@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.69

package/__tests__/client-loop-current-item.test.ts

@@ -0,0 +1,164 @@
+import { generateSharedRuntimeUtilsCode } from '../src'
+import { loadHandler } from './_helpers/load-handler'
+
+// The workflow editor's context schema for "general-loop" offers a body node
+// `currentItem`, `index`, `isFirst` and `isLast` off the loop's own id, and a
+// server segment publishes exactly that while a body node runs. The CLIENT
+// executor published the iteration only under "<loopId>_iter", so the same
+// binding resolved to undefined in the browser. A loop whose body is a
+// custom-node call is exactly the kind the splitter keeps on the client: the
+// buyer's subscription refresh looped over ids and called its node with none.
+// These run the shared `executeNodes` with such a loop.
+
+type SharedUtils = {
+  executeNodes: (
+    nodes: unknown[],
+    edges: unknown[],
+    context: Record<string, unknown>,
+    handlers: Record<string, unknown>,
+    workflowConfig: Record<string, unknown>,
+    callServerSegment: null,
+    executionId: string
+  ) => Promise<void>
+}
+
+function loadSharedRuntime(): SharedUtils {
+  const utilsModule: { exports: Record<string, unknown> } = { exports: {} }
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  new Function('module', 'exports', generateSharedRuntimeUtilsCode())(
+    utilsModule,
+    utilsModule.exports
+  )
+  return utilsModule.exports as unknown as SharedUtils
+}
+
+const ref = (nodeId: string, path: string[]) => ({
+  type: 'workflowContext',
+  nodeId,
+  path: [nodeId, ...path],
+})
+
+const bodyCode = [
+  'function customHandler(params) {',
+  '  var named = params[params.length - 1] || {};',
+  '  return { id: named.id, index: named.index, first: named.first, last: named.last };',
+  '}',
+].join('\n')
+
+const buildGraph = (loopConfig: Record<string, unknown>) => ({
+  nodes: [
+    {
+      id: 'seed',
+      type: 'general-custom-js',
+      stepNumber: 1,
+      config: { code: 'function customHandler() { return { ids: ["a", "b", "c"] } }' },
+    },
+    {
+      id: 'loop',
+      type: 'general-loop',
+      stepNumber: 2,
+      config: { loopType: 'map', collection: ref('seed', ['ids']), ...loopConfig },
+    },
+    {
+      id: 'body',
+      type: 'general-custom-js',
+      stepNumber: 3,
+      config: {
+        code: bodyCode,
+        params: {
+          id: ref('loop', ['currentItem']),
+          index: ref('loop', ['index']),
+          first: ref('loop', ['isFirst']),
+          last: ref('loop', ['isLast']),
+        },
+      },
+    },
+  ],
+  edges: [
+    { id: 'e1', source: 'seed', target: 'loop' },
+    {
+      id: 'e2',
+      source: 'loop',
+      target: 'body',
+      sourceHandle: 'loop',
+      targetHandle: 'loop-body-in',
+    },
+    {
+      id: 'e3',
+      source: 'body',
+      target: 'loop',
+      sourceHandle: 'loop-body-out',
+      targetHandle: 'loop-back',
+    },
+  ],
+})
+
+const expectedRows = [
+  { id: 'a', index: 0, first: true, last: false },
+  { id: 'b', index: 1, first: false, last: false },
+  { id: 'c', index: 2, first: false, last: true },
+]
+
+describe('client loop — a body node bound to the loop id sees the iteration', () => {
+  const utils = loadSharedRuntime()
+  const handlers = { 'general-custom-js': loadHandler('general-custom-js') }
+
+  const run = async (loopConfig: Record<string, unknown>) => {
+    const graph = buildGraph(loopConfig)
+    const context: Record<string, unknown> = { __pendingNodePromises: [] }
+    await utils.executeNodes(
+      graph.nodes,
+      graph.edges,
+      context,
+      handlers,
+      { nodes: graph.nodes, edges: graph.edges },
+      null,
+      'run'
+    )
+    return context
+  }
+
+  it('resolves currentItem / index / isFirst / isLast for every iteration', async () => {
+    const context = await run({})
+    expect((context.loop as { results: unknown[] }).results).toEqual(expectedRows)
+  })
+
+  it('does the same when the iterations run in parallel', async () => {
+    const context = await run({ parallel: true, concurrency: 2 })
+    expect((context.loop as { results: unknown[] }).results).toEqual(expectedRows)
+  })
+
+  it('iterates a bound array of objects — the resolved collection is never re-resolved into text', async () => {
+    // The loop's config arrives resolved; resolving an array a second time
+    // treats it as the parts of one string and joins it, which is how every
+    // client-side loop used to run zero times.
+    const graph = buildGraph({})
+    graph.nodes[0].config.code =
+      'function customHandler() { return { ids: [{ id: "x" }, { id: "y" }] } }'
+    graph.nodes[2].config.params = {
+      id: ref('loop', ['currentItem', 'id']),
+      index: ref('loop', ['index']),
+      first: ref('loop', ['isFirst']),
+      last: ref('loop', ['isLast']),
+    }
+    const context: Record<string, unknown> = { __pendingNodePromises: [] }
+    await utils.executeNodes(
+      graph.nodes,
+      graph.edges,
+      context,
+      handlers,
+      { nodes: graph.nodes, edges: graph.edges },
+      null,
+      'run'
+    )
+    expect((context.loop as { results: unknown[] }).results).toEqual([
+      { id: 'x', index: 0, first: true, last: false },
+      { id: 'y', index: 1, first: false, last: true },
+    ])
+  })
+
+  it('leaves the loop summary, not an iteration, under the loop id once it is done', async () => {
+    const context = await run({})
+    expect(context.loop).toEqual({ results: expectedRows, iterations: 3 })
+  })
+})

package/__tests__/cron-route-loop-custom-node.test.ts

@@ -0,0 +1,123 @@
+import { generateCronAPIRoute } from '../src/api-route-generator'
+import { loadServerRuntime } from './_helpers/load-server-runtime'
+import { withEnv } from './_helpers/fake-fetch'
+
+/**
+ * A custom node inside a loop body of a scheduled workflow runs once per item.
+ * Its handler only hands back a marker; the route must then call the custom
+ * node itself, as it does for a top-level one. Before, the marker was stored
+ * and nothing ran: the store-billing run never sent one of its emails.
+ */
+
+const LOOP_ID = 'loop-1'
+const CUSTOM_ID = 'send-1'
+
+const workflow: any = {
+  id: 'wf-billing',
+  name: 'Store Billing',
+  trigger: {
+    type: 'event-cron-triggered',
+    nodeId: 't',
+    scope: 'global',
+    config: { schedule: '5 * * * *', urlPath: 'cron_billing' },
+  },
+  nodes: [
+    {
+      id: LOOP_ID,
+      type: 'general-loop',
+      config: {
+        loopType: 'forEach',
+        collection: [{ email: 'a@shop.test' }, { email: 'b@shop.test' }],
+        itemVariable: 'item',
+      },
+      stepNumber: 1,
+      label: 'Loop Over Each Billing Email',
+    },
+    {
+      id: CUSTOM_ID,
+      type: 'general-custom-node',
+      config: {
+        customNodeId: 'cn-email',
+        parameters: {
+          to: { type: 'workflowContext', nodeId: LOOP_ID, path: [LOOP_ID, 'currentItem', 'email'] },
+        },
+      },
+      stepNumber: 2,
+      label: 'Send Subscription Lifecycle Email',
+    },
+  ],
+  edges: [
+    { id: 'e1', source: 't', target: LOOP_ID },
+    {
+      id: 'e2',
+      source: LOOP_ID,
+      target: CUSTOM_ID,
+      sourceHandle: 'loop',
+      targetHandle: 'loop-body-in',
+    },
+    {
+      id: 'e3',
+      source: CUSTOM_ID,
+      target: LOOP_ID,
+      sourceHandle: 'loop-body-out',
+      targetHandle: 'loop-back',
+    },
+  ],
+}
+
+const customNodes: any = {
+  'cn-email': { id: 'cn-email', name: 'Send Subscription Lifecycle Email', nodes: [], edges: [] },
+}
+
+describe('generated cron route — custom node in a loop body', () => {
+  it('runs the custom node for every item, with that item bound', async () => {
+    const sent: unknown[] = []
+    const runtime = { exports: loadServerRuntime() }
+    const requireShim = (id: string) => {
+      if (id.endsWith('/utils/workflows/server-runtime')) {
+        return runtime.exports
+      }
+      if (id.endsWith('/utils/workflows/custom-nodes')) {
+        return {
+          'cn-email': async (_context: unknown, parameters: unknown) => {
+            sent.push(parameters)
+            return { sent: true }
+          },
+        }
+      }
+      // eslint-disable-next-line @typescript-eslint/no-var-requires
+      return require(id)
+    }
+    const module = { exports: null as any }
+    // eslint-disable-next-line no-new-func
+    new Function('module', 'exports', 'require', generateCronAPIRoute(workflow, customNodes))(
+      module,
+      {},
+      requireShim
+    )
+
+    const reply = { status: 0, body: null as any }
+    const res = {
+      status(code: number) {
+        reply.status = code
+        return {
+          json(payload: unknown) {
+            reply.body = payload
+          },
+        }
+      },
+    }
+    const req = {
+      method: 'POST',
+      url: '/api/workflows/cron_billing',
+      headers: { host: 'shop.test', 'x-forwarded-proto': 'https' },
+      body: {},
+    }
+    await withEnv({ TELEPORT_CRON_ALLOW_UNSIGNED: 'true', TELEPORT_CRON_SECRET: undefined }, () =>
+      module.exports(req, res)
+    )
+
+    expect(reply.status).toBe(200)
+    expect(sent).toEqual([{ to: 'a@shop.test' }, { to: 'b@shop.test' }])
+  })
+})

package/__tests__/cron-route-loop-templateparams.test.ts

@@ -116,6 +116,13 @@ const buildCronWorkflow = (): any => ({
 describe('generateCronAPIRoute — loop + templateParams support', () => {
   const route = generateCronAPIRoute(buildCronWorkflow())
 
+  it('gives the run the origin it was requested on, so scripts never read env themselves', () => {
+    // Custom-JS scripts read the origin as `runtime.baseUrl`, which the route
+    // derives from crons-worker's request (see cron-route-verification.test.ts).
+    expect(route).toContain('context.__baseUrl = utils.trustedBaseUrl(req)')
+    expect(route).not.toContain('process.env.NEXTAUTH_URL')
+  })
+
   it('uses the loop-capable executor (handles general-loop body discovery)', () => {
     // The shared execution loop keys the loop body off the 'loop' sourceHandle
     // and walks 'loop-body-out' edges — markers absent from the old naive loop.

package/__tests__/cron-route-verification.test.ts

@@ -0,0 +1,252 @@
+import * as crypto from 'crypto'
+import { generateCronAPIRoute } from '../src/api-route-generator'
+import { loadServerRuntime } from './_helpers/load-server-runtime'
+import { NextWorkflowProjectPlugin } from '../src/workflow-project-plugin'
+import { FetchCall, withEnv, withFetch } from './_helpers/fake-fetch'
+
+/**
+ * The generated cron route EXECUTED: it runs its workflow only for a request
+ * crons-worker signed with the project's key (or Vercel Cron's bearer, or a
+ * local run that opted out), and answers 401 without running anything else.
+ */
+
+interface Reply {
+  status: number
+  body: any
+}
+
+const ROUTE_PATH = '/api/workflows/cron_nightly'
+const KEY = 'k'.repeat(64)
+
+// One data node: it calls the deployment's own /api/data route, so a test can
+// see whether the workflow ran, on which origin, and with which credentials.
+const workflow: any = {
+  id: 'wf-cron',
+  name: 'Nightly count',
+  trigger: {
+    type: 'event-cron-triggered',
+    nodeId: 't',
+    scope: 'global',
+    config: { schedule: '0 * * * *', urlPath: 'cron_nightly' },
+  },
+  nodes: [
+    {
+      id: 'count',
+      type: 'data-count',
+      config: { dataSourceId: 'ds-1', tableName: 'orders', filters: [] },
+      stepNumber: 1,
+      label: 'Count orders',
+    },
+  ],
+  edges: [{ id: 'e1', source: 't', target: 'count' }],
+}
+
+const loadRoute = (source: string) => {
+  const runtime = { exports: loadServerRuntime() }
+  const requireShim = (id: string) => {
+    if (id.endsWith('/utils/workflows/server-runtime')) {
+      return runtime.exports
+    }
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    return require(id)
+  }
+  const module = { exports: null as any }
+  // eslint-disable-next-line no-new-func
+  new Function('module', 'exports', 'require', source)(module, {}, requireShim)
+  return module.exports as (req: unknown, res: unknown) => Promise<void>
+}
+
+const handler = loadRoute(generateCronAPIRoute(workflow))
+
+const sign = (
+  key: string,
+  { timestamp = String(Math.floor(Date.now() / 1000)), path = ROUTE_PATH } = {}
+): Record<string, string> => ({
+  'x-teleport-cron-id': 'cron-1',
+  'x-teleport-project-id': 'project-1',
+  'x-teleport-cron-execution-id': 'exec-1',
+  'x-teleport-cron-timestamp': timestamp,
+  'x-teleport-cron-signature':
+    'v1=' +
+    crypto
+      .createHmac('sha256', key)
+      .update(`v1:${timestamp}:project-1:cron-1:exec-1:${path}`)
+      .digest('hex'),
+})
+
+const NO_KEYS: Record<string, string | undefined> = {
+  TELEPORT_CRON_SECRET: undefined,
+  TELEPORT_CRON_SECRET_PREVIOUS: undefined,
+  CRON_SECRET: undefined,
+  TELEPORT_CRON_ALLOW_UNSIGNED: undefined,
+  VERCEL_AUTOMATION_BYPASS_SECRET: undefined,
+}
+
+const run = async (
+  headers: Record<string, string>,
+  env: Record<string, string | undefined> = { TELEPORT_CRON_SECRET: KEY },
+  url = ROUTE_PATH
+): Promise<{ reply: Reply; calls: FetchCall[] }> => {
+  const reply: Reply = { status: 0, body: null }
+  const res = {
+    status(code: number) {
+      reply.status = code
+      return {
+        json(payload: unknown) {
+          reply.body = payload
+        },
+      }
+    },
+  }
+  const req = {
+    method: 'POST',
+    url,
+    headers: { host: 'shop.test', 'x-forwarded-proto': 'https', ...headers },
+    body: {},
+  }
+  const calls = await withEnv({ ...NO_KEYS, ...env }, () =>
+    withFetch(
+      () => ({ status: 200, body: { count: 3 } }),
+      async (recorded) => {
+        await handler(req, res)
+        return recorded
+      }
+    )
+  )
+  return { reply, calls }
+}
+
+const expectRefused = ({ reply, calls }: { reply: Reply; calls: FetchCall[] }) => {
+  expect(reply).toEqual({ status: 401, body: { error: 'Unauthorized' } })
+  expect(calls).toEqual([])
+}
+
+describe('generated cron route — request verification', () => {
+  it('runs a request signed with the deployed key, on the origin it was requested on', async () => {
+    const { reply, calls } = await run(sign(KEY), {
+      TELEPORT_CRON_SECRET: KEY,
+      VERCEL_AUTOMATION_BYPASS_SECRET: 'bypass-1',
+    })
+
+    expect(reply.status).toBe(200)
+    expect(reply.body.success).toBe(true)
+    expect(calls).toHaveLength(1)
+    expect(calls[0].url).toBe('https://shop.test/api/data/ds-1/count')
+    // A deployment behind Vercel protection can call its own data routes.
+    expect(calls[0].headers['x-vercel-protection-bypass']).toBe('bypass-1')
+  })
+
+  it('signs the path without its query string', async () => {
+    const { reply } = await run(sign(KEY), undefined, `${ROUTE_PATH}?source=cron`)
+    expect(reply.status).toBe(200)
+  })
+
+  it('refuses a signature made with another key', async () => {
+    expectRefused(await run(sign('another-key')))
+  })
+
+  it('refuses a timestamp outside the five-minute window, either side', async () => {
+    const now = Math.floor(Date.now() / 1000)
+    expectRefused(await run(sign(KEY, { timestamp: String(now - 301) })))
+    expectRefused(await run(sign(KEY, { timestamp: String(now + 301) })))
+    expectRefused(await run(sign(KEY, { timestamp: 'soon' })))
+  })
+
+  it('refuses a signature made for another route', async () => {
+    expectRefused(await run(sign(KEY, { path: '/api/workflows/cron_other' })))
+  })
+
+  it('refuses a request missing any signed header', async () => {
+    for (const header of Object.keys(sign(KEY))) {
+      const headers = sign(KEY)
+      delete headers[header]
+      expectRefused(await run(headers))
+    }
+  })
+
+  it('refuses a signed id that was changed after signing', async () => {
+    expectRefused(await run({ ...sign(KEY), 'x-teleport-cron-id': 'cron-2' }))
+  })
+
+  it('accepts the previous key while a rotation is under way', async () => {
+    const { reply } = await run(sign('old-key'), {
+      TELEPORT_CRON_SECRET: KEY,
+      TELEPORT_CRON_SECRET_PREVIOUS: 'old-key',
+    })
+    expect(reply.status).toBe(200)
+  })
+
+  it('never verifies against an unset key, even a signature made with the empty one', async () => {
+    expectRefused(await run(sign(''), { TELEPORT_CRON_SECRET: '' }))
+  })
+
+  it("accepts Vercel Cron's bearer only when CRON_SECRET is set and matches", async () => {
+    const accepted = await run(
+      { authorization: 'Bearer vercel-key' },
+      { CRON_SECRET: 'vercel-key' }
+    )
+    expect(accepted.reply.status).toBe(200)
+    expect(accepted.calls).toHaveLength(1)
+
+    expectRefused(await run({ authorization: 'Bearer wrong' }, { CRON_SECRET: 'vercel-key' }))
+    expectRefused(await run({ authorization: 'Bearer ' }, {}))
+    expectRefused(await run({ authorization: 'Bearer undefined' }, {}))
+  })
+
+  it('runs an unsigned request only when the local-run flag is exactly "true"', async () => {
+    expectRefused(await run({}))
+    expectRefused(await run({}, { TELEPORT_CRON_ALLOW_UNSIGNED: '1' }))
+
+    const { reply, calls } = await run({}, { TELEPORT_CRON_ALLOW_UNSIGNED: 'true' })
+    expect(reply.status).toBe(200)
+    expect(calls).toHaveLength(1)
+  })
+})
+
+describe('cron routes and the generated .env', () => {
+  const generate = async (workflows: Record<string, any>) => {
+    const structure: any = {
+      uidl: {
+        name: 'Store',
+        globals: { settings: { title: 'Store', language: 'en' }, env: {} },
+        root: {
+          name: 'Root',
+          stateDefinitions: {
+            route: { type: 'string', defaultValue: 'Home', values: [{ value: 'Home' }] },
+          },
+          node: { type: 'element', content: { elementType: 'container', children: [] } },
+        },
+        components: {},
+        workflows: { workflows },
+      },
+      strategy: { pages: { options: {} } },
+      files: new Map(),
+      dependencies: {},
+      devDependencies: {},
+    }
+    await new NextWorkflowProjectPlugin().runAfter(structure)
+    return structure
+  }
+
+  it('declares TELEPORT_CRON_SECRET, empty, for the deploy to fill', async () => {
+    const structure = await generate({ [workflow.id]: workflow })
+
+    expect(structure.uidl.globals.env.TELEPORT_CRON_SECRET).toBe('')
+    expect(structure.files.has(`workflow-cron-${workflow.id}`)).toBe(true)
+  })
+
+  it('emits the server runtime and handlers a cron route requires, even with no other server work', async () => {
+    const structure = await generate({ [workflow.id]: workflow })
+    const cronRoute = structure.files.get(`workflow-cron-${workflow.id}`)!.files[0]
+      .content as string
+
+    expect(cronRoute).toContain("require('../../../utils/workflows/server-runtime')")
+    expect(structure.files.has('workflow-server-runtime')).toBe(true)
+  })
+
+  it('declares nothing for an app without a cron route', async () => {
+    const structure = await generate({})
+
+    expect('TELEPORT_CRON_SECRET' in structure.uidl.globals.env).toBe(false)
+  })
+})

package/__tests__/custom-js-runtime-base-url.test.ts

@@ -0,0 +1,64 @@
+import { loadHandler, HandlerFn } from './_helpers/load-handler'
+
+/**
+ * A custom-JS script that builds an absolute link (an email button) reads the
+ * segment's request origin as `runtime.baseUrl` — bound by NAME, in either
+ * documented signature — and never touches `process.env`, which the publish
+ * scanner flags. On the client, and in a segment with no request behind it,
+ * the origin is the empty string.
+ */
+
+describe('general-custom-js — runtime.baseUrl', () => {
+  const handler: HandlerFn = loadHandler('general-custom-js')
+
+  const TOP_LEVEL = [
+    'function customHandler(params, inputs, workflowContext, runtime) {',
+    '  return { base: runtime.baseUrl };',
+    '}',
+  ].join('\n')
+
+  const INSIDE_CUSTOM_NODE = [
+    'function customHandler(previousContext, params, runtime) {',
+    '  return { base: runtime.baseUrl };',
+    '}',
+  ].join('\n')
+
+  it('hands a top-level script the segment origin', async () => {
+    const result = await handler(
+      { code: TOP_LEVEL },
+      { trigger: { tag: 'trigger' }, __baseUrl: 'https://shop.example' }
+    )
+    expect(result).toEqual({ base: 'https://shop.example' })
+  })
+
+  it('hands a custom-node script the same origin by name', async () => {
+    const result = await handler(
+      { code: INSIDE_CUSTOM_NODE },
+      {
+        __isInsideCustomNode: true,
+        __customNodeIds: [],
+        __customParams: { orderId: 'o-1' },
+        __baseUrl: 'https://shop.example',
+      }
+    )
+    expect(result).toEqual({ base: 'https://shop.example' })
+  })
+
+  it('is empty where no request stands behind the segment', async () => {
+    const result = await handler({ code: TOP_LEVEL }, { trigger: { tag: 'trigger' } })
+    expect(result).toEqual({ base: '' })
+  })
+
+  it('does not occupy a positional params slot', async () => {
+    const PROBE = [
+      'function customHandler(params) {',
+      '  return { seen: params.map(function (p) { return p && p.tag ? p.tag : null; }) };',
+      '}',
+    ].join('\n')
+    const result = (await handler(
+      { code: PROBE },
+      { trigger: { tag: 'trigger' }, cart: { tag: 'cart' }, __baseUrl: 'https://shop.example' }
+    )) as { seen: string[] }
+    expect(result.seen).toEqual(['trigger', 'cart'])
+  })
+})