@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/src/webhook-generator.ts

@@ -6,6 +6,8 @@ import {
 } from '@teleporthq/teleport-types'
 import { ensurePaymentDriversModule, resolveStorePaymentDriverIds } from './payments'
 import { DEFAULT_PAYMENT_DRIVER_IDS } from './payments/payment-drivers-scope'
+import { CONFIGURED_NEXTAUTH_URL_EXPRESSION } from './configured-nextauth-url'
+import { generateSelfCallHeadersCode } from './self-call-headers'
 
 /**
  * The origin a legacy webhook route calls this deployment's own routes on
@@ -18,7 +20,8 @@ import { DEFAULT_PAYMENT_DRIVER_IDS } from './payments/payment-drivers-scope'
  * NEXTAUTH_URL's origin when it is set — except that a local server on another
  * port than a local NEXTAUTH_URL keeps its own loopback address (NEXTAUTH_URL
  * stuck at :3000 while `next dev` runs on :3001). With no Host header at all,
- * the configured URLs as before.
+ * the configured URLs as before. NEXTAUTH_URL is read as configured, never as
+ * the auth route rewrote it from a request (configured-nextauth-url.ts).
  */
 const WEBHOOK_BASE_URL_CODE = `function __isLoopbackHost(host) {
   var name = String(host || '').replace(/:[0-9]+$/, '').toLowerCase();
@@ -29,20 +32,22 @@ function __webhookBaseUrl(req) {
   var headers = (req && req.headers) || {};
   var host = headers.host || '';
   if (!host) {
-    var envBaseUrl = process.env.NEXTAUTH_URL || process.env.VERCEL_URL || '';
+    var envBaseUrl = ${CONFIGURED_NEXTAUTH_URL_EXPRESSION} || process.env.VERCEL_URL || '';
     if (envBaseUrl && !envBaseUrl.startsWith('http')) envBaseUrl = 'https://' + envBaseUrl;
     return envBaseUrl || 'http://localhost:3000';
   }
   var proto = headers['x-forwarded-proto'] || (__isLoopbackHost(host) ? 'http' : 'https');
   var requestOrigin = String(proto).split(',')[0].trim() + '://' + host;
   if (process.env.VERCEL) return requestOrigin;
-  var configured = String(process.env.NEXTAUTH_URL || '').trim();
+  var configured = String(${CONFIGURED_NEXTAUTH_URL_EXPRESSION} || '').trim();
   if (!configured) return requestOrigin;
   var origin;
   try { origin = new URL(configured).origin; } catch (e) { return requestOrigin; }
   if (__isLoopbackHost(host) && __isLoopbackHost(new URL(origin).host)) return requestOrigin;
   return origin;
-}`
+}
+
+${generateSelfCallHeadersCode()}`
 
 export const generateStripeWebhookCode = (
   invoiceSettings: UIDLInvoiceSettings | undefined,
@@ -78,7 +83,7 @@ function __stripeSecretKey() {
   return __paymentDrivers.core.credential('stripe', 'secretKey', ['STRIPE_TEST_KEY']);
 }
 ${
-  autoGenerateInvoice || hasOrderNotifications
+  autoGenerateInvoice || hasEcommerce
     ? `
 // Stripe reports money in the currency's smallest unit (JPY has none, KWD a
 // thousandth); the store keeps the major one, converted as its drivers do.
@@ -138,6 +143,23 @@ module.exports = async function handler(req, res) {
         if (session.payment_status !== 'paid' && session.payment_status !== 'no_payment_required') {
           console.log('Checkout session completed, payment not received yet:', session.id);
           break;
+        }${
+          hasEcommerce
+            ? `
+        // A session that took less than its order is due, or another
+        // currency, pays nothing: no paid mark, no invoice, no order email.
+        var sessionCheck = await __checkStripeSession(session);
+        if (!sessionCheck.ok) {
+          console.error('Stripe webhook: checkout ' + session.id + ' does not pay its order: ' + sessionCheck.reason);
+          // The order could not be read: Stripe retries a 500, so a database
+          // blip delays the paid mark instead of losing it.
+          if (sessionCheck.retry) {
+            res.status(500).json({ error: 'Webhook processing failed' });
+            return;
+          }
+          break;
+        }`
+            : ''
         }
         ${
           autoGenerateInvoice
@@ -240,11 +262,69 @@ ${hasOrderNotifications ? generateOrderNotificationWebhookCode() : ''}
 }
 
 function generateEcommerceOrderUpdateCode(): string {
-  // Used ONLY when invoice auto-generation is OFF — when invoices are on,
-  // handleInvoiceGeneration calls __linkInvoiceToOrder which does the same
-  // mark-paid update plus invoice linkage, so this function is skipped to
-  // avoid two writes that race for the row.
+  // handleEcommerceOrderUpdate is used ONLY when invoice auto-generation is
+  // OFF — when invoices are on, handleInvoiceGeneration calls
+  // __linkInvoiceToOrder which does the same mark-paid update plus invoice
+  // linkage, so it is skipped to avoid two writes that race for the row.
+  // __checkStripeSession runs before either, the way the PayPal route's
+  // __checkPaypalCapture does, with the rule the workflow-driven "Process
+  // Payment Webhook" applies (a payment may not take less than is due).
   return `
+// Whether a paid checkout session may pay the store order it names: the order
+// exists and the session took, in the order's currency, at least what the
+// order is due — its total less what a gift card covered. A session that names
+// no store order has nothing to check.
+async function __checkStripeSession(session) {
+  var orderId = session && session.metadata && session.metadata.orderId;
+  if (!orderId) {
+    return { ok: true };
+  }
+  var connStr = process.env.TELEPORT_DB_CONNECTION_STRING || process.env.DATABASE_URL || '';
+  if (!connStr) {
+    return { ok: false, retry: true, reason: 'no database connection to check order ' + orderId + ' against' };
+  }
+  var pg;
+  try {
+    pg = require('pg');
+  } catch (e) {
+    return { ok: false, retry: true, reason: 'the pg module is unavailable to check order ' + orderId };
+  }
+  var client = new pg.Client({ connectionString: connStr, ssl: connStr.indexOf('sslmode=require') !== -1 ? { rejectUnauthorized: false } : undefined });
+  var order = null;
+  try {
+    await client.connect();
+    // gift_card_amount and currency are read through the row's JSON: a store
+    // provisioned before them has no such column.
+    var found = await client.query(
+      "SELECT o.total_amount, COALESCE(to_jsonb(o) ->> 'gift_card_amount', '0') AS gift_card_amount, COALESCE(to_jsonb(o) ->> 'currency', '') AS currency FROM teleport_orders o WHERE o.id::text = $1",
+      [String(orderId)]
+    );
+    order = found && found.rows && found.rows[0] ? found.rows[0] : null;
+  } catch (err) {
+    return { ok: false, retry: true, reason: 'order ' + orderId + ' could not be read (' + (err && err.message) + ')' };
+  } finally {
+    try { await client.end(); } catch (_e) {}
+  }
+  if (!order) {
+    return { ok: false, reason: 'the store has no order ' + orderId };
+  }
+  var paidCurrency = String(session.currency || '').toUpperCase();
+  var orderCurrency = String(order.currency || '').toUpperCase();
+  if (orderCurrency && paidCurrency !== orderCurrency) {
+    return { ok: false, reason: 'the session is in ' + (paidCurrency || 'no currency') + ' and order ' + orderId + ' in ' + orderCurrency };
+  }
+  // Whole cents, so 12.30 - 4.10 compares as 820 and never 8.199999999999999.
+  var due = Math.max(0, Math.round((Number(order.total_amount) - Number(order.gift_card_amount || 0)) * 100));
+  var paid = session.amount_total == null ? NaN : Math.round(__stripeMajor(session.amount_total, session.currency) * 100);
+  if (!isFinite(due) || !isFinite(paid) || paid < due) {
+    return {
+      ok: false,
+      reason: 'the session took ' + (isFinite(paid) ? (paid / 100).toFixed(2) : 'an unknown amount') + ' ' + paidCurrency + ' and order ' + orderId + ' is due ' + (due / 100).toFixed(2),
+    };
+  }
+  return { ok: true };
+}
+
 async function handleEcommerceOrderUpdate(session) {
   try {
     var orderId = session.metadata && session.metadata.orderId;
@@ -281,7 +361,7 @@ async function sendOrderNotification(session, baseUrl) {
     await fetch(resolvedBaseUrl + '/api/ecommerce/order-notification', {
       method: 'POST',
       // The route emails the merchant only for the store's own server code.
-      headers: { 'Content-Type': 'application/json', 'x-internal-data-secret': process.env.NEXTAUTH_SECRET || '' },
+      headers: __selfCallHeaders({ 'Content-Type': 'application/json' }),
       body: JSON.stringify({
         orderId: orderId || session.id,
         customerEmail: session.customer_email || (session.customer_details && session.customer_details.email) || '',
@@ -402,7 +482,7 @@ async function handleInvoiceGeneration(paymentObj, source, baseUrl, stripeSecret
       method: 'POST',
       // The route issues invoices only for the store's own server code, which
       // presents the app secret.
-      headers: { 'Content-Type': 'application/json', 'x-internal-data-secret': process.env.NEXTAUTH_SECRET || '' },
+      headers: __selfCallHeaders({ 'Content-Type': 'application/json' }),
       body: JSON.stringify(invoicePayload),
     });
 
@@ -542,7 +622,7 @@ async function handleStripeInvoicePayment(stripeInvoice, baseUrl) {
       method: 'POST',
       // The route issues invoices only for the store's own server code, which
       // presents the app secret.
-      headers: { 'Content-Type': 'application/json', 'x-internal-data-secret': process.env.NEXTAUTH_SECRET || '' },
+      headers: __selfCallHeaders({ 'Content-Type': 'application/json' }),
       body: JSON.stringify(invoicePayload),
     });
 
@@ -659,7 +739,7 @@ module.exports = async function handler(req, res) {
           await fetch(__baseUrl + '/api/ecommerce/order-notification', {
             method: 'POST',
             // The route emails the merchant only for the store's own server code.
-            headers: { 'Content-Type': 'application/json', 'x-internal-data-secret': process.env.NEXTAUTH_SECRET || '' },
+            headers: __selfCallHeaders({ 'Content-Type': 'application/json' }),
             body: JSON.stringify({
               // The internal order id, so the route can load the order's own
               // lines and the rates they were charged at; the capture id is
@@ -871,7 +951,7 @@ async function handlePaypalInvoiceGeneration(resource, baseUrl) {
       method: 'POST',
       // The route issues invoices only for the store's own server code, which
       // presents the app secret.
-      headers: { 'Content-Type': 'application/json', 'x-internal-data-secret': process.env.NEXTAUTH_SECRET || '' },
+      headers: __selfCallHeaders({ 'Content-Type': 'application/json' }),
       body: JSON.stringify(invoicePayload),
     });
 

package/src/webhook-signature-verification.ts

@@ -93,19 +93,29 @@ function verifyStripeSignature(rawBody, sigHeader, secret) {
 // sandbox verification to the live API, which rejected it.
 export const generatePaypalSignatureVerificationCode = (): string => {
   return `
+// The named variables first, then a NUMBERED copy of the stored name (the
+// editor numbers a re-typed secret: …_CLIENT_ID2), the highest number being
+// the newest. Never any other variable that merely starts with the name.
 function resolvePaypalEnv(candidates, prefix) {
   var env = process.env;
   for (var i = 0; i < candidates.length; i++) {
     var value = candidates[i] ? env[candidates[i]] : '';
     if (value && String(value).length > 0) return String(value);
   }
+  var best = '';
+  var bestNumber = -1;
   var keys = Object.keys(env);
   for (var k = 0; k < keys.length; k++) {
-    if (keys[k].indexOf(prefix) === 0 && env[keys[k]] && String(env[keys[k]]).length > 0) {
-      return String(env[keys[k]]);
+    if (keys[k].indexOf(prefix) !== 0) continue;
+    var suffix = keys[k].slice(prefix.length);
+    if (!/^[0-9]+$/.test(suffix)) continue;
+    var number = parseInt(suffix, 10);
+    if (env[keys[k]] && String(env[keys[k]]).length > 0 && number > bestNumber) {
+      best = String(env[keys[k]]);
+      bestNumber = number;
     }
   }
-  return '';
+  return best;
 }
 
 async function verifyPaypalSignature(req, rawBody, webhookConfig) {

package/src/workflow-auth-generator.ts

@@ -30,7 +30,9 @@ export const ROLE_OF_TOKEN_CODE = `function roleOf(token) {
  * protection + a scan of its graph for user-owned writes), so enforcement is a
  * single local JWT decode — `getToken` reads the session cookie the browser
  * already sends and verifies it with `NEXTAUTH_SECRET`. No DB, no network, no
- * round trip. `next-auth/jwt` is required LAZILY so a project generated without
+ * round trip — except the shared reader's session-stamp check, which reads a
+ * stamped session's account at most once a minute per instance
+ * (`session-revocation-generator.ts`). `next-auth/jwt` is required LAZILY so a project generated without
  * authentication (where the package is absent) never fails to load this file —
  * such projects also carry no protected workflows, so the guard no-ops.
  *
@@ -41,7 +43,7 @@ export const ROLE_OF_TOKEN_CODE = `function roleOf(token) {
  * anonymous, and the page-load workflow answered 401.
  */
 export const generateWorkflowAuthHelperFile = (
-  options: { withSubscriberAccess?: boolean } = {}
+  options: { withSubscriberAccess?: boolean; withSessionRevocation?: boolean } = {}
 ): string => {
   return `'use strict';
 
@@ -52,9 +54,12 @@ export const generateWorkflowAuthHelperFile = (
 // (const __WF_AUTH) computed by the GUI mapper from the protection of the
 // page(s) that trigger the workflow plus a graph scan for user-owned writes.
 
-${generateCommonJsSessionTokenResolverCode()}
+${generateCommonJsSessionTokenResolverCode('../..', {
+  withRevocation: options.withSessionRevocation !== false,
+})}
 function getSessionToken(req) {
-  // Local cookie decode — no DB, no network.
+  // Local cookie decode, then the shared session-stamp check of the reader
+  // (a session revoked by a password change is no session).
   return __tqSessionToken(req);
 }
 

package/src/workflow-component-plugin.ts

@@ -29,7 +29,7 @@ import { WorkflowExecutionEnv } from './types'
 import { getAPIRouteFileName, hasStreamingAINode } from './api-route-generator'
 import { REALTIME_TRIGGER_TYPES, REALTIME_NODE_TYPES } from './graph-utils'
 import { neutraliseIsLoggedInGates } from './is-logged-in-gate'
-import { formControlPropertyReads } from './trigger-generator'
+import { TRACK_LEAD_SOURCE, formControlPropertyReads } from './trigger-generator'
 import { elementVisibleObserverCode } from './element-visible-trigger'
 import { restoreControlledSelectValue } from './controlled-select'
 import { resolveScrollPoint } from './scroll-points'
@@ -1816,6 +1816,11 @@ function __createWorkflowHandlers(stateSetters, stateTypes, stateValuesRef) {
 
   function __execWf(config, triggerContext, serverUrls) {
     triggerContext.__stateValues = Object.assign({}, stateValuesRef.current);
+    // The analytics ids of the visit, so a server segment reporting an
+    // outcome (an order, a booking) can attribute it to this session.
+    triggerContext.__tpa = typeof window !== 'undefined' && window.tpAnalytics && typeof window.tpAnalytics.ids === 'function'
+      ? window.tpAnalytics.ids()
+      : null;
     // Route context for {{urlDifferentiator}} / {{Current Page Entity.id}}
     // template tokens in node configs — resolved by the shared runtime's
     // resolveTemplateTokenString. Read at call time (not render time) so the
@@ -1978,7 +1983,12 @@ const generateElementHandler = (et: ElementTriggerInfo): string => {
         `    const fd = new FormData(event.target);\n` +
         `    fd.forEach(function(v, k) { formData[k] = v; });\n` +
         `    const triggerContext = Object.assign({}, formData, { fields: formData, formData: formData, formId: '${elementId}', triggerElement: event.target, element: event.target, timestamp: Date.now() });\n` +
-        `    return __execWf(__wfConfig_${safeId}, triggerContext, __wfServerUrls_${safeId});\n` +
+        // Growth analytics: a form whose workflow ran to the end is a lead.
+        // __execWf resolves undefined when the run threw, so only a finished
+        // run reports.
+        `    return __execWf(__wfConfig_${safeId}, triggerContext, __wfServerUrls_${safeId}).then(function(ctx) { if (ctx) { ${TRACK_LEAD_SOURCE(
+          elementId
+        )} } return ctx; });\n` +
         `  }`
       )
     }
@@ -2737,7 +2747,7 @@ const generateRealtimeSubscribeCode = (
         `            const pd = presenceMessage.data || {};\n` +
         `            const triggerContext = {\n` +
         `              channelName: '${channelName}',\n` +
-        `              userId: pd.userId || presenceMessage.clientId || '',\n` +
+        `              userId: presenceMessage.clientId || pd.userId || '',\n` +
         `              userName: pd.userName || '',\n` +
         `              userData: pd.userData || null,\n` +
         `              timestamp: presenceMessage.timestamp || Date.now()\n` +
@@ -2752,7 +2762,7 @@ const generateRealtimeSubscribeCode = (
         `            const pd = presenceMessage.data || {};\n` +
         `            const triggerContext = {\n` +
         `              channelName: '${channelName}',\n` +
-        `              userId: pd.userId || presenceMessage.clientId || '',\n` +
+        `              userId: presenceMessage.clientId || pd.userId || '',\n` +
         `              userName: pd.userName || '',\n` +
         `              timestamp: presenceMessage.timestamp || Date.now()\n` +
         `            };\n` +