@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/__tests__/security-lists-parity.test.ts

@@ -0,0 +1,245 @@
+import * as fs from 'fs'
+import * as path from 'path'
+import * as ts from 'typescript'
+import {
+  PROTECTED_ENV_NAMES,
+  PROTECTED_ENV_NAME_PATTERN,
+  PLATFORM_ENV_NAME_PATTERN,
+  INTEGRATION_ENV_NAME_PATTERN,
+  SANDBOX_ESCAPE_PATTERNS,
+} from '../src/security-scanner'
+import { generalCustomJs } from '../src/nodes/general/general-custom-js'
+
+/**
+ * The custom-JS security lists are kept in several copies, one per checkpoint:
+ * the editor (teleport-gui `workflow-schema`), the publish gate
+ * (teleport-services-worker), the codegen gate (`security-scanner.ts`) and the
+ * runtime `process` shadow inlined in the custom-JS handler. A name or a
+ * pattern added to one and not the others is a hole at that checkpoint, so
+ * this spec reads every copy by path and fails when they drift. It also holds
+ * the rule that every secret TeleportHQ keeps for the site (the system-managed
+ * list, GUI and worker) is protected from custom JS.
+ *
+ * The GUI and worker copies are read from the sibling checkouts
+ * (`<workspace>/teleport-gui`, `<workspace>/teleport-services-worker`). A
+ * checkout of this repository alone skips those comparisons, saying so; in a
+ * checkout that has the sibling, a copy that is not where this spec looks
+ * fails ("copy not found at <path>") — a moved copy is never left unchecked.
+ */
+
+const WORKSPACE = path.resolve(__dirname, '..', '..', '..', '..')
+const GUI = path.join(WORKSPACE, 'teleport-gui')
+const WORKER = path.join(WORKSPACE, 'teleport-services-worker')
+
+const GUI_FILES = {
+  protectedNames: path.join(GUI, 'packages/workflow-schema/src/security/protected-env-names.ts'),
+  sandboxEscapes: path.join(
+    GUI,
+    'packages/workflow-schema/src/security/sandbox-escape-patterns.ts'
+  ),
+  systemManaged: path.join(GUI, 'apps/gui/app/utils/string.ts'),
+  platformInternal: path.join(GUI, 'apps/gui/app/utils/platform-internal-secrets.ts'),
+}
+const WORKER_FILES = {
+  protectedNames: path.join(WORKER, 'src/modules/vercel/security/protected-env-names.ts'),
+  sandboxEscapes: path.join(WORKER, 'src/modules/vercel/security/sandbox-escape-patterns.ts'),
+  systemManaged: path.join(WORKER, 'src/api/middlewares/system-managed-secrets.ts'),
+  platformInternal: path.join(WORKER, 'src/modules/project/platform-internal-secrets.ts'),
+}
+
+/** Whether a sibling repository is checked out: its root, not any one file. */
+const isCheckedOut = (root: string): boolean => fs.existsSync(path.join(root, 'package.json'))
+
+/** A repository's copies, or — only when the repository is absent — a skipped describe that says why. */
+const describeCopiesOf = (repo: string, root: string) => {
+  if (isCheckedOut(root)) {
+    return describe
+  }
+  // eslint-disable-next-line no-console
+  console.warn(
+    `[security-lists-parity] SKIPPED the ${repo} copies: ${root} is not checked out next to ` +
+      'teleport-code-generators.'
+  )
+  return describe.skip
+}
+
+/**
+ * Evaluates a TypeScript source file for its exported constants. The files
+ * read here import types only (or modules their functions use when called,
+ * which these checks never do), so every require answers an empty module.
+ */
+const loadTs = (file: string): Record<string, any> => {
+  if (!fs.existsSync(file)) {
+    throw new Error(`copy not found at ${file}`)
+  }
+  const { outputText } = ts.transpileModule(fs.readFileSync(file, 'utf8'), {
+    compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2019 },
+  })
+  const module = { exports: {} as Record<string, any> }
+  // eslint-disable-next-line no-new-func
+  new Function('module', 'exports', 'require', outputText)(module, module.exports, () => ({}))
+  return module.exports
+}
+
+const describePatterns = (
+  patterns: ReadonlyArray<{ ruleId: string; message: string; pattern: RegExp }>
+) =>
+  patterns.map(({ ruleId, message, pattern }) => ({
+    ruleId,
+    message,
+    source: pattern.source,
+    flags: pattern.flags,
+  }))
+
+/** A pattern as it matches: a flag (`g` keeps state between tests, `i` widens) is drift too. */
+const patternOf = (pattern: RegExp) => ({ source: pattern.source, flags: pattern.flags })
+
+const CODEGEN = {
+  names: [...PROTECTED_ENV_NAMES],
+  pattern: patternOf(PROTECTED_ENV_NAME_PATTERN),
+  platformPattern: patternOf(PLATFORM_ENV_NAME_PATTERN),
+  integrationPattern: patternOf(INTEGRATION_ENV_NAME_PATTERN),
+  escapes: describePatterns(SANDBOX_ESCAPE_PATTERNS),
+}
+
+/**
+ * The names the integrations store (and look-alikes that are not theirs), to
+ * hold the custom-JS rule to the rule that decides which stored secrets are an
+ * integration's (`platform-internal-secrets.ts`, worker and GUI).
+ */
+const INTEGRATION_NAME_SAMPLES = [
+  '__gsc_access',
+  '__gsc_refresh',
+  '__gsc_keyword_audit',
+  '__google_merchant_refresh',
+  '__social_oauth_linkedin_access',
+  '__social_oauth_instagram_story_refresh',
+  'MAILCHIMP_API_KEY',
+  'MY__KEY',
+  '_single',
+  'gsc_access',
+]
+
+/** The custom-JS rule and a copy's `isPlatformInternalSecretName` agree on every sample. */
+const expectIntegrationRuleMatches = (file: string) => {
+  const isInternal = loadTs(file).isPlatformInternalSecretName as (name: string) => boolean
+  expect(INTEGRATION_NAME_SAMPLES.filter(isInternal)).toEqual(
+    INTEGRATION_NAME_SAMPLES.filter((name) => INTEGRATION_ENV_NAME_PATTERN.test(name))
+  )
+  expect(INTEGRATION_NAME_SAMPLES.filter(isInternal)).toHaveLength(6)
+}
+
+/** The shadow's regex literal named `name`, as `{ source, flags }`. */
+const shadowPatternOf = (handler: string, name: string) => {
+  const literal = new RegExp(`var ${name} = /(.+)/([a-z]*);`).exec(handler)
+  return literal ? { source: literal[1], flags: literal[2] } : null
+}
+
+/** Protected in custom JS: by name, or by the TELEPORT_DB_ rule. */
+const isProtectedPlatformName = (name: string): boolean =>
+  CODEGEN.names.indexOf(name as (typeof CODEGEN.names)[number]) !== -1 ||
+  PLATFORM_ENV_NAME_PATTERN.test(name)
+
+describe('the runtime process shadow in general-custom-js', () => {
+  const handler = generalCustomJs.generateHandler()
+  const start = handler.indexOf('var __TQ_PROTECTED = {')
+  const end = handler.indexOf('var __TQ_PROTECTED_RE')
+
+  it('hides exactly the protected names', () => {
+    expect(start).toBeGreaterThan(-1)
+    expect(end).toBeGreaterThan(start)
+    const shadowed = (handler.slice(start, end).match(/"[A-Z][A-Z0-9_]*":1/g) || []).map((entry) =>
+      entry.slice(1, entry.indexOf('"', 1))
+    )
+    expect(shadowed).toEqual(CODEGEN.names)
+  })
+
+  it('hides the payment credentials by the same pattern, with no flags', () => {
+    expect(CODEGEN.pattern.flags).toBe('')
+    expect(shadowPatternOf(handler, '__TQ_PROTECTED_RE')).toEqual(CODEGEN.pattern)
+  })
+
+  it('hides every TELEPORT_DB_ name by the same rule, with no flags', () => {
+    expect(CODEGEN.platformPattern.flags).toBe('')
+    expect(shadowPatternOf(handler, '__TQ_PROTECTED_PLATFORM_RE')).toEqual(CODEGEN.platformPattern)
+  })
+
+  it("hides every integration's __ name by the same rule, with no flags", () => {
+    expect(CODEGEN.integrationPattern.flags).toBe('')
+    expect(shadowPatternOf(handler, '__TQ_PROTECTED_INTEGRATION_RE')).toEqual(
+      CODEGEN.integrationPattern
+    )
+    expect(handler).toContain('__TQ_PROTECTED_INTEGRATION_RE.test(k)')
+  })
+})
+
+describeCopiesOf('teleport-gui', GUI)('the editor copies (teleport-gui)', () => {
+  it('protect the same env names and credential pattern', () => {
+    const copy = loadTs(GUI_FILES.protectedNames)
+    expect([...copy.PROTECTED_ENV_NAMES]).toEqual(CODEGEN.names)
+    expect(patternOf(copy.PROTECTED_ENV_NAME_PATTERN)).toEqual(CODEGEN.pattern)
+    expect(patternOf(copy.PLATFORM_ENV_NAME_PATTERN)).toEqual(CODEGEN.platformPattern)
+    expect(patternOf(copy.INTEGRATION_ENV_NAME_PATTERN)).toEqual(CODEGEN.integrationPattern)
+  })
+
+  it("protect exactly the names the editor treats as an integration's", () => {
+    expectIntegrationRuleMatches(GUI_FILES.platformInternal)
+  })
+
+  it('protect every secret name the editor reserves for the platform database', () => {
+    const reserved: string[] = Array.from(loadTs(GUI_FILES.systemManaged).RESERVED_SECRET_NAMES)
+    expect(reserved.length).toBeGreaterThan(0)
+    expect(reserved.filter((name) => !isProtectedPlatformName(name))).toEqual([])
+  })
+
+  it('refuse the same sandbox escapes', () => {
+    expect(describePatterns(loadTs(GUI_FILES.sandboxEscapes).SANDBOX_ESCAPE_PATTERNS)).toEqual(
+      CODEGEN.escapes
+    )
+  })
+
+  it('protect every secret the editor lists as system-managed', () => {
+    const managed: string[] = Array.from(
+      loadTs(GUI_FILES.systemManaged).SYSTEM_MANAGED_SECRET_NAMES
+    )
+    expect(managed.length).toBeGreaterThan(0)
+    expect(CODEGEN.names).toEqual(expect.arrayContaining(managed))
+  })
+})
+
+describeCopiesOf('teleport-services-worker', WORKER)(
+  'the publish gate copies (teleport-services-worker)',
+  () => {
+    it('protect the same env names and credential pattern', () => {
+      const copy = loadTs(WORKER_FILES.protectedNames)
+      expect([...copy.PROTECTED_ENV_NAMES]).toEqual(CODEGEN.names)
+      expect(patternOf(copy.PROTECTED_ENV_NAME_PATTERN)).toEqual(CODEGEN.pattern)
+      expect(patternOf(copy.PLATFORM_ENV_NAME_PATTERN)).toEqual(CODEGEN.platformPattern)
+      expect(patternOf(copy.INTEGRATION_ENV_NAME_PATTERN)).toEqual(CODEGEN.integrationPattern)
+    })
+
+    it("protect exactly the names the worker treats as an integration's", () => {
+      expectIntegrationRuleMatches(WORKER_FILES.platformInternal)
+    })
+
+    it('refuse the same sandbox escapes', () => {
+      expect(describePatterns(loadTs(WORKER_FILES.sandboxEscapes).SANDBOX_ESCAPE_PATTERNS)).toEqual(
+        CODEGEN.escapes
+      )
+    })
+
+    it('protect every secret the worker keeps as system-managed', () => {
+      const managed: string[] = Array.from(
+        loadTs(WORKER_FILES.systemManaged).SYSTEM_MANAGED_SECRET_NAMES
+      )
+      expect(managed.length).toBeGreaterThan(0)
+      expect(CODEGEN.names).toEqual(expect.arrayContaining(managed))
+      // The editor shows the same names read-only.
+      if (isCheckedOut(GUI)) {
+        expect([...managed].sort()).toEqual(
+          Array.from(loadTs(GUI_FILES.systemManaged).SYSTEM_MANAGED_SECRET_NAMES).sort()
+        )
+      }
+    })
+  }
+)

package/__tests__/security-runtime-shadow.test.ts

@@ -1,11 +1,31 @@
 import { loadHandler } from './_helpers/load-handler'
 import {
   assertWorkflowsAreSecure,
+  foldStringConcatenations,
   CodegenSecurityError,
   PROTECTED_ENV_NAMES,
   PROTECTED_ENV_NAME_PATTERN,
+  PLATFORM_ENV_NAME_PATTERN,
 } from '../src/security-scanner'
 
+const SITE_SECRETS = [
+  'NEXTAUTH_SECRET',
+  'AUTH_PEPPER_SECRET',
+  'VERCEL_AUTOMATION_BYPASS_SECRET',
+  'TQ_CACHE_SECRET',
+]
+
+// The TeleportHQ database's parts, and one no copy lists by name (any later one).
+const DATABASE_SECRETS = [
+  'TELEPORT_DB_HOST',
+  'TELEPORT_DB_PORT',
+  'TELEPORT_DB_USER',
+  'TELEPORT_DB_PASSWORD',
+  'TELEPORT_DB_NAME',
+  'TELEPORT_DB_SSL',
+  'TELEPORT_DB_REPLICA_URL',
+]
+
 // Verifies the two security layers added on top of the general-custom-js
 // handler:
 //
@@ -124,6 +144,41 @@ describe('assertWorkflowsAreSecure (codegen gate)', () => {
     }
   })
 
+  it('refuses custom JS that reads any TELEPORT_DB_ name', () => {
+    for (const name of DATABASE_SECRETS) {
+      for (const read of [`process.env.${name}`, `process.env['${name}']`]) {
+        const uidlWorkflows = {
+          workflows: {
+            w: {
+              nodes: [
+                {
+                  id: 'a',
+                  type: 'general-custom-js',
+                  config: { code: `function customHandler(){ return ${read}; }` },
+                },
+              ],
+            },
+          },
+        }
+        expect(() => assertWorkflowsAreSecure(uidlWorkflows)).toThrowError(CodegenSecurityError)
+      }
+    }
+  })
+
+  it('the TELEPORT_DB_ rule covers the whole family and nothing else', () => {
+    for (const name of [...DATABASE_SECRETS, 'TELEPORT_DB_CONNECTION_STRING']) {
+      expect(PLATFORM_ENV_NAME_PATTERN.test(name)).toBe(true)
+    }
+    for (const name of [
+      'TELEPORT_DB_',
+      'MY_TELEPORT_DB_PASSWORD',
+      'TELEPORT_DBX',
+      'teleport_db_host',
+    ]) {
+      expect(PLATFORM_ENV_NAME_PATTERN.test(name)).toBe(false)
+    }
+  })
+
   it('the payment credential pattern covers every provider and nothing else', () => {
     for (const name of [
       'STRIPE_WEBHOOK_SECRET',
@@ -145,7 +200,7 @@ describe('assertWorkflowsAreSecure (codegen gate)', () => {
     }
   })
 
-  it('PROTECTED_ENV_NAMES contains exactly the 11 documented secrets', () => {
+  it('PROTECTED_ENV_NAMES contains exactly the 17 documented secrets', () => {
     expect([...PROTECTED_ENV_NAMES].sort()).toEqual(
       [
         'PDF_SERVICE_API_KEY',
@@ -158,11 +213,43 @@ describe('assertWorkflowsAreSecure (codegen gate)', () => {
         'TELEPORT_CRON_SECRET_PREVIOUS',
         'TELEPORT_DB_CONNECTION_STRING',
         'TELEPORT_PROJECT_TOKEN',
+        'NEXTAUTH_SECRET',
+        'AUTH_PEPPER_SECRET',
+        'VERCEL_AUTOMATION_BYPASS_SECRET',
+        'TQ_CACHE_SECRET',
+        // The site's newsletter service key and the services worker's address
+        // (the admin panel's newsletter route reads them, nothing else).
+        'NEWSLETTER_SERVICE_TOKEN',
+        'NEWSLETTER_SERVICE_URL',
         'TELEPORT_WALL_SECRET',
       ].sort()
     )
   })
 
+  // The secrets TeleportHQ keeps for the site: the app secret every guard of
+  // the site rests on, the password pepper, the deployment-protection bypass
+  // and the cache-revalidation key.
+  it('refuses custom JS that reads a site secret TeleportHQ keeps', () => {
+    for (const name of SITE_SECRETS) {
+      for (const read of [`process.env.${name}`, `process.env['${name}']`]) {
+        const uidlWorkflows = {
+          workflows: {
+            w: {
+              nodes: [
+                {
+                  id: 'a',
+                  type: 'general-custom-js',
+                  config: { code: `function customHandler(){ return ${read}; }` },
+                },
+              ],
+            },
+          },
+        }
+        expect(() => assertWorkflowsAreSecure(uidlWorkflows)).toThrowError(CodegenSecurityError)
+      }
+    }
+  })
+
   it('refuses custom JS that reads a cron signing key', () => {
     for (const name of ['TELEPORT_CRON_SECRET', 'TELEPORT_CRON_SECRET_PREVIOUS']) {
       const uidlWorkflows = {
@@ -181,6 +268,49 @@ describe('assertWorkflowsAreSecure (codegen gate)', () => {
       expect(() => assertWorkflowsAreSecure(uidlWorkflows)).toThrowError(CodegenSecurityError)
     }
   })
+
+  // The bypasses the deploy-time scanner let through (A8-18): each reaches the
+  // real global scope or process.env past the runtime's process shadow.
+  const withCode = (code: string) => ({
+    workflows: { w: { nodes: [{ id: 'a', type: 'general-custom-js', config: { code } }] } },
+  })
+
+  it('refuses the function-constructor and descriptor escapes', () => {
+    const escapes = [
+      "return (function(){}).constructor('return proc' + 'ess')().env",
+      "return Function.prototype.constructor('return this')().process.env",
+      "return (async function(){}).constructor('return 1')",
+      "return [].map['constructor']('return this')()",
+      "return Object.getOwnPropertyDescriptor(process, 'env').value",
+      "return Reflect.get(process, 'env')",
+      'return Object.values(globalThis).find(function (v) { return v && v.env && v.pid })',
+      'for (var k in globalThis) { if (globalThis[k] && globalThis[k].pid) return globalThis[k] }',
+      // The variants of the same class (fix round 1).
+      "var C = (function(){}).constructor; return C('return process')().env",
+      "return (function(){}).constructor.call(null, 'return process')().env",
+      "return (() => {}).constructor.apply(null, ['return process'])().env",
+      "const { constructor: F } = () => {}; return F('return process')().env",
+      "return (function(){})['const' + 'ructor']('return process')().env",
+      "return (function(){ return this })().process.env['TELEPORT_DB_' + 'CONNECTION_STRING']",
+    ]
+    for (const code of escapes) {
+      expect(() =>
+        assertWorkflowsAreSecure(withCode(`function customHandler(){ ${code} }`))
+      ).toThrowError(CodegenSecurityError)
+    }
+  })
+
+  it('still passes code that only compares a constructor or reads its name', () => {
+    const code =
+      'function customHandler(p){ var v = p[0]; var kind = v && v.constructor.name; ' +
+      'return v && v.constructor === Object ? Object.keys(v).concat([kind]) : [] }'
+    expect(() => assertWorkflowsAreSecure(withCode(code))).not.toThrow()
+  })
+
+  it('matches a name split across string literals as the whole name', () => {
+    expect(foldStringConcatenations("x['const' + 'ruc' + \"tor\"]")).toBe("x['constructor']")
+    expect(foldStringConcatenations("a + 'b' + c")).toBe("a + 'b' + c")
+  })
 })
 
 describe('general-custom-js handler — runtime process shadow', () => {
@@ -197,6 +327,12 @@ describe('general-custom-js handler — runtime process shadow', () => {
     process.env.CONFIGURATION_PAYPAL_CLIENT_SECRET2 = 'paypal-secret'
     process.env.TELEPORT_CRON_SECRET = 'cron-key'
     process.env.TELEPORT_CRON_SECRET_PREVIOUS = 'old-cron-key'
+    for (const name of SITE_SECRETS) {
+      process.env[name] = 'site-secret-' + name
+    }
+    for (const name of DATABASE_SECRETS) {
+      process.env[name] = 'database-secret-' + name
+    }
   })
   afterAll(() => {
     // Restore exactly what was there.
@@ -268,6 +404,63 @@ describe('general-custom-js handler — runtime process shadow', () => {
     expect(out).toEqual({ current: undefined, previous: undefined, listed: [] })
   })
 
+  it('hides the site secrets TeleportHQ keeps, by name and from every enumeration', async () => {
+    const code = `function customHandler(){
+      var names = ${JSON.stringify(SITE_SECRETS)};
+      return {
+        dotted: [process.env.NEXTAUTH_SECRET, process.env.AUTH_PEPPER_SECRET,
+          process.env.VERCEL_AUTOMATION_BYPASS_SECRET, process.env.TQ_CACHE_SECRET],
+        bracketed: names.map(function (n) { return process.env[n]; }),
+        viaGlobal: names.map(function (n) { return globalThis.process.env[n]; }),
+        has: names.filter(function (n) { return n in process.env; }),
+        described: names.map(function (n) { return Object.getOwnPropertyDescriptor(process.env, n); }),
+        listed: Object.keys(process.env).filter(function (k) { return names.indexOf(k) !== -1; }),
+        spread: Object.keys({ ...process.env }).filter(function (k) { return names.indexOf(k) !== -1; }),
+        allowed: process.env.PUBLIC_FEATURE_FLAG,
+      }
+    }`
+    const out = (await handler({ code, __nodeId: 'a' }, {})) as Record<string, unknown>
+    const none = SITE_SECRETS.map(() => undefined)
+    expect(out).toEqual({
+      dotted: none,
+      bracketed: none,
+      viaGlobal: none,
+      has: [],
+      described: none,
+      listed: [],
+      spread: [],
+      allowed: 'allowed',
+    })
+    expect(JSON.stringify(out)).not.toContain('site-secret-')
+  })
+
+  it('hides every TELEPORT_DB_ name, by name and from every enumeration', async () => {
+    const code = `function customHandler(){
+      var names = ${JSON.stringify(DATABASE_SECRETS)};
+      return {
+        dotted: process.env.TELEPORT_DB_PASSWORD,
+        bracketed: names.map(function (n) { return process.env[n]; }),
+        has: names.filter(function (n) { return n in process.env; }),
+        described: names.map(function (n) { return Object.getOwnPropertyDescriptor(process.env, n); }),
+        listed: Object.keys(process.env).filter(function (k) { return k.indexOf('TELEPORT_DB_') === 0; }),
+        spread: Object.keys({ ...process.env }).filter(function (k) { return k.indexOf('TELEPORT_DB_') === 0; }),
+        allowed: process.env.PUBLIC_FEATURE_FLAG,
+      }
+    }`
+    const out = (await handler({ code, __nodeId: 'a' }, {})) as Record<string, unknown>
+    const none = DATABASE_SECRETS.map(() => undefined)
+    expect(out).toEqual({
+      dotted: undefined,
+      bracketed: none,
+      has: [],
+      described: none,
+      listed: [],
+      spread: [],
+      allowed: 'allowed',
+    })
+    expect(JSON.stringify(out)).not.toContain('database-secret-')
+  })
+
   it('hides the merchant payment credentials from user code', async () => {
     const code = `function customHandler(){
       return {
@@ -288,6 +481,36 @@ describe('general-custom-js handler — runtime process shadow', () => {
     })
   })
 
+  it('runs server code in strict mode: a plain call gets no global this', async () => {
+    const code = `function customHandler(){
+      var self = (function(){ return this })();
+      return { selfIsUndefined: self === undefined };
+    }`
+    expect(await handler({ code, __nodeId: 'n' }, {})).toEqual({ selfIsUndefined: true })
+    const escape = `function customHandler(){
+      return (function(){ return this })().process.env.TELEPORT_DB_CONNECTION_STRING;
+    }`
+    const result = (await handler({ code: escape, __nodeId: 'n' }, {})) as { error?: string }
+    expect(result.error).toMatch(/undefined/)
+    expect(JSON.stringify(result)).not.toContain('secret-db-url')
+  })
+
+  it('keeps a handler with a default parameter working under strict mode', async () => {
+    const code = `function customHandler(params = []) {
+      return { count: params.length, strict: (function(){ return this })() === undefined };
+    }`
+    expect(await handler({ code, __nodeId: 'n' }, { a: 1, b: 2 })).toEqual({
+      count: 2,
+      strict: true,
+    })
+    // A destructured signature still compiles and runs under strict mode (its
+    // values are not forwarded by name — they never were).
+    const destructured = `function customHandler({ items } = {}) {
+      return { ran: true };
+    }`
+    expect(await handler({ code: destructured, __nodeId: 'n' }, { a: 1 })).toEqual({ ran: true })
+  })
+
   it('does not break access to non-process bindings', async () => {
     const code = `function customHandler(){
       return 1 + 2;