@teleporthq/teleport-plugin-next-workflows 0.43.9 → 0.43.11

package/__tests__/account-node-output-contract.test.ts

@@ -0,0 +1,69 @@
+/* tslint:disable:no-eval */
+import { accountGetCurrent } from '../src/nodes/account/account-get-current'
+import { accountLogin } from '../src/nodes/account/account-login'
+import { accountSignup } from '../src/nodes/account/account-signup'
+import { accountComparePasswords } from '../src/nodes/account/account-compare-passwords'
+
+// Regression: these account nodes returned the user NESTED under `.user`, but
+// their declared output contract (node-context-schemas) and the workflow
+// builders read the user's fields FLAT (e.g. wfCtx(node, ['id']) for a row's
+// user_id in follow/like/loyalty/review inserts). Nested-only output meant
+// `user_id` resolved to undefined. The handlers must expose the fields flat
+// (and keep `.user`). account-compare-passwords emitted `isMatch` but the
+// delete-account template read `.match`.
+
+function evalHandler(code: string): any {
+  return eval('(' + code + ')')
+}
+
+describe('account node output contracts (flat user fields)', () => {
+  it('account-get-current exposes user fields flat AND keeps .user', async () => {
+    const handler = evalHandler(accountGetCurrent.generateHandler())
+    const fakeUser = { id: 'u-123', email: 'a@b.com', name: 'Ada', image: 'x.png' }
+    ;(global as any).fetch = async () => ({ ok: true, json: async () => ({ user: fakeUser }) })
+    ;(global as any).window = undefined
+    try {
+      const out = await handler({}, {})
+      expect(out.id).toBe('u-123')
+      expect(out.email).toBe('a@b.com')
+      expect(out.name).toBe('Ada')
+      expect(out.user).toEqual(fakeUser) // nested still works
+    } finally {
+      delete (global as any).fetch
+    }
+  })
+
+  it('account-get-current with no user returns user:null and no flat fields', async () => {
+    const handler = evalHandler(accountGetCurrent.generateHandler())
+    ;(global as any).fetch = async () => ({ ok: true, json: async () => ({ user: null }) })
+    try {
+      const out = await handler({}, {})
+      expect(out.user).toBeNull()
+      expect(out.id).toBeUndefined()
+    } finally {
+      delete (global as any).fetch
+    }
+  })
+
+  it('account-login / account-signup client handlers expose flat fields + user + success', async () => {
+    for (const gen of [accountLogin, accountSignup]) {
+      const code = gen.generateHandler()
+      // Both copy the user fields onto a fresh object then set user + success
+      // (no Object.assign/spread — would down-level to a missing tslib helper).
+      expect(code).toContain('__out.user = user || null')
+      expect(code).toContain('__out.success = true')
+    }
+  })
+
+  it('account-login / account-signup SERVER handlers also flatten the sanitized user', () => {
+    for (const gen of [accountLogin, accountSignup]) {
+      const code = (gen as any).generateServerHandler()
+      expect(code).toContain('Object.assign({}, __su || {}, { user: __su, success: true })')
+    }
+  })
+
+  it('account-compare-passwords emits both isMatch (contract) and match (alias)', () => {
+    const code = accountComparePasswords.generateHandler()
+    expect(code).toContain('isMatch, match: isMatch')
+  })
+})

package/__tests__/data-create-item-cart-mark-ordered.test.ts

@@ -0,0 +1,30 @@
+import { dataCreateItem } from '../src/nodes/data/data-create-item'
+
+// When the place-order workflow inserts a teleport_orders row, the
+// data-create-item node must also retire the buyer's active database cart via
+// a fire-and-forget POST to /api/cart/mark-ordered. This covers the AI
+// place-order path that bypasses /api/ecommerce/checkout. It is keyed by the
+// order's owner id (the real user_id when logged in, else the guest anon id)
+// because the server-to-server call carries no auth cookies. It must never
+// affect the placed order.
+
+describe('data-create-item — marks the database cart ordered on order insert', () => {
+  const handler = dataCreateItem.generateHandler()
+
+  it('fires a mark-ordered call only for teleport_orders inserts', () => {
+    expect(handler).toContain('/api/cart/mark-ordered')
+    // Inside the orders-only branch.
+    const ordersBranch = handler.indexOf("tableName === 'teleport_orders'")
+    const markCall = handler.indexOf('/api/cart/mark-ordered')
+    expect(ordersBranch).toBeGreaterThan(-1)
+    expect(markCall).toBeGreaterThan(ordersBranch)
+  })
+
+  it('keys by the order owner id (user_id or guest anon id) and is fire-and-forget', () => {
+    expect(handler).toContain('item.user_id')
+    expect(handler).toContain('__anonymousUserId')
+    expect(handler).toContain('anonymousUserId: __orderOwnerId')
+    // Fire-and-forget + guarded so it never breaks the order.
+    expect(handler).toMatch(/mark-ordered[\s\S]*\.catch\(/)
+  })
+})

package/__tests__/navigation-go-to-page.test.ts

@@ -90,6 +90,40 @@ describe('navigation-go-to-page', () => {
       )
       expect(win.location.href).toBe('/about-us')
     })
+
+    // Regression: a guest clicking "add to favourites" was sent to
+    // `/TQ_oiC1MlnMiO` (404) instead of `/sign-in`. The auth sign-in page was
+    // missing from the route map, so runBefore left `pageId` as the raw page
+    // id. The runtime must recognise that a non-route pageId can't be a real
+    // URL and fall back to the mapper's staticUrl.
+    it('falls back to targetPage.staticUrl when pageId is an unresolved page id (not a route)', async () => {
+      await handler(
+        {
+          pageId: 'TQ_oiC1MlnMiO',
+          openInNewTab: false,
+          targetPage: {
+            pageId: 'TQ_oiC1MlnMiO',
+            pageName: 'sign-in',
+            staticUrl: '/sign-in',
+            isDetailsPage: false,
+          },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('/sign-in')
+    })
+
+    it('still uses a raw pageId as a last resort when no staticUrl is available', async () => {
+      await handler(
+        {
+          pageId: 'TQ_oiC1MlnMiO',
+          openInNewTab: false,
+          targetPage: { pageId: 'TQ_oiC1MlnMiO', isDetailsPage: false },
+        },
+        {}
+      )
+      expect(win.location.href).toBe('TQ_oiC1MlnMiO')
+    })
   })
 
   describe('details page differentiator', () => {

package/__tests__/node-audit-fixes.test.ts

@@ -0,0 +1,144 @@
+/* tslint:disable:no-eval */
+import { transformValidate } from '../src/nodes/transform/transform-validate'
+import { elementAddClass } from '../src/nodes/element/element-add-class'
+import { elementToggleClass } from '../src/nodes/element/element-toggle-class'
+import { integrationMailchimp } from '../src/nodes/integrations/integration-mailchimp'
+import { integrationSegment } from '../src/nodes/integrations/integration-segment'
+import { integrationSlack } from '../src/nodes/integrations/integration-slack'
+import { integrationYoutube } from '../src/nodes/integrations/integration-youtube'
+import { integrationWoocommerce } from '../src/nodes/integrations/integration-woocommerce'
+import { integrationAmazonS3 } from '../src/nodes/integrations/integration-amazon-s3'
+import { integrationGreenhouse } from '../src/nodes/integrations/integration-greenhouse'
+import { createGenericIntegration } from '../src/nodes/integrations/integration-generic'
+import { transformDateTime } from '../src/nodes/transform/transform-date-time'
+
+// Regression guards for the 26 bugs found by the full node audit. Functional
+// where the fix is logic (eval the emitted handler and run it); string-level
+// where the fix is an API contract embedded in the generated source.
+
+function evalHandler(code: string): any {
+  return eval('(' + code + ')')
+}
+
+describe('node-audit fixes — functional', () => {
+  it('transform-validate accepts valid emails and rejects invalid (regex no longer double-escaped)', async () => {
+    const handler = evalHandler(transformValidate.generateHandler())
+    const cfg = {
+      input: { a: 'john@example.com', b: 'nope' },
+      rules: [
+        { field: 'a', rule: 'email' },
+        { field: 'b', rule: 'email' },
+      ],
+    }
+    const res = await handler(cfg, {})
+    // field a is valid, field b is invalid → exactly one error, for field b.
+    expect(res.isValid).toBe(false)
+    expect(res.errors.length).toBe(1)
+    // And a fully-valid set passes.
+    const ok = await handler(
+      { input: { a: 'jane.doe@sub.example.co' }, rules: [{ field: 'a', rule: 'email' }] },
+      {}
+    )
+    expect(ok.isValid).toBe(true)
+  })
+
+  it('element-add-class handles a multi-class string and empty value without throwing', async () => {
+    const added: string[] = []
+    const el = {
+      classList: {
+        add: (c: string) => {
+          if (!c || /\s/.test(c)) throw new Error('InvalidCharacterError')
+          added.push(c)
+        },
+      },
+    }
+    ;(global as any).document = { getElementById: () => el }
+    try {
+      const handler = evalHandler(elementAddClass.generateHandler())
+      const res = await handler({ nodeId: 'x', className: 'btn  active' }, {})
+      expect(res).toEqual({ success: true })
+      expect(added).toEqual(['btn', 'active'])
+      // Empty className must not throw.
+      const res2 = await handler({ nodeId: 'x', className: '' }, {})
+      expect(res2).toEqual({ success: true })
+    } finally {
+      delete (global as any).document
+    }
+  })
+
+  it('element-toggle-class splits a multi-class string instead of throwing', async () => {
+    const toggled: string[] = []
+    const el = {
+      classList: {
+        toggle: (c: string) => {
+          if (!c || /\s/.test(c)) throw new Error('InvalidCharacterError')
+          toggled.push(c)
+        },
+      },
+    }
+    ;(global as any).document = { getElementById: () => el }
+    try {
+      const handler = evalHandler(elementToggleClass.generateHandler())
+      const res = await handler({ nodeId: 'x', className: 'is-open active' }, {})
+      expect(res).toEqual({ success: true })
+      expect(toggled).toEqual(['is-open', 'active'])
+    } finally {
+      delete (global as any).document
+    }
+  })
+
+  it('transform-date-time is-weekend operation is now reachable', () => {
+    const code = transformDateTime.generateHandler()
+    expect(code).toContain("case 'is-weekend':")
+  })
+})
+
+describe('node-audit fixes — emitted API contracts', () => {
+  it('mailchimp guards a missing apiKey before calling .split', () => {
+    const code = integrationMailchimp.generateHandler()
+    expect(code).toMatch(/Mailchimp API key is not configured/)
+    // the guard precedes the .split('-') call
+    expect(code.indexOf('is not configured')).toBeLessThan(code.indexOf(".split('-')"))
+  })
+
+  it('segment get-profile uses Basic auth, not the wrong "Segment " scheme', () => {
+    const code = integrationSegment.generateHandler()
+    expect(code).toContain("'Basic ' + btoa(config.personasToken")
+    expect(code).not.toContain("'Segment ' + config.personasToken")
+  })
+
+  it('slack files.upload sends form-urlencoded, not JSON', () => {
+    const code = integrationSlack.generateHandler()
+    expect(code).toContain('application/x-www-form-urlencoded')
+    expect(code).toContain('files.upload')
+  })
+
+  it('youtube uses authParam (OAuth or key) on every action, not hardcoded key', () => {
+    const code = integrationYoutube.generateHandler()
+    expect(code).not.toContain("?key=' + apiKey")
+  })
+
+  it('woocommerce guards a missing storeUrl and honours explicit force=false', () => {
+    const code = integrationWoocommerce.generateHandler()
+    expect(code).toContain('storeUrl is not configured')
+    expect(code).toContain('config.force === false ? false : true')
+  })
+
+  it('amazon-s3 set-acl signs acl= (SigV4 key=value form)', () => {
+    const code = integrationAmazonS3.generateHandler()
+    expect(code).toContain("'acl='")
+  })
+
+  it('greenhouse write actions attach the On-Behalf-Of header', () => {
+    const code = integrationGreenhouse.generateHandler()
+    expect(code).toContain('On-Behalf-Of')
+  })
+
+  it('generic integration supports a raw (non-Bearer) auth scheme', () => {
+    const bearer = createGenericIntegration('integration-x').generateHandler()
+    const raw = createGenericIntegration('integration-x', 'raw').generateHandler()
+    expect(bearer).toContain("'Bearer ' + tok")
+    expect(raw).not.toContain("'Bearer ' + tok")
+    expect(raw).toContain("'' + tok")
+  })
+})

package/__tests__/runtime-trigger-element-roundtrip.test.ts

@@ -0,0 +1,156 @@
+import { generateClientRuntimeCode } from '../src/executor-generator'
+
+// Regression guard for the "/cart + button does nothing in production" bug.
+//
+// A workflow that mixes a server segment (stock check, which filters a product
+// by `trigger.element.dataset.productId`) with a client segment (cart-update,
+// which reads `trigger.element.dataset.cartItemId`) used to break on deploy:
+//
+//   1. `pruneContext` could not serialize the live DOM trigger element, so it
+//      crossed to the server as `{ __serializationError: true }`. The server's
+//      data-select then filtered on an undefined productId and matched the
+//      wrong product.
+//   2. The server echoed that `{ __serializationError: true }` placeholder
+//      back, and `Object.assign(context, serverResults)` overwrote the
+//      client's REAL trigger element with it — so the subsequent client
+//      cart-update read `undefined` for cartItemId and silently no-opped.
+//
+// The fix makes `pruneContext` emit a serializable DOM snapshot (carrying the
+// dataset) and `mergeServerResults` keep the client's authoritative live
+// element. These tests lock both halves in.
+
+type Fn = (...args: unknown[]) => unknown
+
+function extractFn(name: string, returnExpr = name): Fn {
+  const src = generateClientRuntimeCode()
+  // Each helper is generated as `function <name>(...) { ... }\n}` — grab it up
+  // to the closing brace on its own line, then eval to expose it. Same
+  // approach as runtime-absolutize-url.test.ts.
+  const re = new RegExp(`function ${name}\\b[\\s\\S]*?\\n\\}`)
+  const match = src.match(re)
+  if (!match) {
+    throw new Error(`${name} not found in generated runtime`)
+  }
+  // pruneContext depends on isDomNode/snapshotDomNode/domSerializationReplacer;
+  // mergeServerResults depends on isDomNode. Pull those in too when present.
+  const deps = ['isDomNode', 'snapshotDomNode', 'domSerializationReplacer']
+    .filter((d) => d !== name)
+    .map((d) => {
+      const m = src.match(new RegExp(`function ${d}\\b[\\s\\S]*?\\n\\}`))
+      return m ? m[0] : ''
+    })
+    .join('\n')
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  return new Function(`${deps}\n${match[0]}\nreturn ${returnExpr};`)() as Fn
+}
+
+// Minimal stand-in for a DOM element with a dataset (jsdom is not loaded here).
+function fakeButton(dataset: Record<string, string>) {
+  return {
+    nodeType: 1,
+    tagName: 'BUTTON',
+    id: 'inc-btn',
+    name: '',
+    type: 'button',
+    className: 'qty-up',
+    dataset,
+    // Live DOM method that must NOT survive the network — its presence proves
+    // we kept the real element rather than a frozen snapshot.
+    closest: () => 'real-element',
+  }
+}
+
+describe('trigger element survives the server-segment round-trip', () => {
+  const pruneContext = extractFn('pruneContext') as (
+    ctx: Record<string, unknown>
+  ) => Record<string, any>
+  const mergeServerResults = extractFn('mergeServerResults') as (
+    ctx: Record<string, unknown>,
+    results: Record<string, unknown>,
+    triggerNodeId?: string
+  ) => void
+
+  const TRIGGER_ID = 'c0bc751c-250c-41b0-b4db-0adbd2867574'
+
+  it('pruneContext keeps the trigger element dataset (no __serializationError)', () => {
+    const el = fakeButton({
+      productId: '1117ddda-a771-4198-80e0-45fd3e7babe0',
+      cartItemId: 'cart_1780265668470_nwqtc3wtm',
+      currentQuantity: '1',
+    })
+    const context = {
+      [TRIGGER_ID]: { element: el, triggerElement: el },
+      triggerElement: el,
+      __baseUrl: 'https://example.teleporthq.dev',
+    }
+
+    const pruned = pruneContext(context)
+
+    // The pruned trigger node must carry the dataset the server filters on —
+    // not the old { __serializationError: true } placeholder.
+    expect(pruned[TRIGGER_ID].__serializationError).toBeUndefined()
+    expect(pruned[TRIGGER_ID].element.dataset.productId).toBe(
+      '1117ddda-a771-4198-80e0-45fd3e7babe0'
+    )
+    expect(pruned[TRIGGER_ID].element.dataset.cartItemId).toBe('cart_1780265668470_nwqtc3wtm')
+    expect(pruned.triggerElement.dataset.currentQuantity).toBe('1')
+    // The whole pruned context must be JSON-serializable for the fetch body —
+    // i.e. no live DOM node / method leaked through.
+    expect(() => JSON.stringify({ context: pruned })).not.toThrow()
+    expect(pruned[TRIGGER_ID].element.closest).toBeUndefined()
+    expect(pruned.__baseUrl).toBe('https://example.teleporthq.dev')
+  })
+
+  it('mergeServerResults preserves the live client trigger element', () => {
+    const el = fakeButton({
+      productId: '1117ddda-a771-4198-80e0-45fd3e7babe0',
+      cartItemId: 'cart_1780265668470_nwqtc3wtm',
+      currentQuantity: '1',
+    })
+    const context: Record<string, any> = {
+      [TRIGGER_ID]: { element: el, triggerElement: el },
+      triggerElement: el,
+    }
+
+    // What the server returns: its own node results PLUS the trigger echoed
+    // back as the unhelpful placeholder (pre-fix) and snapshot (post-fix).
+    const serverResults = {
+      [TRIGGER_ID]: { __serializationError: true },
+      triggerElement: { __serializationError: true },
+      'c83827c1-stock': { rows: [{ id: 'x', quantity: 25 }], count: 12 },
+      '3d274382-if': { result: true },
+    }
+
+    mergeServerResults(context, serverResults, TRIGGER_ID)
+
+    // Server node results merged in...
+    expect(context['3d274382-if']).toEqual({ result: true })
+    expect(context['c83827c1-stock'].count).toBe(12)
+    // ...but the trigger element is still the REAL one (method intact), so the
+    // downstream client cart-update reads the genuine cartItemId.
+    expect(context[TRIGGER_ID].element.closest()).toBe('real-element')
+    expect(context[TRIGGER_ID].element.dataset.cartItemId).toBe('cart_1780265668470_nwqtc3wtm')
+    expect(context.triggerElement.dataset.cartItemId).toBe('cart_1780265668470_nwqtc3wtm')
+  })
+
+  it('mergeServerResults never lets a placeholder clobber a real value', () => {
+    const context: Record<string, any> = {
+      keep: { real: true },
+    }
+    mergeServerResults(context, { keep: { __truncated: true }, fresh: { ok: 1 } }, undefined)
+    expect(context.keep).toEqual({ real: true })
+    expect(context.fresh).toEqual({ ok: 1 })
+  })
+
+  it('mergeServerResults still protects the trigger node without an id (custom node)', () => {
+    const el = fakeButton({ cartItemId: 'cart_abc' })
+    const context: Record<string, any> = {
+      [TRIGGER_ID]: { element: el },
+      triggerElement: el,
+    }
+    // Custom-node executor calls without the outer trigger id; the generic
+    // .element guard must still preserve it.
+    mergeServerResults(context, { [TRIGGER_ID]: { __serializationError: true } }, undefined)
+    expect(context[TRIGGER_ID].element.dataset.cartItemId).toBe('cart_abc')
+  })
+})