@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/dist/cjs/realtime-generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"realtime-generator.js","sourceRoot":"","sources":["../../src/realtime-generator.ts"],"names":[],"mappings":";;;AAAO,MAAM,gCAAgC,GAAG,GAAW,EAAE;IAC3D,OAAO;;;;;;;;;;;;;;CAcR,CAAA;AACD,CAAC,CAAA;AAhBY,QAAA,gCAAgC,oCAgB5C;AAEM,MAAM,0BAA0B,GAAG,GAAW,EAAE;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsJR,CAAA;AACD,CAAC,CAAA;AAxJY,QAAA,0BAA0B,8BAwJtC;AAEM,MAAM,0BAA0B,GAAG,GAAW,EAAE;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;CAoBR,CAAA;AACD,CAAC,CAAA;AAtBY,QAAA,0BAA0B,8BAsBtC;AAEM,MAAM,yBAAyB,GAAG,GAAW,EAAE;IACpD,OAAO;;;;;;;;;;;;;;;;;;;;CAoBR,CAAA;AACD,CAAC,CAAA;AAtBY,QAAA,yBAAyB,6BAsBrC;AAEM,MAAM,0BAA0B,GAAG,GAAW,EAAE;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;CAoBR,CAAA;AACD,CAAC,CAAA;AAtBY,QAAA,0BAA0B,8BAsBtC;AAEM,MAAM,4BAA4B,GAAG,GAAW,EAAE;IACvD,OAAO;;;;;;;;;;;;;;;;;;;;CAoBR,CAAA;AACD,CAAC,CAAA;AAtBY,QAAA,4BAA4B,gCAsBxC;AAEM,MAAM,0BAA0B,GAAG,GAAW,EAAE;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;CAoBR,CAAA;AACD,CAAC,CAAA;AAtBY,QAAA,0BAA0B,8BAsBtC;AAEM,MAAM,iCAAiC,GAAG,GAAW,EAAE;IAC5D,OAAO;;;;;;;;;;;;;;;;;;;;;;CAsBR,CAAA;AACD,CAAC,CAAA;AAxBY,QAAA,iCAAiC,qCAwB7C;AAEM,MAAM,oCAAoC,GAAG,GAAW,EAAE;IAC/D,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;CAyBR,CAAA;AACD,CAAC,CAAA;AA3BY,QAAA,oCAAoC,wCA2BhD"}
+{"version":3,"file":"realtime-generator.js","sourceRoot":"","sources":["../../src/realtime-generator.ts"],"names":[],"mappings":";;;AACA,uEAAoF;AACpF,+CAAsD;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACU,QAAA,wBAAwB,GAAG,qBAAqB,CAAA;AAChD,QAAA,oBAAoB,GAAG,SAAS,CAAA;AAChC,QAAA,2BAA2B,GAAG,cAAc,CAAA;AAC5C,QAAA,0BAA0B,GAAG,GAAG,CAAA;AAE7C,wEAAwE;AAC3D,QAAA,qBAAqB,GAA4C;IAC5E,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3B,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,kBAAkB,EAAE;QAClB,CAAC,EAAE,EAAE,EAAE,CAAC;QACR,CAAC,GAAG,EAAE,KAAK,CAAC;KACb;IACD,gBAAgB,EAAE;QAChB,CAAC,EAAE,EAAE,EAAE,CAAC;QACR,CAAC,GAAG,EAAE,KAAK,CAAC;KACb;IACD,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACpC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;CACxC,CAAA;AAED,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAEtD;;;;GAIG;AACI,MAAM,2BAA2B,GAAG,CAAC,SAAoC,EAAY,EAAE;IAC5F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,MAA2C,EAAE,EAAE;QACxE,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;QAC3D,IACE,oCAAsB,CAAC,GAAG,CAAC,IAAI,CAAC;YAChC,OAAO,WAAW,KAAK,QAAQ;YAC/B,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,EACtC;YACA,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;SACvB;IACH,CAAC,CAAA;IACD,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IACpD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QACzC,IAAI,QAAQ,CAAC,OAAO,EAAE;YACpB,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;SACpD;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE;YACvC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;SAC5B;KACF;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,kCAA0B,CAAC,CAAA;AACtE,CAAC,CAAA;AAtBY,QAAA,2BAA2B,+BAsBvC;AAED;;;;;;GAMG;AACI,MAAM,yBAAyB,GAAG,CACvC,SAAoC,EACpC,KAA0B,EACjB,EAAE;IACX,yDAAyD;IACzD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,iBAAiB,KAAK,mBAAmB,CAAC,CAAA;IACnE,MAAM,SAAS,GAAuC,EAAE,CAAA;IACxD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE;QAC9E,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;KACrC;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE;QAClF,SAAS,CAAC,IAAI,CACZ,CAAE,UAAsD,CAAC,KAAK,IAAI,EAAE,CAElE,CACH,CAAA;KACF;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CACjG,CAAA;AACH,CAAC,CAAA;AApBY,QAAA,yBAAyB,6BAoBrC;AAEM,MAAM,gCAAgC,GAAG,CAC9C,SAAyB,EACzB,UAA+C,EAAE,EACzC,EAAE;IACV,OAAO;;;;;;;wBAOe,IAAI,CAAC,SAAS,CAAC,IAAA,mCAA2B,EAAC,SAAS,CAAC,CAAC;;;uBAGvD,IAAI,CAAC,SAAS,CAAC,6BAAqB,CAAC;;;8BAG9B,mCAA2B;6BAC5B,4BAAoB;;;;;;EAM/C,IAAA,kEAAwC,EAAC,OAAO,EAAE;QAClD,cAAc,EAAE,OAAO,CAAC,qBAAqB,KAAK,KAAK;KACxD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgHa,gCAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDtC,CAAA;AACD,CAAC,CAAA;AAlMY,QAAA,gCAAgC,oCAkM5C;AAEM,MAAM,0BAA0B,GAAG,GAAW,EAAE;IACrD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8JR,CAAA;AACD,CAAC,CAAA;AAhKY,QAAA,0BAA0B,8BAgKtC;AAED,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,IAAY,EAAU,EAAE,CACzD,mCAAmC,KAAK;;;;;EAKxC,IAAI;;;CAGL,CAAA;AAEM,MAAM,0BAA0B,GAAG,GAAW,EAAE,CACrD,UAAU,CACR,UAAU,EACV;;;;wBAIoB,CACrB,CAAA;AARU,QAAA,0BAA0B,8BAQpC;AAEI,MAAM,yBAAyB,GAAG,GAAW,EAAE,CACpD,UAAU,CACR,UAAU,EACV;;;;;;;wBAOoB,CACrB,CAAA;AAXU,QAAA,yBAAyB,6BAWnC;AAEI,MAAM,0BAA0B,GAAG,GAAW,EAAE,CACrD,UAAU,CACR,UAAU,EACV;;;0EAGsE,CACvE,CAAA;AAPU,QAAA,0BAA0B,8BAOpC;AAEI,MAAM,4BAA4B,GAAG,GAAW,EAAE,CACvD,UAAU,CACR,UAAU,EACV;;;;;OAKG,CACJ,CAAA;AATU,QAAA,4BAA4B,gCAStC;AAEI,MAAM,0BAA0B,GAAG,GAAW,EAAE,CACrD,UAAU,CACR,UAAU,EACV;;;;;OAKG,CACJ,CAAA;AATU,QAAA,0BAA0B,8BASpC;AAEI,MAAM,iCAAiC,GAAG,GAAW,EAAE,CAC5D,UAAU,CACR,aAAa,EACb;;;;OAIG,CACJ,CAAA;AARU,QAAA,iCAAiC,qCAQ3C;AAEI,MAAM,oCAAoC,GAAG,GAAW,EAAE,CAC/D,UAAU,CACR,aAAa,EACb;;;;;;OAMG,CACJ,CAAA;AAVU,QAAA,oCAAoC,wCAU9C"}

package/dist/cjs/runtime-storage-generator.d.ts

@@ -45,5 +45,36 @@ export declare const TRUSTED_UPLOAD_ROLES: ReadonlyArray<string>;
 export declare const VISITOR_UPLOAD_MIME_TYPES: ReadonlyArray<string>;
 export declare const VISITOR_MAX_FILE_BYTES: number;
 export declare const VISITOR_MAX_FILES = 10;
-export declare const generateRuntimeStorageUploadRoute: () => string;
+/**
+ * How much one visitor (by address, IPv6 by its /64) and the whole site may
+ * upload, through the shared security runtime:
+ * - VISITOR_UPLOAD_LIMITS: requests, `[limit, windowSeconds]`, checked before
+ *   the body is read;
+ * - VISITOR_UPLOAD_MB_PER_DAY: bytes, counted per file in whole MB (a file
+ *   counts at least 1), after the form passed its checks;
+ * - SITE_VISITOR_FILES_PER_DAY: files from all visitors together, counted only
+ *   for forms that passed, so junk requests cannot pause everyone's uploads.
+ * The storage worker also holds all guests together to their share of the
+ * project's quota. Without these a guest could fill the merchant's quota with
+ * allowed files until the admin's own uploads fail.
+ */
+export declare const VISITOR_UPLOAD_LIMITS: ReadonlyArray<[number, number]>;
+export declare const VISITOR_UPLOAD_MB_PER_DAY = 25;
+export declare const SITE_VISITOR_FILES_PER_DAY = 500;
+/** The true values of the `private` flag, read the way the storage worker reads them. */
+export declare const PRIVATE_FLAG_VALUES: ReadonlyArray<string>;
+/** The extensions a proven type keeps; any other is replaced by the first. */
+export declare const PROVEN_TYPE_EXTENSIONS: Record<string, string[]>;
+/**
+ * Tells the storage worker which policy a forwarded upload gets. Only this
+ * route sends it (the request carries the project key): `visitor` uploads
+ * meet the worker's own allow-list as well as this route's, `trusted` ones
+ * (the store's server code, an admin) upload any type as before. A site
+ * exported before this header existed sends none, and the worker refuses
+ * active content (HTML, SVG, XML, scripts) from it.
+ */
+export declare const UPLOAD_ACCESS_HEADER = "x-teleport-upload-access";
+export declare const generateRuntimeStorageUploadRoute: (options?: {
+    withSessionRevocation?: boolean;
+}) => string;
 //# sourceMappingURL=runtime-storage-generator.d.ts.map

package/dist/cjs/runtime-storage-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-storage-generator.d.ts","sourceRoot":"","sources":["../../src/runtime-storage-generator.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,wBAAwB,kBAAmB,IAAI,MAAM,CAAC,KAAG,OAOrE,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,uBAAuB,SAAS,CAAA;AAE7C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAa,CAAA;AACpE,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAM3D,CAAA;AACD,eAAO,MAAM,sBAAsB,QAAkB,CAAA;AACrD,eAAO,MAAM,iBAAiB,KAAK,CAAA;AAEnC,eAAO,MAAM,iCAAiC,QAAO,MAgSpD,CAAA"}
+{"version":3,"file":"runtime-storage-generator.d.ts","sourceRoot":"","sources":["../../src/runtime-storage-generator.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,wBAAwB,kBAAmB,IAAI,MAAM,CAAC,KAAG,OAOrE,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,uBAAuB,SAAS,CAAA;AAE7C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAa,CAAA;AACpE,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAM3D,CAAA;AACD,eAAO,MAAM,sBAAsB,QAAkB,CAAA;AACrD,eAAO,MAAM,iBAAiB,KAAK,CAAA;AAEnC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAGjE,CAAA;AACD,eAAO,MAAM,yBAAyB,KAAK,CAAA;AAC3C,eAAO,MAAM,0BAA0B,MAAM,CAAA;AAE7C,yFAAyF;AACzF,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAAwB,CAAA;AAE9E,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAM3D,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAA;AAE9D,eAAO,MAAM,iCAAiC,aACnC;IAAE,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAE,KAC3C,MAsfF,CAAA"}

package/dist/cjs/runtime-storage-generator.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateRuntimeStorageUploadRoute = exports.VISITOR_MAX_FILES = exports.VISITOR_MAX_FILE_BYTES = exports.VISITOR_UPLOAD_MIME_TYPES = exports.TRUSTED_UPLOAD_ROLES = exports.UPLOAD_PROXY_TIMEOUT_MS = exports.needsRuntimeStorageRoute = void 0;
+exports.generateRuntimeStorageUploadRoute = exports.UPLOAD_ACCESS_HEADER = exports.PROVEN_TYPE_EXTENSIONS = exports.PRIVATE_FLAG_VALUES = exports.SITE_VISITOR_FILES_PER_DAY = exports.VISITOR_UPLOAD_MB_PER_DAY = exports.VISITOR_UPLOAD_LIMITS = exports.VISITOR_MAX_FILES = exports.VISITOR_MAX_FILE_BYTES = exports.VISITOR_UPLOAD_MIME_TYPES = exports.TRUSTED_UPLOAD_ROLES = exports.UPLOAD_PROXY_TIMEOUT_MS = exports.needsRuntimeStorageRoute = void 0;
 const session_cookie_resolver_1 = require("./session-cookie-resolver");
 const workflow_auth_generator_1 = require("./workflow-auth-generator");
+const security_runtime_1 = require("./security-runtime");
 const FILE_STORAGE_NODE_TYPES = new Set([
     'file-storage-upload',
     'file-storage-list',
@@ -70,7 +71,45 @@ exports.VISITOR_UPLOAD_MIME_TYPES = [
 ];
 exports.VISITOR_MAX_FILE_BYTES = 5 * 1024 * 1024;
 exports.VISITOR_MAX_FILES = 10;
-const generateRuntimeStorageUploadRoute = () => {
+/**
+ * How much one visitor (by address, IPv6 by its /64) and the whole site may
+ * upload, through the shared security runtime:
+ * - VISITOR_UPLOAD_LIMITS: requests, `[limit, windowSeconds]`, checked before
+ *   the body is read;
+ * - VISITOR_UPLOAD_MB_PER_DAY: bytes, counted per file in whole MB (a file
+ *   counts at least 1), after the form passed its checks;
+ * - SITE_VISITOR_FILES_PER_DAY: files from all visitors together, counted only
+ *   for forms that passed, so junk requests cannot pause everyone's uploads.
+ * The storage worker also holds all guests together to their share of the
+ * project's quota. Without these a guest could fill the merchant's quota with
+ * allowed files until the admin's own uploads fail.
+ */
+exports.VISITOR_UPLOAD_LIMITS = [
+    [20, 3600],
+    [60, 86400],
+];
+exports.VISITOR_UPLOAD_MB_PER_DAY = 25;
+exports.SITE_VISITOR_FILES_PER_DAY = 500;
+/** The true values of the `private` flag, read the way the storage worker reads them. */
+exports.PRIVATE_FLAG_VALUES = ['true', '1', 'yes'];
+/** The extensions a proven type keeps; any other is replaced by the first. */
+exports.PROVEN_TYPE_EXTENSIONS = {
+    'image/jpeg': ['.jpg', '.jpeg'],
+    'image/png': ['.png'],
+    'image/webp': ['.webp'],
+    'image/gif': ['.gif'],
+    'application/pdf': ['.pdf'],
+};
+/**
+ * Tells the storage worker which policy a forwarded upload gets. Only this
+ * route sends it (the request carries the project key): `visitor` uploads
+ * meet the worker's own allow-list as well as this route's, `trusted` ones
+ * (the store's server code, an admin) upload any type as before. A site
+ * exported before this header existed sends none, and the worker refuses
+ * active content (HTML, SVG, XML, scripts) from it.
+ */
+exports.UPLOAD_ACCESS_HEADER = 'x-teleport-upload-access';
+const generateRuntimeStorageUploadRoute = (options = {}) => {
     return `var RUNTIME_STORAGE_URL = process.env.RUNTIME_STORAGE_URL;
 var RUNTIME_STORAGE_API_KEY = process.env.RUNTIME_STORAGE_API_KEY;
 var RUNTIME_STORAGE_PROJECT_ID = process.env.RUNTIME_STORAGE_PROJECT_ID;
@@ -79,7 +118,9 @@ var RUNTIME_STORAGE_PROJECT_ID = process.env.RUNTIME_STORAGE_PROJECT_ID;
 // must become a 504, never a request the browser waits on forever.
 var UPLOAD_TIMEOUT_MS = ${exports.UPLOAD_PROXY_TIMEOUT_MS};
 
-${(0, session_cookie_resolver_1.generateCommonJsSessionTokenResolverCode)()}
+${(0, session_cookie_resolver_1.generateCommonJsSessionTokenResolverCode)('../../..', {
+        withRevocation: options.withSessionRevocation !== false,
+    })}
 ${workflow_auth_generator_1.ROLE_OF_TOKEN_CODE}
 
 // What a visitor may upload — see TRUSTED_UPLOAD_ROLES in the generator.
@@ -93,6 +134,14 @@ var VISITOR_MAX_REQUEST_BYTES = VISITOR_MAX_FILES * VISITOR_MAX_FILE_BYTES + 256
 var CRLF = Buffer.from([13, 10]);
 var BLANK_LINE = Buffer.from([13, 10, 13, 10]);
 
+var __security = require('${(0, security_runtime_1.securityRuntimeSpecifier)('../../..')}');
+var VISITOR_UPLOAD_LIMITS = ${JSON.stringify(exports.VISITOR_UPLOAD_LIMITS)};
+var VISITOR_UPLOAD_MB_PER_DAY = ${exports.VISITOR_UPLOAD_MB_PER_DAY};
+var SITE_VISITOR_FILES_PER_DAY = ${exports.SITE_VISITOR_FILES_PER_DAY};
+var PRIVATE_FLAG_VALUES = ${JSON.stringify(exports.PRIVATE_FLAG_VALUES)};
+var PROVEN_TYPE_EXTENSIONS = ${JSON.stringify(exports.PROVEN_TYPE_EXTENSIONS)};
+var UPLOAD_ACCESS_HEADER = '${exports.UPLOAD_ACCESS_HEADER}';
+
 // Only server code can read NEXTAUTH_SECRET, so a browser cannot present it.
 function presentsAppSecret(req) {
   var given = req && req.headers ? req.headers['x-internal-data-secret'] : '';
@@ -155,23 +204,113 @@ function multipartBoundary(contentType) {
   return match ? (match[1] || match[2] || '').trim() : '';
 }
 
+// RFC 7230 token characters: what busboy accepts as a disposition type or a
+// parameter name.
+var TOKEN_CHAR = /[!#$%&'*+.^_\\x60|~0-9A-Za-z-]/;
+
+// A Content-Disposition value read the way busboy (the storage worker's
+// parser) reads it: the type, then ';'-separated parameters whose value is a
+// token, a quoted string (backslash escapes) or, for a name ending in '*', an
+// RFC 5987 extended value (charset'language'percent-encoded). null when it is
+// malformed. Deciding "is this a file" on any other reading lets a part the
+// worker stores as a file pass this route as a plain field.
+function parseDisposition(value) {
+  var i = 0;
+  while (i < value.length && TOKEN_CHAR.test(value[i])) i++;
+  var type = value.slice(0, i).toLowerCase();
+  if (!type) return null;
+  var params = {};
+  while (i < value.length) {
+    while (value[i] === ' ' || value[i] === '\\t') i++;
+    if (i >= value.length) break;
+    if (value[i] !== ';') return null;
+    i++;
+    while (value[i] === ' ' || value[i] === '\\t') i++;
+    var nameStart = i;
+    while (i < value.length && TOKEN_CHAR.test(value[i])) i++;
+    if (i === nameStart || value[i] !== '=') return null;
+    var name = value.slice(nameStart, i).toLowerCase();
+    i++;
+    var paramValue = '';
+    if (name.charAt(name.length - 1) === '*') {
+      var ext = /^([^']*)'[^']*'([^;\\s]*)/.exec(value.slice(i));
+      if (!ext) return null;
+      i += ext[0].length;
+      try {
+        paramValue = /^utf-?8$/i.test(ext[1])
+          ? decodeURIComponent(ext[2])
+          : unescape(ext[2]);
+      } catch (e) {
+        return null;
+      }
+    } else if (value[i] === '"') {
+      i++;
+      var closed = false;
+      while (i < value.length) {
+        var ch = value[i];
+        if (ch === '\\\\' && i + 1 < value.length) {
+          paramValue += value[i + 1];
+          i += 2;
+          continue;
+        }
+        if (ch === '"') {
+          closed = true;
+          i++;
+          break;
+        }
+        paramValue += ch;
+        i++;
+      }
+      if (!closed) return null;
+    } else {
+      var valueStart = i;
+      while (i < value.length && TOKEN_CHAR.test(value[i])) i++;
+      if (i === valueStart) return null;
+      paramValue = value.slice(valueStart, i);
+    }
+    if (!Object.prototype.hasOwnProperty.call(params, name)) params[name] = paramValue;
+  }
+  return { type: type, params: params };
+}
+
+// One part's name, filename and declared type. A file is what the storage
+// worker stores as one: a part whose 'filename*' or 'filename' is not empty
+// ('filename*' first), quoted, unquoted or extended alike. The ambiguous flag marks a
+// part two parsers could read differently (a second disposition, a folded
+// header line, a disposition that is not well-formed form-data); a visitor's
+// form with one is refused.
 function readPart(headerText, data) {
-  var part = { name: '', filename: null, type: '', data: data };
+  var part = { name: '', filename: null, type: '', data: data, ambiguous: false };
+  var sawDisposition = false;
   var lines = headerText.split(String.fromCharCode(13, 10));
   for (var i = 0; i < lines.length; i++) {
+    if (lines[i].charAt(0) === ' ' || lines[i].charAt(0) === '\\t') {
+      part.ambiguous = true;
+      continue;
+    }
     var colon = lines[i].indexOf(':');
     if (colon <= 0) continue;
     var key = lines[i].slice(0, colon).trim().toLowerCase();
     var value = lines[i].slice(colon + 1).trim();
     if (key === 'content-disposition') {
-      var name = /[; ]name="([^"]*)"/i.exec(value);
-      var filename = /filename="([^"]*)"/i.exec(value);
-      part.name = name ? name[1] : '';
-      part.filename = filename ? filename[1] : null;
+      if (sawDisposition) {
+        part.ambiguous = true;
+        continue;
+      }
+      sawDisposition = true;
+      var disposition = parseDisposition(value);
+      if (!disposition || disposition.type !== 'form-data') {
+        part.ambiguous = true;
+        continue;
+      }
+      part.name = disposition.params.name || '';
+      var filename = disposition.params['filename*'] || disposition.params.filename || '';
+      part.filename = filename ? filename : null;
     } else if (key === 'content-type') {
       part.type = value.split(';')[0].trim().toLowerCase();
     }
   }
+  if (!sawDisposition) part.ambiguous = true;
   return part;
 }
 
@@ -215,8 +354,12 @@ function visitorUploadRefusal(parts) {
   var files = 0;
   for (var i = 0; i < parts.length; i++) {
     var part = parts[i];
+    if (part.ambiguous) {
+      return { status: 400, code: 'UPLOAD_INVALID', message: 'The upload is not a file form.' };
+    }
     if (part.filename === null) {
-      if (part.name === 'private' && String(part.data.toString('utf8')).trim() === 'true') {
+      // Every value the storage worker takes as private (true, 1, yes; any case).
+      if (part.name === 'private' && PRIVATE_FLAG_VALUES.indexOf(part.data.toString('utf8').trim().toLowerCase()) !== -1) {
         return { status: 403, code: 'UPLOAD_PRIVATE_FORBIDDEN', message: 'Only the store can upload private files.' };
       }
       continue;
@@ -238,6 +381,103 @@ function visitorUploadRefusal(parts) {
   return null;
 }
 
+// The file's base name with the extension its proven type has: x.html holding
+// PNG bytes is stored as x.png, never under a name that says it is a page.
+function provenFileName(filename, type) {
+  var base = String(filename).split(/[\\\\/]/).pop() || 'file';
+  var allowed = PROVEN_TYPE_EXTENSIONS[type] || [];
+  var dot = base.lastIndexOf('.');
+  var ext = dot > 0 ? base.slice(dot).toLowerCase() : '';
+  if (allowed.indexOf(ext) !== -1) return base;
+  var stem = dot > 0 ? base.slice(0, dot) : base;
+  var stemDot = stem.lastIndexOf('.');
+  if (stemDot > 0 && allowed.indexOf(stem.slice(stemDot).toLowerCase()) !== -1) return stem;
+  return (stem || 'file') + (allowed[0] || '');
+}
+
+// Header-safe: no quote, backslash or control character survives.
+function headerSafe(text) {
+  return String(text).replace(/["\\\\\\u0000-\\u001f\\u007f]/g, '_');
+}
+
+// The checked form, written afresh: one quoted disposition per part, each
+// file with the type its bytes proved and its base name, under a boundary of
+// our own. The storage worker parses this and nothing else, so what it stores
+// is exactly what visitorUploadRefusal passed — not a second reading of the
+// visitor's bytes. null when the boundary cannot be made unique.
+function serializeVisitorForm(parts) {
+  for (var attempt = 0; attempt < 3; attempt++) {
+    var boundary = '----tqupload' + require('crypto').randomBytes(16).toString('hex');
+    var marker = Buffer.from('--' + boundary);
+    var clash = false;
+    var chunks = [];
+    for (var i = 0; i < parts.length && !clash; i++) {
+      var part = parts[i];
+      if (part.data.indexOf(marker) !== -1) {
+        clash = true;
+        break;
+      }
+      var head = '--' + boundary + '\\r\\nContent-Disposition: form-data; name="' + headerSafe(part.name) + '"';
+      if (part.filename !== null) {
+        var type = sniffMimeType(part.data);
+        head += '; filename="' + headerSafe(provenFileName(part.filename, type)) + '"\\r\\nContent-Type: ' + type;
+      }
+      chunks.push(Buffer.from(head + '\\r\\n\\r\\n', 'utf8'), part.data, CRLF);
+    }
+    if (clash) continue;
+    chunks.push(Buffer.from('--' + boundary + '--\\r\\n'));
+    return { boundary: boundary, body: Buffer.concat(chunks) };
+  }
+  return null;
+}
+
+// A visitor's request allowance, before the body is read.
+// false = the 429 is already sent.
+async function visitorMayUpload(req, res) {
+  for (var i = 0; i < VISITOR_UPLOAD_LIMITS.length; i++) {
+    var ok = await __security.rateLimitRequest(req, res, {
+      scope: 'runtime-storage-upload',
+      limit: VISITOR_UPLOAD_LIMITS[i][0],
+      windowSeconds: VISITOR_UPLOAD_LIMITS[i][1],
+    });
+    if (!ok) return false;
+  }
+  return true;
+}
+
+// A checked form's cost, per file: its size in whole MB out of the visitor's
+// daily byte budget, then one file out of the site's daily visitor files.
+// false = the 429 is already sent.
+async function visitorMayStore(req, res, parts) {
+  var files = 0;
+  for (var i = 0; i < parts.length; i++) {
+    if (parts[i].filename === null) continue;
+    files += 1;
+    var units = Math.max(1, Math.ceil(parts[i].data.length / 1048576));
+    for (var u = 0; u < units; u++) {
+      var ok = await __security.rateLimitRequest(req, res, {
+        scope: 'runtime-storage-upload-mb',
+        limit: VISITOR_UPLOAD_MB_PER_DAY,
+        windowSeconds: 86400,
+      });
+      if (!ok) return false;
+    }
+  }
+  for (var f = 0; f < files; f++) {
+    var site = await __security.rateLimit({
+      key: 'site:visitor-uploads',
+      limit: SITE_VISITOR_FILES_PER_DAY,
+      windowSeconds: 86400,
+    });
+    if (!site.allowed) {
+      res.setHeader('Retry-After', String(site.retryAfter));
+      refuse(res, 429, 'UPLOAD_LIMIT_REACHED', 'Uploads are paused for now. Please try again later.');
+      return false;
+    }
+  }
+  return true;
+}
+
 module.exports = async function handler(req, res) {
   if (req.method !== 'POST') {
     res.status(405).json({ error: 'Method not allowed' });
@@ -252,8 +492,10 @@ module.exports = async function handler(req, res) {
   var trusted = await isTrustedUploader(req);
   var body = req;
   var contentLength = req.headers['content-length'];
+  var contentType = req.headers['content-type'];
 
   if (!trusted) {
+    if (!(await visitorMayUpload(req, res))) return;
     var declaredLength = parseInt(contentLength, 10);
     if (!isNaN(declaredLength) && declaredLength > VISITOR_MAX_REQUEST_BYTES) {
       refuse(res, 413, 'UPLOAD_TOO_LARGE', 'The upload is too large.');
@@ -284,6 +526,14 @@ module.exports = async function handler(req, res) {
       refuse(res, refusal.status, refusal.code, refusal.message);
       return;
     }
+    if (!(await visitorMayStore(req, res, parts))) return;
+    var checked = serializeVisitorForm(parts);
+    if (!checked) {
+      refuse(res, 400, 'UPLOAD_INVALID', 'The upload could not be read.');
+      return;
+    }
+    body = checked.body;
+    contentType = 'multipart/form-data; boundary=' + checked.boundary;
     contentLength = String(body.length);
   }
 
@@ -300,9 +550,12 @@ module.exports = async function handler(req, res) {
     var headers = {
       'Authorization': 'Bearer ' + RUNTIME_STORAGE_API_KEY,
     };
+    // Which of the storage worker's policies this upload gets (only this
+    // server can send it: the request carries the project key).
+    headers[UPLOAD_ACCESS_HEADER] = trusted ? 'trusted' : 'visitor';
 
-    if (req.headers['content-type']) {
-      headers['content-type'] = req.headers['content-type'];
+    if (contentType) {
+      headers['content-type'] = contentType;
     }
     if (contentLength) {
       headers['content-length'] = contentLength;
@@ -312,7 +565,7 @@ module.exports = async function handler(req, res) {
       method: 'POST',
       headers: headers,
       // A trusted caller's form is streamed through untouched; a visitor's was
-      // read in full to be checked, and is forwarded byte for byte.
+      // read in full, checked, and is forwarded as the form it was checked as.
       body: body,
       duplex: 'half',
       signal: controller.signal,

package/dist/cjs/runtime-storage-generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-storage-generator.js","sourceRoot":"","sources":["../../src/runtime-storage-generator.ts"],"names":[],"mappings":";;;AAAA,uEAAoF;AACpF,uEAA8D;AAE9D,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,qBAAqB;IACrB,mBAAmB;IACnB,0BAA0B;IAC1B,qBAAqB;CACtB,CAAC,CAAA;AAEK,MAAM,wBAAwB,GAAG,CAAC,aAA0B,EAAW,EAAE;IAC9E,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE;QAC9B,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YACnC,OAAO,IAAI,CAAA;SACZ;KACF;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAPY,QAAA,wBAAwB,4BAOpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,uBAAuB,GAAG,MAAM,CAAA;AAE7C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACU,QAAA,oBAAoB,GAA0B,CAAC,OAAO,CAAC,CAAA;AACvD,QAAA,yBAAyB,GAA0B;IAC9D,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,iBAAiB;CAClB,CAAA;AACY,QAAA,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACxC,QAAA,iBAAiB,GAAG,EAAE,CAAA;AAE5B,MAAM,iCAAiC,GAAG,GAAW,EAAE;IAC5D,OAAO;;;;;;0BAMiB,+BAAuB;;EAE/C,IAAA,kEAAwC,GAAE;EAC1C,4CAAkB;;;6BAGS,IAAI,CAAC,SAAS,CAAC,4BAAoB,CAAC;kCAC/B,IAAI,CAAC,SAAS,CAAC,iCAAyB,CAAC;+BAC5C,8BAAsB;0BAC3B,yBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+Q1C,CAAA;AACD,CAAC,CAAA;AAhSY,QAAA,iCAAiC,qCAgS7C"}
+{"version":3,"file":"runtime-storage-generator.js","sourceRoot":"","sources":["../../src/runtime-storage-generator.ts"],"names":[],"mappings":";;;AAAA,uEAAoF;AACpF,uEAA8D;AAC9D,yDAA6D;AAE7D,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,qBAAqB;IACrB,mBAAmB;IACnB,0BAA0B;IAC1B,qBAAqB;CACtB,CAAC,CAAA;AAEK,MAAM,wBAAwB,GAAG,CAAC,aAA0B,EAAW,EAAE;IAC9E,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE;QAC9B,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YACnC,OAAO,IAAI,CAAA;SACZ;KACF;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAPY,QAAA,wBAAwB,4BAOpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,uBAAuB,GAAG,MAAM,CAAA;AAE7C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACU,QAAA,oBAAoB,GAA0B,CAAC,OAAO,CAAC,CAAA;AACvD,QAAA,yBAAyB,GAA0B;IAC9D,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,iBAAiB;CAClB,CAAA;AACY,QAAA,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACxC,QAAA,iBAAiB,GAAG,EAAE,CAAA;AAEnC;;;;;;;;;;;;GAYG;AACU,QAAA,qBAAqB,GAAoC;IACpE,CAAC,EAAE,EAAE,IAAI,CAAC;IACV,CAAC,EAAE,EAAE,KAAK,CAAC;CACZ,CAAA;AACY,QAAA,yBAAyB,GAAG,EAAE,CAAA;AAC9B,QAAA,0BAA0B,GAAG,GAAG,CAAA;AAE7C,yFAAyF;AAC5E,QAAA,mBAAmB,GAA0B,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;AAE9E,8EAA8E;AACjE,QAAA,sBAAsB,GAA6B;IAC9D,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,CAAC,MAAM,CAAC;IACrB,YAAY,EAAE,CAAC,OAAO,CAAC;IACvB,WAAW,EAAE,CAAC,MAAM,CAAC;IACrB,iBAAiB,EAAE,CAAC,MAAM,CAAC;CAC5B,CAAA;AAED;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAG,0BAA0B,CAAA;AAEvD,MAAM,iCAAiC,GAAG,CAC/C,UAA+C,EAAE,EACzC,EAAE;IACV,OAAO;;;;;;0BAMiB,+BAAuB;;EAE/C,IAAA,kEAAwC,EAAC,UAAU,EAAE;QACrD,cAAc,EAAE,OAAO,CAAC,qBAAqB,KAAK,KAAK;KACxD,CAAC;EACA,4CAAkB;;;6BAGS,IAAI,CAAC,SAAS,CAAC,4BAAoB,CAAC;kCAC/B,IAAI,CAAC,SAAS,CAAC,iCAAyB,CAAC;+BAC5C,8BAAsB;0BAC3B,yBAAiB;;;;;;;4BAOf,IAAA,2CAAwB,EAAC,UAAU,CAAC;8BAClC,IAAI,CAAC,SAAS,CAAC,6BAAqB,CAAC;kCACjC,iCAAyB;mCACxB,kCAA0B;4BACjC,IAAI,CAAC,SAAS,CAAC,2BAAmB,CAAC;+BAChC,IAAI,CAAC,SAAS,CAAC,8BAAsB,CAAC;8BACvC,4BAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsdjD,CAAA;AACD,CAAC,CAAA;AAxfY,QAAA,iCAAiC,qCAwf7C"}

package/dist/cjs/security-runtime/index.d.ts

@@ -0,0 +1,14 @@
+import { ProjectPluginStructure } from '@teleporthq/teleport-types';
+export { generateSecurityRuntimeCode, RATE_LIMITS_TABLE, SECURITY_RUNTIME_FILE_KEY, SECURITY_RUNTIME_FILE_NAME, SECURITY_RUNTIME_PATH, securityRuntimeSpecifier, TOO_MANY_REQUESTS_MESSAGE, } from './security-runtime-code';
+/**
+ * Writes `utils/security-runtime.js` into the project, once. The workflow
+ * project plugin calls it for every app with server routes; an emitter whose
+ * route can exist in an app without them calls it where it emits the route
+ * that `require`s the module.
+ *
+ * The module is the same for every app (it finds the database at run time);
+ * the `pg` driver is added only when the project's database is Postgres,
+ * through the same driver map auth and invoices use.
+ */
+export declare const ensureSecurityRuntimeModule: (structure: ProjectPluginStructure) => void;
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/security-runtime/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security-runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAU7E,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAA;AAEhC;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,cAAe,sBAAsB,KAAG,IAsB/E,CAAA"}

package/dist/cjs/security-runtime/index.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureSecurityRuntimeModule = exports.TOO_MANY_REQUESTS_MESSAGE = exports.securityRuntimeSpecifier = exports.SECURITY_RUNTIME_PATH = exports.SECURITY_RUNTIME_FILE_NAME = exports.SECURITY_RUNTIME_FILE_KEY = exports.RATE_LIMITS_TABLE = exports.generateSecurityRuntimeCode = void 0;
+const teleport_types_1 = require("@teleporthq/teleport-types");
+const auth_generator_1 = require("../auth-generator");
+const resolve_data_source_1 = require("../invoice/resolve-data-source");
+const security_runtime_code_1 = require("./security-runtime-code");
+var security_runtime_code_2 = require("./security-runtime-code");
+Object.defineProperty(exports, "generateSecurityRuntimeCode", { enumerable: true, get: function () { return security_runtime_code_2.generateSecurityRuntimeCode; } });
+Object.defineProperty(exports, "RATE_LIMITS_TABLE", { enumerable: true, get: function () { return security_runtime_code_2.RATE_LIMITS_TABLE; } });
+Object.defineProperty(exports, "SECURITY_RUNTIME_FILE_KEY", { enumerable: true, get: function () { return security_runtime_code_2.SECURITY_RUNTIME_FILE_KEY; } });
+Object.defineProperty(exports, "SECURITY_RUNTIME_FILE_NAME", { enumerable: true, get: function () { return security_runtime_code_2.SECURITY_RUNTIME_FILE_NAME; } });
+Object.defineProperty(exports, "SECURITY_RUNTIME_PATH", { enumerable: true, get: function () { return security_runtime_code_2.SECURITY_RUNTIME_PATH; } });
+Object.defineProperty(exports, "securityRuntimeSpecifier", { enumerable: true, get: function () { return security_runtime_code_2.securityRuntimeSpecifier; } });
+Object.defineProperty(exports, "TOO_MANY_REQUESTS_MESSAGE", { enumerable: true, get: function () { return security_runtime_code_2.TOO_MANY_REQUESTS_MESSAGE; } });
+/**
+ * Writes `utils/security-runtime.js` into the project, once. The workflow
+ * project plugin calls it for every app with server routes; an emitter whose
+ * route can exist in an app without them calls it where it emits the route
+ * that `require`s the module.
+ *
+ * The module is the same for every app (it finds the database at run time);
+ * the `pg` driver is added only when the project's database is Postgres,
+ * through the same driver map auth and invoices use.
+ */
+const ensureSecurityRuntimeModule = (structure) => {
+    const { files, dependencies } = structure;
+    if (files.has(security_runtime_code_1.SECURITY_RUNTIME_FILE_KEY)) {
+        return;
+    }
+    files.set(security_runtime_code_1.SECURITY_RUNTIME_FILE_KEY, {
+        path: security_runtime_code_1.SECURITY_RUNTIME_PATH,
+        files: [
+            {
+                name: security_runtime_code_1.SECURITY_RUNTIME_FILE_NAME,
+                fileType: teleport_types_1.FileType.JS,
+                content: (0, security_runtime_code_1.generateSecurityRuntimeCode)(),
+            },
+        ],
+    });
+    const { dataSourceType } = (0, resolve_data_source_1.resolveInvoiceDataSource)(structure);
+    const driverDeps = (0, auth_generator_1.getDatabaseDriverDependencies)(dataSourceType);
+    if ('pg' in driverDeps && !dependencies.pg) {
+        dependencies.pg = driverDeps.pg;
+    }
+};
+exports.ensureSecurityRuntimeModule = ensureSecurityRuntimeModule;
+//# sourceMappingURL=index.js.map

package/dist/cjs/security-runtime/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security-runtime/index.ts"],"names":[],"mappings":";;;AAAA,+DAA6E;AAC7E,sDAAiE;AACjE,wEAAyE;AACzE,mEAKgC;AAEhC,iEAQgC;AAP9B,oIAAA,2BAA2B,OAAA;AAC3B,0HAAA,iBAAiB,OAAA;AACjB,kIAAA,yBAAyB,OAAA;AACzB,mIAAA,0BAA0B,OAAA;AAC1B,8HAAA,qBAAqB,OAAA;AACrB,iIAAA,wBAAwB,OAAA;AACxB,kIAAA,yBAAyB,OAAA;AAG3B;;;;;;;;;GASG;AACI,MAAM,2BAA2B,GAAG,CAAC,SAAiC,EAAQ,EAAE;IACrF,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,SAAS,CAAA;IACzC,IAAI,KAAK,CAAC,GAAG,CAAC,iDAAyB,CAAC,EAAE;QACxC,OAAM;KACP;IAED,KAAK,CAAC,GAAG,CAAC,iDAAyB,EAAE;QACnC,IAAI,EAAE,6CAAqB;QAC3B,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,kDAA0B;gBAChC,QAAQ,EAAE,yBAAQ,CAAC,EAAE;gBACrB,OAAO,EAAE,IAAA,mDAA2B,GAAE;aACvC;SACF;KACF,CAAC,CAAA;IAEF,MAAM,EAAE,cAAc,EAAE,GAAG,IAAA,8CAAwB,EAAC,SAAS,CAAC,CAAA;IAC9D,MAAM,UAAU,GAAG,IAAA,8CAA6B,EAAC,cAAc,CAAC,CAAA;IAChE,IAAI,IAAI,IAAI,UAAU,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE;QAC1C,YAAY,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAA;KAChC;AACH,CAAC,CAAA;AAtBY,QAAA,2BAA2B,+BAsBvC"}

package/dist/cjs/security-runtime/security-runtime-code.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Where the shared security runtime lives in the generated project
+ * (`utils/security-runtime.js`), and the table its rate limits keep.
+ */
+export declare const SECURITY_RUNTIME_FILE_KEY = "security-runtime";
+export declare const SECURITY_RUNTIME_PATH: string[];
+export declare const SECURITY_RUNTIME_FILE_NAME = "security-runtime";
+export declare const RATE_LIMITS_TABLE = "teleport_rate_limits";
+/** What `rateLimitRequest` answers a refused request, with a 429. */
+export declare const TOO_MANY_REQUESTS_MESSAGE = "Too many requests. Try again later.";
+/**
+ * The `require` specifier of the runtime from a generated file whose folder
+ * is `relativePrefix` below the project root: `'../../..'` for
+ * `pages/api/<folder>/<route>.js`, `'../..'` for `pages/api/<route>.js` and
+ * for `utils/workflows/server-runtime.js`.
+ */
+export declare const securityRuntimeSpecifier: (relativePrefix: string) => string;
+/**
+ * Emits `utils/security-runtime.js` — the one place the generated app's
+ * server code takes the visitor's address, compares secrets, counts rate
+ * limits and answers errors from.
+ *
+ * - `clientIp(req)` reads the address only where the host guarantees it: on
+ *   Vercel the headers its edge sets; elsewhere `X-Forwarded-For` only when
+ *   the connection comes from a proxy on a private address, and only the hop
+ *   that proxy appended; otherwise the socket address. A visitor-written hop
+ *   is never read. `TQ_TRUSTED_PROXY` (`private` default | `vercel` | `none`)
+ *   lets a self-hoster narrow that (see the emitted header).
+ * - `safeEqual(a, b)` is a constant-time compare that is false for anything
+ *   missing, empty or of another length, and never throws.
+ * - `visitorKey(ip)` is the visitor an address stands for: an IPv4 address
+ *   itself, an IPv6 one its /64 (an IPv4 tail counted as the two groups it
+ *   fills). Every rate limit keyed by visitor uses it.
+ * - `rateLimit` counts fixed windows in the app's Postgres database (table
+ *   `teleport_rate_limits`, created on first use under an advisory lock), so
+ *   every instance of a serverless app counts together. Only an app with no
+ *   database (or no `pg` driver) counts in a bounded per-instance map; a
+ *   database error counts in that map for a short while and is logged once.
+ *   A request waits on the database at most 1.5 s; after a failure one
+ *   request at a time probes it. Keys are stored as `<windowSeconds>:<sha256>`,
+ *   so no address or email reaches the table; each row carries its indexed
+ *   `expires_at`, and an unawaited cleanup deletes windows that are over.
+ * - `rateLimitRequest` keys by route scope, visitor (an IPv6 visitor by its
+ *   /64) and optional parts, and answers a refusal with a 429 itself.
+ * - `sendClientError` answers `{ error, id }` with a generic message and logs
+ *   the detail under the same opaque id, server-side only.
+ *
+ * One module for every app: whether a database is there is read at run time
+ * (`TELEPORT_DB_CONNECTION_STRING` / `TELEPORT_DB_HOST` and the driver), and
+ * the driver is loaded on first use, so an app without `pg` still builds.
+ */
+export declare const generateSecurityRuntimeCode: () => string;
+//# sourceMappingURL=security-runtime-code.d.ts.map

package/dist/cjs/security-runtime/security-runtime-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-runtime-code.d.ts","sourceRoot":"","sources":["../../../src/security-runtime/security-runtime-code.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAA;AAC3D,eAAO,MAAM,qBAAqB,UAAY,CAAA;AAC9C,eAAO,MAAM,0BAA0B,qBAAqB,CAAA;AAC5D,eAAO,MAAM,iBAAiB,yBAAyB,CAAA;AAEvD,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,wCAAwC,CAAA;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,mBAAoB,MAAM,KAAG,MACoB,CAAA;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,2BAA2B,QAAO,MAygB9C,CAAA"}