Promise<void> {
+      return undefined
+    }
+    async query(sql: string, values: unknown[]) {
+      queries.push({ sql, values })
+      return queryImpl(sql, values)
+    }
+    async end(): Promise<void> {
+      return undefined
+    }
+  }
+  const requireShim = (id: string) => {
+    if (id === 'pg') {
+      if (options.pgAvailable === false) {
+        throw new Error("Cannot find module 'pg'")
+      }
+      return { Client }
+    }
+    if (id === 'crypto') {
+      return require('crypto')
+    }
+    throw new Error('unexpected require: ' + id)
+  }
+  const savedConnection = process.env.TELEPORT_DB_CONNECTION_STRING
+  process.env.TELEPORT_DB_CONNECTION_STRING = 'postgresql://u:p@localhost:5432/db'
+  const module = { exports: {} as any }
+  // eslint-disable-next-line no-new-func
+  new Function(
+    'module',
+    'exports',
+    'require',
+    'process',
+    'console',
+    'Buffer',
+    generateWebhookDeliveryLeaseCode({ pgSupported: options.pgSupported !== false })
+  )(module, module.exports, requireShim, process, silentConsole, Buffer)
+  const restore = () => {
+    if (savedConnection === undefined) {
+      delete process.env.TELEPORT_DB_CONNECTION_STRING
+    } else {
+      process.env.TELEPORT_DB_CONNECTION_STRING = savedConnection
+    }
+  }
+  return { claim: module.exports.claimWebhookDelivery, queries, restore }
+}
+
+describe('webhook delivery lease module', () => {
+  it('creates its table once, claims with a fresh token and releases only its own claim', async () => {
+    const lease = loadLease({})
+    try {
+      const first = await lease.claim('webhooks/stripe-payment', Buffer.from('{"id":"evt_1"}'), {
+        id: 'evt_1',
+      })
+      expect(first.claimed).toBe(true)
+      expect(lease.queries[0].sql).toMatch(
+        /^CREATE TABLE IF NOT EXISTS "teleport_webhook_deliveries"/
+      )
+      const claim = lease.queries[1]
+      expect(claim.sql).toContain('ON CONFLICT (delivery_key) DO UPDATE')
+      expect(claim.sql).toContain('WHERE d.claimed_at < NOW() - make_interval(secs => $3::int)')
+      expect(claim.values[0]).toMatch(/^[0-9a-f]{64}$/)
+      expect(claim.values[2]).toBe(300)
+      await first.release()
+      const release = lease.queries[2]
+      expect(release.sql).toMatch(
+        /^DELETE FROM "teleport_webhook_deliveries" WHERE \(delivery_key = \$1 AND claim_token = \$2\)/
+      )
+      expect(release.values).toEqual([claim.values[0], claim.values[1]])
+      // The table is not created again by the next delivery.
+      await lease.claim('webhooks/stripe-payment', Buffer.from('{"id":"evt_2"}'), { id: 'evt_2' })
+      expect(lease.queries[3].sql).toMatch(/^INSERT INTO/)
+    } finally {
+      lease.restore()
+    }
+  })
+
+  it('reports a delivery whose twin holds the claim as not claimed', async () => {
+    const lease = loadLease({ queryImpl: async () => ({ rows: [] }) })
+    try {
+      const twin = await lease.claim('webhooks/paddle-payment', Buffer.from('{}'), {})
+      expect(twin.claimed).toBe(false)
+      await twin.release()
+      expect(lease.queries.filter((query) => query.sql.startsWith('DELETE'))).toHaveLength(0)
+    } finally {
+      lease.restore()
+    }
+  })
+
+  it('keys a delivery on the webhook, the body and the state it was verified as', async () => {
+    const lease = loadLease({})
+    try {
+      const keyOf = async (scope: string, raw: string, verified: unknown) => {
+        await lease.claim(scope, Buffer.from(raw), verified)
+        return lease.queries.filter((query) => query.sql.startsWith('INSERT')).pop()!.values[0]
+      }
+      const paid = await keyOf('webhooks/mollie-payment', 'id=tr_1', { status: 'paid' })
+      expect(await keyOf('webhooks/mollie-payment', 'id=tr_1', { status: 'paid' })).toBe(paid)
+      // Mollie posts the same id for every change: the fetched state tells them apart.
+      expect(await keyOf('webhooks/mollie-payment', 'id=tr_1', { status: 'expired' })).not.toBe(
+        paid
+      )
+      expect(await keyOf('webhooks/coingate-payment', 'id=tr_1', { status: 'paid' })).not.toBe(paid)
+    } finally {
+      lease.restore()
+    }
+  })
+
+  it('lets every delivery run when it cannot hold a lease', async () => {
+    const noDriver = loadLease({ pgAvailable: false })
+    try {
+      expect((await noDriver.claim('w', Buffer.from('{}'), {})).claimed).toBe(true)
+      expect(noDriver.queries).toHaveLength(0)
+    } finally {
+      noDriver.restore()
+    }
+    const failing = loadLease({
+      queryImpl: async () => {
+        throw Object.assign(new Error('permission denied'), { code: '42501' })
+      },
+    })
+    try {
+      expect((await failing.claim('w', Buffer.from('{}'), {})).claimed).toBe(true)
+      // Disabled for the process after a privilege error: nothing is tried again.
+      const tried = failing.queries.length
+      expect((await failing.claim('w', Buffer.from('{}'), {})).claimed).toBe(true)
+      expect(failing.queries).toHaveLength(tried)
+    } finally {
+      failing.restore()
+    }
+    const otherDatabase = loadLease({ pgSupported: false })
+    try {
+      expect((await otherDatabase.claim('w', Buffer.from('{}'), {})).claimed).toBe(true)
+      expect(otherDatabase.queries).toHaveLength(0)
+    } finally {
+      otherDatabase.restore()
+    }
+  })
+})
+
+const ECHO_URL = 'https://echo.test/received'
+
+const workflow = (webhookConfig: Record<string, unknown>, failing = false) =>
+  ({
+    id: 'wf-1',
+    name: 'Payment webhook',
+    trigger: { type: 'event-webhook-triggered', nodeId: 't', scope: 'global', config: {} },
+    nodes: [
+      {
+        id: 'echo',
+        type: 'general-http-request',
+        config: {
+          url: failing ? 'https://echo.test/fails' : ECHO_URL,
+          method: 'POST',
+          body: { type: 'workflowContext', nodeId: 't', path: ['body'] },
+        },
+        stepNumber: 1,
+        label: 'Echo',
+      },
+    ],
+    edges: [{ id: 'e1', source: 't', target: 'echo' }],
+    webhookConfig: { httpMethod: 'POST', ...webhookConfig },
+  } as any)
+
+interface LeaseLog {
+  claims: Array<{ scope: string; body: unknown }>
+  releases: number
+  events: string[]
+}
+
+const loadRoute = (source: string, claimed: boolean, log: LeaseLog) => {
+  const runtime = { exports: loadServerRuntime() }
+  const requireShim = (id: string) => {
+    if (id.endsWith('/utils/workflows/server-runtime')) {
+      return runtime.exports
+    }
+    if (id.endsWith('/utils/payments')) {
+      return {
+        get: () => ({
+          verifyWebhook: async (input: { body: unknown }) => ({ ok: true, body: input.body }),
+        }),
+      }
+    }
+    if (id.endsWith('/utils/workflows/webhook-delivery-lease')) {
+      return {
+        claimWebhookDelivery: async (scope: string, _raw: Buffer, body: unknown) => {
+          log.claims.push({ scope, body })
+          log.events.push('claim')
+          return {
+            claimed,
+            release: async () => {
+              log.releases += 1
+              log.events.push('release')
+            },
+          }
+        },
+      }
+    }
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    return require(id)
+  }
+  const module = { exports: null as any }
+  // eslint-disable-next-line no-new-func
+  new Function('module', 'exports', 'require', source)(module, {}, requireShim)
+  return module.exports as (req: unknown, res: unknown) => Promise<void>
+}
+
+const post = async (handler: (req: unknown, res: unknown) => Promise<void>, log: LeaseLog) => {
+  const reply = { status: 0, body: null as unknown, headers: {} as Record<string, string> }
+  const res = {
+    setHeader(name: string, value: string) {
+      reply.headers[name] = value
+    },
+    status(code: number) {
+      reply.status = code
+      return {
+        json(payload: unknown) {
+          log.events.push('reply ' + code)
+          reply.body = payload
+        },
+      }
+    },
+  }
+  const req = {
+    method: 'POST',
+    url: '/api/webhooks/paddle-payment',
+    query: {},
+    headers: { host: 'shop.test', 'content-type': 'application/json' },
+    body: Buffer.from('{"event_id":"evt_1"}'),
+  }
+  const ran: unknown[] = []
+  await withFetch(
+    (call) => {
+      if (call.url === ECHO_URL) {
+        ran.push(call.json)
+        return { status: 200, body: {} }
+      }
+      throw new Error('network down')
+    },
+    () => handler(req, res)
+  )
+  return { reply, ran }
+}
+
+describe('generated payment webhook route — delivery lease', () => {
+  const paymentSource = generateWebhookWorkflowAPIRoute(
+    workflow({ urlPath: 'webhooks/paddle-payment', verifySignature: true })
+  )
+
+  it('runs a claimed delivery and releases the claim before replying', async () => {
+    const log: LeaseLog = { claims: [], releases: 0, events: [] }
+    const { reply, ran } = await post(loadRoute(paymentSource, true, log), log)
+    expect(reply.status).toBe(200)
+    expect(ran).toEqual([{ event_id: 'evt_1' }])
+    expect(log.claims).toEqual([{ scope: 'webhooks/paddle-payment', body: { event_id: 'evt_1' } }])
+    expect(log.events).toEqual(['claim', 'release', 'reply 200'])
+  })
+
+  it('turns a twin away while the first delivery runs, asking the provider to come back', async () => {
+    const log: LeaseLog = { claims: [], releases: 0, events: [] }
+    const { reply, ran } = await post(loadRoute(paymentSource, false, log), log)
+    expect(reply.status).toBe(503)
+    expect(reply.headers['Retry-After']).toBe('60')
+    expect(ran).toEqual([])
+    expect(log.releases).toBe(0)
+  })
+
+  it('releases the claim of a run that failed, so the retry runs', async () => {
+    const failingSource = generateWebhookWorkflowAPIRoute(
+      workflow({ urlPath: 'webhooks/paddle-payment', verifySignature: true }, true)
+    )
+    const log: LeaseLog = { claims: [], releases: 0, events: [] }
+    const { reply } = await post(loadRoute(failingSource, true, log), log)
+    expect(reply.status).toBe(500)
+    expect(log.events).toEqual(['claim', 'release', 'reply 500'])
+  })
+
+  it('leaves every other webhook without a lease', () => {
+    const other = generateWebhookWorkflowAPIRoute(
+      workflow({ urlPath: 'webhooks/orders', verifySignature: false })
+    )
+    expect(other).not.toContain('webhook-delivery-lease')
+    expect(other).not.toContain('__delivery')
+    expect(paymentSource).toContain("require('../../../utils/workflows/webhook-delivery-lease')")
+  })
+})

package/__tests__/workflow-auth-guard.test.ts

@@ -19,14 +19,45 @@ type Guard = (
   policy: any
 ) => Promise<{ status: number; message: string } | null>
 
+/** What the stubbed `utils/auth/subscriber-access` module answers, and what it was asked. */
+interface SubscriberAccessStub {
+  entitled?: boolean
+  throws?: boolean
+  /** `null` boots the guard with the module ABSENT (a project with no subscriber-only page). */
+  absent?: boolean
+  calls: Array<{ userId: string; productIds: string[] }>
+}
+
+/** What the stubbed server runtime accepts as this deployment's internal-call token. */
+const INTERNAL_TOKEN = 'internal-call-token'
+
 /** Boots the emitted guard file with getToken stubbed to read `req.__token`. */
-function bootGuard(secret: string | undefined): Guard {
-  const code = generateWorkflowAuthHelperFile()
+function bootGuard(secret: string | undefined, subscriberAccess?: SubscriberAccessStub): Guard {
+  const code = generateWorkflowAuthHelperFile({
+    withSubscriberAccess: Boolean(subscriberAccess && !subscriberAccess.absent),
+  })
   const moduleObj: { exports: any } = { exports: {} }
   const fakeRequire = (name: string): any => {
     if (name === 'next-auth/jwt') {
       return { getToken: async ({ req }: any) => (req && req.__token) || null }
     }
+    if (name === './server-runtime') {
+      return { isInternalCall: (req: any) => req.headers['x-teleport-internal'] === INTERNAL_TOKEN }
+    }
+    if (name === '../auth/subscriber-access') {
+      if (!subscriberAccess || subscriberAccess.absent) {
+        throw new Error(`Cannot find module '${name}'`)
+      }
+      return {
+        isSubscriberEntitled: async (userId: string, productIds: string[]) => {
+          subscriberAccess.calls.push({ userId, productIds })
+          if (subscriberAccess.throws) {
+            throw new Error('database down')
+          }
+          return subscriberAccess.entitled === true
+        },
+      }
+    }
     // eslint-disable-next-line @typescript-eslint/no-var-requires
     return require(name)
   }
@@ -42,6 +73,40 @@ function bootGuard(secret: string | undefined): Guard {
 
 const reqWith = (extra: Record<string, unknown> = {}): any => ({ headers: {}, ...extra })
 
+describe("guardWorkflowRequest — calls from this deployment's own server code", () => {
+  const serverOnly = { requiresAuth: false, allowedRoles: [], serverOnly: true }
+  const adminOnly = { requiresAuth: true, allowedRoles: ['admin'] }
+
+  it('answers a server-only route to the internal-call token alone', async () => {
+    const guard = bootGuard('server-secret')
+    expect(await guard(reqWith(), {}, serverOnly)).toEqual({
+      status: 401,
+      message: 'Unauthenticated',
+    })
+    expect(await guard(reqWith({ __token: { id: 'u1', role: 'admin' } }), {}, serverOnly)).toEqual({
+      status: 401,
+      message: 'Unauthenticated',
+    })
+    expect(
+      await guard(reqWith({ headers: { 'x-teleport-internal': 'forged' } }), {}, serverOnly)
+    ).toEqual({ status: 401, message: 'Unauthenticated' })
+    expect(
+      await guard(reqWith({ headers: { 'x-teleport-internal': INTERNAL_TOKEN } }), {}, serverOnly)
+    ).toBeNull()
+  })
+
+  it('lets the internal-call token through a gated route (a webhook running an admin node)', async () => {
+    const guard = bootGuard('server-secret')
+    expect(await guard(reqWith(), {}, adminOnly)).toEqual({
+      status: 401,
+      message: 'Unauthenticated',
+    })
+    expect(
+      await guard(reqWith({ headers: { 'x-teleport-internal': INTERNAL_TOKEN } }), {}, adminOnly)
+    ).toBeNull()
+  })
+})
+
 describe('guardWorkflowRequest (runtime enforcement)', () => {
   const guard = bootGuard('server-secret')
 
@@ -108,6 +173,77 @@ describe('guardWorkflowRequest (runtime enforcement)', () => {
     expect(context.resolver.email).toBe('x') // other fields untouched
   })
 
+  it('binds a role claim to the SESSION role, never the one the browser sent', async () => {
+    const policy = {
+      requiresAuth: true,
+      allowedRoles: [],
+      userScoped: {
+        ownerColumn: 'user_id',
+        bindings: [
+          { nodeId: 'evaluate', path: ['role'], claim: 'role' },
+          { nodeId: 'evaluate', path: ['userId'] },
+        ],
+      },
+    }
+    const shopper = { evaluate: { role: 'admin', userId: 'victim-id' } }
+    expect(
+      await guard(reqWith({ __token: { id: 'shopper-id', role: 'user' } }), shopper, policy)
+    ).toBeNull()
+    expect(shopper.evaluate).toEqual({ role: 'user', userId: 'shopper-id' })
+
+    // A session without a role binds '' — an admin check can only fail.
+    const roleless = { evaluate: { role: 'admin', userId: 'x' } }
+    await guard(reqWith({ __token: { id: 'roleless-id' } }), roleless, policy)
+    expect(roleless.evaluate).toEqual({ role: '', userId: 'roleless-id' })
+
+    const admin = { evaluate: { role: '', userId: '' } }
+    await guard(reqWith({ __token: { id: 'admin-id', roleName: 'admin' } }), admin, policy)
+    expect(admin.evaluate).toEqual({ role: 'admin', userId: 'admin-id' })
+  })
+
+  it('binds a GUEST role claim to an empty role, so a signed-out request cannot claim admin', async () => {
+    // A public (no requiresAuth) route: the guest gets through, but the role it
+    // posted must not reach the query. Its anonymous user id is kept.
+    const guest = { evaluate: { role: 'admin', userId: 'guest-anon-uuid' } }
+    const res = await guard(reqWith(), guest, {
+      requiresAuth: false,
+      allowedRoles: [],
+      userScoped: {
+        ownerColumn: 'user_id',
+        bindings: [
+          { nodeId: 'evaluate', path: ['role'], claim: 'role' },
+          { nodeId: 'evaluate', path: ['userId'] },
+        ],
+      },
+    })
+    expect(res).toBeNull()
+    expect(guest.evaluate).toEqual({ role: '', userId: 'guest-anon-uuid' })
+  })
+
+  it('binds a signedInUserId claim to the session id, and to an empty id for a guest', async () => {
+    const policy = {
+      requiresAuth: false,
+      allowedRoles: [],
+      userScoped: {
+        ownerColumn: 'user_id',
+        bindings: [{ nodeId: 'collect', path: ['signedInUserId'], claim: 'signedInUserId' }],
+      },
+    }
+    const shopper = { collect: { signedInUserId: 'victim-id', city: 'Austin' } }
+    await guard(reqWith({ __token: { id: 'shopper-id' } }), shopper, policy)
+    expect(shopper.collect).toEqual({ signedInUserId: 'shopper-id', city: 'Austin' })
+
+    const guest = { collect: { signedInUserId: 'victim-id', city: 'Austin' } }
+    expect(await guard(reqWith(), guest, policy)).toBeNull()
+    expect(guest.collect).toEqual({ signedInUserId: '', city: 'Austin' })
+
+    // A segment that runs before the node produced its result still gets the
+    // binding, so the node's own later output is what overwrites it.
+    const early: any = {}
+    await guard(reqWith(), early, policy)
+    expect(early.collect).toEqual({ signedInUserId: '' })
+  })
+
   it('binds a nested path and creates missing context nodes', async () => {
     const context: any = {}
     await guard(reqWith({ __token: { id: 'sess-1' } }), context, {
@@ -274,4 +410,119 @@ describe('buildWorkflowAuthInjection', () => {
     expect(injection.policyConst).toContain('"userScoped"')
     expect(injection.guardCall).toContain('guardWorkflowRequest')
   })
+
+  it('bakes the subscription requirement and its product ids into the policy', () => {
+    const injection = buildWorkflowAuthInjection({
+      requiresAuth: true,
+      allowedRoles: [],
+      requiresSubscription: true,
+      subscriptionProductIds: [' prod-1 ', 'prod-2', ''],
+      derivedFrom: 'page',
+    })
+    const policy = JSON.parse(
+      injection.policyConst.replace('const __WF_AUTH = ', '').replace(/;\s*$/, '')
+    )
+    expect(policy).toEqual({
+      requiresAuth: true,
+      allowedRoles: [],
+      requiresSubscription: true,
+      subscriptionProductIds: ['prod-1', 'prod-2'],
+    })
+    const plain = buildWorkflowAuthInjection({
+      requiresAuth: true,
+      allowedRoles: [],
+      derivedFrom: 'page',
+    })
+    expect(plain.policyConst).not.toContain('requiresSubscription')
+  })
+})
+
+describe('guardWorkflowRequest on a subscriber-only page', () => {
+  const policy = {
+    requiresAuth: true,
+    allowedRoles: [] as string[],
+    requiresSubscription: true,
+    subscriptionProductIds: ['prod-1'],
+  }
+  const anyProduct = {
+    requiresAuth: true,
+    allowedRoles: [] as string[],
+    requiresSubscription: true,
+  }
+
+  it('still answers 401 to a guest before asking about any subscription', async () => {
+    const access: SubscriberAccessStub = { entitled: true, calls: [] }
+    const res = await bootGuard('server-secret', access)(reqWith(), {}, policy)
+    expect(res).toEqual({ status: 401, message: 'Unauthenticated' })
+    expect(access.calls).toHaveLength(0)
+  })
+
+  it('lets an entitled member through, asking with the SESSION id and the product ids', async () => {
+    const access: SubscriberAccessStub = { entitled: true, calls: [] }
+    const guard = bootGuard('server-secret', access)
+    expect(await guard(reqWith({ __token: { id: 'u1' } }), {}, policy)).toBeNull()
+    expect(access.calls).toEqual([{ userId: 'u1', productIds: ['prod-1'] }])
+    expect(await guard(reqWith({ __token: { sub: 'u2' } }), {}, anyProduct)).toBeNull()
+    expect(access.calls[1]).toEqual({ userId: 'u2', productIds: [] })
+  })
+
+  it('answers 403 Subscription required to a member without one', async () => {
+    const access: SubscriberAccessStub = { entitled: false, calls: [] }
+    const res = await bootGuard('server-secret', access)(
+      reqWith({ __token: { id: 'u1' } }),
+      {},
+      policy
+    )
+    expect(res).toEqual({ status: 403, message: 'Subscription required' })
+  })
+
+  it('checks the role first, and fails closed when the check itself fails or is missing', async () => {
+    const access: SubscriberAccessStub = { entitled: true, calls: [] }
+    const wrongRole = await bootGuard('server-secret', access)(
+      reqWith({ __token: { id: 'u1', role: 'user' } }),
+      {},
+      { ...policy, allowedRoles: ['admin'] }
+    )
+    expect(wrongRole).toEqual({ status: 403, message: 'Forbidden' })
+    expect(access.calls).toHaveLength(0)
+
+    const down = await bootGuard('server-secret', { throws: true, calls: [] })(
+      reqWith({ __token: { id: 'u1' } }),
+      {},
+      policy
+    )
+    expect(down).toEqual({ status: 403, message: 'Subscription required' })
+    const absent = await bootGuard('server-secret', { absent: true, calls: [] })(
+      reqWith({ __token: { id: 'u1' } }),
+      {},
+      policy
+    )
+    expect(absent).toEqual({ status: 403, message: 'Subscription required' })
+  })
+
+  it('never asks for a policy without the requirement, and lets an internal caller through', async () => {
+    const access: SubscriberAccessStub = { entitled: false, calls: [] }
+    const guard = bootGuard('server-secret', access)
+    expect(
+      await guard(reqWith({ __token: { id: 'u1' } }), {}, { requiresAuth: true, allowedRoles: [] })
+    ).toBeNull()
+    expect(
+      await guard(reqWith({ headers: { 'x-internal-data-secret': 'server-secret' } }), {}, policy)
+    ).toBeNull()
+    expect(access.calls).toHaveLength(0)
+  })
+})
+
+describe('subscriber-access require', () => {
+  // A require is a static import to the bundler even inside a function, so it
+  // must not appear when utils/auth/subscriber-access.js is not emitted.
+  it('is absent from a project with no subscriber-only page', () => {
+    expect(generateWorkflowAuthHelperFile()).not.toContain('../auth/subscriber-access')
+  })
+
+  it('is present when a page is subscriber-only', () => {
+    expect(generateWorkflowAuthHelperFile({ withSubscriberAccess: true })).toContain(
+      "require('../auth/subscriber-access')"
+    )
+  })
 })

package/dist/cjs/admin-form-hydration.d.ts

@@ -0,0 +1,10 @@
+import { UIDLStateDefinition } from '@teleporthq/teleport-types';
+/**
+ * The state a page's initial props are copied into on mount. The page's states
+ * arrive in no particular order (the editor stores them by id), so an update
+ * page with several object states — a form and an editor's view state — must
+ * name its form: the `<entity>SelectedItemData` state wins, and a page without
+ * one keeps its only (first) object state.
+ */
+export declare function findFormStateKeyForHydration(stateDefinitions: Record<string, UIDLStateDefinition>): string | undefined;
+//# sourceMappingURL=admin-form-hydration.d.ts.map

package/dist/cjs/admin-form-hydration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-form-hydration.d.ts","sourceRoot":"","sources":["../../src/admin-form-hydration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAahE;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GACpD,MAAM,GAAG,SAAS,CAKpB"}

package/dist/cjs/admin-form-hydration.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findFormStateKeyForHydration = void 0;
+/** An admin update page keeps the row it loads in `<entity>SelectedItemData`. */
+const SELECTED_ITEM_DATA_STATE = /SelectedItemData$/;
+const isFormDataState = (definition) => !!definition &&
+    definition.type === 'object' &&
+    typeof definition.defaultValue === 'object' &&
+    definition.defaultValue !== null &&
+    !Array.isArray(definition.defaultValue) &&
+    Object.keys(definition.defaultValue).length > 0;
+/**
+ * The state a page's initial props are copied into on mount. The page's states
+ * arrive in no particular order (the editor stores them by id), so an update
+ * page with several object states — a form and an editor's view state — must
+ * name its form: the `<entity>SelectedItemData` state wins, and a page without
+ * one keeps its only (first) object state.
+ */
+function findFormStateKeyForHydration(stateDefinitions) {
+    var _a;
+    const candidates = Object.keys(stateDefinitions).filter((key) => isFormDataState(stateDefinitions[key]));
+    return (_a = candidates.find((key) => SELECTED_ITEM_DATA_STATE.test(key))) !== null && _a !== void 0 ? _a : candidates[0];
+}
+exports.findFormStateKeyForHydration = findFormStateKeyForHydration;
+//# sourceMappingURL=admin-form-hydration.js.map

package/dist/cjs/admin-form-hydration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-form-hydration.js","sourceRoot":"","sources":["../../src/admin-form-hydration.ts"],"names":[],"mappings":";;;AAEA,iFAAiF;AACjF,MAAM,wBAAwB,GAAG,mBAAmB,CAAA;AAEpD,MAAM,eAAe,GAAG,CAAC,UAA2C,EAAW,EAAE,CAC/E,CAAC,CAAC,UAAU;IACZ,UAAU,CAAC,IAAI,KAAK,QAAQ;IAC5B,OAAO,UAAU,CAAC,YAAY,KAAK,QAAQ;IAC3C,UAAU,CAAC,YAAY,KAAK,IAAI;IAChC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IACvC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,YAAuC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;AAE5E;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAC1C,gBAAqD;;IAErD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9D,eAAe,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CACvC,CAAA;IACD,OAAO,MAAA,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,mCAAI,UAAU,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC;AAPD,oEAOC"}

package/dist/cjs/api-route-generator.d.ts

@@ -1,12 +1,28 @@
-import { UIDLWorkflow, UIDLCustomWorkflowNode, UIDLWorkflowProtection } from '@teleporthq/teleport-types';
+import { UIDLWorkflow, UIDLWorkflows, UIDLCustomWorkflowNode, UIDLWorkflowProtection } from '@teleporthq/teleport-types';
 import { WorkflowSegment } from './types';
-export declare const generateServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string, protection?: UIDLWorkflowProtection) => string;
+import { SegmentTrust } from './segment-trust';
+export interface ServerSegmentRouteOptions {
+    /** A custom node's inner node ids, in the order its runner lists them. */
+    customNodeIds?: string[];
+    /**
+     * What the route may believe about results earlier segments of the same
+     * graph hand it (see segment-trust.ts). Every route the project plugin
+     * emits carries it.
+     */
+    trust?: SegmentTrust;
+}
+export declare const generateServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string, protection?: UIDLWorkflowProtection, options?: ServerSegmentRouteOptions) => string;
 export declare const hasStreamingAINode: (segment: WorkflowSegment) => boolean;
-export declare const generateStreamingServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string, protection?: UIDLWorkflowProtection) => string;
+export declare const generateStreamingServerSegmentAPIRoute: (segment: WorkflowSegment, workflowName?: string, protection?: UIDLWorkflowProtection, options?: ServerSegmentRouteOptions) => string;
 export declare const generateCronAPIRoute: (workflow: UIDLWorkflow, customNodes?: Record<string, UIDLCustomWorkflowNode>) => string;
 export declare const getAPIRouteFileName: (workflowId: string, segmentId: string, workflowName?: string) => string;
 export declare const getCronRouteFileName: (workflow: UIDLWorkflow) => string;
 export declare const generateWebhookWorkflowAPIRoute: (workflow: UIDLWorkflow, customNodes?: Record<string, UIDLCustomWorkflowNode>) => string;
 export declare const getWebhookRouteFileName: (workflow: UIDLWorkflow) => string;
+/**
+ * The address the store serves a provider's payment webhook at
+ * (`/api/webhooks/paypal-payment`), or null when no workflow receives it.
+ */
+export declare const findPaymentWebhookRouteUrl: (workflows: UIDLWorkflows | undefined, providerId: string) => string | null;
 export declare const getWebhookRoutePath: (workflow: UIDLWorkflow) => string[];
 //# sourceMappingURL=api-route-generator.d.ts.map