@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/dist/cjs/password-reset-route-generator.js

@@ -0,0 +1,460 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emitPasswordAuthFiles = exports.collectWorkflowNodeConfigs = exports.REQUEST_PASSWORD_RESET_NODE_TYPE = exports.AUTH_PEPPER_SECRET_ENV = exports.generateResetPasswordRoute = exports.generateForgotPasswordRoute = exports.TRUSTED_ORIGIN_CODE = exports.resolveResetPagePath = exports.resetEmailSenderOf = exports.resetLinkOf = exports.resetTokenKeeperPagePaths = exports.readsKeptResetToken = exports.RESET_TOKEN_STORAGE_KEY = exports.FORGOT_PASSWORD_ANSWER = exports.DEFAULT_RESET_PAGE_PATH = exports.RESET_PASSWORD_VISITOR_LIMIT = exports.FORGOT_PASSWORD_VISITOR_LIMIT = exports.FORGOT_PASSWORD_RECIPIENT_LIMIT = exports.PASSWORD_RESET_TOKEN_TTL_SECONDS = exports.RESET_PASSWORD_ROUTE_NAME = exports.FORGOT_PASSWORD_ROUTE_NAME = void 0;
+/**
+ * The password-reset routes every project with password sign-in gets:
+ * `pages/api/auth/forgot-password.js` and `pages/api/auth/reset-password.js`.
+ *
+ * Like the account-deletion route, each makes the whole security decision on
+ * the server, in one place. The reset link's token is minted here with a
+ * CSPRNG and never leaves the server except in the email to the account's own
+ * address; only its SHA-256 is stored, bound to the account id, for 30
+ * minutes, and the reset route spends it in the same statement that sets the
+ * password. Nothing a browser sends can name a token, an account or the email
+ * a link goes to — the workflow that used to compose them from browser-relayed
+ * context let anyone set any user's password.
+ *
+ * The forgot route answers the same, in about the same time, whether the
+ * address has an account or not, and writes nothing for an address without
+ * one. The email goes out through the provider and template the project's
+ * `account-request-password-reset` node configures (the same baked-config
+ * pattern as the sign-up welcome email).
+ */
+const teleport_types_1 = require("@teleporthq/teleport-types");
+const transactional_email_code_1 = require("./transactional-email-code");
+const configured_nextauth_url_1 = require("./configured-nextauth-url");
+const security_runtime_code_1 = require("./security-runtime/security-runtime-code");
+const email_locale_1 = require("./email-locale");
+const sent_email_log_1 = require("./sent-email-log");
+exports.FORGOT_PASSWORD_ROUTE_NAME = 'forgot-password';
+exports.RESET_PASSWORD_ROUTE_NAME = 'reset-password';
+/** How long an emailed reset link works. */
+exports.PASSWORD_RESET_TOKEN_TTL_SECONDS = 1800;
+/** Reset links one address can be sent per hour, and forgot requests per visitor per hour. */
+exports.FORGOT_PASSWORD_RECIPIENT_LIMIT = 3;
+exports.FORGOT_PASSWORD_VISITOR_LIMIT = 10;
+/** Reset attempts (and link checks) per visitor per 15 minutes. */
+exports.RESET_PASSWORD_VISITOR_LIMIT = 20;
+exports.DEFAULT_RESET_PAGE_PATH = '/reset-password';
+/** The same answer for every well-formed request, whatever the address. */
+exports.FORGOT_PASSWORD_ANSWER = 'If an account exists for that email, we sent it a link to reset the password.';
+/**
+ * The sessionStorage key the reset page reads the link's token from (mirrored
+ * in teleport-gui `RESET_TOKEN_STORAGE_KEY`). The published site's first head
+ * script (teleport-project-generator-next `address-key-keeper.ts`) moves the
+ * token there, out of the address, before any other script of the page runs:
+ * an analytics or ads tag reads `location.href`, and the token is the account
+ * for 30 minutes.
+ */
+exports.RESET_TOKEN_STORAGE_KEY = 'tq-reset-token';
+/**
+ * Whether the project's reset page reads the token the keeper keeps (its
+ * workflows name RESET_TOKEN_STORAGE_KEY). Only then does the emailed link
+ * carry the token in its fragment, and does the keeper watch the reset page: a
+ * site exported by an editor that still reads `?token=` keeps its links as
+ * they were.
+ */
+const readsKeptResetToken = (uidl) => {
+    const auth = uidl.authentication;
+    if (!(auth === null || auth === void 0 ? void 0 : auth.enabled) || !auth.passwordAuthEnabled || !uidl.workflows) {
+        return false;
+    }
+    try {
+        return JSON.stringify(uidl.workflows).includes(exports.RESET_TOKEN_STORAGE_KEY);
+    }
+    catch (error) {
+        return false;
+    }
+};
+exports.readsKeptResetToken = readsKeptResetToken;
+/** The reset page paths the keeper watches: the page the reset email links to. */
+const resetTokenKeeperPagePaths = (uidl) => {
+    if (!(0, exports.readsKeptResetToken)(uidl)) {
+        return [];
+    }
+    const config = (0, exports.collectWorkflowNodeConfigs)(uidl.workflows, exports.REQUEST_PASSWORD_RESET_NODE_TYPE)[0] || {};
+    return [(0, exports.resolveResetPagePath)(config.resetPagePath)];
+};
+exports.resetTokenKeeperPagePaths = resetTokenKeeperPagePaths;
+/**
+ * The page this project's reset links open, and whether they carry the token
+ * in the fragment: the forgot-password link, and the set-password link a
+ * sign-up mails to an address the site knows without a password.
+ */
+const resetLinkOf = (uidl) => {
+    const config = (0, exports.collectWorkflowNodeConfigs)(uidl.workflows, exports.REQUEST_PASSWORD_RESET_NODE_TYPE)[0] || {};
+    return {
+        resetPagePath: (0, exports.resolveResetPagePath)(config.resetPagePath),
+        tokenInFragment: (0, exports.readsKeptResetToken)(uidl),
+    };
+};
+exports.resetLinkOf = resetLinkOf;
+/**
+ * Who sends this project's reset email (the forgot-password node's provider id
+ * without `email-`, sender and credential env var). The sign-up's emails to an
+ * address the site already knows fall back to it.
+ */
+const resetEmailSenderOf = (uidl) => {
+    const config = (0, exports.collectWorkflowNodeConfigs)(uidl.workflows, exports.REQUEST_PASSWORD_RESET_NODE_TYPE)[0] || {};
+    const providerNodeType = typeof config.emailProvider === 'string' ? config.emailProvider : '';
+    return {
+        emailProvider: providerNodeType.startsWith('email-')
+            ? providerNodeType.slice('email-'.length)
+            : '',
+        fromEmail: typeof config.from === 'string' ? config.from : '',
+        emailSecretEnvName: secretEnvNameOf(config.apiKey) || secretEnvNameOf(config.serverToken),
+    };
+};
+exports.resetEmailSenderOf = resetEmailSenderOf;
+/**
+ * The reset page path a link may point at: a same-site path without a query
+ * or fragment, else the default reset page. Never taken from a request — a
+ * link to another page of the site (an open redirect, a page with third-party
+ * scripts) would hand the token to someone else.
+ */
+const resolveResetPagePath = (value) => {
+    const path = typeof value === 'string' ? value.trim() : '';
+    if (!path.startsWith('/') ||
+        path.startsWith('//') ||
+        /[\\?#\s"'<>]/.test(path) ||
+        path.indexOf('..') !== -1) {
+        return exports.DEFAULT_RESET_PAGE_PATH;
+    }
+    return path.length > 1 ? path.replace(/\/+$/, '') : path;
+};
+exports.resolveResetPagePath = resolveResetPagePath;
+exports.TRUSTED_ORIGIN_CODE = `function isLoopbackHost(host) {
+  var name = String(host || '').replace(/:[0-9]+$/, '').toLowerCase();
+  return name === 'localhost' || name === '127.0.0.1' || name === '[::1]';
+}
+
+// The origin the emailed link opens. On Vercel the request's host is a domain
+// Vercel routed to this deployment; anywhere else the Host header is whatever
+// the caller sent — a forged one would mail the victim a link to the attacker's
+// site — so the configured NEXTAUTH_URL wins (read as the deployment set it,
+// before the auth route rewrites it per request).
+function trustedOrigin(req) {
+  var headers = (req && req.headers) || {};
+  var host = String(headers.host || '');
+  var proto = String(headers['x-forwarded-proto'] || (isLoopbackHost(host) ? 'http' : 'https')).split(',')[0].trim();
+  var requestOrigin = proto + '://' + host;
+  if (process.env.VERCEL && host) return requestOrigin;
+  var configured = String(${configured_nextauth_url_1.CONFIGURED_NEXTAUTH_URL_EXPRESSION} || '').trim();
+  var origin = '';
+  try { origin = configured ? new URL(configured).origin : ''; } catch (e) { origin = ''; }
+  if (!origin) return isLoopbackHost(host) ? requestOrigin : 'http://localhost:3000';
+  if (isLoopbackHost(host) && isLoopbackHost(new URL(origin).host)) return requestOrigin;
+  return origin;
+}`;
+const READ_BODY_CODE = `function readBody(req) {
+  var body = req.body;
+  if (typeof body === 'string') {
+    try { body = JSON.parse(body); } catch (e) { body = null; }
+  }
+  return body && typeof body === 'object' ? body : {};
+}
+
+function sha256(value) {
+  return crypto.createHash('sha256').update(String(value)).digest('hex');
+}`;
+const generateForgotPasswordRoute = (options = {}) => {
+    const provider = options.emailProvider && transactional_email_code_1.SUPPORTED_EMAIL_PROVIDERS.has(options.emailProvider)
+        ? options.emailProvider
+        : null;
+    const resetPagePath = (0, exports.resolveResetPagePath)(options.resetPagePath);
+    return `var crypto = require('crypto');
+var __security = require('${(0, security_runtime_code_1.securityRuntimeSpecifier)('../../..')}');
+var authUtils = require('../../../utils/auth/auth-options');
+${(0, transactional_email_code_1.generateEmailLocaleRequire)('../../..')}
+${provider
+        ? "var __sentEmailLog = require('../../../utils/email/sent-email-log');"
+        : 'var __sentEmailLog = null;'}
+
+var RESET_PAGE_PATH = ${JSON.stringify(resetPagePath)};
+// Where the link carries the token (see ForgotPasswordRouteOptions.tokenInFragment).
+var TOKEN_LINK_PREFIX = ${JSON.stringify(options.tokenInFragment ? '#token=' : '?token=')};
+var TOKEN_TTL_SECONDS = ${exports.PASSWORD_RESET_TOKEN_TTL_SECONDS};
+// Every answer takes at least this long, so the time does not tell an address
+// with an account (a link is stored and mailed) from one without.
+var MIN_RESPONSE_MS = 1200;
+var ANSWER = { success: true, message: ${JSON.stringify(exports.FORGOT_PASSWORD_ANSWER)} };
+
+var EMAIL_PROVIDER = ${JSON.stringify(provider)};
+var EMAIL_FROM = ${JSON.stringify(options.fromEmail || '')};
+var EMAIL_SECRET_ENV_NAME = ${JSON.stringify(options.emailSecretEnvName || '')};
+var EMAIL_SUBJECT = ${JSON.stringify(options.emailSubject || 'Reset your password')};
+var EMAIL_BODY_HTML = ${JSON.stringify(options.emailBodyHtml || '')};
+var EMAIL_LOCALIZED = ${JSON.stringify(options.localizedTemplates || {})};
+var SITE_NAME = ${JSON.stringify(options.siteName || '')};
+
+${READ_BODY_CODE}
+
+${exports.TRUSTED_ORIGIN_CODE}
+
+${(0, transactional_email_code_1.generateFillTemplateFn)()}
+
+${(0, transactional_email_code_1.generateLocalizedEmailCopyFn)({
+        fnName: 'resolveResetEmailCopy',
+        subjectConst: 'EMAIL_SUBJECT',
+        bodyConst: 'EMAIL_BODY_HTML',
+        localizedConst: 'EMAIL_LOCALIZED',
+    })}
+
+${(0, transactional_email_code_1.generateProviderSendFunction)(provider)}
+
+function waitUntilElapsed(startedAt, ms) {
+  var left = ms - (Date.now() - startedAt);
+  return left > 0 ? new Promise(function (resolve) { setTimeout(resolve, left); }) : Promise.resolve();
+}
+
+// The token, wherever it appears, for what the sent-email log keeps: whoever
+// can read the log must not be able to set the password with it.
+function hideToken(text, token) {
+  return String(text == null ? '' : text).split(token).join('[hidden]');
+}
+
+async function sendResetEmail(user, resetUrl, token, locale) {
+  if (!EMAIL_PROVIDER || !EMAIL_BODY_HTML) {
+    console.warn('[forgot-password] reset link not sent: no email provider or email template is configured');
+    return;
+  }
+  var apiKey = EMAIL_SECRET_ENV_NAME ? process.env[EMAIL_SECRET_ENV_NAME] : '';
+  if (apiKey && String(apiKey).indexOf('teleporthq.secrets.') === 0) { apiKey = ''; }
+  if (!apiKey) { console.warn('[forgot-password] reset link not sent: the email credential is not set'); return; }
+  var from = EMAIL_FROM || process.env.EMAIL_FROM || '';
+  if (!from) { console.warn('[forgot-password] reset link not sent: no sender is configured'); return; }
+  var to = String(user.email);
+  var values = {
+    resetUrl: resetUrl,
+    recipientEmail: to,
+    userName: user.name || 'there',
+    siteName: SITE_NAME,
+  };
+  var copy = resolveResetEmailCopy(locale);
+  var subject = fillSubjectTemplate(copy.subject, values);
+  var html = fillTemplate(copy.body, values);
+  var failure = null;
+  try {
+    await __sendProviderEmail({ from: from, to: to, subject: subject, html: html, apiKey: apiKey });
+  } catch (err) {
+    failure = err;
+  }
+  if (__sentEmailLog) {
+    __sentEmailLog.recordSentEmail({
+      emailType: 'forgot-password',
+      audience: 'customer',
+      to: to,
+      from: from,
+      subject: hideToken(subject, token),
+      html: hideToken(html, token),
+      payload: { resetUrl: hideToken(resetUrl, token), recipientEmail: to },
+      provider: EMAIL_PROVIDER,
+      status: failure ? 'failed' : 'sent',
+      error: failure ? (failure.message || String(failure)) : null,
+      source: 'forgot-password',
+      sourceRef: 'api/auth/forgot-password',
+      userId: user.id,
+    });
+    await __sentEmailLog.settleSentEmailLog();
+  }
+  if (failure) { throw failure; }
+}
+
+module.exports = async function handler(req, res) {
+  if (req.method !== 'POST') {
+    return res.status(405).json({ error: 'Method not allowed' });
+  }
+  if (!(await __security.rateLimitRequest(req, res, { scope: 'auth-forgot-password', limit: ${exports.FORGOT_PASSWORD_VISITOR_LIMIT}, windowSeconds: 3600 }))) {
+    return;
+  }
+  var startedAt = Date.now();
+  var body = readBody(req);
+  var email = typeof body.email === 'string' ? body.email.trim() : '';
+  if (!email || email.length > 254 || !/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {
+    return res.status(400).json({ error: 'Enter a valid email address.' });
+  }
+
+  var user = null;
+  try {
+    user = await authUtils.findUserByEmail(email);
+  } catch (err) {
+    return __security.sendClientError(res, 503, 'We could not reach the account service. Please try again in a moment.', err);
+  }
+
+  try {
+    // Counted for every address, with an account or without, so neither the
+    // answer nor its timing differs.
+    var recipient = await __security.rateLimit({
+      key: 'auth-forgot-recipient:' + email.toLowerCase(),
+      limit: ${exports.FORGOT_PASSWORD_RECIPIENT_LIMIT},
+      windowSeconds: 3600,
+    });
+    var userId = user ? (user.id != null ? user.id : user._id) : null;
+    if (user && userId != null && user.email && !recipient.allowed) {
+      console.warn('[forgot-password] reset link not sent: this address was sent ${exports.FORGOT_PASSWORD_RECIPIENT_LIMIT} in the last hour');
+    } else if (user && userId != null && user.email) {
+      if (!authUtils.PASSWORD_RESET_SUPPORTED) {
+        console.warn('[forgot-password] reset link not sent: password reset needs a Postgres user store');
+      } else {
+        var token = crypto.randomBytes(32).toString('hex');
+        await authUtils.storePasswordReset(userId, sha256(token), TOKEN_TTL_SECONDS);
+        var resetUrl = trustedOrigin(req) + RESET_PAGE_PATH + TOKEN_LINK_PREFIX + token;
+        await sendResetEmail(user, resetUrl, token, __emailLocale.resolveRequestLocale(req));
+      }
+    }
+  } catch (err) {
+    console.error('[forgot-password] could not send a reset link:', err && err.message ? err.message : err);
+  }
+
+  await waitUntilElapsed(startedAt, MIN_RESPONSE_MS);
+  return res.status(200).json(ANSWER);
+};
+`;
+};
+exports.generateForgotPasswordRoute = generateForgotPasswordRoute;
+const generateResetPasswordRoute = () => `var crypto = require('crypto');
+var __security = require('${(0, security_runtime_code_1.securityRuntimeSpecifier)('../../..')}');
+var hashPassword = require('../../../utils/auth/hash-password');
+var authUtils = require('../../../utils/auth/auth-options');
+
+// What forgot-password mints: 32 random bytes, hex.
+var TOKEN_PATTERN = /^[0-9a-f]{64}$/;
+var NOT_VALID = { valid: false, changed: false };
+
+${READ_BODY_CODE}
+
+// { token, password } sets the password when the link is live, spending it;
+// { token, checkOnly: true } only says whether it is live. A link that is not
+// (expired, spent, superseded, from before these links, or no link at all) is
+// { valid: false, changed: false }.
+module.exports = async function handler(req, res) {
+  if (req.method !== 'POST') {
+    return res.status(405).json({ error: 'Method not allowed' });
+  }
+  if (!(await __security.rateLimitRequest(req, res, { scope: 'auth-reset-password', limit: ${exports.RESET_PASSWORD_VISITOR_LIMIT}, windowSeconds: 900 }))) {
+    return;
+  }
+  var body = readBody(req);
+  var token = typeof body.token === 'string' ? body.token.trim().toLowerCase() : '';
+  if (!TOKEN_PATTERN.test(token)) {
+    return res.status(200).json(NOT_VALID);
+  }
+  var tokenHash = sha256(token);
+
+  if (body.checkOnly === true) {
+    try {
+      var live = await authUtils.passwordResetIsLive(tokenHash);
+      return res.status(200).json({ valid: live === true, changed: false });
+    } catch (err) {
+      return __security.sendClientError(res, 503, 'We could not check the reset link. Please try again in a moment.', err);
+    }
+  }
+
+  var password = typeof body.password === 'string' ? body.password : '';
+  var policyError = hashPassword.passwordPolicyError(password);
+  if (policyError) {
+    return res.status(400).json({ error: policyError });
+  }
+  try {
+    var account = await authUtils.consumePasswordReset(tokenHash, hashPassword(password));
+    if (!account) {
+      return res.status(200).json(NOT_VALID);
+    }
+    // Every session stamped with the old password ends (session-revocation).
+    return res.status(200).json({ valid: true, changed: true });
+  } catch (err) {
+    return __security.sendClientError(res, 503, 'We could not reset the password. Please try again in a moment.', err);
+  }
+};
+`;
+exports.generateResetPasswordRoute = generateResetPasswordRoute;
+/** The env var holding the project's own password pepper (provisioned at deploy). */
+exports.AUTH_PEPPER_SECRET_ENV = 'AUTH_PEPPER_SECRET';
+/** The node type whose config carries the reset email (provider, sender, template, page). */
+exports.REQUEST_PASSWORD_RESET_NODE_TYPE = 'account-request-password-reset';
+/** Every config of a node type across the project's workflows and custom nodes. */
+const collectWorkflowNodeConfigs = (workflows, nodeType) => {
+    const configs = [];
+    for (const group of [workflows === null || workflows === void 0 ? void 0 : workflows.workflows, workflows === null || workflows === void 0 ? void 0 : workflows.customNodes]) {
+        if (!group || typeof group !== 'object') {
+            continue;
+        }
+        for (const entry of Object.values(group)) {
+            const nodes = entry && Array.isArray(entry.nodes) ? entry.nodes : [];
+            for (const node of nodes) {
+                if (node && node.type === nodeType) {
+                    configs.push(node.config || {});
+                }
+            }
+        }
+    }
+    return configs;
+};
+exports.collectWorkflowNodeConfigs = collectWorkflowNodeConfigs;
+const secretEnvNameOf = (value) => {
+    if (typeof value === 'string') {
+        return value.startsWith('teleporthq.secrets.')
+            ? value.slice('teleporthq.secrets.'.length)
+            : value;
+    }
+    const ref = value;
+    return ref && ref.content && ref.content.referenceType === 'secret' && ref.content.id
+        ? ref.content.id
+        : '';
+};
+/**
+ * What every project with password sign-in gets beside its sign-in and sign-up
+ * routes: the forgot / reset password routes (the reset email baked from the
+ * first `account-request-password-reset` node's config) and an
+ * `AUTH_PEPPER_SECRET=` line in `.env`, which the
+ * deploy step fills with the project's own pepper (declared empty, never
+ * random: a pepper that changed with every generation would lock every user
+ * out, while an empty one means the old pepper — see utils/auth/hash-password).
+ */
+const emitPasswordAuthFiles = (structure, auth) => {
+    const { files, dependencies, uidl } = structure;
+    if (!auth.enabled || !auth.passwordAuthEnabled) {
+        return;
+    }
+    const config = (0, exports.collectWorkflowNodeConfigs)(uidl.workflows, exports.REQUEST_PASSWORD_RESET_NODE_TYPE)[0] || {};
+    const sender = (0, exports.resetEmailSenderOf)(uidl);
+    const emailProvider = sender.emailProvider;
+    (0, email_locale_1.ensureEmailLocaleModule)(structure);
+    files.set('auth-forgot-password-route', {
+        path: ['pages', 'api', 'auth'],
+        files: [
+            {
+                name: exports.FORGOT_PASSWORD_ROUTE_NAME,
+                fileType: teleport_types_1.FileType.JS,
+                content: (0, exports.generateForgotPasswordRoute)(Object.assign(Object.assign(Object.assign({}, (0, exports.resetLinkOf)(uidl)), sender), { emailSubject: typeof config.subject === 'string' ? config.subject : '', emailBodyHtml: typeof config.body === 'string' ? config.body : '', localizedTemplates: (0, transactional_email_code_1.readLocalizedEmailTemplates)(config.localizedTemplates), siteName: uidl.name || '' })),
+            },
+        ],
+    });
+    files.set('auth-reset-password-route', {
+        path: ['pages', 'api', 'auth'],
+        files: [
+            {
+                name: exports.RESET_PASSWORD_ROUTE_NAME,
+                fileType: teleport_types_1.FileType.JS,
+                content: (0, exports.generateResetPasswordRoute)(),
+            },
+        ],
+    });
+    const providerDeps = (0, transactional_email_code_1.transactionalEmailDependencies)(emailProvider);
+    for (const [pkg, version] of Object.entries(providerDeps)) {
+        if (!dependencies[pkg]) {
+            dependencies[pkg] = version;
+        }
+    }
+    if (Object.keys(providerDeps).length > 0) {
+        (0, sent_email_log_1.ensureSentEmailLogModule)(structure);
+    }
+    if (uidl.globals) {
+        uidl.globals.env = uidl.globals.env || {};
+        if (typeof uidl.globals.env[exports.AUTH_PEPPER_SECRET_ENV] !== 'string') {
+            uidl.globals.env[exports.AUTH_PEPPER_SECRET_ENV] = '';
+        }
+    }
+};
+exports.emitPasswordAuthFiles = emitPasswordAuthFiles;
+//# sourceMappingURL=password-reset-route-generator.js.map

package/dist/cjs/password-reset-route-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-route-generator.js","sourceRoot":"","sources":["../../src/password-reset-route-generator.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,+DAMmC;AACnC,yEAQmC;AACnC,uEAA8E;AAC9E,oFAAmF;AACnF,iDAAwD;AACxD,qDAA2D;AAE9C,QAAA,0BAA0B,GAAG,iBAAiB,CAAA;AAC9C,QAAA,yBAAyB,GAAG,gBAAgB,CAAA;AAEzD,4CAA4C;AAC/B,QAAA,gCAAgC,GAAG,IAAI,CAAA;AACpD,8FAA8F;AACjF,QAAA,+BAA+B,GAAG,CAAC,CAAA;AACnC,QAAA,6BAA6B,GAAG,EAAE,CAAA;AAC/C,mEAAmE;AACtD,QAAA,4BAA4B,GAAG,EAAE,CAAA;AAEjC,QAAA,uBAAuB,GAAG,iBAAiB,CAAA;AAExD,2EAA2E;AAC9D,QAAA,sBAAsB,GACjC,+EAA+E,CAAA;AAEjF;;;;;;;GAOG;AACU,QAAA,uBAAuB,GAAG,gBAAgB,CAAA;AAEvD;;;;;;GAMG;AACI,MAAM,mBAAmB,GAAG,CAAC,IAAiB,EAAW,EAAE;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAA;IAChC,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,CAAA,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;QAClE,OAAO,KAAK,CAAA;KACb;IACD,IAAI;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,+BAAuB,CAAC,CAAA;KACxE;IAAC,OAAO,KAAK,EAAE;QACd,OAAO,KAAK,CAAA;KACb;AACH,CAAC,CAAA;AAVY,QAAA,mBAAmB,uBAU/B;AAED,kFAAkF;AAC3E,MAAM,yBAAyB,GAAG,CAAC,IAAiB,EAAY,EAAE;IACvE,IAAI,CAAC,IAAA,2BAAmB,EAAC,IAAI,CAAC,EAAE;QAC9B,OAAO,EAAE,CAAA;KACV;IACD,MAAM,MAAM,GACV,IAAA,kCAA0B,EAAC,IAAI,CAAC,SAAS,EAAE,wCAAgC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACvF,OAAO,CAAC,IAAA,4BAAoB,EAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;AACrD,CAAC,CAAA;AAPY,QAAA,yBAAyB,6BAOrC;AAED;;;;GAIG;AACI,MAAM,WAAW,GAAG,CACzB,IAAiB,EACoC,EAAE;IACvD,MAAM,MAAM,GACV,IAAA,kCAA0B,EAAC,IAAI,CAAC,SAAS,EAAE,wCAAgC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACvF,OAAO;QACL,aAAa,EAAE,IAAA,4BAAoB,EAAC,MAAM,CAAC,aAAa,CAAC;QACzD,eAAe,EAAE,IAAA,2BAAmB,EAAC,IAAI,CAAC;KAC3C,CAAA;AACH,CAAC,CAAA;AATY,QAAA,WAAW,eASvB;AAED;;;;GAIG;AACI,MAAM,kBAAkB,GAAG,CAChC,IAAiB,EACyD,EAAE;IAC5E,MAAM,MAAM,GACV,IAAA,kCAA0B,EAAC,IAAI,CAAC,SAAS,EAAE,wCAAgC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACvF,MAAM,gBAAgB,GAAG,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7F,OAAO;QACL,aAAa,EAAE,gBAAgB,CAAC,UAAU,CAAC,QAAQ,CAAC;YAClD,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACzC,CAAC,CAAC,EAAE;QACN,SAAS,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC7D,kBAAkB,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC;KAC1F,CAAA;AACH,CAAC,CAAA;AAbY,QAAA,kBAAkB,sBAa9B;AAsBD;;;;;GAKG;AACI,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAU,EAAE;IAC7D,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACrB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACzB;QACA,OAAO,+BAAuB,CAAA;KAC/B;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1D,CAAC,CAAA;AAXY,QAAA,oBAAoB,wBAWhC;AAEY,QAAA,mBAAmB,GAAG;;;;;;;;;;;;;;;;4BAgBP,4DAAkC;;;;;;EAM5D,CAAA;AAEF,MAAM,cAAc,GAAG;;;;;;;;;;EAUrB,CAAA;AAEK,MAAM,2BAA2B,GAAG,CAAC,UAAsC,EAAE,EAAU,EAAE;IAC9F,MAAM,QAAQ,GACZ,OAAO,CAAC,aAAa,IAAI,oDAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3E,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,IAAI,CAAA;IACV,MAAM,aAAa,GAAG,IAAA,4BAAoB,EAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAEjE,OAAO;4BACmB,IAAA,gDAAwB,EAAC,UAAU,CAAC;;EAE9D,IAAA,qDAA0B,EAAC,UAAU,CAAC;EAEtC,QAAQ;QACN,CAAC,CAAC,sEAAsE;QACxE,CAAC,CAAC,4BACN;;wBAEwB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;0BAE3B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;0BAC/D,wCAAgC;;;;yCAIjB,IAAI,CAAC,SAAS,CAAC,8BAAsB,CAAC;;uBAExD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;mBAC5B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;8BAC5B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;sBACxD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;wBAC3D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;wBAC3C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;kBACtD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;;EAEtD,cAAc;;EAEd,2BAAmB;;EAEnB,IAAA,iDAAsB,GAAE;;EAExB,IAAA,uDAA4B,EAAC;QAC7B,MAAM,EAAE,uBAAuB;QAC/B,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,iBAAiB;QAC5B,cAAc,EAAE,iBAAiB;KAClC,CAAC;;EAEA,IAAA,uDAA4B,EAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8FAgEsD,qCAA6B;;;;;;;;;;;;;;;;;;;;;;eAsB5G,uCAA+B;;;;;mFAKqC,uCAA+B;;;;;;;;;;;;;;;;;;CAkBjH,CAAA;AACD,CAAC,CAAA;AA7JY,QAAA,2BAA2B,+BA6JvC;AAEM,MAAM,0BAA0B,GAAG,GAAW,EAAE,CAAC;4BAC5B,IAAA,gDAAwB,EAAC,UAAU,CAAC;;;;;;;;EAQ9D,cAAc;;;;;;;;;;6FAU6E,oCAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCxH,CAAA;AAtDY,QAAA,0BAA0B,8BAsDtC;AAED,qFAAqF;AACxE,QAAA,sBAAsB,GAAG,oBAAoB,CAAA;AAE1D,6FAA6F;AAChF,QAAA,gCAAgC,GAAG,gCAAgC,CAAA;AAEhF,mFAAmF;AAC5E,MAAM,0BAA0B,GAAG,CACxC,SAAqE,EACrE,QAAgB,EACgB,EAAE;IAClC,MAAM,OAAO,GAAmC,EAAE,CAAA;IAClD,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,SAAS,EAAE,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,WAAW,CAAC,EAAE;QAClE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;YACvC,SAAQ;SACT;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAA4C,CAAC,EAAE;YAC/E,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;YACpE,KAAK,MAAM,IAAI,IAAI,KAAmE,EAAE;gBACtF,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE;oBAClC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;iBAChC;aACF;SACF;KACF;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAnBY,QAAA,0BAA0B,8BAmBtC;AAED,MAAM,eAAe,GAAG,CAAC,KAAc,EAAU,EAAE;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;QAC7B,OAAO,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAC5C,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC;YAC3C,CAAC,CAAC,KAAK,CAAA;KACV;IACD,MAAM,GAAG,GAAG,KAAqE,CAAA;IACjF,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE;QACnF,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAChB,CAAC,CAAC,EAAE,CAAA;AACR,CAAC,CAAA;AAED;;;;;;;;GAQG;AACI,MAAM,qBAAqB,GAAG,CACnC,SAAiC,EACjC,IAAwB,EAClB,EAAE;IACR,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;IAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE;QAC9C,OAAM;KACP;IAED,MAAM,MAAM,GACV,IAAA,kCAA0B,EAAC,IAAI,CAAC,SAAS,EAAE,wCAAgC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACvF,MAAM,MAAM,GAAG,IAAA,0BAAkB,EAAC,IAAI,CAAC,CAAA;IACvC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAA;IAE1C,IAAA,sCAAuB,EAAC,SAAS,CAAC,CAAA;IAClC,KAAK,CAAC,GAAG,CAAC,4BAA4B,EAAE;QACtC,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;QAC9B,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,kCAA0B;gBAChC,QAAQ,EAAE,yBAAQ,CAAC,EAAE;gBACrB,OAAO,EAAE,IAAA,mCAA2B,gDAC/B,IAAA,mBAAW,EAAC,IAAI,CAAC,GACjB,MAAM,KACT,YAAY,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EACtE,aAAa,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EACjE,kBAAkB,EAAE,IAAA,sDAA2B,EAAC,MAAM,CAAC,kBAAkB,CAAC,EAC1E,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,IACzB;aACH;SACF;KACF,CAAC,CAAA;IACF,KAAK,CAAC,GAAG,CAAC,2BAA2B,EAAE;QACrC,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;QAC9B,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,iCAAyB;gBAC/B,QAAQ,EAAE,yBAAQ,CAAC,EAAE;gBACrB,OAAO,EAAE,IAAA,kCAA0B,GAAE;aACtC;SACF;KACF,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,IAAA,yDAA8B,EAAC,aAAa,CAAC,CAAA;IAClE,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;QACzD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE;YACtB,YAAY,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;SAC5B;KACF;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;QACxC,IAAA,yCAAwB,EAAC,SAAS,CAAC,CAAA;KACpC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE;QAChB,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAA;QACzC,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,8BAAsB,CAAC,KAAK,QAAQ,EAAE;YAChE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,8BAAsB,CAAC,GAAG,EAAE,CAAA;SAC9C;KACF;AACH,CAAC,CAAA;AA3DY,QAAA,qBAAqB,yBA2DjC"}

package/dist/cjs/payments/payment-core-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payment-core-code.d.ts","sourceRoot":"","sources":["../../../src/payments/payment-core-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,cACxB,0BAA0B,KACnC,MAgZF,CAAA"}
+{"version":3,"file":"payment-core-code.d.ts","sourceRoot":"","sources":["../../../src/payments/payment-core-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,cACxB,0BAA0B,KACnC,MAqZF,CAAA"}

package/dist/cjs/payments/payment-core-code.js

@@ -42,9 +42,10 @@ function usable(value) {
 }
 
 /**
- * The first usable variable among \`names\`, else the first whose name
- * starts with \`prefix\`: the editor stores a credential under a
- * CONFIGURATION_* name that a second save may number (…_KEY2).
+ * The first usable variable among \`names\`, else a NUMBERED copy of
+ * \`prefix\`: the editor stores a credential under a CONFIGURATION_* name that
+ * a second save numbers (…_KEY2); the highest number is the newest. Never a
+ * variable that merely starts with the name (…_KEY_OLDSHOP).
  */
 function env(names, prefix) {
   var values = process.env;
@@ -54,16 +55,20 @@ function env(names, prefix) {
       return value;
     }
   }
+  var best = '';
+  var bestNumber = -1;
   if (prefix) {
     var keys = Object.keys(values);
     for (var k = 0; k < keys.length; k++) {
-      var candidate = keys[k].indexOf(prefix) === 0 ? usable(values[keys[k]]) : '';
-      if (candidate) {
-        return candidate;
+      var suffix = keys[k].indexOf(prefix) === 0 ? keys[k].slice(prefix.length) : '';
+      var candidate = /^[0-9]+$/.test(suffix) ? usable(values[keys[k]]) : '';
+      if (candidate && parseInt(suffix, 10) > bestNumber) {
+        best = candidate;
+        bestNumber = parseInt(suffix, 10);
       }
     }
   }
-  return '';
+  return best;
 }
 
 /** "clientSecret" -> "CLIENT_SECRET", the editor's secret naming. */

package/dist/cjs/payments/payment-core-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"payment-core-code.js","sourceRoot":"","sources":["../../../src/payments/payment-core-code.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;GAeG;AACI,MAAM,uBAAuB,GAAG,CACrC,WAAuC,EAAE,EACjC,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAyDgB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuVpD,CAAA;AAlZY,QAAA,uBAAuB,2BAkZnC"}
+{"version":3,"file":"payment-core-code.js","sourceRoot":"","sources":["../../../src/payments/payment-core-code.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;GAeG;AACI,MAAM,uBAAuB,GAAG,CACrC,WAAuC,EAAE,EACjC,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BA8DgB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuVpD,CAAA;AAvZY,QAAA,uBAAuB,2BAuZnC"}

package/dist/cjs/project-code-scanner.d.ts

@@ -0,0 +1,11 @@
+import { CodegenSecurityViolation } from './security-scanner';
+export declare const findProjectCodeViolations: (uidl: {
+    root?: unknown;
+    components?: Record<string, unknown>;
+}) => CodegenSecurityViolation[];
+/** Throws `CodegenSecurityError` when a page or component carries such code. */
+export declare const assertProjectCodeIsSecure: (uidl: {
+    root?: unknown;
+    components?: Record<string, unknown>;
+}) => void;
+//# sourceMappingURL=project-code-scanner.d.ts.map

package/dist/cjs/project-code-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-code-scanner.d.ts","sourceRoot":"","sources":["../../src/project-code-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAEzB,MAAM,oBAAoB,CAAA;AA8B3B,eAAO,MAAM,yBAAyB,SAAU;IAC9C,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,UAAU,CAAC,EAAE,OAAO,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC,KAAG,wBAAwB,EAiD3B,CAAA;AAED,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,SAAU;IAC9C,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,UAAU,CAAC,EAAE,OAAO,MAAM,EAAE,OAAO,CAAC,CAAA;CACrC,KAAG,IAKH,CAAA"}

package/dist/cjs/project-code-scanner.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertProjectCodeIsSecure = exports.findProjectCodeViolations = void 0;
+const security_scanner_1 = require("./security-scanner");
+/**
+ * Author code a published page runs on the server beside its workflows, read
+ * from the UIDL before any of it is emitted (`NextWorkflowProjectPlugin.runBefore`):
+ *
+ * - a state's mapping function (`mappingFunction`): a page's `getStaticProps`
+ *   compiles it with `Function('items', …)` at build and on every revalidation
+ *   (teleport-project-generator-next `state-data-source-plugin.ts`);
+ * - an expression node (`{ type: 'expr', content }`, an element's text, an
+ *   attribute, a condition): it is written into the page's JSX, which Next
+ *   prerenders in Node with the deploy's environment (an object is written as
+ *   JSON, so a bare `process.env` would print every variable), and the invoice
+ *   PDF route evaluates the template's.
+ *
+ * Both are held to the custom-code rules (`scanForObviousViolations`, the same
+ * scanner custom-JS steps are), as the editor's publish gate holds them to its
+ * own (teleport-gui `workflow-schema/src/security/scan-server-sources.ts`). The
+ * whole tree is read, however deep it nests.
+ */
+const describeOwner = (ownerName, record) => typeof record.name === 'string' && record.name.trim() ? record.name.trim() : ownerName;
+const findProjectCodeViolations = (uidl) => {
+    const violations = [];
+    const seen = new Set();
+    const report = (ownerName, nodeId, what, code) => {
+        for (const finding of (0, security_scanner_1.scanForObviousViolations)(code)) {
+            violations.push({
+                workflowId: ownerName,
+                workflowName: ownerName,
+                nodeId,
+                rule: finding.rule,
+                message: `${what} ${finding.message}`,
+            });
+        }
+    };
+    const pending = [{ value: uidl.root, ownerName: 'the pages', path: 'root' }];
+    for (const [componentName, component] of Object.entries(uidl.components || {})) {
+        pending.push({
+            value: component,
+            ownerName: componentName,
+            path: `components.${componentName}`,
+        });
+    }
+    // An explicit stack, not recursion: no nesting depth is skipped.
+    while (pending.length > 0) {
+        const { value, ownerName, path } = pending.pop();
+        if (!value || typeof value !== 'object' || seen.has(value)) {
+            continue;
+        }
+        seen.add(value);
+        if (Array.isArray(value)) {
+            value.forEach((item, index) => pending.push({ value: item, ownerName, path: `${path}.${index}` }));
+            continue;
+        }
+        const record = value;
+        if (typeof record.mappingFunction === 'string' && record.mappingFunction.trim()) {
+            report(ownerName, `${path}.mappingFunction`, 'the mapping function', record.mappingFunction);
+        }
+        if (record.type === 'expr' && typeof record.content === 'string' && record.content.trim()) {
+            report(ownerName, `${path}.content`, 'an expression', record.content);
+        }
+        const childOwner = describeOwner(ownerName, record);
+        for (const key of Object.keys(record)) {
+            pending.push({ value: record[key], ownerName: childOwner, path: `${path}.${key}` });
+        }
+    }
+    return violations;
+};
+exports.findProjectCodeViolations = findProjectCodeViolations;
+/** Throws `CodegenSecurityError` when a page or component carries such code. */
+const assertProjectCodeIsSecure = (uidl) => {
+    const violations = (0, exports.findProjectCodeViolations)(uidl);
+    if (violations.length > 0) {
+        throw new security_scanner_1.CodegenSecurityError(violations);
+    }
+};
+exports.assertProjectCodeIsSecure = assertProjectCodeIsSecure;
+//# sourceMappingURL=project-code-scanner.js.map

package/dist/cjs/project-code-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-code-scanner.js","sourceRoot":"","sources":["../../src/project-code-scanner.ts"],"names":[],"mappings":";;;AAAA,yDAI2B;AAE3B;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAE,MAA+B,EAAU,EAAE,CACnF,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAQjF,MAAM,yBAAyB,GAAG,CAAC,IAGzC,EAA8B,EAAE;IAC/B,MAAM,UAAU,GAA+B,EAAE,CAAA;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAA;IAC/B,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE;QAC/E,KAAK,MAAM,OAAO,IAAI,IAAA,2CAAwB,EAAC,IAAI,CAAC,EAAE;YACpD,UAAU,CAAC,IAAI,CAAC;gBACd,UAAU,EAAE,SAAS;gBACrB,YAAY,EAAE,SAAS;gBACvB,MAAM;gBACN,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,GAAG,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE;aACtC,CAAC,CAAA;SACH;IACH,CAAC,CAAA;IAED,MAAM,OAAO,GAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvF,KAAK,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE;QAC9E,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,aAAa;YACxB,IAAI,EAAE,cAAc,aAAa,EAAE;SACpC,CAAC,CAAA;KACH;IACD,iEAAiE;IACjE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;QACzB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,EAAa,CAAA;QAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YAC1D,SAAQ;SACT;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACf,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YACxB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC,CACnE,CAAA;YACD,SAAQ;SACT;QACD,MAAM,MAAM,GAAG,KAAgC,CAAA;QAC/C,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE;YAC/E,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAA;SAC7F;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;YACzF,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;SACtE;QACD,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACnD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACrC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC,CAAA;SACpF;KACF;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AApDY,QAAA,yBAAyB,6BAoDrC;AAED,gFAAgF;AACzE,MAAM,yBAAyB,GAAG,CAAC,IAGzC,EAAQ,EAAE;IACT,MAAM,UAAU,GAAG,IAAA,iCAAyB,EAAC,IAAI,CAAC,CAAA;IAClD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE;QACzB,MAAM,IAAI,uCAAoB,CAAC,UAAU,CAAC,CAAA;KAC3C;AACH,CAAC,CAAA;AARY,QAAA,yBAAyB,6BAQrC"}