@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/__tests__/data-api-protected-tables.test.ts

@@ -8,8 +8,12 @@ import { dataRawQuery } from '../src/nodes/data/data-raw-query'
 import { dataUpdateItem } from '../src/nodes/data/data-update-item'
 import { dataDeleteItem } from '../src/nodes/data/data-delete-item'
 import { accountSignup } from '../src/nodes/account/account-signup'
-import { generateSignupRouteFile } from '../src/auth-generator'
+import { generateSignupRouteFile, resolveSignupFields } from '../src/auth-generator'
 import { resolveAuthUsersTableName } from '../src/workflow-project-plugin'
+import { isSecurityRuntimeSpecifier, loadSecurityRuntime } from './_helpers/load-security-runtime'
+
+// The data routes compare the app secret with the shared runtime's safeEqual.
+const securityRuntime = loadSecurityRuntime()
 
 /**
  * The generated `/api/data/<ds>/<op>` route is reachable from any browser, so
@@ -70,6 +74,9 @@ function bootRoute(
     if (name === 'next-auth/jwt') {
       return { getToken: async () => null }
     }
+    if (isSecurityRuntimeSpecifier(name)) {
+      return securityRuntime
+    }
     throw new Error('unexpected require: ' + name)
   }
   new Function('require', 'module', 'exports', 'process', 'console', code)(
@@ -550,7 +557,7 @@ describe('data API — money tables are server-only', () => {
     ).toBe(200)
   })
 
-  it('keeps password reset tokens server-only — reading one is taking the account', async () => {
+  it('keeps password reset tokens out of reach — reading one is taking the account', async () => {
     expect((await run('select', { tableName: 'password_reset_tokens' })).status).toBe(403)
     for (const headers of [{}, restricted]) {
       expect(
@@ -566,7 +573,8 @@ describe('data API — money tables are server-only', () => {
         ).status
       ).toBe(403)
     }
-    expect((await run('select', { tableName: 'password_reset_tokens' }, internal)).status).toBe(200)
+    // Retired (review fix A3): the app's own server code is refused it too.
+    expect((await run('select', { tableName: 'password_reset_tokens' }, internal)).status).toBe(403)
   })
 
   it('keeps push subscriptions server-only — an endpoint and its keys can notify that device', async () => {
@@ -819,19 +827,31 @@ describe('the other ways a browser could write its own role', () => {
     body: Record<string, unknown>,
     customUserProperties: Array<{ key: string }> = []
   ): Promise<Record<string, unknown>> => {
-    const code = generateSignupRouteFile({
-      enabled: true,
-      dataSourceType: 'postgresql',
-      customUserProperties,
-    } as any)
+    const auth = { enabled: true, dataSourceType: 'postgresql', customUserProperties } as any
+    // The sign-up route writes only what the project's sign-up forms collect.
+    const code = generateSignupRouteFile(
+      auth,
+      {},
+      {},
+      {
+        fields: resolveSignupFields(auth, [
+          Object.fromEntries(customUserProperties.map((p) => [p.key, 1])),
+        ]),
+      }
+    )
     let created: Record<string, unknown> = {}
     const fakeRequire = (name: string): any => {
       if (name.endsWith('/hash-password')) {
-        return (password: string) => 'hashed:' + password
+        return Object.assign((password: string) => 'hashed:' + password, {
+          passwordPolicyError: () => '',
+        })
+      }
+      if (name.endsWith('/security-runtime')) {
+        return { rateLimitRequest: async () => true, sendClientError: () => undefined }
       }
       if (name.endsWith('/auth-options')) {
         return {
-          userExistsByEmail: async () => false,
+          findSignupUserByEmail: async () => null,
           createUser: async (userData: Record<string, unknown>) => {
             created = userData
             return { id: 'u1', ...userData }
@@ -881,9 +901,10 @@ describe('the other ways a browser could write its own role', () => {
 
   it('keeps the server signup node from copying a role-bearing config key onto the new row', () => {
     const source = accountSignup.generateServerHandler!()
-    expect(source).toContain('const roleBearingKey = /^(roles?|role_?name)$/i;')
+    // Any column that grants something (a role in any spelling among them).
+    expect(source).toContain('const privilegedKey = /^(role.*|isadmin|admin|')
     expect(source).toContain(
-      'if (!reservedKeys[configKeys[i]] && !roleBearingKey.test(configKeys[i])) {'
+      'if (!reservedKeys[configKeys[i]] && !privilegedKey.test(normalizedKey)) {'
     )
   })
 
@@ -941,8 +962,20 @@ describe('data API — the users table never serves its credentials to a browser
     }
   })
 
-  it('serves the whole row to a server segment, which checks a password or refreshes a token', async () => {
-    const result = await run('select', { tableName: 'users' }, internal)
-    expect(result.body.rows).toEqual([userRow])
+  // A server segment relays its rows to the browser: a SELECT * gives it the
+  // profile only, and so does a projection that names a credential — only the
+  // auth layer's own in-process call is handed one (see the owner-scope spec).
+  it('serves a server segment the profile, never a credential, even one it names', async () => {
+    const whole = await run('select', { tableName: 'users' }, internal)
+    expect(whole.body.rows).toEqual([
+      { id: 'u1', email: 'ada@shop.test', name: 'Ada', role: 'user' },
+    ])
+    const named = await run(
+      'select',
+      { tableName: 'users', selectedColumns: ['id', 'password', 'refresh_token'] },
+      internal
+    )
+    expect(named.body.rows[0]).not.toHaveProperty('password')
+    expect(named.body.rows[0]).not.toHaveProperty('refresh_token')
   })
 })

package/__tests__/data-api-retired-table-and-account-fields.test.ts

@@ -0,0 +1,208 @@
+/* tslint:disable:function-constructor */
+import { AccountFields } from '@teleporthq/teleport-shared'
+import { generateDataAPIRoute } from '../src/data-api-route-generator'
+import { isPrivilegedUserField } from '../src/auth-generator'
+import { accountSignup } from '../src/nodes/account/account-signup'
+import { isSecurityRuntimeSpecifier, loadSecurityRuntime } from './_helpers/load-security-runtime'
+
+/**
+ * Review fix round 1 of the 2026-10-25 security round, executed against the
+ * generated `/api/data/<ds>/<op>` route over a fake pg client.
+ *
+ * A3: the old reset-token table (`password_reset_tokens`) held live reset
+ * tokens in clear. The dedicated reset routes replaced it, and the data API
+ * refuses it to EVERY caller — the app's own server code and its jobs too —
+ * by the table a request names and by any mention in a raw statement.
+ *
+ * m1: one privileged-field rule (`AccountFields.isPrivilegedAccountField`) for
+ * the sign-up route, the sign-up node and the data API's account-table net. A
+ * server segment acting for a signed-in customer cannot write a verified flag
+ * or a plan onto an account; the same column of any other table is ordinary.
+ */
+
+const SECRET = 'server-secret'
+const securityRuntime = loadSecurityRuntime()
+
+interface Answer {
+  status: number
+  body: any
+  queries: string[]
+}
+
+const bootRoute = (session: Record<string, unknown> | null = null) => {
+  const code = generateDataAPIRoute({ authUsersTableName: 'users' })
+  const queries: string[] = []
+  class FakeClient {
+    public async connect(): Promise<void> {
+      return
+    }
+    public async end(): Promise<void> {
+      return
+    }
+    public async query(sql: string): Promise<{ rows: any[]; rowCount: number }> {
+      queries.push(sql)
+      return { rows: [], rowCount: 0 }
+    }
+  }
+  const moduleObj: { exports: any } = { exports: {} }
+  new Function('require', 'module', 'exports', 'process', 'console', code)(
+    (name: string): any => {
+      if (name === 'pg') {
+        return { Client: FakeClient }
+      }
+      if (name === 'next-auth/jwt') {
+        return { getToken: async () => session }
+      }
+      if (isSecurityRuntimeSpecifier(name)) {
+        return securityRuntime
+      }
+      throw new Error('unexpected require: ' + name)
+    },
+    moduleObj,
+    moduleObj.exports,
+    { env: { NEXTAUTH_SECRET: SECRET, TELEPORT_DB_CONNECTION_STRING: 'postgresql://x' } },
+    { error: () => undefined, warn: () => undefined, log: () => undefined }
+  )
+  return async (
+    operation: string,
+    body: Record<string, unknown>,
+    headers: Record<string, string> = {}
+  ): Promise<Answer> => {
+    queries.length = 0
+    let status = 0
+    let responseBody: any = null
+    const res = {
+      status(statusCode: number) {
+        status = statusCode
+        return this
+      },
+      json(payload: any) {
+        responseBody = payload
+        return this
+      },
+    }
+    await moduleObj.exports(
+      {
+        method: 'POST',
+        query: { params: ['ds-1', operation] },
+        headers: { host: 'shop.example', ...headers },
+        body,
+      },
+      res
+    )
+    return { status, body: responseBody, queries: queries.slice() }
+  }
+}
+
+const internal = { 'x-internal-data-secret': SECRET }
+const customerCookie = { cookie: '__Host-next-auth.session-token=signed' }
+
+describe('A3: the old reset-token table is closed to every caller', () => {
+  const run = bootRoute()
+
+  it('refuses an internal-secret insert into and a select from password_reset_tokens', async () => {
+    const insert = await run(
+      'create',
+      {
+        tableName: 'password_reset_tokens',
+        columnMappings: { email: 'victim@site.test', token: 'mine' },
+      },
+      internal
+    )
+    expect(insert.status).toBe(403)
+    expect(insert.queries).toEqual([])
+    for (const tableName of ['password_reset_tokens', 'public.password_reset_tokens']) {
+      const select = await run('select', { tableName }, internal)
+      expect(select.status).toBe(403)
+      expect(select.queries).toEqual([])
+    }
+  })
+
+  it('refuses a raw statement naming it — quoted or not, any case, schema-qualified — to the server too', async () => {
+    for (const query of [
+      'SELECT * FROM password_reset_tokens WHERE token = $1',
+      'select email from "password_reset_tokens"',
+      'DELETE FROM PUBLIC.PASSWORD_RESET_TOKENS',
+      'SELECT u.id FROM users u JOIN "public"."password_reset_tokens" t ON t.email = u.email',
+    ]) {
+      const answer = await run('raw-query', { query }, internal)
+      expect([query, answer.status]).toEqual([query, 403])
+      expect(answer.queries).toEqual([])
+    }
+    // A select whose raw override names it is refused the same way.
+    const override = await run(
+      'select',
+      { tableName: 'teleport_products', rawQueryUserPart: 'SELECT * FROM password_reset_tokens' },
+      internal
+    )
+    expect(override.status).toBe(403)
+  })
+
+  it('leaves a statement that only resembles the name alone', async () => {
+    const answer = await run(
+      'raw-query',
+      { query: 'SELECT id FROM password_reset_tokens_archive' },
+      internal
+    )
+    expect(answer.status).not.toBe(403)
+  })
+})
+
+describe('m1: one privileged-field rule, for the account table only', () => {
+  // A server segment acting for a signed-in customer (it forwards their cookie).
+  const run = bootRoute({ id: 'u-2', sub: 'u-2', role: 'user' })
+  const asCustomer = { ...internal, ...customerCookie }
+
+  it('refuses a customer a verified flag or a plan on their account', async () => {
+    for (const column of ['email_verified', 'emailVerified', 'plan', 'credits', 'is_admin']) {
+      const answer = await run(
+        'update',
+        {
+          tableName: 'users',
+          columnMappings: { [column]: true },
+          filters: [{ source: 'id', operand: '=', destination: 'u-2' }],
+        },
+        asCustomer
+      )
+      expect([column, answer.status]).toEqual([column, 403])
+    }
+    const raw = await run(
+      'raw-query',
+      { query: "UPDATE users SET plan = 'pro' WHERE id = $1", params: ['u-2'] },
+      asCustomer
+    )
+    expect(raw.status).toBe(403)
+  })
+
+  it('leaves the same column of any other table, and the account’s ordinary columns, as they were', async () => {
+    const other = await run(
+      'update',
+      {
+        tableName: 'teleport_subscriptions',
+        columnMappings: { plan: 'pro', credits: 3 },
+        filters: [{ source: 'id', operand: '=', destination: 's-1' }],
+      },
+      asCustomer
+    )
+    expect(other.status).not.toBe(403)
+    const profile = await run(
+      'update',
+      {
+        tableName: 'users',
+        columnMappings: { name: 'Ana', company: 'Acme' },
+        filters: [{ source: 'id', operand: '=', destination: 'u-2' }],
+      },
+      asCustomer
+    )
+    expect(profile.status).not.toBe(403)
+  })
+
+  it('is the same rule in the sign-up route and the sign-up node', () => {
+    for (const key of ['email_verified', 'Plan', 'subscription_tier', 'role_name', 'company']) {
+      expect(isPrivilegedUserField(key)).toBe(AccountFields.isPrivilegedAccountField(key))
+    }
+    expect(accountSignup.generateServerHandler!({} as never)).toContain(
+      `const privilegedKey = ${AccountFields.PRIVILEGED_ACCOUNT_FIELD_PATTERN.toString()};`
+    )
+  })
+})

package/__tests__/email-locale-senders.test.ts

@@ -96,10 +96,10 @@ describe('welcome and farewell routes', () => {
 
   it('send the copy of the request language', () => {
     expect(signup).toContain('var copy = resolveWelcomeEmailCopy(locale);')
-    expect(signup).toContain('var subject = fillTemplate(copy.subject, tokenValues);')
+    expect(signup).toContain('var subject = fillSubjectTemplate(copy.subject, tokenValues);')
     expect(signup).toContain('var html = fillTemplate(copy.body, tokenValues);')
     expect(del).toContain('var copy = resolveFarewellEmailCopy(locale);')
-    expect(del).toContain('var subject = fillTemplate(copy.subject, tokenValues);')
+    expect(del).toContain('var subject = fillSubjectTemplate(copy.subject, tokenValues);')
     expect(del).toContain('var html = fillTemplate(copy.body, tokenValues);')
   })
 
@@ -132,7 +132,9 @@ describe('welcome and farewell routes', () => {
   })
 
   it('the signup route never inserts the copies as a user column', () => {
-    expect(signup).toContain('"localizedTemplates":1')
+    // An allow-list: only the fields a sign-up form collects reach the row.
+    expect(signup).toContain('const signupFields = ["image"];')
+    expect(signup).not.toContain('userData[bodyKeys[i]]')
   })
 })