@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/src/newsletter/newsletter-scope.ts

@@ -0,0 +1,116 @@
+import type { ProjectUIDL, UIDLNewsletterSettings } from '@teleporthq/teleport-types'
+
+/**
+ * The newsletter: a subscriber is a person of the site's `users` table whose
+ * `newsletter_status` is `subscribed` (`pending` waits for the emailed
+ * confirmation link, `unsubscribed` left, NULL was never on it). The generated
+ * app adds people, confirms them and lets them leave on its own server:
+ *
+ * - `utils/newsletter/newsletter.js`, the helper every writer goes through
+ *   (helper-code.ts);
+ * - `pages/api/newsletter/{subscribe,confirm,unsubscribe}.js` (routes-code.ts);
+ * - the `newsletter-subscribe` server node, and the `newsletter-confirm` /
+ *   `newsletter-unsubscribe` client nodes the confirm and unsubscribe pages run.
+ *
+ * All of it is generated only when the project carries `newsletterSettings`
+ * on the TeleportHQ database (v1).
+ */
+
+export const NEWSLETTER_HELPER_FILE_KEY = 'newsletter-helper'
+export const NEWSLETTER_HELPER_PATH = ['utils', 'newsletter']
+export const NEWSLETTER_HELPER_FILE_NAME = 'newsletter'
+export const NEWSLETTER_ROUTES_FILE_KEY = 'newsletter-routes'
+export const NEWSLETTER_ROUTES_PATH = ['pages', 'api', 'newsletter']
+
+export const NEWSLETTER_SUBSCRIBE_URL = '/api/newsletter/subscribe'
+export const NEWSLETTER_CONFIRM_URL = '/api/newsletter/confirm'
+export const NEWSLETTER_UNSUBSCRIBE_URL = '/api/newsletter/unsubscribe'
+
+/** The table the newsletter state lives on (teleport-gui `NEWSLETTER_USER_COLUMNS`). */
+export const NEWSLETTER_USERS_TABLE = 'users'
+
+export const DEFAULT_NEWSLETTER_CONFIRM_PATH = '/newsletter/confirm'
+export const DEFAULT_NEWSLETTER_UNSUBSCRIBE_PATH = '/newsletter/unsubscribe'
+
+/** `users.newsletter_source` (teleport-gui `NEWSLETTER_SOURCES`). */
+export const NEWSLETTER_SOURCES = [
+  'block',
+  'footer',
+  'popup',
+  'signup',
+  'account',
+  'checkout',
+  'booking',
+  'form',
+  'import',
+  'manual',
+  'admin',
+] as const
+
+/**
+ * The sign-up points a visitor's request may name (the public route's body,
+ * the node's config): the owner's own (`import`, `manual`, `admin`) never.
+ * Anything else is `block`.
+ */
+export const VISITOR_SIGN_UP_POINTS = [
+  'block',
+  'footer',
+  'popup',
+  'form',
+  'checkout',
+  'booking',
+  'signup',
+  'account',
+] as const
+
+/**
+ * The sign-up points of the site's own pages: what the public sign-up route
+ * takes from its body (anything else is `block`). The checkout, a booking and
+ * the account sign-up subscribe on the server, never through that route.
+ */
+export const PUBLIC_ROUTE_SIGN_UP_POINTS = ['block', 'footer', 'popup', 'form'] as const
+
+/** Confirmation links an address that opted out may be sent per day. */
+export const NEWSLETTER_OPTED_OUT_CONFIRMATIONS_PER_DAY = 1
+
+/** Every outcome of a sign-up answers this, in about the same time. */
+export const NEWSLETTER_MIN_RESPONSE_MS = 800
+
+/** Sign-ups one address may make per hour, and one visitor per hour. */
+export const NEWSLETTER_ADDRESS_LIMIT = 5
+export const NEWSLETTER_VISITOR_LIMIT = 5
+/**
+ * The visitor budget the sign-up route and the sign-up workflows share: the
+ * steps' `visitorLimit.scope`, counted as `visitor-limit:<scope>`.
+ */
+export const NEWSLETTER_VISITOR_SCOPE = 'newsletter-signup'
+
+/** The `require` specifier of the helper from a file `relativePrefix` below the project root. */
+export const newsletterHelperSpecifier = (relativePrefix: string): string =>
+  `${relativePrefix}/${NEWSLETTER_HELPER_PATH.join('/')}/${NEWSLETTER_HELPER_FILE_NAME}`
+
+/**
+ * The project's newsletter settings when the generated app gets the newsletter:
+ * `newsletterSettings` on the TeleportHQ database. Null otherwise (nothing is
+ * generated then).
+ */
+export const readNewsletterSettings = (
+  uidl: Pick<ProjectUIDL, 'newsletterSettings'>
+): UIDLNewsletterSettings | null => {
+  const settings = uidl.newsletterSettings
+  if (!settings || typeof settings !== 'object') {
+    return null
+  }
+  if (settings.dataSourceType !== 'teleport' || typeof settings.dataSourceId !== 'string') {
+    return null
+  }
+  return settings.dataSourceId ? settings : null
+}
+
+/** The sign-up form's ticked consent box also subscribes the person (R-N15). */
+export const newsletterSignupSubscribes = (
+  uidl: Pick<ProjectUIDL, 'newsletterSettings'>
+): boolean => {
+  const settings = readNewsletterSettings(uidl)
+  return !!settings && !!settings.signUp && settings.signUp.signupCheckbox === true
+}

package/src/newsletter/project-plugin.ts

@@ -0,0 +1,119 @@
+import { FileType, ProjectPlugin, ProjectPluginStructure } from '@teleporthq/teleport-types'
+import { getDatabaseDriverDependencies } from '../auth-generator'
+import { hasAutomationsBus } from '../automations/automations-scope'
+import { ensureEmailLocaleModule } from '../email-locale'
+import { collectWorkflowNodeConfigs } from '../password-reset-route-generator'
+import { ensureSecurityRuntimeModule } from '../security-runtime'
+import { ensureSentEmailLogModule } from '../sent-email-log'
+import {
+  SUPPORTED_EMAIL_PROVIDERS,
+  transactionalEmailDependencies,
+} from '../transactional-email-code'
+import { generateNewsletterHelperCode } from './helper-code'
+import {
+  NEWSLETTER_HELPER_FILE_KEY,
+  NEWSLETTER_HELPER_FILE_NAME,
+  NEWSLETTER_HELPER_PATH,
+  NEWSLETTER_ROUTES_FILE_KEY,
+  NEWSLETTER_ROUTES_PATH,
+  readNewsletterSettings,
+} from './newsletter-scope'
+import {
+  generateNewsletterConfirmRoute,
+  generateNewsletterSubscribeRoute,
+  generateNewsletterUnsubscribeRoute,
+} from './routes-code'
+
+/**
+ * The newsletter's generated side (see newsletter-scope.ts): the helper
+ * `utils/newsletter/newsletter.js` and the routes
+ * `pages/api/newsletter/{subscribe,confirm,unsubscribe}.js`, with the modules
+ * they require (the security runtime, the email locale, the sent-email log
+ * when a provider sends) and the provider's and Postgres's packages.
+ *
+ * Only for a project that carries `newsletterSettings` on the TeleportHQ
+ * database; every other project is left byte for byte as it was. Runs after
+ * the workflow project plugin, whose routes (the sign-up route's consent box,
+ * the `newsletter-subscribe` node) require the helper.
+ */
+export class NextNewsletterProjectPlugin implements ProjectPlugin {
+  async runBefore(structure: ProjectPluginStructure): Promise<ProjectPluginStructure> {
+    return structure
+  }
+
+  async runAfter(structure: ProjectPluginStructure): Promise<ProjectPluginStructure> {
+    const { uidl, files, dependencies } = structure
+    const settings = readNewsletterSettings(uidl)
+    if (!settings) {
+      return structure
+    }
+
+    ensureSecurityRuntimeModule(structure)
+    ensureEmailLocaleModule(structure)
+    const provider =
+      settings.email &&
+      settings.email.provider &&
+      SUPPORTED_EMAIL_PROVIDERS.has(settings.email.provider)
+        ? settings.email.provider
+        : null
+    const packages = {
+      ...getDatabaseDriverDependencies('teleport'),
+      ...transactionalEmailDependencies(provider),
+    }
+    for (const [pkg, version] of Object.entries(packages)) {
+      if (!dependencies[pkg]) {
+        dependencies[pkg] = version
+      }
+    }
+    if (provider) {
+      ensureSentEmailLogModule(structure)
+    }
+
+    files.set(NEWSLETTER_HELPER_FILE_KEY, {
+      path: NEWSLETTER_HELPER_PATH,
+      files: [
+        {
+          name: NEWSLETTER_HELPER_FILE_NAME,
+          fileType: FileType.JS,
+          content: generateNewsletterHelperCode({
+            settings,
+            siteName: uidl.name || '',
+            withAutomations: hasAutomationsBus(uidl),
+            signupSendsAccountWelcome: signupSendsAccountWelcome(uidl.workflows),
+          }),
+        },
+      ],
+    })
+
+    files.set(NEWSLETTER_ROUTES_FILE_KEY, {
+      path: NEWSLETTER_ROUTES_PATH,
+      files: [
+        { name: 'subscribe', fileType: FileType.JS, content: generateNewsletterSubscribeRoute() },
+        { name: 'confirm', fileType: FileType.JS, content: generateNewsletterConfirmRoute() },
+        {
+          name: 'unsubscribe',
+          fileType: FileType.JS,
+          content: generateNewsletterUnsubscribeRoute(),
+        },
+      ],
+    })
+
+    // The published admin panel does not send. Scheduling is a row edit on the
+    // site, then an unauthenticated hint. No service token is declared.
+    return structure
+  }
+}
+
+/**
+ * Whether the sign-up route sends the account's welcome email: the project's
+ * `account-signup` node names a provider and a body (the route bakes the same
+ * first config, generateSignupRouteFile).
+ */
+const signupSendsAccountWelcome = (
+  workflows: { workflows?: unknown; customNodes?: unknown } | undefined
+): boolean => {
+  const config = collectWorkflowNodeConfigs(workflows, 'account-signup')[0] || {}
+  const nodeType = typeof config.emailProvider === 'string' ? config.emailProvider : ''
+  const provider = nodeType.startsWith('email-') ? nodeType.slice('email-'.length) : ''
+  return SUPPORTED_EMAIL_PROVIDERS.has(provider) && typeof config.body === 'string' && !!config.body
+}

package/src/newsletter/routes-code.ts

@@ -0,0 +1,186 @@
+/**
+ * The newsletter's public routes, `pages/api/newsletter/*.js`. Each makes its
+ * decision through the helper (`utils/newsletter/newsletter.js`), never from
+ * what the browser claims beyond the address or the link's token.
+ *
+ * - `subscribe` — POST `{ email, website, signUpPoint }`: `website` is the
+ *   form's honeypot; `signUpPoint` one of the site pages' own (`block`,
+ *   `footer`, `popup`, `form`), else `block`; errors are logged by code and
+ *   message only (never a database row); every answer is `{ ok: true, pending }`, after at least
+ *   `NEWSLETTER_MIN_RESPONSE_MS`, whatever happened to the address.
+ * - `confirm` — POST `{ token }` → `{ ok, email? }`.
+ * - `unsubscribe` — POST `{ token }` → `{ ok, email? }`; a GET with `?t=`
+ *   (a click in a mail client) answers a small page whose button POSTs it, so a
+ *   link scanner that opens every link unsubscribes nobody.
+ */
+import { securityRuntimeSpecifier } from '../security-runtime/security-runtime-code'
+import {
+  NEWSLETTER_UNSUBSCRIBE_URL,
+  NEWSLETTER_VISITOR_LIMIT,
+  NEWSLETTER_VISITOR_SCOPE,
+  newsletterHelperSpecifier,
+} from './newsletter-scope'
+
+/** From `pages/api/newsletter/` to the project root. */
+const RELATIVE_PREFIX = '../../..'
+
+/** Confirm and unsubscribe attempts per visitor per hour. */
+export const NEWSLETTER_LINK_VISITOR_LIMIT = 30
+
+const ROUTE_PREAMBLE = `var __security = require('${securityRuntimeSpecifier(RELATIVE_PREFIX)}');
+var __newsletter = require('${newsletterHelperSpecifier(RELATIVE_PREFIX)}');
+
+function readBody(req) {
+  var body = req.body;
+  if (typeof body === 'string') {
+    try { body = JSON.parse(body); } catch (e) { body = null; }
+  }
+  return body && typeof body === 'object' ? body : {};
+}`
+
+const methodGuard = (methods: string[]): string => `  if (${methods
+  .map((method) => `req.method !== '${method}'`)
+  .join(' && ')}) {
+    res.setHeader('Allow', '${methods.join(', ')}');
+    return res.status(405).json({ error: 'Method not allowed' });
+  }`
+
+export const generateNewsletterSubscribeRoute = (): string => `${ROUTE_PREAMBLE}
+
+module.exports = async function handler(req, res) {
+${methodGuard(['POST'])}
+  // ${NEWSLETTER_VISITOR_LIMIT} sign-ups per visitor per hour, one budget with the sign-up
+  // workflows' steps (their visitorLimit scope '${NEWSLETTER_VISITOR_SCOPE}').
+  if (!(await __security.rateLimitRequest(req, res, { scope: 'visitor-limit:${NEWSLETTER_VISITOR_SCOPE}', limit: ${NEWSLETTER_VISITOR_LIMIT}, windowSeconds: 3600 }))) {
+    return;
+  }
+  var startedAt = Date.now();
+  var body = readBody(req);
+  var answer = __newsletter.publicSubscribeAnswer();
+  // The honeypot: a field people never see, which a bot fills. It is thanked
+  // like a person and nothing is written.
+  var trap = body.website == null ? '' : String(body.website).trim();
+  if (trap) {
+    await __newsletter.waitUntilElapsed(startedAt, __newsletter.NEWSLETTER_MIN_RESPONSE_MS);
+    return res.status(200).json(answer);
+  }
+  var email = __newsletter.normalizeEmail(body.email);
+  if (!email) {
+    return res.status(400).json({ error: 'Enter a valid email address.' });
+  }
+  try {
+    await __newsletter.withNewsletterDb(function (db) {
+      return __newsletter.subscribeNewsletterPerson({
+        db: db,
+        email: email,
+        // Only the site pages' own points: the server-side ones are never a visitor's.
+        signUpPoint: __newsletter.publicRouteSignUpPoint(body.signUpPoint),
+        req: req,
+      });
+    });
+  } catch (err) {
+    return __security.sendClientError(res, 503, 'We could not add you to the newsletter. Please try again in a moment.', __newsletter.safeError(err));
+  }
+  await __newsletter.waitUntilElapsed(startedAt, __newsletter.NEWSLETTER_MIN_RESPONSE_MS);
+  return res.status(200).json(answer);
+};
+`
+
+export const generateNewsletterConfirmRoute = (): string => `${ROUTE_PREAMBLE}
+
+module.exports = async function handler(req, res) {
+${methodGuard(['POST'])}
+  if (!(await __security.rateLimitRequest(req, res, { scope: 'newsletter-confirm', limit: ${NEWSLETTER_LINK_VISITOR_LIMIT}, windowSeconds: 3600 }))) {
+    return;
+  }
+  var body = readBody(req);
+  var token = typeof body.token === 'string' ? body.token : '';
+  if (!token) {
+    return res.status(200).json({ ok: false });
+  }
+  try {
+    var result = await __newsletter.withNewsletterDb(function (db) {
+      return __newsletter.confirmNewsletter({ db: db, token: token, req: req });
+    });
+    return res.status(200).json(result.ok ? { ok: true, email: result.email } : { ok: false });
+  } catch (err) {
+    return __security.sendClientError(res, 503, 'We could not confirm the subscription. Please try again in a moment.', __newsletter.safeError(err));
+  }
+};
+`
+
+export const generateNewsletterUnsubscribeRoute = (): string => `${ROUTE_PREAMBLE}
+
+function escapeHtml(value) {
+  return String(value == null ? '' : value)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+// The page a mail client's click lands on: plain, never indexed, never cached.
+function sendPage(res, status, title, message, form) {
+  res.statusCode = status;
+  res.setHeader('Content-Type', 'text/html; charset=utf-8');
+  res.setHeader('Cache-Control', 'no-store');
+  res.setHeader('Referrer-Policy', 'no-referrer');
+  res.setHeader('X-Robots-Tag', 'noindex');
+  res.end(
+    '<!doctype html><html lang="en"><head><meta charset="utf-8">' +
+    '<meta name="viewport" content="width=device-width, initial-scale=1">' +
+    '<meta name="robots" content="noindex"><title>' + escapeHtml(title) + '</title>' +
+    '<style>body{font-family:system-ui,-apple-system,sans-serif;max-width:480px;margin:15vh auto;padding:0 16px;color:#111;line-height:1.5}' +
+    'button{font:inherit;padding:10px 18px;border:0;border-radius:6px;background:#111;color:#fff;cursor:pointer}</style>' +
+    '</head><body><h1>' + escapeHtml(title) + '</h1><p>' + escapeHtml(message) + '</p>' + (form || '') + '</body></html>'
+  );
+}
+
+var NOT_A_LINK = 'This unsubscribe link does not work. Use the link in a newer email from us.';
+
+module.exports = async function handler(req, res) {
+${methodGuard(['GET', 'POST'])}
+  if (!(await __security.rateLimitRequest(req, res, { scope: 'newsletter-unsubscribe', limit: ${NEWSLETTER_LINK_VISITOR_LIMIT}, windowSeconds: 3600 }))) {
+    return;
+  }
+  if (req.method === 'GET') {
+    // Opening the link changes nothing: the button does.
+    var linkToken = req.query && typeof req.query.t === 'string' ? req.query.t : '';
+    if (!__newsletter.verifyNewsletterToken(linkToken, 'unsubscribe')) {
+      return sendPage(res, 200, 'Link not valid', NOT_A_LINK, '');
+    }
+    return sendPage(
+      res,
+      200,
+      'Unsubscribe',
+      'Stop receiving the newsletter at this address?',
+      '<form method="post" action="${NEWSLETTER_UNSUBSCRIBE_URL}"><input type="hidden" name="t" value="' +
+        escapeHtml(linkToken) + '"><button type="submit">Unsubscribe</button></form>'
+    );
+  }
+  var body = readBody(req);
+  var fromForm = String((req.headers && req.headers['content-type']) || '').indexOf('application/x-www-form-urlencoded') !== -1;
+  var token = typeof body.token === 'string' ? body.token : typeof body.t === 'string' ? body.t : '';
+  var result = { ok: false };
+  try {
+    if (token) {
+      result = await __newsletter.withNewsletterDb(function (db) {
+        return __newsletter.unsubscribeNewsletter({ db: db, token: token, req: req });
+      });
+    }
+  } catch (err) {
+    if (fromForm) {
+      console.error('[newsletter] unsubscribe failed:', __newsletter.safeError(err));
+      return sendPage(res, 503, 'Please try again', 'We could not unsubscribe you just now. Please try again in a moment.', '');
+    }
+    return __security.sendClientError(res, 503, 'We could not unsubscribe you. Please try again in a moment.', __newsletter.safeError(err));
+  }
+  if (fromForm) {
+    return result.ok
+      ? sendPage(res, 200, "You're unsubscribed", 'You will not receive the newsletter at this address any more.', '')
+      : sendPage(res, 200, 'Link not valid', NOT_A_LINK, '');
+  }
+  return res.status(200).json(result.ok ? { ok: true, email: result.email } : { ok: false });
+};
+`

package/src/nodes/account/account-compare-passwords.ts

@@ -35,12 +35,23 @@ async function account_compare_passwords(config: any, context: Record<string, un
   const bcrypt = __nodeRequire('bcryptjs')
   const crypto = __nodeRequire('crypto')
 
-  const PEPPER = (globalThis as any).process.env.AUTH_PEPPER || ''
-  const sha = crypto
-    .createHash('sha256')
-    .update(passwordStr + PEPPER)
-    .digest('base64')
-  const isMatch = bcrypt.compareSync(sha, hashStr)
+  // The project's own pepper (AUTH_PEPPER_SECRET) first, then the one every
+  // earlier hash used (AUTH_PEPPER) — as utils/auth/hash-password.
+  const env = (globalThis as any).process.env
+  const secretPepper =
+    typeof env.AUTH_PEPPER_SECRET === 'string' &&
+    env.AUTH_PEPPER_SECRET.indexOf('teleporthq.secrets.') !== 0
+      ? env.AUTH_PEPPER_SECRET
+      : ''
+  const peppers = secretPepper ? [secretPepper, env.AUTH_PEPPER || ''] : [env.AUTH_PEPPER || '']
+  let isMatch = false
+  for (let i = 0; i < peppers.length && !isMatch; i++) {
+    const sha = crypto
+      .createHash('sha256')
+      .update(passwordStr + peppers[i])
+      .digest('base64')
+    isMatch = bcrypt.compareSync(sha, hashStr)
+  }
 
   // `isMatch` is the contract key; `match` is a defensive alias for any
   // workflow that reads `.match` (the delete-account template did).

package/src/nodes/account/account-delete-current.ts

@@ -88,7 +88,7 @@ export const accountDeleteCurrent: NodeHandlerGenerator = {
   executionEnv: 'client',
   isTerminal: true,
   dependencies: {
-    'next-auth': '^4.24.0',
+    'next-auth': '4.24.15',
   },
   generateHandler(): string {
     return handlerToString(account_delete_current)

package/src/nodes/account/account-get-current.ts

@@ -146,7 +146,7 @@ export const accountGetCurrent: NodeHandlerGenerator = {
   nodeType: 'account-get-current',
   executionEnv: 'client',
   dependencies: {
-    'next-auth': '^4.24.0',
+    'next-auth': '4.24.15',
   },
   generateHandler(): string {
     return handlerToString(account_get_current)

package/src/nodes/account/account-hash-password.ts

@@ -14,8 +14,16 @@ async function account_hash_password(config: any, context: Record<string, unknow
     throw new Error('Password cannot be empty')
   }
 
-  if (passwordStr.length > 1000) {
-    throw new Error('Password exceeds maximum length')
+  // The password a site accepts (the sign-up and reset routes apply the same).
+  if (passwordStr.length < 8) {
+    throw new Error('Password must be at least 8 characters')
+  }
+
+  if (
+    passwordStr.length > 1000 ||
+    (globalThis as any).Buffer.byteLength(passwordStr, 'utf8') > 128
+  ) {
+    throw new Error('Password is too long (at most 128 bytes)')
   }
 
   if (!Number.isInteger(saltRounds) || saltRounds < 4 || saltRounds > 31) {
@@ -34,7 +42,15 @@ async function account_hash_password(config: any, context: Record<string, unknow
   const bcrypt = __nodeRequire('bcryptjs')
   const crypto = __nodeRequire('crypto')
 
-  const PEPPER = (globalThis as any).process.env.AUTH_PEPPER || ''
+  // The project's own pepper (AUTH_PEPPER_SECRET) when the deployment has one,
+  // else the one every earlier hash used (AUTH_PEPPER) — as utils/auth/hash-password.
+  const env = (globalThis as any).process.env
+  const secretPepper =
+    typeof env.AUTH_PEPPER_SECRET === 'string' &&
+    env.AUTH_PEPPER_SECRET.indexOf('teleporthq.secrets.') !== 0
+      ? env.AUTH_PEPPER_SECRET
+      : ''
+  const PEPPER = secretPepper || env.AUTH_PEPPER || ''
   const sha = crypto
     .createHash('sha256')
     .update(passwordStr + PEPPER)

package/src/nodes/account/account-login.ts

@@ -1,4 +1,6 @@
-import { NodeHandlerGenerator, handlerToString } from '../types'
+import { NodeHandlerGenerator, ServerHandlerOptions, handlerToString } from '../types'
+import { serverHandlerPrefix } from '../general/visitor-request'
+import { securityRuntimeSpecifier } from '../../security-runtime/security-runtime-code'
 
 async function account_login(config: any, context: Record<string, unknown>) {
   const email = config.email
@@ -89,12 +91,13 @@ export const accountLogin: NodeHandlerGenerator = {
   nodeType: 'account-login',
   executionEnv: 'client',
   dependencies: {
-    'next-auth': '^4.24.0',
+    'next-auth': '4.24.15',
   },
   generateHandler(): string {
     return handlerToString(account_login)
   },
-  generateServerHandler(): string {
+  generateServerHandler(options: ServerHandlerOptions = {}): string {
+    const prefix = serverHandlerPrefix(options)
     return `async function account_login(config, context) {
   const email = config.email;
   const password = config.password;
@@ -106,13 +109,27 @@ export const accountLogin: NodeHandlerGenerator = {
   const __nodeRequire = (typeof __non_webpack_require__ !== 'undefined' ? __non_webpack_require__ : require);
   const { verifyPassword } = __nodeRequire('../../../utils/auth/hash-password');
   const authUtils = __nodeRequire('../../../utils/auth/auth-options');
+  const security = __nodeRequire('${securityRuntimeSpecifier(prefix)}');
 
-  const user = await authUtils.findUserByEmail(email);
-  if (!user) {
-    throw new Error('Invalid email or password');
+  // The same failure throttle as the sign-in route, for the visitor this
+  // route serves (every caller shares one count when the route has none).
+  const request = (context && context.__request) || {};
+  const throttle = { headers: {}, body: { email: email } };
+  throttle.headers[authUtils.SIGN_IN_VISITOR_HEADER] = security.clientIp({
+    headers: request.headers || {},
+    socket: { remoteAddress: request.remoteAddress || '' },
+  });
+  const verdict = await authUtils.checkSignInAllowed(throttle);
+  if (!verdict.allowed) {
+    throw new Error('Too many sign-in attempts. Try again later.');
   }
 
-  if (!verifyPassword(password, user.password)) {
+  const user = await authUtils.findUserByEmail(email);
+  // Checked even without an account (against a stand-in hash), so every
+  // failure costs what a wrong password costs.
+  const passwordOk = verifyPassword(password, user ? user.password : null);
+  if (!user || !passwordOk) {
+    await authUtils.countSignInFailure(throttle, email);
     throw new Error('Invalid email or password');
   }
 

package/src/nodes/account/account-logout.ts

@@ -31,7 +31,7 @@ export const accountLogout: NodeHandlerGenerator = {
   nodeType: 'account-logout',
   executionEnv: 'client',
   dependencies: {
-    'next-auth': '^4.24.0',
+    'next-auth': '4.24.15',
   },
   generateHandler(): string {
     return handlerToString(account_logout)

package/src/nodes/account/account-refresh-session.ts

@@ -89,7 +89,7 @@ export const accountRefreshSession: NodeHandlerGenerator = {
   nodeType: 'account-refresh-session',
   executionEnv: 'client',
   dependencies: {
-    'next-auth': '^4.24.0',
+    'next-auth': '4.24.15',
   },
   generateHandler(): string {
     return handlerToString(account_refresh_session)

package/src/nodes/account/account-request-password-reset.ts

@@ -0,0 +1,47 @@
+import { NodeHandlerGenerator, handlerToString } from '../types'
+
+// Client node. It sends only the address the visitor typed to the dedicated
+// /api/auth/forgot-password route, which decides everything else on the
+// server: whether the address has an account, the link's token (minted there,
+// stored hashed), the page it opens and the email itself (provider, sender and
+// template baked from this node's config at generation). The route answers the
+// same whether the address has an account or not, so this node always reports
+// success for a well-formed request.
+async function account_request_password_reset(config: any, context: Record<string, unknown>) {
+  const email = config && typeof config.email === 'string' ? config.email.trim() : ''
+  if (!email) {
+    throw new Error('Email is required')
+  }
+
+  const baseUrl = (context && (context as any).__baseUrl) || ''
+  // The page's language rides along so the email is sent in it.
+  const requestHeaders: any = { 'Content-Type': 'application/json' }
+  const runLocale = context && (context as any).__locale
+  if (typeof runLocale === 'string' && runLocale) {
+    requestHeaders['x-teleport-locale'] = runLocale
+  }
+  const response = await fetch(baseUrl + '/api/auth/forgot-password', {
+    method: 'POST',
+    headers: requestHeaders,
+    body: JSON.stringify({ email }),
+  })
+
+  let data: any = {}
+  try {
+    data = await response.json()
+  } catch (_e) {}
+
+  if (!response.ok) {
+    throw new Error((data && data.error) || 'We could not send the reset link. Please try again.')
+  }
+
+  return { success: true, message: (data && data.message) || '' }
+}
+
+export const accountRequestPasswordReset: NodeHandlerGenerator = {
+  nodeType: 'account-request-password-reset',
+  executionEnv: 'client',
+  generateHandler(): string {
+    return handlerToString(account_request_password_reset)
+  },
+}