@teleporthq/teleport-plugin-next-workflows 0.44.10 → 0.44.17

package/src/nodes/realtime/realtime-send-channel-message.ts

@@ -4,8 +4,19 @@ async function realtime_send_channel_message(config: any, context: Record<string
   const channelName = config.channelName
   const message = config.message != null ? String(config.message) : ''
   const messageData = config.messageData || null
-  const senderId = config.senderId || 'system'
-  const senderName = config.senderName || 'System'
+  // Run for a signed-in visitor, the send goes out as that visitor — the
+  // session the segment route verified, never a value the request carries.
+  // Otherwise (a guest, a cron, an automation) as the author configured, or
+  // "System".
+  const ctx = (context || {}) as any
+  const sessionId =
+    ctx.__sessionUserId != null && ctx.__sessionUserId !== '' ? String(ctx.__sessionUserId) : ''
+  const sessionName =
+    ctx.__sessionUser && typeof ctx.__sessionUser.name === 'string' && ctx.__sessionUser.name
+      ? ctx.__sessionUser.name
+      : 'Member'
+  const senderId = sessionId || config.senderId || 'system'
+  const senderName = sessionId ? sessionName : config.senderName || 'System'
 
   if (!channelName) {
     return { success: false, error: 'channelName is required' }

package/src/nodes/sms/sms-infobip.ts

@@ -1,6 +1,18 @@
-import { NodeHandlerGenerator, handlerToString } from '../types'
+import { NodeHandlerGenerator } from '../types'
+import { outboundMessageHandlerSources } from '../email/outbound-message-guard'
+
+declare function __outboundMessageGuard(channel: string, config: any, context: any): Promise<any>
 
 async function sms_infobip(config: any, context: Record<string, unknown>) {
+  // Line breaks out of every header; a visitor-supplied recipient counted
+  // (see outbound-message-guard).
+  const refused = await __outboundMessageGuard('sms', config, context)
+  if (refused) {
+    // Over a limit: skipped, not failed, so the visitor's action goes on.
+    return refused.skipped
+      ? { messageId: '', skipped: true, reason: refused.skipped }
+      : { messageId: '', success: false, error: refused.error }
+  }
   const apiKey = config.apiKey
   // Infobip's dashboard gives the base URL WITH the scheme (https://xxx.api.infobip.com).
   // Strip any existing scheme so we don't build the invalid `https://https://...`.
@@ -60,7 +72,5 @@ async function sms_infobip(config: any, context: Record<string, unknown>) {
 export const smsInfobip: NodeHandlerGenerator = {
   nodeType: 'sms-infobip',
   executionEnv: 'server',
-  generateHandler(): string {
-    return handlerToString(sms_infobip)
-  },
+  ...outboundMessageHandlerSources(sms_infobip),
 }

package/src/nodes/sms/sms-smsapi.ts

@@ -1,6 +1,18 @@
-import { NodeHandlerGenerator, handlerToString } from '../types'
+import { NodeHandlerGenerator } from '../types'
+import { outboundMessageHandlerSources } from '../email/outbound-message-guard'
+
+declare function __outboundMessageGuard(channel: string, config: any, context: any): Promise<any>
 
 async function sms_smsapi(config: any, context: Record<string, unknown>) {
+  // Line breaks out of every header; a visitor-supplied recipient counted
+  // (see outbound-message-guard).
+  const refused = await __outboundMessageGuard('sms', config, context)
+  if (refused) {
+    // Over a limit: skipped, not failed, so the visitor's action goes on.
+    return refused.skipped
+      ? { messageId: '', skipped: true, reason: refused.skipped }
+      : { messageId: '', success: false, error: refused.error }
+  }
   const accessToken = config.accessToken
   const from = config.from
   const to = config.to
@@ -45,7 +57,5 @@ async function sms_smsapi(config: any, context: Record<string, unknown>) {
 export const smsSmsapi: NodeHandlerGenerator = {
   nodeType: 'sms-smsapi',
   executionEnv: 'server',
-  generateHandler(): string {
-    return handlerToString(sms_smsapi)
-  },
+  ...outboundMessageHandlerSources(sms_smsapi),
 }

package/src/nodes/sms/sms-textmagic.ts

@@ -1,6 +1,18 @@
-import { NodeHandlerGenerator, handlerToString } from '../types'
+import { NodeHandlerGenerator } from '../types'
+import { outboundMessageHandlerSources } from '../email/outbound-message-guard'
+
+declare function __outboundMessageGuard(channel: string, config: any, context: any): Promise<any>
 
 async function sms_textmagic(config: any, context: Record<string, unknown>) {
+  // Line breaks out of every header; a visitor-supplied recipient counted
+  // (see outbound-message-guard).
+  const refused = await __outboundMessageGuard('sms', config, context)
+  if (refused) {
+    // Over a limit: skipped, not failed, so the visitor's action goes on.
+    return refused.skipped
+      ? { messageId: '', skipped: true, reason: refused.skipped }
+      : { messageId: '', success: false, error: refused.error }
+  }
   const apiKey = config.apiKey
   const username = config.username
   const from = config.from
@@ -38,7 +50,5 @@ async function sms_textmagic(config: any, context: Record<string, unknown>) {
 export const smsTextmagic: NodeHandlerGenerator = {
   nodeType: 'sms-textmagic',
   executionEnv: 'server',
-  generateHandler(): string {
-    return handlerToString(sms_textmagic)
-  },
+  ...outboundMessageHandlerSources(sms_textmagic),
 }

package/src/nodes/sms/sms-twilio.ts

@@ -1,6 +1,18 @@
-import { NodeHandlerGenerator, handlerToString } from '../types'
+import { NodeHandlerGenerator } from '../types'
+import { outboundMessageHandlerSources } from '../email/outbound-message-guard'
+
+declare function __outboundMessageGuard(channel: string, config: any, context: any): Promise<any>
 
 async function sms_twilio(config: any, context: Record<string, unknown>) {
+  // Line breaks out of every header; a visitor-supplied recipient counted
+  // (see outbound-message-guard).
+  const refused = await __outboundMessageGuard('sms', config, context)
+  if (refused) {
+    // Over a limit: skipped, not failed, so the visitor's action goes on.
+    return refused.skipped
+      ? { messageSid: '', skipped: true, reason: refused.skipped }
+      : { messageSid: '', success: false, error: refused.error }
+  }
   const accountSid = config.accountSid
   const authToken = config.authToken
   const from = config.from
@@ -44,7 +56,5 @@ export const smsTwilio: NodeHandlerGenerator = {
   dependencies: {
     twilio: '^5.0.0',
   },
-  generateHandler(): string {
-    return handlerToString(sms_twilio)
-  },
+  ...outboundMessageHandlerSources(sms_twilio),
 }

package/src/nodes/types.ts

@@ -110,6 +110,14 @@ export function resolveHandlerEntryName(source: string, nodeType: string): strin
   )
 }
 
+/** What a route's server handlers are generated for. */
+export interface ServerHandlerOptions {
+  /** The project has the in-app event bus (`hasAutomationsBus`). */
+  withAutomations?: boolean
+  /** From the file the handler is inlined into to the project root. */
+  relativePrefix?: string
+}
+
 export interface NodeHandlerGenerator {
   nodeType: string
   executionEnv: 'client' | 'server' | 'universal'
@@ -122,7 +130,7 @@ export interface NodeHandlerGenerator {
   resultIsCredential?: boolean
   dependencies?: Record<string, string>
   generateHandler(): string
-  generateServerHandler?(): string
+  generateServerHandler?(options?: ServerHandlerOptions): string
 }
 
 export interface IntegrationHandlerGenerator extends NodeHandlerGenerator {

package/src/nodes/utility/utility-similarity-scoring.ts

@@ -1,7 +1,10 @@
-import { NodeHandlerGenerator } from '../types'
+import { NodeHandlerGenerator, ServerHandlerOptions } from '../types'
 import { generateAIProviderUtils, AI_PROVIDER_DEPENDENCIES } from '../ai/ai-provider-utils'
+import { serverHandlerPrefix } from '../general/visitor-request'
 
 declare function __ai_resolveToken(token: any): string
+declare function __ai_enforceCallBudget(prompt?: any): Promise<void>
+declare function __ai_publicMessage(err: any, code: string): string
 
 async function utility_similarity_scoring(config: any, context: Record<string, unknown>) {
   const text1 = config.text1 || ''
@@ -249,19 +252,30 @@ async function utility_similarity_scoring(config: any, context: Record<string, u
         try {
           apiKey = __ai_resolveToken(config.token)
         } catch (tokenErr: any) {
-          return { score: 0, algorithm, error: tokenErr.message }
+          return {
+            score: 0,
+            algorithm,
+            error: __ai_publicMessage(tokenErr, 'authentication_error'),
+          }
         }
 
-        const __nodeRequire =
-          typeof __non_webpack_require__ !== 'undefined' ? __non_webpack_require__ : require
-        const _mod = __nodeRequire('openai')
-        const OpenAI = _mod.default || _mod
-        const client = new OpenAI({ apiKey })
-
-        const response = await client.embeddings.create({
-          model: config.model || 'text-embedding-3-small',
-          input: [String(text1), String(text2)],
-        })
+        // One call against the site's daily AI budget; a provider's detail
+        // stays in the server log (see ai-provider-utils).
+        let response
+        try {
+          await __ai_enforceCallBudget()
+          const __nodeRequire =
+            typeof __non_webpack_require__ !== 'undefined' ? __non_webpack_require__ : require
+          const _mod = __nodeRequire('openai')
+          const OpenAI = _mod.default || _mod
+          const client = new OpenAI({ apiKey })
+          response = await client.embeddings.create({
+            model: config.model || 'text-embedding-3-small',
+            input: [String(text1), String(text2)],
+          })
+        } catch (providerErr: any) {
+          return { score: 0, algorithm, error: __ai_publicMessage(providerErr, 'provider_error') }
+        }
 
         const vectors = (response.data || []).map(function (entry: any) {
           return entry.embedding
@@ -312,4 +326,11 @@ export const utilitySimilarityScoring: NodeHandlerGenerator = {
     // in the shared AI utils, so they have to be emitted alongside the handler.
     return generateAIProviderUtils() + '\n\n' + utility_similarity_scoring.toString()
   },
+  generateServerHandler(options?: ServerHandlerOptions): string {
+    return (
+      generateAIProviderUtils(serverHandlerPrefix(options)) +
+      '\n\n' +
+      utility_similarity_scoring.toString()
+    )
+  },
 }

package/src/page-access-guard-generator.ts

@@ -0,0 +1,154 @@
+/**
+ * The server half of page protection: `utils/auth/page-access.js`, emitted
+ * beside the middleware for every project whose authentication protects a
+ * page or a folder.
+ *
+ * The middleware (`generateMiddlewareFile` in auth-generator.ts) stays the
+ * first net, but a request can reach a page without it — a Next 12
+ * Pages-Router app with i18n serves `/_next/data/<build>/<page>.json` without
+ * running it (CVE-2026-44573), and its matcher skips every path that merely
+ * starts with "api". So every page it gates renders with getServerSideProps
+ * whose first statement is `guardPageAccess(context, <policy>)`: the policy is
+ * baked into the page at build time (`PageAccess.resolvePageAccessPolicy` in
+ * teleport-shared, the middleware's own route table), and a denied request
+ * gets a redirect or a 404 before any of the page's data is read.
+ *
+ * The session is decoded from the request the way the workflow routes decode
+ * it (`session-cookie-resolver`), the role read the way their guard reads it
+ * (`ROLE_OF_TOKEN_CODE`), and a subscription checked with the one entitlement
+ * query the subscriber-access route runs (`utils/auth/subscriber-access.js`).
+ */
+import { UIDLAuthentication } from '@teleporthq/teleport-types'
+import { generateCommonJsSessionTokenResolverCode } from './session-cookie-resolver'
+import { ROLE_OF_TOKEN_CODE } from './workflow-auth-generator'
+import { hasSubscriberOnlyPages } from './subscriber-access-route-generator'
+
+const subscriberAccessLoader = (withSubscriberAccess: boolean): string =>
+  withSubscriberAccess
+    ? `// The entitlement query the subscriber-access route runs.
+function subscriberAccessModule() {
+  return require('./subscriber-access');
+}`
+    : `// No page is subscriber-only, so no entitlement query was emitted: a policy
+// that still asks for a subscription fails closed.
+function subscriberAccessModule() {
+  throw new Error('No subscriber-only pages in this project');
+}`
+
+export const generatePageAccessGuardModule = (auth: UIDLAuthentication): string => {
+  const signInRoute = auth.authPages?.signIn?.route || '/auth/sign-in'
+
+  return `'use strict';
+
+// GENERATED — see generatePageAccessGuardModule in
+// @teleporthq/teleport-plugin-next-workflows/src/page-access-guard-generator.ts.
+//
+// Every page the middleware protects calls guardPageAccess first in its
+// getServerSideProps: a request can reach a page without the middleware (Next 12
+// serves a page's /_next/data/<build>/<page>.json without running it when the
+// site has languages), so the page checks the session itself.
+
+${generateCommonJsSessionTokenResolverCode('../..')}
+${ROLE_OF_TOKEN_CODE}
+
+${subscriberAccessLoader(hasSubscriberOnlyPages(auth))}
+
+var SIGN_IN_ROUTE = ${JSON.stringify(signInRoute)};
+
+function sessionUserId(token) {
+  if (!token || typeof token !== 'object') {
+    return null;
+  }
+  return token.id != null ? token.id : (token.sub != null ? token.sub : null);
+}
+
+// Next.js strips the language prefix before the page runs; a redirect puts it
+// back. The default language is served unprefixed.
+function localizedPath(context, path) {
+  var locale = context && context.locale;
+  var defaultLocale = context && context.defaultLocale;
+  if (!locale || !defaultLocale || locale === defaultLocale) {
+    return path;
+  }
+  return '/' + locale + (path === '/' ? '' : path);
+}
+
+// The page asked for, as a same-site path without its query.
+function requestedPath(context) {
+  var url = context && typeof context.resolvedUrl === 'string' ? context.resolvedUrl : '/';
+  var path = url.split('?')[0].split('#')[0];
+  if (path.charAt(0) !== '/' || path.indexOf('//') === 0 || path.indexOf('\\\\') !== -1) {
+    return '/';
+  }
+  return path;
+}
+
+function signInRedirect(context) {
+  return {
+    redirect: {
+      destination:
+        localizedPath(context, SIGN_IN_ROUTE) +
+        '?callbackUrl=' +
+        encodeURIComponent(localizedPath(context, requestedPath(context))),
+      permanent: false,
+    },
+  };
+}
+
+// null when the visitor may see the page; otherwise what getServerSideProps
+// returns instead — sign-in without a session, a 404 for a session without the
+// role or the subscription. Every failure (no app secret, a cookie that does not
+// decode, a database error) answers "not allowed".
+async function guardPageAccess(context, policy) {
+  var res = context && context.res;
+  if (res && typeof res.setHeader === 'function') {
+    // A page behind a sign-in is never kept by a shared cache.
+    res.setHeader('Cache-Control', 'private, no-store');
+  }
+
+  var token = null;
+  try {
+    token = await __tqSessionToken(context && context.req);
+  } catch (e) {
+    token = null;
+  }
+  if (!token) {
+    return signInRedirect(context);
+  }
+
+  var roles = (policy && policy.allowedRoles) || [];
+  if (roles.length > 0) {
+    var role = roleOf(token);
+    if (!role || roles.indexOf(role) < 0) {
+      return { notFound: true };
+    }
+  }
+
+  if (policy && policy.requiresSubscription) {
+    var userId = sessionUserId(token);
+    var entitled = false;
+    try {
+      entitled =
+        userId != null &&
+        String(userId) !== '' &&
+        (await subscriberAccessModule().isSubscriberEntitled(
+          String(userId),
+          policy.subscriptionProductIds || []
+        )) === true;
+    } catch (e) {
+      console.error('[page-access] subscription check failed:', e && e.message ? e.message : e);
+      entitled = false;
+    }
+    if (!entitled) {
+      return { notFound: true };
+    }
+  }
+
+  return null;
+}
+
+module.exports = {
+  guardPageAccess: guardPageAccess,
+};
+`
+}