@teleporthq/teleport-plugin-next-workflows 0.44.10 → 0.44.17

package/dist/cjs/public-step-guards.d.ts

@@ -0,0 +1,122 @@
+import { UIDLAuthentication } from '@teleporthq/teleport-types';
+/**
+ * Steps no visitor may run, refused at generation when their workflow's route
+ * answers callers it should not.
+ *
+ * - `push-send-notification` sends to every subscriber of the site (or to one
+ *   user's browsers), with a title, text and link the workflow fills in.
+ * - The runtime-storage file steps act on ANY file of the project with the
+ *   project's storage key: the storage worker keeps no owner per file, and a
+ *   file's id is in its public address.
+ *
+ * Who may run them:
+ *
+ * - Sending a push, deleting or listing files (`STAFF`): only this
+ *   deployment's own server code — a route that is `serverOnly`, a cron (signed
+ *   by the crons worker), an automation (the in-app event bus), a webhook that
+ *   verifies its signature — or a route that requires a session with a named
+ *   staff role: every role it admits is one of the project's staff roles (the
+ *   admin panel's and `admin`, `TableAccess.resolveStaffRoles`, the rule the
+ *   data API uses). "Any signed-in user" is not enough: on a site with open
+ *   sign-up that is one sign-up away from anyone.
+ * - Reading one file's details (`SESSION`): the same, or any session — a
+ *   private file comes back without an address, and a public one is public.
+ *
+ * A custom node only server code may call (`serverOnly`) runs in its CALLERS'
+ * server segments with this deployment's credentials, so it is as reachable
+ * as its most reachable caller: a public page's workflow calling it can replay
+ * its push or its delete.
+ *
+ * The refusal is thrown before any code is emitted, the way the raw-SQL and
+ * custom-code gates refuse; the editor shows its `message` (see
+ * {@link PublicStepRefusalError}). Disabled workflows are checked too: the
+ * generator emits every workflow it is given.
+ */
+export declare const PUBLIC_STEP_REFUSAL_CODE = "PUBLIC_STEP_REFUSED";
+export declare const PUBLIC_RESTRICTED_STEP_TYPES: ReadonlyArray<string>;
+export interface PublicStepRefusal {
+    /** The workflow's id, or the custom node's. */
+    ownerId: string;
+    ownerName: string;
+    ownerKind: 'workflow' | 'custom-node';
+    nodeId: string;
+    nodeType: string;
+    stepName: string;
+    /** For a server-only custom node: the caller that makes it reachable. */
+    calledFrom?: string;
+    /**
+     * Who can start the route today: absent for anyone, `[]` for any session,
+     * else the roles it admits (none of them all staff).
+     */
+    admits?: string[];
+}
+/** One line of plain prose, for the person publishing. */
+export declare const describePublicStepRefusals: (refusals: PublicStepRefusal[], staffRoles?: string[]) => string;
+/**
+ * Thrown when a restricted step sits on a route that answers callers it should
+ * not. Its message carries a JSON body whose `message` is one sentence for the
+ * person publishing — the editor's publish flow shows exactly that sentence
+ * ("Publishing failed. …") instead of its "contact support" notice, the same
+ * contract a server refusal uses (`getApiErrorMessage`). `refusals` lists
+ * every refused step.
+ */
+export declare class PublicStepRefusalError extends Error {
+    readonly code = "PUBLIC_STEP_REFUSED";
+    readonly refusals: PublicStepRefusal[];
+    constructor(refusals: PublicStepRefusal[], staffRoles?: string[]);
+}
+interface NodeLike {
+    id?: string;
+    type?: string;
+    name?: string;
+    label?: string;
+    config?: Record<string, unknown>;
+}
+interface WorkflowLike {
+    name?: string;
+    nodes?: NodeLike[];
+    trigger?: {
+        type?: string;
+    };
+    webhookConfig?: {
+        verifySignature?: boolean;
+    };
+    protection?: RoutePolicyLike;
+}
+/** The fields of a route's policy (`UIDLWorkflowProtection`) that gate its callers. */
+interface RoutePolicyLike {
+    requiresAuth?: boolean;
+    allowedRoles?: string[];
+    serverOnly?: boolean;
+}
+interface WorkflowsLike {
+    workflows?: Record<string, WorkflowLike>;
+    customNodes?: Record<string, WorkflowLike>;
+}
+export interface PublicStepGuardOptions {
+    /** The project's staff roles; `['admin']` when not given. */
+    staffRoles?: string[];
+}
+/** Every restricted step on a route that answers callers it should not (custom nodes included). */
+export declare const findPublicRestrictedSteps: (workflows: WorkflowsLike | undefined, options?: PublicStepGuardOptions) => PublicStepRefusal[];
+/** How reachable one custom node's push and file steps are, with the roles a session reach admits. */
+export interface CustomNodeStepReach {
+    access: 'public' | 'session' | 'staff' | 'server';
+    admits?: string[];
+}
+/**
+ * The reach `findPublicRestrictedSteps` judges one custom node's steps by: its
+ * own policy, or — when it is server-only — its least-guarded caller's,
+ * workflows and custom nodes alike (`customNodeReach`). The editor's workflow
+ * agents read it (teleport-gui `workflow-route-access.ts`), so they refuse what
+ * the publish refuses.
+ */
+export declare const customNodeStepReach: (workflows: WorkflowsLike, customNodeId: string, options?: PublicStepGuardOptions) => CustomNodeStepReach;
+/**
+ * Throws {@link PublicStepRefusalError} when any restricted step sits on a
+ * route that answers callers it should not. The staff roles are the project's
+ * (`TableAccess.resolveStaffRoles(authentication)`).
+ */
+export declare const assertNoPublicRestrictedSteps: (workflows: WorkflowsLike | undefined, authentication?: UIDLAuthentication | null) => void;
+export {};
+//# sourceMappingURL=public-step-guards.d.ts.map

package/dist/cjs/public-step-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-step-guards.d.ts","sourceRoot":"","sources":["../../src/public-step-guards.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAI/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,eAAO,MAAM,wBAAwB,wBAAwB,CAAA;AAY7D,eAAO,MAAM,4BAA4B,EAAE,aAAa,CAAC,MAAM,CAAiC,CAAA;AAEhG,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,UAAU,GAAG,aAAa,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAqCD,0DAA0D;AAC1D,eAAO,MAAM,0BAA0B,aAC3B,iBAAiB,EAAE,eACjB,MAAM,EAAE,KACnB,MA0BF,CAAA;AAED;;;;;;;GAOG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,yBAA2B;IACxC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAA;gBAE1B,QAAQ,EAAE,iBAAiB,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE;CAajE;AAED,UAAU,QAAQ;IAChB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAA;IAClB,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3B,aAAa,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IAC7C,UAAU,CAAC,EAAE,eAAe,CAAA;CAC7B;AAED,uFAAuF;AACvF,UAAU,eAAe;IACvB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,UAAU,aAAa;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CAC3C;AA6LD,MAAM,WAAW,sBAAsB;IACrC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,mGAAmG;AACnG,eAAO,MAAM,yBAAyB,cACzB,aAAa,GAAG,SAAS,YAC3B,sBAAsB,KAC9B,iBAAiB,EAoBnB,CAAA;AAED,sGAAsG;AACtG,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAA;IACjD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,cACnB,aAAa,gBACV,MAAM,YACX,sBAAsB,KAC9B,mBAIF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,cAC7B,aAAa,GAAG,SAAS,mBACnB,kBAAkB,GAAG,IAAI,KACzC,IAMF,CAAA"}

package/dist/cjs/public-step-guards.js

@@ -0,0 +1,288 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertNoPublicRestrictedSteps = exports.customNodeStepReach = exports.findPublicRestrictedSteps = exports.PublicStepRefusalError = exports.describePublicStepRefusals = exports.PUBLIC_RESTRICTED_STEP_TYPES = exports.PUBLIC_STEP_REFUSAL_CODE = void 0;
+const teleport_shared_1 = require("@teleporthq/teleport-shared");
+const automations_scope_1 = require("./automations/automations-scope");
+const payments_1 = require("./payments");
+/**
+ * Steps no visitor may run, refused at generation when their workflow's route
+ * answers callers it should not.
+ *
+ * - `push-send-notification` sends to every subscriber of the site (or to one
+ *   user's browsers), with a title, text and link the workflow fills in.
+ * - The runtime-storage file steps act on ANY file of the project with the
+ *   project's storage key: the storage worker keeps no owner per file, and a
+ *   file's id is in its public address.
+ *
+ * Who may run them:
+ *
+ * - Sending a push, deleting or listing files (`STAFF`): only this
+ *   deployment's own server code — a route that is `serverOnly`, a cron (signed
+ *   by the crons worker), an automation (the in-app event bus), a webhook that
+ *   verifies its signature — or a route that requires a session with a named
+ *   staff role: every role it admits is one of the project's staff roles (the
+ *   admin panel's and `admin`, `TableAccess.resolveStaffRoles`, the rule the
+ *   data API uses). "Any signed-in user" is not enough: on a site with open
+ *   sign-up that is one sign-up away from anyone.
+ * - Reading one file's details (`SESSION`): the same, or any session — a
+ *   private file comes back without an address, and a public one is public.
+ *
+ * A custom node only server code may call (`serverOnly`) runs in its CALLERS'
+ * server segments with this deployment's credentials, so it is as reachable
+ * as its most reachable caller: a public page's workflow calling it can replay
+ * its push or its delete.
+ *
+ * The refusal is thrown before any code is emitted, the way the raw-SQL and
+ * custom-code gates refuse; the editor shows its `message` (see
+ * {@link PublicStepRefusalError}). Disabled workflows are checked too: the
+ * generator emits every workflow it is given.
+ */
+exports.PUBLIC_STEP_REFUSAL_CODE = 'PUBLIC_STEP_REFUSED';
+/** What each refused step does, in the words the editor shows, and who may run it. */
+const RESTRICTED_STEPS = {
+    'push-send-notification': { does: 'sends a push notification', gate: 'staff' },
+    'file-storage-delete': { does: 'deletes a stored file', gate: 'staff' },
+    'file-storage-list': { does: 'lists the stored files', gate: 'staff' },
+    'file-storage-get-details': { does: "reads a stored file's details", gate: 'session' },
+};
+exports.PUBLIC_RESTRICTED_STEP_TYPES = Object.keys(RESTRICTED_STEPS);
+/** The longest sentence the editor shows as it is (`getApiErrorMessage` in teleport-gui). */
+const MAX_SENTENCE_LENGTH = 400;
+const LISTED_STEPS = 3;
+const quote = (text) => `"${text.replace(/["\r\n]+/g, ' ').trim()}"`;
+const quoteList = (values) => values.map(quote).join(' or ');
+/** Who can start the step's route today, in words. */
+const whoCanStart = (refusal) => refusal.admits === undefined
+    ? 'any visitor'
+    : refusal.admits.length === 0
+        ? 'anyone signed in'
+        : `anyone with the role ${quoteList(refusal.admits)}`;
+const describe = (refusal) => `${quote(refusal.stepName)} (${RESTRICTED_STEPS[refusal.nodeType].does}) in ${refusal.ownerKind === 'custom-node' ? 'the custom node' : 'the workflow'} ${quote(refusal.ownerName)}${refusal.calledFrom ? `, started from ${quote(refusal.calledFrom)}` : ''}, which ${whoCanStart(refusal)} can start`;
+/**
+ * What to change: the roles that count as staff here (the admin panel's and
+ * `admin`), and how a role becomes one — by the admin-panel pages admitting it.
+ */
+const adviceFor = (staffRoles) => `Only an admin or your server should run it: let only the role ${quoteList(staffRoles.length > 0 ? staffRoles : [teleport_shared_1.TableAccess.ADMIN_ROLE])} start it (another role counts once your admin-panel pages admit it), or move it into a scheduled, signed webhook or automation workflow, then publish again.`;
+const SHORT_ADVICE = 'Let only an admin role start it (a role your admin-panel pages admit), or move it into a scheduled, signed webhook or automation workflow, then publish again.';
+/** One line of plain prose, for the person publishing. */
+const describePublicStepRefusals = (refusals, staffRoles = [teleport_shared_1.TableAccess.ADMIN_ROLE]) => {
+    const advice = adviceFor(staffRoles);
+    const listed = refusals.slice(0, LISTED_STEPS).map(describe);
+    const more = refusals.length - listed.length;
+    const subject = refusals.length === 1
+        ? `On your site the step ${listed[0]}.`
+        : `On your site ${refusals.length} steps meant only for an admin or your own server can be started by others: ${listed.join('; ')}${more > 0 ? `; and ${more} more` : ''}.`;
+    for (const candidate of [
+        `${subject} ${advice}`,
+        `${subject} ${SHORT_ADVICE}`,
+        `On your site the step ${describe(refusals[0])}${refusals.length > 1 ? `, and ${refusals.length - 1} more` : ''}. ${SHORT_ADVICE}`,
+    ]) {
+        if (candidate.length <= MAX_SENTENCE_LENGTH) {
+            return candidate;
+        }
+    }
+    return `On your site ${refusals.length === 1 ? 'a step' : `${refusals.length} steps`} meant only for an admin or your own server (a push notification or a stored-file step) can be started by others. ${SHORT_ADVICE}`;
+};
+exports.describePublicStepRefusals = describePublicStepRefusals;
+/**
+ * Thrown when a restricted step sits on a route that answers callers it should
+ * not. Its message carries a JSON body whose `message` is one sentence for the
+ * person publishing — the editor's publish flow shows exactly that sentence
+ * ("Publishing failed. …") instead of its "contact support" notice, the same
+ * contract a server refusal uses (`getApiErrorMessage`). `refusals` lists
+ * every refused step.
+ */
+class PublicStepRefusalError extends Error {
+    constructor(refusals, staffRoles) {
+        super(`Publishing refused: ${JSON.stringify({
+            code: exports.PUBLIC_STEP_REFUSAL_CODE,
+            message: (0, exports.describePublicStepRefusals)(refusals, staffRoles),
+            steps: refusals.map((r) => ({ owner: r.ownerId, node: r.nodeId, type: r.nodeType })),
+        })}`);
+        this.code = exports.PUBLIC_STEP_REFUSAL_CODE;
+        // `extends Error` loses the prototype when downlevelled to ES5.
+        Object.setPrototypeOf(this, PublicStepRefusalError.prototype);
+        this.name = 'PublicStepRefusalError';
+        this.refusals = refusals;
+    }
+}
+exports.PublicStepRefusalError = PublicStepRefusalError;
+const ACCESS_ORDER = ['public', 'session', 'staff', 'server'];
+const lessGuarded = (a, b) => ACCESS_ORDER.indexOf(a) <= ACCESS_ORDER.indexOf(b) ? a : b;
+const allows = (access, gate) => access === 'server' || access === 'staff' || (gate === 'session' && access === 'session');
+const policyAccess = (protection, staffRoles) => {
+    if (!protection) {
+        return 'public';
+    }
+    if (protection.serverOnly === true) {
+        return 'server';
+    }
+    if (protection.requiresAuth === true) {
+        const roles = Array.isArray(protection.allowedRoles) ? protection.allowedRoles : [];
+        return roles.length > 0 && roles.every((role) => staffRoles.has(role)) ? 'staff' : 'session';
+    }
+    return 'public';
+};
+/** Who can make the route(s) a workflow compiles to run. */
+const workflowAccess = (workflow, staffRoles) => {
+    // An automation runs in the in-app event bus, from this deployment's own code.
+    if ((0, automations_scope_1.isAutomationWorkflow)(workflow)) {
+        return 'server';
+    }
+    const triggerType = workflow.trigger && workflow.trigger.type;
+    // A cron route refuses every request the crons worker did not sign.
+    if (triggerType === 'event-cron-triggered') {
+        return 'server';
+    }
+    // A webhook route is the trigger's own: guarded only when it checks a signature.
+    if (triggerType === 'event-webhook-received' && workflow.webhookConfig) {
+        return (0, payments_1.isPaymentWebhookConfig)(workflow.webhookConfig) ||
+            workflow.webhookConfig.verifySignature === true
+            ? 'server'
+            : 'public';
+    }
+    return policyAccess(workflow.protection, staffRoles);
+};
+const calledCustomNodeIds = (owner) => (owner.nodes || [])
+    .filter((node) => !!node && node.type === 'general-custom-node')
+    .map((node) => (node.config || {}).customNodeId || (node.config || {}).customWorkflowNodeId)
+    .filter((id) => typeof id === 'string' && id.length > 0);
+/** How reachable a workflow's route is, with the roles it admits when a session is enough. */
+const workflowReach = (workflow, staffRoles) => {
+    const access = workflowAccess(workflow, staffRoles);
+    return access === 'session'
+        ? { access, admits: (workflow.protection && workflow.protection.allowedRoles) || [] }
+        : { access };
+};
+/**
+ * How reachable each custom node's steps are: a custom node with a policy of
+ * its own is called by the browser and its route answers by that policy; a
+ * server-only one runs in its callers' server segments, so it is as reachable
+ * as its most reachable caller (a workflow, or another custom node, the same
+ * way). Server-only with no caller: only server code reaches it.
+ */
+const customNodeReach = (workflows, staffRoles) => {
+    const customNodes = workflows.customNodes || {};
+    const callers = {};
+    const reach = {};
+    const resolving = new Set();
+    const reachOf = (customNodeId) => {
+        if (reach[customNodeId]) {
+            return reach[customNodeId];
+        }
+        const customNode = customNodes[customNodeId];
+        const own = policyAccess(customNode && customNode.protection, staffRoles);
+        if (own !== 'server') {
+            reach[customNodeId] =
+                own === 'session'
+                    ? {
+                        access: own,
+                        admits: (customNode.protection && customNode.protection.allowedRoles) || [],
+                    }
+                    : { access: own };
+            return reach[customNodeId];
+        }
+        if (resolving.has(customNodeId)) {
+            // A cycle back to itself adds no caller of its own.
+            return { access: own };
+        }
+        resolving.add(customNodeId);
+        let result = { access: 'server' };
+        for (const caller of callers[customNodeId] || []) {
+            const callerReach = caller.reach();
+            const access = lessGuarded(result.access, callerReach.access);
+            if (access !== result.access) {
+                result = Object.assign({ access, via: callerReach.via || caller.name }, (callerReach.admits ? { admits: callerReach.admits } : {}));
+            }
+        }
+        resolving.delete(customNodeId);
+        reach[customNodeId] = result;
+        return result;
+    };
+    for (const [workflowId, workflow] of Object.entries(workflows.workflows || {})) {
+        if (!workflow) {
+            continue;
+        }
+        for (const id of calledCustomNodeIds(workflow)) {
+            ;
+            (callers[id] = callers[id] || []).push({
+                name: workflow.name || workflowId,
+                reach: () => workflowReach(workflow, staffRoles),
+            });
+        }
+    }
+    for (const [callerId, caller] of Object.entries(customNodes)) {
+        if (!caller) {
+            continue;
+        }
+        for (const id of calledCustomNodeIds(caller)) {
+            ;
+            (callers[id] = callers[id] || []).push({
+                name: caller.name || callerId,
+                reach: () => reachOf(callerId),
+            });
+        }
+    }
+    for (const id of Object.keys(customNodes)) {
+        reachOf(id);
+    }
+    return reach;
+};
+const collectFrom = (owners, ownerKind, reachOf, out) => {
+    for (const [ownerId, owner] of Object.entries(owners || {})) {
+        if (!owner || !Array.isArray(owner.nodes)) {
+            continue;
+        }
+        const restricted = owner.nodes.filter((node) => !!node && typeof node.type === 'string' && node.type in RESTRICTED_STEPS);
+        if (restricted.length === 0) {
+            continue;
+        }
+        const reach = reachOf(ownerId, owner);
+        for (const node of restricted) {
+            if (allows(reach.access, RESTRICTED_STEPS[node.type].gate)) {
+                continue;
+            }
+            out.push(Object.assign(Object.assign({ ownerId, ownerName: owner.name || ownerId, ownerKind, nodeId: node.id || '?', nodeType: node.type, stepName: node.name || node.label || node.type }, (reach.via ? { calledFrom: reach.via } : {})), (reach.access === 'session' ? { admits: reach.admits || [] } : {})));
+        }
+    }
+};
+/** Every restricted step on a route that answers callers it should not (custom nodes included). */
+const findPublicRestrictedSteps = (workflows, options = {}) => {
+    const refusals = [];
+    if (!workflows) {
+        return refusals;
+    }
+    const staffRoles = new Set(options.staffRoles || [teleport_shared_1.TableAccess.ADMIN_ROLE]);
+    collectFrom(workflows.workflows, 'workflow', (_id, workflow) => workflowReach(workflow, staffRoles), refusals);
+    const reach = customNodeReach(workflows, staffRoles);
+    collectFrom(workflows.customNodes, 'custom-node', (id) => reach[id] || { access: 'public' }, refusals);
+    return refusals;
+};
+exports.findPublicRestrictedSteps = findPublicRestrictedSteps;
+/**
+ * The reach `findPublicRestrictedSteps` judges one custom node's steps by: its
+ * own policy, or — when it is server-only — its least-guarded caller's,
+ * workflows and custom nodes alike (`customNodeReach`). The editor's workflow
+ * agents read it (teleport-gui `workflow-route-access.ts`), so they refuse what
+ * the publish refuses.
+ */
+const customNodeStepReach = (workflows, customNodeId, options = {}) => {
+    const staffRoles = new Set(options.staffRoles || [teleport_shared_1.TableAccess.ADMIN_ROLE]);
+    const reach = customNodeReach(workflows, staffRoles)[customNodeId] || { access: 'public' };
+    return Object.assign({ access: reach.access }, (reach.admits ? { admits: reach.admits } : {}));
+};
+exports.customNodeStepReach = customNodeStepReach;
+/**
+ * Throws {@link PublicStepRefusalError} when any restricted step sits on a
+ * route that answers callers it should not. The staff roles are the project's
+ * (`TableAccess.resolveStaffRoles(authentication)`).
+ */
+const assertNoPublicRestrictedSteps = (workflows, authentication) => {
+    const staffRoles = teleport_shared_1.TableAccess.resolveStaffRoles(authentication);
+    const refusals = (0, exports.findPublicRestrictedSteps)(workflows, { staffRoles });
+    if (refusals.length > 0) {
+        throw new PublicStepRefusalError(refusals, staffRoles);
+    }
+};
+exports.assertNoPublicRestrictedSteps = assertNoPublicRestrictedSteps;
+//# sourceMappingURL=public-step-guards.js.map

package/dist/cjs/public-step-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-step-guards.js","sourceRoot":"","sources":["../../src/public-step-guards.ts"],"names":[],"mappings":";;;AAAA,iEAAyD;AAEzD,uEAAsE;AACtE,yCAAmD;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEU,QAAA,wBAAwB,GAAG,qBAAqB,CAAA;AAI7D,sFAAsF;AACtF,MAAM,gBAAgB,GAAqD;IACzE,wBAAwB,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,OAAO,EAAE;IAC9E,qBAAqB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE;IACvE,mBAAmB,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,OAAO,EAAE;IACtE,0BAA0B,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,SAAS,EAAE;CACvF,CAAA;AAEY,QAAA,4BAA4B,GAA0B,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;AAmBhG,6FAA6F;AAC7F,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAC/B,MAAM,YAAY,GAAG,CAAC,CAAA;AAEtB,MAAM,KAAK,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,CAAA;AAEpF,MAAM,SAAS,GAAG,CAAC,MAAgB,EAAU,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAE9E,sDAAsD;AACtD,MAAM,WAAW,GAAG,CAAC,OAA0B,EAAU,EAAE,CACzD,OAAO,CAAC,MAAM,KAAK,SAAS;IAC1B,CAAC,CAAC,aAAa;IACf,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAC7B,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,wBAAwB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAA;AAEzD,MAAM,QAAQ,GAAG,CAAC,OAA0B,EAAU,EAAE,CACtD,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,QACpE,OAAO,CAAC,SAAS,KAAK,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAC1B,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EACvE,WAAW,WAAW,CAAC,OAAO,CAAC,YAAY,CAAA;AAE7C;;;GAGG;AACH,MAAM,SAAS,GAAG,CAAC,UAAoB,EAAU,EAAE,CACjD,iEAAiE,SAAS,CACxE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,6BAAW,CAAC,UAAU,CAAC,CAC9D,+JAA+J,CAAA;AAElK,MAAM,YAAY,GAChB,gKAAgK,CAAA;AAElK,0DAA0D;AACnD,MAAM,0BAA0B,GAAG,CACxC,QAA6B,EAC7B,aAAuB,CAAC,6BAAW,CAAC,UAAU,CAAC,EACvC,EAAE;IACV,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC5C,MAAM,OAAO,GACX,QAAQ,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,yBAAyB,MAAM,CAAC,CAAC,CAAC,GAAG;QACvC,CAAC,CAAC,gBACE,QAAQ,CAAC,MACX,+EAA+E,MAAM,CAAC,IAAI,CACxF,IAAI,CACL,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAA;IACjD,KAAK,MAAM,SAAS,IAAI;QACtB,GAAG,OAAO,IAAI,MAAM,EAAE;QACtB,GAAG,OAAO,IAAI,YAAY,EAAE;QAC5B,yBAAyB,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAC5C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAC9D,KAAK,YAAY,EAAE;KACpB,EAAE;QACD,IAAI,SAAS,CAAC,MAAM,IAAI,mBAAmB,EAAE;YAC3C,OAAO,SAAS,CAAA;SACjB;KACF;IACD,OAAO,gBACL,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,QACvD,qHAAqH,YAAY,EAAE,CAAA;AACrI,CAAC,CAAA;AA7BY,QAAA,0BAA0B,8BA6BtC;AAED;;;;;;;GAOG;AACH,MAAa,sBAAuB,SAAQ,KAAK;IAI/C,YAAY,QAA6B,EAAE,UAAqB;QAC9D,KAAK,CACH,uBAAuB,IAAI,CAAC,SAAS,CAAC;YACpC,IAAI,EAAE,gCAAwB;YAC9B,OAAO,EAAE,IAAA,kCAA0B,EAAC,QAAQ,EAAE,UAAU,CAAC;YACzD,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;SACrF,CAAC,EAAE,CACL,CAAA;QAVM,SAAI,GAAG,gCAAwB,CAAA;QAWtC,gEAAgE;QAChE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAA;QAC7D,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;QACpC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAjBD,wDAiBC;AAgCD,MAAM,YAAY,GAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;AAE5E,MAAM,WAAW,GAAG,CAAC,CAAc,EAAE,CAAc,EAAe,EAAE,CAClE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAE5D,MAAM,MAAM,GAAG,CAAC,MAAmB,EAAE,IAAc,EAAW,EAAE,CAC9D,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,CAAA;AAE3F,MAAM,YAAY,GAAG,CACnB,UAAuC,EACvC,UAAuB,EACV,EAAE;IACf,IAAI,CAAC,UAAU,EAAE;QACf,OAAO,QAAQ,CAAA;KAChB;IACD,IAAI,UAAU,CAAC,UAAU,KAAK,IAAI,EAAE;QAClC,OAAO,QAAQ,CAAA;KAChB;IACD,IAAI,UAAU,CAAC,YAAY,KAAK,IAAI,EAAE;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAA;QACnF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;KAC7F;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,4DAA4D;AAC5D,MAAM,cAAc,GAAG,CAAC,QAAsB,EAAE,UAAuB,EAAe,EAAE;IACtF,+EAA+E;IAC/E,IAAI,IAAA,wCAAoB,EAAC,QAAiB,CAAC,EAAE;QAC3C,OAAO,QAAQ,CAAA;KAChB;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAA;IAC7D,oEAAoE;IACpE,IAAI,WAAW,KAAK,sBAAsB,EAAE;QAC1C,OAAO,QAAQ,CAAA;KAChB;IACD,iFAAiF;IACjF,IAAI,WAAW,KAAK,wBAAwB,IAAI,QAAQ,CAAC,aAAa,EAAE;QACtE,OAAO,IAAA,iCAAsB,EAAC,QAAQ,CAAC,aAAa,CAAC;YACnD,QAAQ,CAAC,aAAa,CAAC,eAAe,KAAK,IAAI;YAC/C,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,CAAA;KACb;IACD,OAAO,YAAY,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;AACtD,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,KAAmB,EAAY,EAAE,CAC5D,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;KAChB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC;KAC/D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,oBAAoB,CAAC;KAC3F,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAU1E,8FAA8F;AAC9F,MAAM,aAAa,GAAG,CAAC,QAAsB,EAAE,UAAuB,EAAS,EAAE;IAC/E,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IACnD,OAAO,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE;QACrF,CAAC,CAAC,EAAE,MAAM,EAAE,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,CACtB,SAAwB,EACxB,UAAuB,EACA,EAAE;IACzB,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,IAAI,EAAE,CAAA;IAC/C,MAAM,OAAO,GAAgE,EAAE,CAAA;IAC/E,MAAM,KAAK,GAA0B,EAAE,CAAA;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IAEnC,MAAM,OAAO,GAAG,CAAC,YAAoB,EAAS,EAAE;QAC9C,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE;YACvB,OAAO,KAAK,CAAC,YAAY,CAAC,CAAA;SAC3B;QACD,MAAM,UAAU,GAAG,WAAW,CAAC,YAAY,CAAC,CAAA;QAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QACzE,IAAI,GAAG,KAAK,QAAQ,EAAE;YACpB,KAAK,CAAC,YAAY,CAAC;gBACjB,GAAG,KAAK,SAAS;oBACf,CAAC,CAAC;wBACE,MAAM,EAAE,GAAG;wBACX,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE;qBAC5E;oBACH,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;YACrB,OAAO,KAAK,CAAC,YAAY,CAAC,CAAA;SAC3B;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE;YAC/B,oDAAoD;YACpD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;SACvB;QACD,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAC3B,IAAI,MAAM,GAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QACxC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE;YAChD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,CAAA;YAClC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YAC7D,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;gBAC5B,MAAM,mBACJ,MAAM,EACN,GAAG,EAAE,WAAW,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,IAChC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9D,CAAA;aACF;SACF;QACD,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAC9B,KAAK,CAAC,YAAY,CAAC,GAAG,MAAM,CAAA;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,KAAK,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE;QAC9E,IAAI,CAAC,QAAQ,EAAE;YACb,SAAQ;SACT;QACD,KAAK,MAAM,EAAE,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE;YAC9C,CAAC;YAAA,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;gBACtC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,UAAU;gBACjC,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC;aACjD,CAAC,CAAA;SACH;KACF;IACD,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;QAC5D,IAAI,CAAC,MAAM,EAAE;YACX,SAAQ;SACT;QACD,KAAK,MAAM,EAAE,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE;YAC5C,CAAC;YAAA,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;gBACtC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ;gBAC7B,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;aAC/B,CAAC,CAAA;SACH;KACF;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE;QACzC,OAAO,CAAC,EAAE,CAAC,CAAA;KACZ;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAClB,MAAgD,EAChD,SAAyC,EACzC,OAAwD,EACxD,GAAwB,EAClB,EAAE;IACR,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;QAC3D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACzC,SAAQ;SACT;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,IAAI,gBAAgB,CACnF,CAAA;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE;YAC3B,SAAQ;SACT;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACrC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE;YAC7B,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC,IAAI,CAAC,EAAE;gBACpE,SAAQ;aACT;YACD,GAAG,CAAC,IAAI,+BACN,OAAO,EACP,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,EAChC,SAAS,EACT,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EACtB,QAAQ,EAAE,IAAI,CAAC,IAAc,EAC7B,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAK,IAAI,CAAC,IAAe,IACvD,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC5C,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACrE,CAAA;SACH;KACF;AACH,CAAC,CAAA;AAOD,mGAAmG;AAC5F,MAAM,yBAAyB,GAAG,CACvC,SAAoC,EACpC,UAAkC,EAAE,EACf,EAAE;IACvB,MAAM,QAAQ,GAAwB,EAAE,CAAA;IACxC,IAAI,CAAC,SAAS,EAAE;QACd,OAAO,QAAQ,CAAA;KAChB;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,6BAAW,CAAC,UAAU,CAAC,CAAC,CAAA;IAC1E,WAAW,CACT,SAAS,CAAC,SAAS,EACnB,UAAU,EACV,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,EACtD,QAAQ,CACT,CAAA;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IACpD,WAAW,CACT,SAAS,CAAC,WAAW,EACrB,aAAa,EACb,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EACzC,QAAQ,CACT,CAAA;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAvBY,QAAA,yBAAyB,6BAuBrC;AAQD;;;;;;GAMG;AACI,MAAM,mBAAmB,GAAG,CACjC,SAAwB,EACxB,YAAoB,EACpB,UAAkC,EAAE,EACf,EAAE;IACvB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,6BAAW,CAAC,UAAU,CAAC,CAAC,CAAA;IAC1E,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC1F,uBAAS,MAAM,EAAE,KAAK,CAAC,MAAM,IAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;AACpF,CAAC,CAAA;AARY,QAAA,mBAAmB,uBAQ/B;AAED;;;;GAIG;AACI,MAAM,6BAA6B,GAAG,CAC3C,SAAoC,EACpC,cAA0C,EACpC,EAAE;IACR,MAAM,UAAU,GAAG,6BAAW,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAA;IAChE,MAAM,QAAQ,GAAG,IAAA,iCAAyB,EAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IACrE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;QACvB,MAAM,IAAI,sBAAsB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;KACvD;AACH,CAAC,CAAA;AATY,QAAA,6BAA6B,iCASzC"}

package/dist/cjs/publish-refusals.d.ts

@@ -0,0 +1,66 @@
+import { UIDLAuthentication, UIDLWorkflowNode, UIDLWorkflowProtection, UIDLWorkflows } from '@teleporthq/teleport-types';
+import { SegmentTrust } from './segment-trust';
+import { WorkflowSegment } from './types';
+/**
+ * Every refusal this code generator makes over a project's workflows at
+ * publish, in ONE place. `workflow-project-plugin` makes them through
+ * `assertWorkflowPublishGates` (before any code is emitted) and
+ * `assertSegmentRouteGates` (as it emits each server segment route), throwing
+ * the first; the editor asks `collectWorkflowPublishRefusals`, which runs the
+ * same checks over the same routes and reports every refused step, before an
+ * AI write lands and before a publish goes out (teleport-gui
+ * `publish-refusal-checks.ts`). A new workflow refusal is added here, to the
+ * gates below, so the editor's assistant applies it with no change of its own.
+ *
+ * Two kinds:
+ * - `refused`: the export stops (raw SQL a value cannot be bound into, custom
+ *   code naming a platform secret, a push or stored-file step on a route
+ *   callers it should not serve can start, a recorded event fed by a browser
+ *   value);
+ * - `never-sends`: the export goes on, but an email or SMS step that sends only
+ *   the visitor's input to an address the visitor supplies, or takes its sender
+ *   from the visitor, is refused at run time (`outbound-message-guard.ts`).
+ */
+export type WorkflowPublishRefusalKind = 'refused' | 'never-sends';
+export interface WorkflowPublishRefusal {
+    kind: WorkflowPublishRefusalKind;
+    /** Which of the generator's checks refused it. */
+    check: string;
+    /** The workflow's id, or the custom node's. */
+    ownerId: string;
+    ownerKind: 'workflow' | 'custom-node';
+    /** The refused step; absent when the check names it only in `message`. */
+    nodeId?: string;
+    /** One sentence for the owner, in the generator's words. */
+    message: string;
+}
+type Refusal = Omit<WorkflowPublishRefusal, 'kind' | 'check'>;
+/** R-N23: what the owner is told about a newsletter sign-up step anywhere else. */
+export declare const NEWSLETTER_SIGNUP_REFUSAL_MESSAGE = "The newsletter sign-up step runs only when a visitor submits a form.";
+export declare class NewsletterSignupRefusalError extends Error {
+    readonly code = "NEWSLETTER_SIGNUP_REFUSED";
+    constructor(refusals: Refusal[]);
+}
+/** The plugin's gates over the workflow block, before any code is emitted: throws the first refusal. */
+export declare const assertWorkflowPublishGates: (workflows: UIDLWorkflows | undefined, authentication?: UIDLAuthentication | null) => void;
+export interface SegmentRouteGateOptions {
+    /** The workflow's or custom node's name. */
+    owner: string;
+    /** Its nodes, for the step names. */
+    graphNodes?: UIDLWorkflowNode[];
+    protection?: UIDLWorkflowProtection;
+    /** The roles only the business's staff hold (`TableAccess.resolveStaffRoles`). */
+    staffRoles?: string[];
+}
+/** The checks the plugin makes as it emits one server segment route: throws the first refusal. */
+export declare const assertSegmentRouteGates: (segment: WorkflowSegment, trust: SegmentTrust | undefined, options: SegmentRouteGateOptions) => void;
+/**
+ * Every refusal publishing would make over `workflows` (the project's exported
+ * UIDL block, or the part of it a change touches): the gates above, run over a
+ * copy of the block so `workflows` stays as it is, and the routes' sends,
+ * marked without a build-log line. `authentication` is the project's
+ * (`uidl.authentication`): it names the staff roles.
+ */
+export declare const collectWorkflowPublishRefusals: (workflows: UIDLWorkflows | undefined, authentication?: UIDLAuthentication | null) => WorkflowPublishRefusal[];
+export {};
+//# sourceMappingURL=publish-refusals.d.ts.map

package/dist/cjs/publish-refusals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-refusals.d.ts","sourceRoot":"","sources":["../../src/publish-refusals.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAKlB,gBAAgB,EAChB,sBAAsB,EACtB,aAAa,EACd,MAAM,4BAA4B,CAAA;AAsBnC,OAAO,EAAqB,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAKjE,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,MAAM,0BAA0B,GAAG,SAAS,GAAG,aAAa,CAAA;AAElE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,0BAA0B,CAAA;IAChC,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAA;IACb,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,UAAU,GAAG,aAAa,CAAA;IACrC,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,KAAK,OAAO,GAAG,IAAI,CAAC,sBAAsB,EAAE,MAAM,GAAG,OAAO,CAAC,CAAA;AAmG7D,mFAAmF;AACnF,eAAO,MAAM,iCAAiC,yEAC0B,CAAA;AA2BxE,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,+BAA8B;gBAE/B,QAAQ,EAAE,OAAO,EAAE;CAMhC;AAyBD,wGAAwG;AACxG,eAAO,MAAM,0BAA0B,cAC1B,aAAa,GAAG,SAAS,mBACnB,kBAAkB,GAAG,IAAI,KACzC,IAOF,CAAA;AAED,MAAM,WAAW,uBAAuB;IACtC,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAA;IACb,qCAAqC;IACrC,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC/B,UAAU,CAAC,EAAE,sBAAsB,CAAA;IACnC,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB;AA2BD,kGAAkG;AAClG,eAAO,MAAM,uBAAuB,YACzB,eAAe,SACjB,YAAY,GAAG,SAAS,WACtB,uBAAuB,KAC/B,IAIF,CAAA;AA2GD;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,cAC9B,aAAa,GAAG,SAAS,mBACnB,kBAAkB,GAAG,IAAI,KACzC,sBAAsB,EA+CxB,CAAA"}