@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/__tests__/invoice-pdf-service-project-header.test.ts

@@ -0,0 +1,120 @@
+import type { ProjectPluginStructure, UIDLInvoiceSettings } from '@teleporthq/teleport-types'
+import { generatePdfServiceClientCode } from '../src/invoice/pdf-service-client-code'
+import { generateInvoiceFiles } from '../src/invoice'
+import { createEnvFiles } from '../../teleport-project-generator/src/file-handlers'
+
+/**
+ * The invoice PDF service checks the key against the project id it comes with
+ * (a per-project key the services worker derives at deploy time), so the
+ * emitted client sends `PDF_SERVICE_PROJECT_ID` as `X-Pdf-Service-Project`
+ * beside `PDF_SERVICE_API_KEY`. Executed against the emitted client.
+ */
+
+type CallPdfService = (html: string, invoiceData: unknown) => Promise<Buffer>
+
+interface FetchCall {
+  url: string
+  init: { headers: Record<string, string> }
+}
+
+const loadClient = (env: Record<string, string>, calls: FetchCall[]): CallPdfService => {
+  const fakeFetch = async (url: string, init: FetchCall['init']) => {
+    calls.push({ url, init })
+    return {
+      ok: true,
+      status: 200,
+      headers: {
+        get: (name: string) => (name.toLowerCase() === 'content-type' ? 'application/pdf' : null),
+      },
+      arrayBuffer: async () => new ArrayBuffer(4),
+      text: async () => '',
+    }
+  }
+  const noop = (): void => undefined
+  const quiet = { info: noop, error: noop, warn: noop }
+  // The jest node environment has no AbortController; the client only needs
+  // a signal to hand to fetch.
+  class FakeAbortController {
+    signal = {}
+    abort(): void {
+      return undefined
+    }
+  }
+  // tslint:disable-next-line:function-constructor
+  const factory = new Function(
+    'process',
+    'fetch',
+    'console',
+    'AbortController',
+    `${generatePdfServiceClientCode()}\nreturn callPdfService;`
+  )
+  return factory({ env }, fakeFetch, quiet, FakeAbortController) as CallPdfService
+}
+
+describe('invoice PDF client sends the project id with its key', () => {
+  it('sends X-Pdf-Service-Project from PDF_SERVICE_PROJECT_ID beside the key', async () => {
+    const calls: FetchCall[] = []
+    const callPdfService = loadClient(
+      {
+        PDF_SERVICE_URL: 'https://pdf.example/',
+        PDF_SERVICE_API_KEY: 'tqpdf_abc',
+        PDF_SERVICE_PROJECT_ID: 'project-a',
+      },
+      calls
+    )
+
+    await callPdfService('<p>x</p>', { invoiceNumber: 'INV-1' })
+
+    expect(calls).toHaveLength(1)
+    expect(calls[0].url).toBe('https://pdf.example/generate')
+    expect(calls[0].init.headers['X-Pdf-Service-Key']).toBe('tqpdf_abc')
+    expect(calls[0].init.headers['X-Pdf-Service-Project']).toBe('project-a')
+  })
+
+  it('omits the header when the deploy gave no project id (the service then decides)', async () => {
+    const calls: FetchCall[] = []
+    const callPdfService = loadClient(
+      { PDF_SERVICE_URL: 'https://pdf.example', PDF_SERVICE_API_KEY: 'legacy-key' },
+      calls
+    )
+
+    await callPdfService('<p>x</p>', {})
+
+    expect(calls[0].init.headers['X-Pdf-Service-Key']).toBe('legacy-key')
+    expect('X-Pdf-Service-Project' in calls[0].init.headers).toBe(false)
+  })
+
+  // The services worker injects the per-project key only into a bundle whose
+  // `.env` declares this line (the client that sends the project id); any
+  // other bundle keeps the legacy key its client can use.
+  it('emits PDF_SERVICE_PROJECT_ID= in the project .env so the deploy fills it', () => {
+    const structure = {
+      files: new Map(),
+      dependencies: {},
+      uidl: { components: {}, globals: { settings: { language: 'en' }, assets: [], env: {} } },
+    } as unknown as ProjectPluginStructure
+    generateInvoiceFiles(
+      {
+        enabled: true,
+        invoicePrefix: 'INV-',
+        emailDelivery: { enabled: false },
+      } as unknown as UIDLInvoiceSettings,
+      structure,
+      'postgresql',
+      null
+    )
+    expect(structure.uidl.globals.env).toMatchObject({
+      PDF_SERVICE_URL: '',
+      PDF_SERVICE_API_KEY: '',
+      PDF_SERVICE_PROJECT_ID: '',
+    })
+    const dotEnv = createEnvFiles(structure.uidl.globals.env).find((f) => f.name === '.env')
+    expect(dotEnv?.content.split('\n')).toEqual(
+      expect.arrayContaining([
+        'PDF_SERVICE_URL=',
+        'PDF_SERVICE_API_KEY=',
+        'PDF_SERVICE_PROJECT_ID=',
+      ])
+    )
+  })
+})

package/__tests__/invoice-self-call-origin.test.ts

@@ -26,7 +26,7 @@ interface Assembly {
   ) => Promise<{ storageUrl: string }>
 }
 
-const ENV_KEYS = ['NEXTAUTH_URL', 'VERCEL', 'NEXTAUTH_SECRET']
+const ENV_KEYS = ['NEXTAUTH_URL', 'VERCEL', 'NEXTAUTH_SECRET', 'VERCEL_AUTOMATION_BYPASS_SECRET']
 
 describe('invoice self-calls go to the store, never to a host the request named', () => {
   const saved: Record<string, string | undefined> = {}
@@ -60,6 +60,20 @@ describe('invoice self-calls go to the store, never to a host the request named'
     )
   })
 
+  it('reads NEXTAUTH_URL as configured, never as the auth route rewrote it from a request', () => {
+    const scope = globalThis as Record<string, unknown>
+    // /api/auth kept the configured value, then rewrote the live one from X-Forwarded-Host.
+    scope.__tqConfiguredNextAuthUrl = 'https://shop.example'
+    process.env.NEXTAUTH_URL = 'https://evil.test'
+    try {
+      expect(assembly().requestBaseUrl({ headers: { host: 'evil.test' } })).toBe(
+        'https://shop.example'
+      )
+    } finally {
+      delete scope.__tqConfiguredNextAuthUrl
+    }
+  })
+
   it("keeps the routed host on Vercel, and a local server's own port", () => {
     process.env.NEXTAUTH_URL = 'https://shop.example'
     process.env.VERCEL = '1'
@@ -113,5 +127,47 @@ describe('invoice self-calls go to the store, never to a host the request named'
     expect(calls).toHaveLength(1)
     expect(calls[0].url).toBe('https://shop.example/api/runtime-storage/upload')
     expect(calls[0].headers['x-internal-data-secret']).toBe('app-secret')
+    // No password wall here: no bypass.
+    expect(calls[0].headers).not.toHaveProperty('x-vercel-protection-bypass')
+  })
+
+  it("passes the deployment's password wall with the upload when it has one", async () => {
+    process.env.NEXTAUTH_URL = 'https://shop.example'
+    process.env.NEXTAUTH_SECRET = 'app-secret'
+    process.env.VERCEL_AUTOMATION_BYPASS_SECRET = 'bypass-1'
+    const { uploadInvoicePdfToRuntimeStorage } = assembly()
+    const headers: Array<Record<string, string>> = []
+    const globals = globalThis as any
+    const original = { fetch: globals.fetch, Blob: globals.Blob, FormData: globals.FormData }
+    globals.Blob = globals.Blob || NodeBlob
+    globals.FormData =
+      globals.FormData ||
+      class {
+        public append(): void {
+          return
+        }
+      }
+    globals.fetch = async (_url: string, init: { headers: Record<string, string> }) => {
+      headers.push(init.headers)
+      return { ok: true, status: 200, json: async () => ({ files: [{ url: 'u', id: 'f' }] }) }
+    }
+    try {
+      await uploadInvoicePdfToRuntimeStorage(
+        Buffer.from('%PDF-1.4'),
+        'INV-1.pdf',
+        'https://shop.example'
+      )
+    } finally {
+      globals.fetch = original.fetch
+      globals.Blob = original.Blob
+      globals.FormData = original.FormData
+    }
+    expect(headers).toEqual([
+      {
+        'x-internal-data-secret': 'app-secret',
+        'x-vercel-protection-bypass': 'bypass-1',
+        'x-vercel-set-bypass-cookie': 'false',
+      },
+    ])
   })
 })

package/__tests__/legacy-webhook-self-calls.test.ts

@@ -115,7 +115,9 @@ describe('legacy webhook self-calls: the secret, to the store only', () => {
           },
         },
       },
-      'evil.test'
+      'evil.test',
+      // The order the session pays: due exactly what it took.
+      { total_amount: '10.00', gift_card_amount: '0', currency: 'USD' }
     )
     expectStoreCalls(calls, ['/api/invoices/generate', '/api/ecommerce/order-notification'])
   })
@@ -160,6 +162,89 @@ describe('legacy webhook self-calls: the secret, to the store only', () => {
     expectStoreCalls(calls, ['/api/invoices/generate', '/api/ecommerce/order-notification'])
   })
 
+  it("passes the deployment's password wall on every self-call when it has one, and only then", async () => {
+    const paidCheckout = {
+      id: 'evt_5',
+      type: 'checkout.session.completed',
+      data: {
+        object: {
+          id: 'cs_5',
+          payment_status: 'paid',
+          payment_intent: 'pi_5',
+          amount_total: 1000,
+          currency: 'usd',
+          metadata: { orderId: 'order-5' },
+        },
+      },
+    }
+    const capture = {
+      id: 'WH-5',
+      event_type: 'PAYMENT.CAPTURE.COMPLETED',
+      resource: {
+        id: 'CAP-5',
+        status: 'COMPLETED',
+        amount: { value: '30.00', currency_code: 'USD' },
+        custom_id: JSON.stringify({ orderId: 'order-5', orderNumber: 'ORD-5' }),
+      },
+    }
+    const routes: Array<[string, unknown, Record<string, unknown>]> = [
+      [
+        generateStripeWebhookCode(invoices, notifications),
+        paidCheckout,
+        { total_amount: '10.00', gift_card_amount: '0', currency: 'USD' },
+      ],
+      [
+        generatePaypalWebhookCode(invoices, notifications),
+        capture,
+        { status: 'pending', payment_status: 'unpaid', currency: 'USD', total_amount: '30.00' },
+      ],
+    ]
+    for (const [source, event, order] of routes) {
+      const walled = selfCalls(
+        await deliver(source, event, 'evil.test', order, {
+          VERCEL_AUTOMATION_BYPASS_SECRET: 'bypass-1',
+        })
+      )
+      expect(walled).toHaveLength(2)
+      for (const call of walled) {
+        expect(call.headers['x-vercel-protection-bypass']).toBe('bypass-1')
+        expect(call.headers['x-vercel-set-bypass-cookie']).toBe('false')
+        expect(call.headers['x-internal-data-secret']).toBe(APP_SECRET)
+      }
+      const open = selfCalls(
+        await deliver(source, event, 'evil.test', order, {
+          VERCEL_AUTOMATION_BYPASS_SECRET: undefined as unknown as string,
+        })
+      )
+      expect(open).toHaveLength(2)
+      for (const call of open) {
+        expect(call.headers).not.toHaveProperty('x-vercel-protection-bypass')
+      }
+    }
+  })
+
+  it('reads NEXTAUTH_URL as configured, never as the auth route rewrote it from a request', async () => {
+    const scope = globalThis as Record<string, unknown>
+    // /api/auth kept the configured value, then rewrote the live one from X-Forwarded-Host.
+    scope.__tqConfiguredNextAuthUrl = STORE_ORIGIN
+    try {
+      const calls = await deliver(
+        generateStripeWebhookCode(invoices, undefined),
+        {
+          id: 'evt_4',
+          type: 'invoice.payment_succeeded',
+          data: { object: { id: 'in_3', amount_paid: 100, currency: 'usd', lines: { data: [] } } },
+        },
+        'evil.test',
+        {},
+        { NEXTAUTH_URL: 'https://evil.test' }
+      )
+      expectStoreCalls(calls, ['/api/invoices/generate'])
+    } finally {
+      delete scope.__tqConfiguredNextAuthUrl
+    }
+  })
+
   it("keeps Vercel's routed host, and a local dev server's own port", async () => {
     const source = generateStripeWebhookCode(invoices, undefined)
     const event = {

package/__tests__/middleware-home-route-protection.test.ts

@@ -55,7 +55,9 @@ describe('generateMiddlewareFile: home-route ("/") protection', () => {
 
   it('keeps the catch-all matcher for every deeper path', () => {
     const code = withHomeDashboard(['admin'])
-    expect(code).toContain("'/((?!api|_next/static|_next/image|favicon")
+    // Only the API routes ("/api", "/api/...") are left out — never a page
+    // whose path merely starts with "api".
+    expect(code).toContain("'/((?!api(?:/|$)|_next/static|_next/image|favicon")
   })
 
   it('still records "/" as a protected route in the protectedRoutes map', () => {

package/__tests__/middleware-subscriber-access.test.ts

@@ -153,7 +153,7 @@ describe('the generated middleware on a subscriber-only page', () => {
     expect(access?.url).toBe(
       'https://shop.test/api/auth/subscriber-access?products=prod-1%2Cprod-2'
     )
-    expect(access?.cookie).toBe('next-auth.session-token=stub')
+    expect(access?.cookie).toBe('__Host-next-auth.session-token=stub')
   })
 
   it('redirects a non-subscriber to the product page the route suggests, flagged', async () => {