@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/src/nodes/general/general-rate-limiter.ts

@@ -1,77 +1,17 @@
-import { NodeHandlerGenerator } from '../types'
-
-const RATE_LIMIT_STORE_CODE = `var __rateLimitStore = new Map();
-
-function __rateLimitCleanup(currentWindowKey) {
-  if (__rateLimitStore.size <= 10000) return;
-  var keysToDelete = [];
-  __rateLimitStore.forEach(function(val, key) {
-    var lastColon = key.lastIndexOf(':');
-    if (lastColon === -1) return;
-    var keyWindow = parseInt(key.substring(lastColon + 1), 10);
-    if (isNaN(keyWindow) || keyWindow < currentWindowKey - 1) {
-      keysToDelete.push(key);
-    }
-  });
-  for (var d = 0; d < keysToDelete.length; d++) {
-    __rateLimitStore.delete(keysToDelete[d]);
-  }
-}
-
-function __getClientIp(req) {
-  if (!req) return 'unknown';
-  var forwarded = req.headers && req.headers['x-forwarded-for'];
-  if (forwarded) {
-    var first = (typeof forwarded === 'string' ? forwarded : forwarded[0] || '').split(',')[0].trim();
-    if (first) return __normalizeIp(first);
-  }
-  var realIp = req.headers && req.headers['x-real-ip'];
-  if (realIp) {
-    var val = typeof realIp === 'string' ? realIp : realIp[0] || '';
-    if (val) return __normalizeIp(val.trim());
-  }
-  if (req.socket && req.socket.remoteAddress) {
-    return __normalizeIp(req.socket.remoteAddress);
-  }
-  if (req.connection && req.connection.remoteAddress) {
-    return __normalizeIp(req.connection.remoteAddress);
-  }
-  return 'unknown';
-}
-
-function __normalizeIp(ip) {
-  if (!ip) return 'unknown';
-  var cleaned = ip.replace(/^\\[|\\]$/g, '').toLowerCase();
-  if (cleaned === '::1' || cleaned === '::ffff:127.0.0.1') return '127.0.0.1';
-  if (cleaned.indexOf('::ffff:') === 0) return cleaned.substring(7);
-  return cleaned;
-}
-
-function __checkRateLimit(key, maxRequests, windowMs) {
-  var now = Date.now();
-  var windowKey = Math.floor(now / windowMs);
-  var storeKey = key + ':' + windowKey;
-  var windowExpiresSec = Math.ceil((((windowKey + 1) * windowMs) - now) / 1000);
-
-  var entry = __rateLimitStore.get(storeKey);
-  if (!entry) {
-    entry = { count: 0 };
-  }
-  entry.count += 1;
-  __rateLimitStore.set(storeKey, entry);
-
-  __rateLimitCleanup(windowKey);
-
-  var allowed = entry.count <= maxRequests;
-  var remaining = Math.max(0, maxRequests - entry.count);
-
-  return {
-    allowed: allowed,
-    remaining: remaining,
-    retryAfter: allowed ? 0 : windowExpiresSec
-  };
-}`
-
+import { NodeHandlerGenerator, ServerHandlerOptions } from '../types'
+import {
+  generateSecurityRuntimeVar,
+  serverHandlerPrefix,
+  VISITOR_KEY_CODE,
+} from './visitor-request'
+
+/**
+ * Counts in the app's shared, durable limiter (`rateLimit` in
+ * `utils/security-runtime.js`), so every instance of a serverless app counts
+ * together and a redeploy or cold start resets nothing. The 'ip' strategy
+ * reads the visitor's address only where the host guarantees it (an IPv6
+ * visitor counts by its /64). Without the runtime the request is refused.
+ */
 const RATE_LIMIT_HANDLER_CODE = `
 async function general_rate_limiter(config, context) {
   var strategy = config.strategy;
@@ -89,7 +29,7 @@ async function general_rate_limiter(config, context) {
     };
   }
 
-  if (!maxRequests || typeof maxRequests !== 'number' || maxRequests <= 0) {
+  if (!maxRequests || typeof maxRequests !== 'number' || maxRequests < 1) {
     return {
       __earlyResponse: {
         status: 500,
@@ -109,9 +49,21 @@ async function general_rate_limiter(config, context) {
     };
   }
 
+  var security = __rateLimitSecurity;
+  if (!security || typeof security.rateLimit !== 'function' || typeof security.clientIp !== 'function') {
+    console.error('[rate-limiter] request refused: the security runtime is not available');
+    return {
+      __earlyResponse: {
+        status: 500,
+        headers: {},
+        body: { error: 'Internal Server Error', message: 'Rate limiting is not available.' }
+      }
+    };
+  }
+
   var identifier;
   if (strategy === 'ip') {
-    identifier = (context.__request && context.__request.ip) || 'unknown';
+    identifier = __visitorKeyOf(security, context.__request);
   } else {
     identifier = config.key;
     if (identifier === undefined || identifier === null || identifier === '') {
@@ -126,8 +78,23 @@ async function general_rate_limiter(config, context) {
     identifier = String(identifier);
   }
 
-  var fullKey = 'rate_limit:' + config.__nodeId + ':' + identifier;
-  var result = __checkRateLimit(fullKey, maxRequests, windowMs);
+  var result;
+  try {
+    result = await security.rateLimit({
+      key: JSON.stringify(['workflow-rate-limiter', String(config.__nodeId), strategy, identifier]),
+      limit: Math.floor(maxRequests),
+      windowSeconds: Math.max(1, Math.ceil(windowMs / 1000))
+    });
+  } catch (err) {
+    console.error('[rate-limiter] request refused:', err && err.message ? err.message : err);
+    return {
+      __earlyResponse: {
+        status: 500,
+        headers: {},
+        body: { error: 'Internal Server Error', message: 'Rate limiting is not available.' }
+      }
+    };
+  }
 
   if (!result.allowed) {
     return {
@@ -143,7 +110,7 @@ async function general_rate_limiter(config, context) {
     };
   }
 
-  return { allowed: true, remaining: result.remaining };
+  return { allowed: true };
 }`
 
 export const generalRateLimiter: NodeHandlerGenerator = {
@@ -154,7 +121,13 @@ export const generalRateLimiter: NodeHandlerGenerator = {
   throw new Error('general-rate-limiter must run on the server');
 }`
   },
-  generateServerHandler(): string {
-    return RATE_LIMIT_STORE_CODE + '\n' + RATE_LIMIT_HANDLER_CODE
+  generateServerHandler(options?: ServerHandlerOptions): string {
+    return (
+      generateSecurityRuntimeVar('__rateLimitSecurity', serverHandlerPrefix(options)) +
+      '\n' +
+      VISITOR_KEY_CODE +
+      '\n' +
+      RATE_LIMIT_HANDLER_CODE
+    )
   },
 }

package/src/nodes/general/general-wait.ts

@@ -0,0 +1,80 @@
+import type { NodeHandlerGenerator } from '../types'
+
+/**
+ * Wait (`general-wait { amount, unit } | { until }`): pauses an automation and
+ * resumes it later (spec §5.2). Server only, and only inside an automation
+ * handler module (`lib/automations/handlers/*.js`), which hands the node its
+ * run through `context.__automation`:
+ *
+ * - the node works out when the run resumes and stores its output
+ *   (`{ until }`, the node-context schema) on the context first, so the nodes
+ *   after it read it once the run resumes;
+ * - `context.__automation.park(nodeId, until)` stores the run — a
+ *   `teleport_automation_waits` row with the event, the workflow, the next
+ *   node and the context — and the node answers `{ __wait: true }`, which
+ *   stops the handler's node loop: nothing after it runs now. A Wait with no
+ *   step after it parks nothing (`park` answers null): the node answers
+ *   `{ until }` and the run ends there, delivered, instead of waiting for a
+ *   resume that would never come.
+ *
+ * A test event (`context.__automation.test`) parks nothing: the node answers
+ * `{ __wait: true, wouldWait: { amount, unit } | { until } }` and the run stops
+ * there, so a test never leaves a run behind.
+ *
+ * The dispatcher resumes the row once `until` has passed, at the next node,
+ * with the stored context. Not in the node registry: no other route can run
+ * it, and one that met it would fail with "No implementation" — a Wait is
+ * refused outside automations by the editor's validation.
+ *
+ * Authored as a string so a consumer's minifier cannot rename the entry
+ * function (see resolveHandlerEntryName).
+ */
+const GENERAL_WAIT_HANDLER = `async function general_wait(config, context) {
+  var automation = context && context.__automation;
+  if (!automation || typeof automation.park !== 'function') {
+    throw new Error('A Wait runs only in an automation');
+  }
+  // Checked before anything else, a test included, so a test fails exactly
+  // where the live run would: a Wait in a loop has no single place to resume.
+  if (context.__loopScopeStack && context.__loopScopeStack.length > 0) {
+    throw new Error('A Wait cannot run inside a loop');
+  }
+  var runAt;
+  var untilMode = config.until !== undefined && config.until !== null && config.until !== '';
+  if (untilMode) {
+    runAt = new Date(config.until);
+    if (isNaN(runAt.getTime())) {
+      throw new Error('The Wait is set to a date that is not one: ' + String(config.until));
+    }
+  } else {
+    var unitMs = { minutes: 60000, hours: 3600000, days: 86400000 }[config.unit || 'minutes'];
+    var amount = Number(config.amount);
+    if (!unitMs || !isFinite(amount) || amount < 0) {
+      throw new Error('Set how many minutes, hours or days the Wait lasts');
+    }
+    runAt = new Date(Date.now() + amount * unitMs);
+  }
+  var until = runAt.toISOString();
+  // A test event shows where the run would pause, and stops there: nothing is stored.
+  if (automation.test) {
+    return {
+      __wait: true,
+      until: until,
+      wouldWait: untilMode ? { until: until } : { amount: Number(config.amount), unit: config.unit || 'minutes' },
+    };
+  }
+  context[config.__nodeId] = { until: until };
+  var parked = await automation.park(config.__nodeId, until);
+  return parked ? { __wait: true, until: until } : { until: until };
+}`
+
+export const generalWait: NodeHandlerGenerator = {
+  nodeType: 'general-wait',
+  executionEnv: 'server',
+  generateHandler(): string {
+    return GENERAL_WAIT_HANDLER
+  },
+  generateServerHandler(): string {
+    return GENERAL_WAIT_HANDLER
+  },
+}

package/src/nodes/general/visitor-request.ts

@@ -0,0 +1,79 @@
+import type { ServerHandlerOptions } from '../types'
+import { securityRuntimeSpecifier } from '../../security-runtime/security-runtime-code'
+
+/**
+ * What the server handlers that limit or send on a visitor's behalf share:
+ * where the route they are inlined into sits, the shared security runtime
+ * (`utils/security-runtime.js`), and the visitor a request comes from.
+ */
+
+/**
+ * The prefix from the route a server handler is inlined into to the project
+ * root. Segment routes (`pages/api/workflows/<file>.js`) pass none.
+ */
+export const serverHandlerPrefix = (options?: ServerHandlerOptions): string =>
+  (options && options.relativePrefix) || '../../..'
+
+/** Email and SMS provider nodes: `email-resend`, `sms-twilio`, … */
+export const isOutboundMessageNodeType = (nodeType: string): boolean =>
+  nodeType.startsWith('email-') || nodeType.startsWith('sms-')
+
+/**
+ * A route running one of these hands its nodes the visitor's request
+ * (`context.__request`). The newsletter sign-up reads it for the links it
+ * mails (the site's origin) and the email's language.
+ */
+export const needsVisitorRequest = (nodeTypes: Iterable<string>): boolean => {
+  for (const nodeType of nodeTypes) {
+    if (
+      nodeType === 'general-rate-limiter' ||
+      nodeType === 'newsletter-subscribe' ||
+      isOutboundMessageNodeType(nodeType)
+    ) {
+      return true
+    }
+  }
+  return false
+}
+
+/**
+ * The route statement that hands the nodes the request they serve: its
+ * headers and socket address (the visitor's address is read from them by the
+ * security runtime's `clientIp`, only where the host guarantees it), and
+ * whether this deployment's own server code made the call. Set after the
+ * request context is copied, so a body cannot supply it.
+ */
+export const VISITOR_REQUEST_INJECTION =
+  "\n    context.__request = { headers: req.headers || {}, remoteAddress: (req.socket && req.socket.remoteAddress) || '', internal: utils.isInternalCall(req) };"
+
+/**
+ * Emitted: `var <name>` holding the security runtime. Without a prefix (a
+ * handler emitted for no known route) it is `null`, and whatever needs it
+ * refuses. The `require` is a static one, so the bundler includes the file; it
+ * is only emitted where the prefix is known to be right.
+ */
+export const generateSecurityRuntimeVar = (name: string, relativePrefix?: string): string => {
+  const value = relativePrefix
+    ? `(function () { try { return require('${securityRuntimeSpecifier(
+        relativePrefix
+      )}'); } catch (_e) { return null; } })()`
+    : 'null'
+  return `var ${name} = typeof ${name} !== 'undefined' ? ${name} : ${value};`
+}
+
+/**
+ * Emitted: `__visitorKeyOf(security, request)` — the visitor a request comes
+ * from, read by `security.clientIp` from what the route put in
+ * `context.__request` and keyed by `security.visitorKey` (an IPv6 visitor by
+ * its /64: one visitor holds the whole block), the one rule every limiter of
+ * the app keys a visitor by. 'unknown' when there is no request, so every
+ * such call shares one bucket.
+ */
+export const VISITOR_KEY_CODE = `var __visitorKeyOf = typeof __visitorKeyOf !== 'undefined' ? __visitorKeyOf : function __visitorKeyOf(security, request) {
+  if (!request || typeof request !== 'object') return 'unknown';
+  var ip = security.clientIp({
+    headers: request.headers && typeof request.headers === 'object' ? request.headers : {},
+    socket: { remoteAddress: typeof request.remoteAddress === 'string' ? request.remoteAddress : '' }
+  });
+  return security.visitorKey(ip) || 'unknown';
+};`

package/src/nodes/index.ts

@@ -8,6 +8,8 @@ import { accountHashPassword } from './account/account-hash-password'
 import { accountLogin } from './account/account-login'
 import { accountLogout } from './account/account-logout'
 import { accountRefreshSession } from './account/account-refresh-session'
+import { accountRequestPasswordReset } from './account/account-request-password-reset'
+import { accountResetPassword } from './account/account-reset-password'
 import { accountSignup } from './account/account-signup'
 import { accountSocialLogin } from './account/account-social-login'
 import { audioPlay } from './audio/audio-play'
@@ -20,6 +22,7 @@ import { aiSentimentAnalysis } from './ai/ai-sentiment-analysis'
 import { aiSummarization } from './ai/ai-summarization'
 import { aiTextClassifier } from './ai/ai-text-classifier'
 import { aiTextTransform } from './ai/ai-text-transform'
+import { analyticsTrackOutcome } from './analytics/analytics-track-outcome'
 import { browserAskPermission } from './browser/browser-ask-permission'
 import { browserFullscreen } from './browser/browser-fullscreen'
 import { browserGetDeviceInfo } from './browser/browser-get-device-info'
@@ -99,6 +102,9 @@ import { navigationGoBack } from './navigation/navigation-go-back'
 import { navigationGoToPage } from './navigation/navigation-go-to-page'
 import { navigationNavigateToUrl } from './navigation/navigation-navigate-to-url'
 import { navigationRefreshPage } from './navigation/navigation-refresh-page'
+import { newsletterConfirm } from './newsletter/newsletter-confirm'
+import { newsletterSubscribe } from './newsletter/newsletter-subscribe'
+import { newsletterUnsubscribe } from './newsletter/newsletter-unsubscribe'
 import { pushSendNotification } from './push/push-send-notification'
 import { paymentChargeUser } from './payment/payment-charge-user'
 import { paymentCreateCustomer } from './payment/payment-create-customer'
@@ -185,6 +191,8 @@ export const nodeRegistry: Record<string, NodeHandlerGenerator> = {
   'account-login': accountLogin,
   'account-logout': accountLogout,
   'account-refresh-session': accountRefreshSession,
+  'account-request-password-reset': accountRequestPasswordReset,
+  'account-reset-password': accountResetPassword,
   'account-signup': accountSignup,
   'account-social-login': accountSocialLogin,
   'audio-play': audioPlay,
@@ -197,6 +205,7 @@ export const nodeRegistry: Record<string, NodeHandlerGenerator> = {
   'ai-summarization': aiSummarization,
   'ai-text-classifier': aiTextClassifier,
   'ai-text-transform': aiTextTransform,
+  'analytics-track-outcome': analyticsTrackOutcome,
   'browser-ask-permission': browserAskPermission,
   'browser-fullscreen': browserFullscreen,
   'browser-get-device-info': browserGetDeviceInfo,
@@ -272,6 +281,9 @@ export const nodeRegistry: Record<string, NodeHandlerGenerator> = {
   'navigation-go-to-page': navigationGoToPage,
   'navigation-navigate-to-url': navigationNavigateToUrl,
   'navigation-refresh-page': navigationRefreshPage,
+  'newsletter-confirm': newsletterConfirm,
+  'newsletter-subscribe': newsletterSubscribe,
+  'newsletter-unsubscribe': newsletterUnsubscribe,
   'push-send-notification': pushSendNotification,
   'payment-charge-user': paymentChargeUser,
   'payment-refund': paymentRefund,

package/src/nodes/integrations/integration-slack.ts

@@ -17,6 +17,21 @@ async function integration_slack(config: any, context: Record<string, unknown>)
       return { error_summary: text, error: text, message: text, raw: text }
     }
   }
+  // A value embedded in a message reaches it HTML-escaped (the runtime's
+  // resolveRichTextContext): `&amp;`, `&lt;` and `&gt;` are Slack's own escapes
+  // and stay, so a value can never open a link or a mention. A quote is no
+  // Slack control character and Slack shows its entity as typed, so it is put back.
+  const slackText = (value: any) =>
+    typeof value === 'string'
+      ? value.replace(/&quot;|&#34;|&#39;|&#x27;/g, (entity: string) =>
+          entity === '&quot;' || entity === '&#34;' ? '"' : "'"
+        )
+      : value
+  // The same for the text inside Block Kit blocks.
+  const slackBlocks = (blocks: any) =>
+    blocks && typeof blocks === 'object'
+      ? JSON.parse(JSON.stringify(blocks), (_key: string, value: any) => slackText(value))
+      : blocks
   const token = config.token
   const action = config.action
   const baseUrl = 'https://slack.com/api/'
@@ -29,10 +44,10 @@ async function integration_slack(config: any, context: Record<string, unknown>)
     case 'send-message': {
       const body: Record<string, any> = {
         channel: config.channel,
-        text: config.text,
+        text: slackText(config.text),
       }
       if (config.blocks) {
-        body.blocks = config.blocks
+        body.blocks = slackBlocks(config.blocks)
       }
       if (config.threadTs) {
         body.thread_ts = config.threadTs
@@ -112,10 +127,10 @@ async function integration_slack(config: any, context: Record<string, unknown>)
       const body: Record<string, any> = {
         channel: config.channel,
         ts: config.ts,
-        text: config.text,
+        text: slackText(config.text),
       }
       if (config.blocks) {
-        body.blocks = config.blocks
+        body.blocks = slackBlocks(config.blocks)
       }
       const response = await fetch(baseUrl + 'chat.update', {
         method: 'POST',
@@ -376,11 +391,11 @@ async function integration_slack(config: any, context: Record<string, unknown>)
     case 'schedule-message': {
       const body: Record<string, any> = {
         channel: config.channel,
-        text: config.text,
+        text: slackText(config.text),
         post_at: config.postAt || Math.floor(Date.now() / 1000) + 60,
       }
       if (config.blocks) {
-        body.blocks = config.blocks
+        body.blocks = slackBlocks(config.blocks)
       }
       const response = await fetch(baseUrl + 'chat.scheduleMessage', {
         method: 'POST',

package/src/nodes/newsletter/newsletter-confirm.ts

@@ -0,0 +1,44 @@
+import { NodeHandlerGenerator, handlerToString } from '../types'
+
+// Client node, for the newsletter's confirm page. It hands the link's token
+// (from the page URL) to the dedicated /api/newsletter/confirm route, which
+// checks it and subscribes the person on the server. `{ ok, email? }`: a link
+// that is expired or not one is `{ ok: false }`, never an error.
+async function newsletter_confirm(config: any, context: Record<string, unknown>) {
+  const token = config && config.token != null ? String(config.token).trim() : ''
+  if (!token) {
+    return { ok: false }
+  }
+
+  const baseUrl = (context && (context as any).__baseUrl) || ''
+  const response = await fetch(baseUrl + '/api/newsletter/confirm', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ token }),
+  })
+
+  let data: any = {}
+  try {
+    data = await response.json()
+  } catch (_e) {}
+
+  if (!response.ok) {
+    throw new Error(
+      (data && data.error) || 'We could not confirm the subscription. Please try again.'
+    )
+  }
+
+  const result: any = { ok: !!data && data.ok === true }
+  if (result.ok && typeof data.email === 'string') {
+    result.email = data.email
+  }
+  return result
+}
+
+export const newsletterConfirm: NodeHandlerGenerator = {
+  nodeType: 'newsletter-confirm',
+  executionEnv: 'client',
+  generateHandler(): string {
+    return handlerToString(newsletter_confirm)
+  },
+}

package/src/nodes/newsletter/newsletter-subscribe.ts

@@ -0,0 +1,78 @@
+import { NodeHandlerGenerator, ServerHandlerOptions } from '../types'
+import { serverHandlerPrefix } from '../general/visitor-request'
+import { newsletterHelperSpecifier } from '../../newsletter/newsletter-scope'
+
+/** What the step fails with on a site whose newsletter is not generated. */
+export const NEWSLETTER_NOT_SET_UP_MESSAGE =
+  'The newsletter is not set up on this site. Switch on Newsletter, then publish again.'
+
+/** What the step fails with when the site's database does not answer. */
+export const NEWSLETTER_TRY_AGAIN_MESSAGE =
+  'We could not add you to the newsletter. Please try again in a moment.'
+
+/**
+ * Server node. Adds the address a visitor typed to the newsletter through the
+ * site's helper (`utils/newsletter/newsletter.js`), which decides everything:
+ * double opt-in, an unsubscribed address only ever mailed a confirmation link,
+ * the per-address limit, the event and the welcome email. `website` is the
+ * form's honeypot: filled, nothing is written. Every run answers
+ * `{ ok: true, pending }` after the same minimum time, whatever happened to
+ * the address. The visitor limit is the step's `visitorLimit` (scope
+ * `newsletter-signup`), which the feature builders declare.
+ *
+ * The helper is a static `require` (Next's server build bundles it), emitted
+ * only where the route's place is known; elsewhere the step refuses.
+ */
+const generateSubscribeHandler = (
+  relativePrefix: string | null
+): string => `var __newsletterHelper = typeof __newsletterHelper !== 'undefined' ? __newsletterHelper : ${
+  relativePrefix
+    ? `(function () { try { return require('${newsletterHelperSpecifier(
+        relativePrefix
+      )}'); } catch (_e) { return null; } })()`
+    : 'null'
+};
+
+async function newsletter_subscribe(config, context) {
+  var newsletter = __newsletterHelper;
+  if (!newsletter) {
+    throw new Error(${JSON.stringify(NEWSLETTER_NOT_SET_UP_MESSAGE)});
+  }
+  var startedAt = Date.now();
+  var answer = newsletter.publicSubscribeAnswer();
+  var trap = config && config.website != null ? String(config.website).trim() : '';
+  if (!trap) {
+    var email = newsletter.normalizeEmail(config && config.email);
+    if (!email) {
+      throw new Error('Enter a valid email address.');
+    }
+    try {
+      await newsletter.withNewsletterDb(function (db) {
+        return newsletter.subscribeNewsletterPerson({
+          db: db,
+          email: email,
+          signUpPoint: newsletter.visitorSignUpPoint(config && config.signUpPoint),
+          req: context && context.__request,
+        });
+      });
+    } catch (err) {
+      // Logged by code and message only (never a database row); the visitor
+      // is told nothing about the database.
+      console.error('[newsletter] sign-up failed:', newsletter.safeError(err));
+      throw new Error(${JSON.stringify(NEWSLETTER_TRY_AGAIN_MESSAGE)});
+    }
+  }
+  await newsletter.waitUntilElapsed(startedAt, newsletter.NEWSLETTER_MIN_RESPONSE_MS);
+  return { ok: answer.ok === true, pending: answer.pending === true };
+}`
+
+export const newsletterSubscribe: NodeHandlerGenerator = {
+  nodeType: 'newsletter-subscribe',
+  executionEnv: 'server',
+  generateHandler(): string {
+    return generateSubscribeHandler(null)
+  },
+  generateServerHandler(options?: ServerHandlerOptions): string {
+    return generateSubscribeHandler(serverHandlerPrefix(options))
+  },
+}

package/src/nodes/newsletter/newsletter-unsubscribe.ts

@@ -0,0 +1,43 @@
+import { NodeHandlerGenerator, handlerToString } from '../types'
+
+// Client node, for the newsletter's unsubscribe page. It hands the link's
+// token (from the page URL) to the dedicated /api/newsletter/unsubscribe
+// route, which checks it and takes the person off the list on the server
+// (idempotent). `{ ok, email? }`: a link that is not one is `{ ok: false }`,
+// never an error; `email` lets the page offer to subscribe again.
+async function newsletter_unsubscribe(config: any, context: Record<string, unknown>) {
+  const token = config && config.token != null ? String(config.token).trim() : ''
+  if (!token) {
+    return { ok: false }
+  }
+
+  const baseUrl = (context && (context as any).__baseUrl) || ''
+  const response = await fetch(baseUrl + '/api/newsletter/unsubscribe', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ token }),
+  })
+
+  let data: any = {}
+  try {
+    data = await response.json()
+  } catch (_e) {}
+
+  if (!response.ok) {
+    throw new Error((data && data.error) || 'We could not unsubscribe you. Please try again.')
+  }
+
+  const result: any = { ok: !!data && data.ok === true }
+  if (result.ok && typeof data.email === 'string') {
+    result.email = data.email
+  }
+  return result
+}
+
+export const newsletterUnsubscribe: NodeHandlerGenerator = {
+  nodeType: 'newsletter-unsubscribe',
+  executionEnv: 'client',
+  generateHandler(): string {
+    return handlerToString(newsletter_unsubscribe)
+  },
+}

package/src/nodes/realtime/realtime-join-channel.ts

@@ -7,8 +7,6 @@ async function realtime_join_channel(config: any, context: Record<string, unknow
   }
 
   const rt = typeof window !== 'undefined' ? (window as any).__teleportRealtime : null
-  const userId = rt ? rt.getUserId() : 'anon'
-  const userName = rt ? rt.getUserName() : 'Anonymous'
   const channelData = config.channelData || undefined
   let parsedChannelData
   if (channelData && typeof channelData === 'string') {
@@ -26,14 +24,17 @@ async function realtime_join_channel(config: any, context: Record<string, unknow
     const joinRes = await fetch(baseUrl + '/api/realtime/join', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
+      // Who joins is the server's call (the site's session, or an opaque id
+      // it issues): the body carries no user.
       body: JSON.stringify({
         channelName,
-        userId,
-        userName,
         userData: parsedChannelData,
       }),
     })
     const joinData = await joinRes.json()
+    const identity = (joinData && joinData.identity) || {}
+    const userId = identity.id || (rt ? rt.getUserId() : '')
+    const userName = identity.name || (rt ? rt.getUserName() : 'Anonymous')
 
     if (!joinRes.ok) {
       return {

package/src/nodes/realtime/realtime-send-channel-event.ts

@@ -4,8 +4,19 @@ async function realtime_send_channel_event(config: any, context: Record<string,
   const channelName = config.channelName
   const eventName = config.eventName
   const eventData = config.eventData || null
-  const senderId = config.senderId || 'system'
-  const senderName = config.senderName || 'System'
+  // Run for a signed-in visitor, the send goes out as that visitor — the
+  // session the segment route verified, never a value the request carries.
+  // Otherwise (a guest, a cron, an automation) as the author configured, or
+  // "System".
+  const ctx = (context || {}) as any
+  const sessionId =
+    ctx.__sessionUserId != null && ctx.__sessionUserId !== '' ? String(ctx.__sessionUserId) : ''
+  const sessionName =
+    ctx.__sessionUser && typeof ctx.__sessionUser.name === 'string' && ctx.__sessionUser.name
+      ? ctx.__sessionUser.name
+      : 'Member'
+  const senderId = sessionId || config.senderId || 'system'
+  const senderName = sessionId ? sessionName : config.senderName || 'System'
 
   if (!channelName) {
     return { success: false, error: 'channelName is required' }