@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/__tests__/resolve-config-template-params.test.ts

@@ -163,9 +163,9 @@ describe('the server-segment route reaches the fill', () => {
     'Submit Withdrawal'
   )
 
-  it('routes the node config through the shared resolveConfig', () => {
-    expect(route).toContain('const resolveConfig = utils.resolveConfig')
-    expect(route).toContain('resolveConfig(node.config, context)')
+  it('routes the node config through the shared resolveConfig (by resolveNodeConfig)', () => {
+    expect(route).toContain('const resolveNodeConfig = utils.resolveNodeConfig')
+    expect(route).toContain('resolveNodeConfig(node, context)')
   })
 
   it('carries no private copy of the fill that could drift', () => {

package/__tests__/runtime-storage-upload-access.test.ts

@@ -1,8 +1,12 @@
 /* tslint:disable:function-constructor */
 import { Readable } from 'stream'
 import {
+  SITE_VISITOR_FILES_PER_DAY,
+  UPLOAD_ACCESS_HEADER,
   VISITOR_MAX_FILE_BYTES,
   VISITOR_MAX_FILES,
+  VISITOR_UPLOAD_LIMITS,
+  VISITOR_UPLOAD_MB_PER_DAY,
   generateRuntimeStorageUploadRoute,
 } from '../src/runtime-storage-generator'
 import { AbortControllerStub } from './_helpers/abort-controller-stub'
@@ -33,9 +37,12 @@ interface Part {
   filename?: string
   type?: string
   data: Buffer | string
+  // The part's raw header lines, replacing the quoted disposition built from
+  // name/filename (an unquoted or RFC 5987 filename, a folded header…).
+  rawHeaders?: string[]
 }
 
-function multipart(parts: Part[]): Buffer {
+function multipart(parts: Part[], boundary = BOUNDARY): Buffer {
   const chunks: Buffer[] = []
   for (const part of parts) {
     const disposition =
@@ -43,30 +50,65 @@ function multipart(parts: Part[]): Buffer {
       part.name +
       '"' +
       (part.filename !== undefined ? '; filename="' + part.filename + '"' : '')
-    const header =
-      '--' +
-      BOUNDARY +
-      '\r\n' +
-      disposition +
-      '\r\n' +
-      (part.type ? 'Content-Type: ' + part.type + '\r\n' : '') +
-      '\r\n'
+    const lines = part.rawHeaders || [
+      disposition,
+      ...(part.type ? ['Content-Type: ' + part.type] : []),
+    ]
+    const header = '--' + boundary + '\r\n' + lines.map((line) => line + '\r\n').join('') + '\r\n'
     chunks.push(Buffer.from(header), Buffer.from(part.data), Buffer.from('\r\n'))
   }
-  chunks.push(Buffer.from('--' + BOUNDARY + '--\r\n'))
+  chunks.push(Buffer.from('--' + boundary + '--\r\n'))
   return Buffer.concat(chunks)
 }
 
+/** The parts of a form as the forwarded body spells them: raw header text + data. */
+function forwardedParts(body: Buffer, contentType: string): Array<{ head: string; data: string }> {
+  const boundary = /boundary=(.+)$/.exec(contentType)![1]
+  return body
+    .toString('latin1')
+    .split('--' + boundary)
+    .slice(1, -1)
+    .map((chunk) => {
+      const end = chunk.indexOf('\r\n\r\n')
+      return { head: chunk.slice(2, end), data: chunk.slice(end + 4, -2) }
+    })
+}
+
 interface Upstream {
   url: string
   headers: Record<string, string>
   body: unknown
 }
 
-function bootRoute(session: { role?: string } | null) {
+interface LimitCall {
+  scope?: string
+  key?: string
+  limit: number
+  windowSeconds: number
+}
+
+function bootRoute(session: { role?: string } | null, refuseScope?: string) {
   const code = generateRuntimeStorageUploadRoute()
   const moduleObj: { exports: any } = { exports: {} }
+  const limitCalls: LimitCall[] = []
+  const security = {
+    rateLimitRequest: async (_req: unknown, res: any, options: LimitCall) => {
+      limitCalls.push(options)
+      if (options.scope === refuseScope) {
+        res.status(429).json({ error: 'Too many requests. Try again later.' })
+        return false
+      }
+      return true
+    },
+    rateLimit: async (options: LimitCall) => {
+      limitCalls.push(options)
+      return { allowed: options.key !== refuseScope, retryAfter: 60 }
+    },
+  }
   const fakeRequire = (name: string): any => {
+    if (name === '../../../utils/security-runtime') {
+      return security
+    }
     if (name === 'next-auth/jwt') {
       return { getToken: async () => (session ? { sub: 'u1', role: session.role } : null) }
     }
@@ -112,6 +154,7 @@ function bootRoute(session: { role?: string } | null) {
   const handler = moduleObj.exports
   return async (body: Buffer, headers: Record<string, string> = {}) => {
     upstream.length = 0
+    limitCalls.length = 0
     const req = Object.assign(Readable.from([body]), {
       method: 'POST',
       headers: {
@@ -132,14 +175,15 @@ function bootRoute(session: { role?: string } | null) {
         payload = value
         return res
       },
+      setHeader: (): void => undefined,
     }
     await handler(req, res)
-    return { status, payload, upstream: upstream.slice() }
+    return { status, payload, upstream: upstream.slice(), limits: limitCalls.slice() }
   }
 }
 
 describe('/api/runtime-storage/upload — what a visitor may store', () => {
-  it('forwards a visitor’s images and PDFs, byte for byte', async () => {
+  it('forwards a visitor’s images and PDFs as the form it checked, marked as a visitor’s', async () => {
     const upload = bootRoute(null)
     const body = multipart([
       { name: 'file', filename: 'photo.png', type: 'image/png', data: PNG },
@@ -150,10 +194,223 @@ describe('/api/runtime-storage/upload — what a visitor may store', () => {
     const result = await upload(body)
     expect(result.status).toBe(200)
     expect(result.upstream).toHaveLength(1)
-    expect(result.upstream[0].url).toBe('https://storage.test/project/p1/upload')
-    expect(Buffer.compare(result.upstream[0].body as Buffer, body)).toBe(0)
-    expect(result.upstream[0].headers['content-length']).toBe(String(body.length))
-    expect(result.upstream[0].headers.Authorization).toBe('Bearer key')
+    const sent = result.upstream[0]
+    expect(sent.url).toBe('https://storage.test/project/p1/upload')
+    expect(sent.headers.Authorization).toBe('Bearer key')
+    expect(sent.headers[UPLOAD_ACCESS_HEADER]).toBe('visitor')
+    // Written afresh under a boundary of the route's own, one quoted
+    // disposition per part, each file typed by its bytes.
+    expect(sent.headers['content-type']).toMatch(
+      /^multipart\/form-data; boundary=----tqupload[0-9a-f]{32}$/
+    )
+    const forwarded = sent.body as Buffer
+    expect(sent.headers['content-length']).toBe(String(forwarded.length))
+    expect(forwardedParts(forwarded, sent.headers['content-type'])).toEqual([
+      {
+        head: 'Content-Disposition: form-data; name="file"; filename="photo.png"\r\nContent-Type: image/png',
+        data: PNG.toString('latin1'),
+      },
+      {
+        head: 'Content-Disposition: form-data; name="file"; filename="photo.jpg"\r\nContent-Type: image/jpeg',
+        data: JPEG.toString('latin1'),
+      },
+      {
+        head: 'Content-Disposition: form-data; name="file"; filename="print.pdf"\r\nContent-Type: application/pdf',
+        data: PDF.toString('latin1'),
+      },
+      { head: 'Content-Disposition: form-data; name="folder"', data: 'product-options' },
+    ])
+  })
+
+  // A8-02: the storage worker's parser (busboy) takes an unquoted or an RFC
+  // 5987 filename as a file. This route used to read only the quoted form, so
+  // such a part passed as a plain field — no type check, no size cap — and
+  // was stored as an HTML page or an SVG at a public URL.
+  it('checks a file whose filename is unquoted or RFC 5987 like any other file', async () => {
+    const upload = bootRoute(null)
+    for (const disposition of [
+      'Content-Disposition: form-data; name="file"; filename=x.html',
+      'Content-Disposition: form-data; name=file; filename=x.html',
+      'Content-Disposition: form-data; name="file"; filename*=UTF-8\'\'x.html',
+      'Content-Disposition: form-data; name="file"; filename="x.png"; filename*=utf-8\'\'x.html',
+    ]) {
+      const result = await upload(
+        multipart([
+          { name: 'file', rawHeaders: [disposition, 'Content-Type: text/html'], data: HTML },
+        ])
+      )
+      expect([disposition, result.status]).toEqual([disposition, 415])
+      expect(result.upstream).toEqual([])
+    }
+  })
+
+  it('takes an unquoted private flag for what it is', async () => {
+    const upload = bootRoute(null)
+    const result = await upload(
+      multipart([
+        { name: 'file', filename: 'a.png', type: 'image/png', data: PNG },
+        {
+          name: 'private',
+          rawHeaders: ['Content-Disposition: form-data; name=private'],
+          data: 'true',
+        },
+      ])
+    )
+    expect(result.status).toBe(403)
+    expect(result.upstream).toEqual([])
+  })
+
+  it('refuses a part two parsers could read differently', async () => {
+    const upload = bootRoute(null)
+    for (const rawHeaders of [
+      // Which disposition counts depends on the parser.
+      [
+        'Content-Disposition: form-data; name="note"',
+        'Content-Disposition: form-data; name="file"; filename="x.html"',
+      ],
+      // A folded line continues the disposition for busboy.
+      ['Content-Disposition: form-data; name="note"', ' ; filename="x.html"'],
+      ['Content-Disposition: attachment; name="file"; filename="x.png"'],
+      ['Content-Disposition: form-data; name="file"; filename="x.png'],
+      ['Content-Type: text/html'],
+    ]) {
+      const result = await upload(multipart([{ name: 'x', rawHeaders, data: HTML }]))
+      expect([rawHeaders, result.status]).toEqual([rawHeaders, 400])
+      expect(result.upstream).toEqual([])
+    }
+  })
+
+  it('forwards an unquoted filename it accepted, quoted and reduced to its base name', async () => {
+    const upload = bootRoute(null)
+    const result = await upload(
+      multipart([
+        {
+          name: 'file',
+          rawHeaders: [
+            "Content-Disposition: form-data; name=file; filename*=UTF-8''..%2Fevil%22.png",
+            'Content-Type: image/png',
+          ],
+          data: PNG,
+        },
+      ])
+    )
+    expect(result.status).toBe(200)
+    const sent = result.upstream[0]
+    expect(forwardedParts(sent.body as Buffer, sent.headers['content-type'])[0].head).toBe(
+      'Content-Disposition: form-data; name="file"; filename="evil_.png"\r\nContent-Type: image/png'
+    )
+  })
+
+  it('limits a visitor’s requests, its bytes per file, and the site’s visitor files', async () => {
+    const upload = bootRoute(null)
+    const threeMb = Buffer.concat([PNG, Buffer.alloc(2 * 1024 * 1024 + 1)])
+    const ok = await upload(
+      multipart([
+        { name: 'file', filename: 'a.png', type: 'image/png', data: PNG },
+        { name: 'file', filename: 'b.png', type: 'image/png', data: threeMb },
+      ])
+    )
+    expect(ok.status).toBe(200)
+    const mb = {
+      scope: 'runtime-storage-upload-mb',
+      limit: VISITOR_UPLOAD_MB_PER_DAY,
+      windowSeconds: 86400,
+    }
+    const siteFile = {
+      key: 'site:visitor-uploads',
+      limit: SITE_VISITOR_FILES_PER_DAY,
+      windowSeconds: 86400,
+    }
+    expect(ok.limits).toEqual([
+      ...VISITOR_UPLOAD_LIMITS.map(([limit, windowSeconds]) => ({
+        scope: 'runtime-storage-upload',
+        limit,
+        windowSeconds,
+      })),
+      // A small file counts 1 MB, a file just over 2 MB counts 3.
+      mb,
+      mb,
+      mb,
+      mb,
+      siteFile,
+      siteFile,
+    ])
+
+    const overBudget = await bootRoute(
+      null,
+      'runtime-storage-upload-mb'
+    )(multipart([{ name: 'file', filename: 'a.png', type: 'image/png', data: PNG }]))
+    expect(overBudget.status).toBe(429)
+    expect(overBudget.upstream).toEqual([])
+
+    const perVisitor = await bootRoute(
+      null,
+      'runtime-storage-upload'
+    )(multipart([{ name: 'file', filename: 'a.png', type: 'image/png', data: PNG }]))
+    expect(perVisitor.status).toBe(429)
+    expect(perVisitor.upstream).toEqual([])
+
+    const perSite = await bootRoute(
+      null,
+      'site:visitor-uploads'
+    )(multipart([{ name: 'file', filename: 'a.png', type: 'image/png', data: PNG }]))
+    expect(perSite.status).toBe(429)
+    expect(perSite.payload.error).toBe('UPLOAD_LIMIT_REACHED')
+    expect(perSite.upstream).toEqual([])
+  })
+
+  it('counts nothing against the visitor’s bytes or the site for a form it refused', async () => {
+    const refused = await bootRoute(null)(
+      multipart([{ name: 'file', filename: 'x.html', type: 'text/html', data: HTML }])
+    )
+    expect(refused.status).toBe(415)
+    expect(refused.limits.map((entry) => entry.scope || entry.key)).toEqual([
+      'runtime-storage-upload',
+      'runtime-storage-upload',
+    ])
+  })
+
+  it('refuses every form of the private flag the storage worker reads', async () => {
+    for (const flag of ['1', 'YES', ' yes ', 'True']) {
+      const result = await bootRoute(null)(
+        multipart([
+          { name: 'file', filename: 'a.png', type: 'image/png', data: PNG },
+          { name: 'private', data: flag },
+        ])
+      )
+      expect([flag, result.status]).toEqual([flag, 403])
+      expect(result.upstream).toEqual([])
+    }
+  })
+
+  it('stores a file under the extension its bytes proved', async () => {
+    for (const [given, stored] of [
+      ['x.html', 'x.png'],
+      ['x.png.html', 'x.png'],
+      ['photo', 'photo.png'],
+      ['shot.PNG', 'shot.PNG'],
+    ]) {
+      const result = await bootRoute(null)(
+        multipart([{ name: 'file', filename: given, type: 'image/png', data: PNG }])
+      )
+      const sent = result.upstream[0]
+      expect([
+        given,
+        forwardedParts(sent.body as Buffer, sent.headers['content-type'])[0].head,
+      ]).toEqual([
+        given,
+        'Content-Disposition: form-data; name="file"; filename="' +
+          stored +
+          '"\r\nContent-Type: image/png',
+      ])
+    }
+    const jpeg = await bootRoute(null)(
+      multipart([{ name: 'file', filename: 'me.jpeg', type: 'image/jpeg', data: JPEG }])
+    )
+    const sentJpeg = jpeg.upstream[0]
+    expect(
+      forwardedParts(sentJpeg.body as Buffer, sentJpeg.headers['content-type'])[0].head
+    ).toContain('filename="me.jpeg"')
   })
 
   it('refuses a file that is not what it claims, an SVG, or a page — by its bytes', async () => {
@@ -240,6 +497,12 @@ describe("/api/runtime-storage/upload — the store's own uploads", () => {
     expect(result.upstream).toHaveLength(1)
     // The request stream itself, not a buffered copy.
     expect(Buffer.isBuffer(result.upstream[0].body)).toBe(false)
+    expect(result.upstream[0].headers[UPLOAD_ACCESS_HEADER]).toBe('trusted')
+    expect(result.upstream[0].headers['content-type']).toBe(
+      'multipart/form-data; boundary=' + BOUNDARY
+    )
+    // The store's own uploads are not counted against visitors.
+    expect(result.limits).toEqual([])
   })
 
   it('serves server code presenting the app secret (the invoice PDF upload)', async () => {

package/__tests__/security-integration-env-names.test.ts

@@ -0,0 +1,74 @@
+import { loadHandler } from './_helpers/load-handler'
+import {
+  assertWorkflowsAreSecure,
+  CodegenSecurityError,
+  INTEGRATION_ENV_NAME_PATTERN,
+} from '../src/security-scanner'
+
+// The integrations keep another member's sign-in in the project's secrets under
+// `__` names (`__gsc_access`, `__google_merchant_refresh`,
+// `__social_oauth_<platform>_*`), and every publish before 2026-10-26 put them
+// in the site's environment. Custom JS may not read them: the codegen gate
+// refuses the obvious reads, the runtime shadow hides them from the rest.
+
+const withCode = (code: string) => ({
+  workflows: { w: { nodes: [{ id: 'a', type: 'general-custom-js', config: { code } }] } },
+})
+
+describe('the codegen gate and integration secrets', () => {
+  it('names every __ env name as protected', () => {
+    expect(INTEGRATION_ENV_NAME_PATTERN.test('__gsc_access')).toBe(true)
+    expect(INTEGRATION_ENV_NAME_PATTERN.test('__social_oauth_instagram_story_refresh')).toBe(true)
+    expect(INTEGRATION_ENV_NAME_PATTERN.test('MY__KEY')).toBe(false)
+    expect(INTEGRATION_ENV_NAME_PATTERN.test('_single')).toBe(false)
+  })
+
+  it.each([
+    'return process.env.__gsc_access',
+    "return process.env['__google_merchant_refresh']",
+    'return process.env["__social_oauth_linkedin_access"]',
+    'var env = process.env; return env . __gsc_refresh',
+  ])('refuses %s', (body) => {
+    expect(() =>
+      assertWorkflowsAreSecure(withCode(`function customHandler(){ ${body} }`))
+    ).toThrowError(CodegenSecurityError)
+  })
+
+  it('still passes code that mentions a __ name anywhere but an env read', () => {
+    const code =
+      'function customHandler(p){ var o = {}; var proto = o.__proto__; ' +
+      'return { proto: !!proto, dir: typeof __dirname, label: "__gsc_access" } }'
+    expect(() => assertWorkflowsAreSecure(withCode(code))).not.toThrow()
+  })
+})
+
+describe('the runtime shadow and integration secrets', () => {
+  const handler = loadHandler('general-custom-js')
+  const ORIGINAL = process.env
+
+  beforeAll(() => {
+    process.env.__gsc_access = 'ya29.leaked'
+    process.env.__social_oauth_x_refresh = 'x-leaked'
+    process.env.PUBLIC_FEATURE_FLAG = 'allowed'
+  })
+  afterAll(() => {
+    process.env = { ...ORIGINAL }
+  })
+
+  it('hides them from a read, a computed read and a key listing', async () => {
+    const code = `function customHandler(){
+      var name = '__social' + '_oauth_x_refresh';
+      return {
+        direct: process.env.__gsc_access,
+        computed: process.env[name],
+        listed: Object.keys(process.env).filter(function (k) { return k.indexOf('__') === 0 }),
+        allowed: process.env.PUBLIC_FEATURE_FLAG,
+      }
+    }`
+    const out = (await handler({ code, __nodeId: 'a' }, {})) as Record<string, unknown>
+    expect(out.direct).toBeUndefined()
+    expect(out.computed).toBeUndefined()
+    expect(out.listed).toEqual([])
+    expect(out.allowed).toBe('allowed')
+  })
+})