@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/__tests__/cost-bearing-node-types.test.ts

@@ -0,0 +1,119 @@
+import { nodeRegistry } from '../src/nodes'
+import {
+  COST_BEARING_NODE_TYPES,
+  isCostBearingNodeType,
+} from '../src/nodes/cost-bearing-node-types'
+
+// A server segment that runs a node spending the site's money (an AI model, a
+// mail / SMS / payment provider) or reaching a URL the site does not own is
+// rate-limited per visitor. Which nodes those are is one set beside the
+// registry; this reads every registered node's server source and fails when a
+// node of that kind is missing from it, so a new one cannot ship ungated.
+
+/** Server nodes whose only `fetch` goes to the site's own routes or a TeleportHQ platform service. */
+const PLATFORM_ONLY_FETCH = new Set([
+  'analytics-track-outcome',
+  'cache-invalidate',
+  'cart-price-order',
+  'data-count',
+  'data-create-item',
+  'data-delete-item',
+  'data-raw-query',
+  'data-select',
+  'data-update-item',
+  'ecommerce-generate-invoice',
+  'ecommerce-get-settings',
+  'file-storage-delete',
+  'file-storage-get-details',
+  'file-storage-list',
+  'page-revalidate',
+  'realtime-send-channel-event',
+  'realtime-send-channel-message',
+])
+
+const PROVIDER_SDKS =
+  /require\(['"](?:openai|@anthropic-ai\/sdk|@google\/generative-ai|@mistralai\/mistralai|cohere-ai|@sendgrid\/mail|mailgun\.js|mailersend|postmark|resend|twilio|stripe|airtable)['"]\)/
+
+const serverSourceOf = (type: string): string => {
+  const generator = nodeRegistry[type]
+  if (generator.executionEnv === 'client' && !generator.generateServerHandler) {
+    return ''
+  }
+  return generator.generateServerHandler
+    ? generator.generateServerHandler({ relativePrefix: '../../..' })
+    : generator.generateHandler()
+}
+
+const reachesOutside = (type: string, source: string): string | null => {
+  if (/__ai_resolveToken|__ai_callProvider|__ai_enforceCallBudget/.test(source)) {
+    return 'calls an AI provider'
+  }
+  if (PROVIDER_SDKS.test(source)) {
+    return 'loads a provider SDK'
+  }
+  if (/https?:\/\/(?!localhost)[a-z0-9-]+\.[a-z0-9.-]+/i.test(source)) {
+    return 'names an outbound URL'
+  }
+  if (/\bfetch\s*\(/.test(source) && !PLATFORM_ONLY_FETCH.has(type)) {
+    return 'fetches a URL'
+  }
+  return null
+}
+
+describe('cost-bearing node types', () => {
+  it('names every registered node that spends money or reaches outside the site', () => {
+    const missing: string[] = []
+    for (const type of Object.keys(nodeRegistry).sort()) {
+      const why = reachesOutside(type, serverSourceOf(type))
+      if (why && !COST_BEARING_NODE_TYPES.has(type)) {
+        missing.push(`${type} (${why})`)
+      }
+    }
+    expect(missing).toEqual([])
+  })
+
+  it('names every AI, mail, SMS, payment and integration node of the registry', () => {
+    const prefixed = Object.keys(nodeRegistry).filter((type) =>
+      /^(ai|email|sms|payment|integration)-/.test(type)
+    )
+    expect(prefixed.length).toBeGreaterThan(20)
+    for (const type of prefixed) {
+      expect(COST_BEARING_NODE_TYPES.has(type)).toBe(true)
+    }
+  })
+
+  it('keeps every outbound node it names, the ones the source heuristic cannot see included', () => {
+    // general-http-request, utility-youtube-transcript and utility-ocr-extract-text
+    // reach outside through calls the heuristic above does not recognise: only
+    // this list catches one of them being dropped from the set.
+    const outbound = [
+      'general-http-request',
+      'utility-scrape-website',
+      'utility-extract-links',
+      'utility-pdf-extract-text',
+      'utility-youtube-transcript',
+      'utility-ocr-extract-text',
+      'utility-similarity-scoring',
+      'transform-image',
+      'transform-color',
+      'transform-geolocation',
+      'push-send-notification',
+    ]
+    for (const type of outbound) {
+      expect([type, COST_BEARING_NODE_TYPES.has(type)]).toEqual([type, true])
+    }
+  })
+
+  it('counts the embedding similarity node and any unknown node named like a cost-bearing one', () => {
+    expect(isCostBearingNodeType('utility-similarity-scoring')).toBe(true)
+    expect(isCostBearingNodeType('ai-some-future-model')).toBe(true)
+    expect(isCostBearingNodeType('general-custom-js')).toBe(false)
+    expect(isCostBearingNodeType('data-select')).toBe(false)
+  })
+
+  it('counts the embedding similarity node against the site AI budget on the server', () => {
+    const source = serverSourceOf('utility-similarity-scoring')
+    expect(source).toContain('await __ai_enforceCallBudget()')
+    expect(source).toContain("require('../../../utils/security-runtime')")
+  })
+})

package/__tests__/credential-columns-reply.test.ts

@@ -59,6 +59,15 @@ function bootDataRoute(rows: Array<Record<string, unknown>>) {
     if (name === 'next-auth/jwt') {
       return { getToken: async () => ({ id: 'u-1' }) }
     }
+    if (/(^|\/)security-runtime$/.test(name)) {
+      return {
+        safeEqual: (given: unknown, expected: unknown) =>
+          typeof given === 'string' &&
+          typeof expected === 'string' &&
+          given !== '' &&
+          given === expected,
+      }
+    }
     throw new Error('unexpected require: ' + name)
   }
   new Function('require', 'module', 'exports', 'process', 'console', code)(

package/__tests__/credential-result-reply.test.ts

@@ -10,6 +10,7 @@ import { splitIntoSegments } from '../src/segment-splitter'
 import { buildSegmentTrust } from '../src/segment-trust'
 import type { WorkflowSegment } from '../src/types'
 import { loadServerRuntime } from './_helpers/load-server-runtime'
+import { isSecurityRuntimeSpecifier, loadSecurityRuntime } from './_helpers/load-security-runtime'
 
 /**
  * The result of the password-hashing node is a credential: a server segment
@@ -103,12 +104,17 @@ function bootRoute(segment: WorkflowSegment, graph: Graph) {
     ? generateStreamingServerSegmentAPIRoute(segment, 'Flow', undefined, options)
     : generateServerSegmentAPIRoute(segment, 'Flow', undefined, options)
   const runtime = loadServerRuntime()
+  const security = loadSecurityRuntime()
   const modules: Record<string, unknown> = { bcryptjs: fakeBcrypt, crypto, openai: FakeOpenAI }
   const routeModule: { exports: unknown } = { exports: {} }
   new Function('module', 'exports', 'require', source)(
     routeModule,
     routeModule.exports,
-    (id: string) => (id.endsWith('server-runtime') ? runtime : modules[id] || {})
+    (id: string) => {
+      if (id.endsWith('server-runtime')) return runtime
+      if (isSecurityRuntimeSpecifier(id)) return security
+      return modules[id] || {}
+    }
   )
   const handler = routeModule.exports as (req: unknown, res: unknown) => Promise<void>
   return async (context: Context): Promise<RouteReply> => {
@@ -470,7 +476,7 @@ describe('the other ways a hash could reach the browser', () => {
   it('a loop that maps passwords to hashes replies its results sealed', async () => {
     const loop = graphOf(
       [
-        step('each', 'general-loop', 1, { collection: ['First-1', 'Second-2'], loopType: 'map' }),
+        step('each', 'general-loop', 1, { collection: ['First-12', 'Second-2'], loopType: 'map' }),
         step('hash', 'account-hash-password', 2, { password: ref('each', 'currentItem') }),
       ],
       [edge('each', 'hash', 'loop')]
@@ -481,14 +487,22 @@ describe('the other ways a hash could reach the browser', () => {
     expect(reply.text).not.toMatch(BCRYPT_SHAPED)
     expect(reply.body?.results?.each).toEqual({ __sealed: expect.any(String) })
 
+    const trust = buildSegmentTrust(segment, loop)
     const runtime = loadServerRuntime()
     const relayed = JSON.parse(JSON.stringify(reply.body?.results))
     runtime.claimSegmentContext(
-      { nodes: [], edges: [], entryNodeIds: [], signedNodeIds: ['each', 'hash'] },
+      {
+        nodes: [],
+        edges: [],
+        entryNodeIds: [],
+        workflowId: trust.workflowId,
+        signedNodeIds: ['each', 'hash'],
+        signedBy: { each: segment.id, hash: segment.id },
+      },
       relayed
     )
     expect(relayed.each.results).toEqual([
-      { hash: hashOf('First-1') },
+      { hash: hashOf('First-12') },
       { hash: hashOf('Second-2') },
     ])
   })
@@ -496,7 +510,7 @@ describe('the other ways a hash could reach the browser', () => {
   it('a loop that only repeats the hash keeps its count readable', async () => {
     const loop = graphOf(
       [
-        step('each', 'general-loop', 1, { collection: ['First-1'], loopType: 'forEach' }),
+        step('each', 'general-loop', 1, { collection: ['First-12'], loopType: 'forEach' }),
         step('hash', 'account-hash-password', 2, { password: ref('each', 'currentItem') }),
       ],
       [edge('each', 'hash', 'loop')]

package/__tests__/cron-route-loop-templateparams.test.ts

@@ -140,9 +140,12 @@ describe('generateCronAPIRoute — loop + templateParams support', () => {
     // workflow's email node runs) without it, shipping literal `{{token}}`s.
     const runtime = generateSharedRuntimeUtilsCode()
     expect(runtime).toContain('applyTemplateParams(resolved.body, resolved.templateParams)')
-    expect(runtime).toContain('applyTemplateParams(resolved.subject, resolved.templateParams)')
-    // …and the route reaches it simply by calling resolveConfig.
-    expect(route).toContain('const resolveConfig = utils.resolveConfig')
+    expect(runtime).toContain(
+      'applyTemplateParams(resolved.subject, resolved.templateParams, true)'
+    )
+    // …and the route reaches it through resolveNodeConfig, which resolves
+    // with it (and keeps code fields as the author wrote them).
+    expect(route).toContain('const resolveNodeConfig = utils.resolveNodeConfig')
     // No stale per-site copy left behind to drift out of sync.
     expect(route).not.toContain('utils.applyTemplateParams(')
   })

package/__tests__/custom-js-authored-code.test.ts

@@ -0,0 +1,304 @@
+import { generateServerSegmentAPIRoute } from '../src/api-route-generator'
+import { generateSharedRuntimeUtilsCode } from '../src/executor-generator'
+import { assertWorkflowsAreSecure, CodegenSecurityError } from '../src/security-scanner'
+import { findProjectCodeViolations } from '../src/project-code-scanner'
+import type { WorkflowSegment } from '../src/types'
+import { loadServerRuntime } from './_helpers/load-server-runtime'
+
+/**
+ * A custom-JS step's code, and a condition's mode, are only ever what the
+ * author wrote. The runtime resolves every config field before a handler runs:
+ * a step whose code is `{{state.code}}` used to compile the code a visitor's
+ * request carried in its page state, which reached the real `process` through
+ * a `.constructor` escape (the precheck review's probe). The generated route
+ * now drops code that is not authored text, and the code generator refuses to
+ * generate it.
+ */
+
+const SECRET = 'postgres://REAL-SECRET'
+const scope = globalThis as Record<string, unknown>
+const ESCAPE =
+  "function customHandler(params) { var p = (function(){}).constructor('return process')(); return { leak: p.env.TELEPORT_DB_CONNECTION_STRING }; }"
+
+const originalSecret = process.env.TELEPORT_DB_CONNECTION_STRING
+beforeEach(() => {
+  process.env.TELEPORT_DB_CONNECTION_STRING = SECRET
+  delete scope.__tqModePwned
+})
+afterAll(() => {
+  if (originalSecret === undefined) {
+    delete process.env.TELEPORT_DB_CONNECTION_STRING
+  } else {
+    process.env.TELEPORT_DB_CONNECTION_STRING = originalSecret
+  }
+  delete scope.__tqModePwned
+})
+
+const segmentOf = (nodes: any[]): WorkflowSegment => ({
+  id: 'server-1',
+  env: 'server',
+  nodeIds: nodes.map((n) => n.id),
+  nodes,
+  edges: [],
+  entryNodeIds: [nodes[0].id],
+})
+
+/** The generated segment route, run with the server runtime, answering a visitor's request. */
+async function runRoute(segment: WorkflowSegment, context: Record<string, unknown>) {
+  const runtime = loadServerRuntime()
+  const requireStub = (id: string) => (id.endsWith('server-runtime') ? runtime : {})
+  const routeModule: { exports: any } = { exports: {} }
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  new Function('module', 'exports', 'require', generateServerSegmentAPIRoute(segment, 'Quote'))(
+    routeModule,
+    routeModule.exports,
+    requireStub
+  )
+  const reply = { status: 0, body: null as any }
+  const res = {
+    status(code: number) {
+      reply.status = code
+      return this
+    },
+    json(payload: unknown) {
+      reply.body = payload
+      return this
+    },
+  }
+  await (routeModule.exports as (req: unknown, res: unknown) => Promise<void>)(
+    { method: 'POST', body: { context }, headers: { host: 'localhost:3000' } },
+    res
+  )
+  return reply
+}
+
+describe('a custom-JS step runs only the code the author wrote', () => {
+  it.each([
+    ['a {{state.…}} token', '{{state.code}}'],
+    [
+      'a page-state reference',
+      { type: 'workflowContext', nodeId: '__stateValues', path: ['__stateValues', 'code'] },
+    ],
+  ])('never compiles a visitor’s code bound by %s', async (_kind, code) => {
+    const reply = await runRoute(
+      segmentOf([
+        {
+          id: 'q-js',
+          type: 'general-custom-js',
+          label: 'Shape quote',
+          stepNumber: 1,
+          config: { code, context: 'server' },
+        },
+      ]),
+      { __stateValues: { code: ESCAPE } }
+    )
+    expect(JSON.stringify(reply.body)).not.toContain(SECRET)
+    expect(reply.body?.results?.['q-js']?.leak).toBeUndefined()
+  })
+
+  it('still runs the code the author wrote', async () => {
+    const reply = await runRoute(
+      segmentOf([
+        {
+          id: 'q-js',
+          type: 'general-custom-js',
+          label: 'Shape quote',
+          stepNumber: 1,
+          config: {
+            code: 'function customHandler(params) { return { total: 42 }; }',
+            context: 'server',
+          },
+        },
+      ]),
+      {}
+    )
+    expect(reply.status).toBe(200)
+    expect(reply.body.results['q-js']).toEqual({ total: 42 })
+  })
+})
+
+describe('a condition’s mode is the one the author wrote', () => {
+  const utils: { exports: Record<string, any> } = { exports: {} }
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval
+  new Function('module', 'exports', generateSharedRuntimeUtilsCode())(utils, utils.exports)
+  const runtime = utils.exports
+  const PAYLOAD = '(globalThis.__tqModePwned = true)'
+
+  it('an if step whose mode is a token never compiles its condition', () => {
+    const authored = { conditionType: '{{state.mode}}', condition: PAYLOAD }
+    const context = { __stateValues: { mode: 'expression' } }
+    const resolved = runtime.resolveConfig(authored, context)
+    expect(resolved.conditionType).toBe('expression')
+    runtime.evaluateCondition(resolved, context, authored)
+    expect(scope.__tqModePwned).toBeUndefined()
+  })
+
+  it('a switch whose mode is a reference never compiles its cases', () => {
+    const authored = {
+      switchValue: 1,
+      comparisonMode: {
+        type: 'workflowContext',
+        nodeId: '__stateValues',
+        path: ['__stateValues', 'mode'],
+      },
+      cases: [{ id: 'a', condition: PAYLOAD }],
+    }
+    const context = { __stateValues: { mode: 'expression' } }
+    runtime.matchSwitchCase(authored, runtime.resolveConfig(authored, context), context)
+    expect(scope.__tqModePwned).toBeUndefined()
+  })
+
+  it('an authored expression mode still compiles', () => {
+    const authored = { conditionType: 'expression', condition: 'context.n > 1' }
+    expect(runtime.evaluateCondition(authored, { n: 2 }, authored)).toBe(true)
+  })
+})
+
+describe('the code generator refuses code that is a reference', () => {
+  const workflowWith = (code: unknown) => ({
+    workflows: {
+      wf: {
+        id: 'wf',
+        name: 'Quote',
+        nodes: [{ id: 'q-js', type: 'general-custom-js', config: { code } }],
+      },
+    },
+  })
+
+  it.each([
+    ['a {{…}} token', '{{state.code}}'],
+    ['a context value', { type: 'workflowContext', nodeId: 'n1', path: ['code'] }],
+    ['a secret reference', 'WORKFLOW_SECRET_CODE'],
+    ['an inserted value', '<span class="context-value-inline">code</span>'],
+  ])('refuses a custom-JS step whose code is %s', (_kind, code) => {
+    let error: unknown
+    try {
+      assertWorkflowsAreSecure(workflowWith(code) as never)
+    } catch (caught) {
+      error = caught
+    }
+    expect(error).toBeInstanceOf(CodegenSecurityError)
+    expect((error as CodegenSecurityError).violations[0]).toMatchObject({
+      nodeId: 'q-js',
+      rule: 'unreadable-step-code',
+    })
+  })
+
+  it('refuses custom JS that reads the whole environment, or a key it builds, as the editor does', () => {
+    for (const [code, rule] of [
+      ['function customHandler() { return { env: process.env }; }', 'process-without-property'],
+      ['function customHandler(p) { return process.env[p.name]; }', 'dynamic-env-access'],
+    ]) {
+      let error: unknown
+      try {
+        assertWorkflowsAreSecure(workflowWith(code) as never)
+      } catch (caught) {
+        error = caught
+      }
+      expect((error as CodegenSecurityError).violations.map((v) => v.rule)).toContain(rule)
+    }
+    expect(() =>
+      assertWorkflowsAreSecure(
+        workflowWith(
+          "function customHandler() { var KEY = 'MY_API_URL'; return { url: process.env ? process.env[KEY] : '' }; }"
+        ) as never
+      )
+    ).not.toThrow()
+  })
+
+  it('generates authored code', () => {
+    expect(() =>
+      assertWorkflowsAreSecure(
+        workflowWith('function customHandler(params) { return params[0]; }') as never
+      )
+    ).not.toThrow()
+  })
+})
+
+describe('the code generator reads the code pages run on the server', () => {
+  const pageWith = (node: unknown, stateDefinitions: Record<string, unknown> = {}) => ({
+    root: { name: 'Root', stateDefinitions, node },
+    components: {},
+  })
+  const text = (content: string) => ({ type: 'expr', content })
+
+  it('refuses a state mapping function that escapes the sandbox', () => {
+    const violations = findProjectCodeViolations(
+      pageWith(text('items.length'), {
+        items: {
+          type: 'array',
+          defaultValue: [],
+          mappingFunction: `function mapData(items) { return (function(){}).constructor('return process')().env }`,
+        },
+      })
+    )
+    expect(violations.map((v) => v.rule)).toContain('sandbox-escape-constructor')
+  })
+
+  it('refuses an expression the page prerenders that reads a platform secret', () => {
+    expect(
+      findProjectCodeViolations(pageWith(text('process.env.NEXTAUTH_SECRET'))).map((v) => v.rule)
+    ).toContain('protected-env-access')
+  })
+
+  // The editor's gate refuses these as process-without-property,
+  // dynamic-env-access and sandbox-escape-function; the code generator's
+  // page check runs the same custom-code rules.
+  it.each([
+    ['the whole environment', 'process.env', 'process-without-property'],
+    [
+      'a secret by a key it builds',
+      'process.env[["NEXTAUTH","SECRET"].join("_")]',
+      'dynamic-env-access',
+    ],
+    [
+      'the environment through the Function constructor',
+      'new Function("return process.env")()',
+      'sandbox-escape-function',
+    ],
+  ])('refuses a page expression that reads %s', (_kind, code, rule) => {
+    expect(findProjectCodeViolations(pageWith(text(code))).map((v) => v.rule)).toContain(rule)
+  })
+
+  it('reads an expression however deep the page nests it', () => {
+    let node: unknown = text('process.env.NEXTAUTH_SECRET')
+    for (let depth = 0; depth < 400; depth++) {
+      node = { type: 'element', content: { elementType: 'container', children: [node] } }
+    }
+    expect(findProjectCodeViolations(pageWith(node)).map((v) => v.rule)).toContain(
+      'protected-env-access'
+    )
+  })
+
+  it('leaves process.env that is only tested, or read by a key the code spells out', () => {
+    expect(
+      findProjectCodeViolations(
+        pageWith(
+          text(
+            "typeof process !== 'undefined' && process.env ? process.env['NEXT_PUBLIC_SITE'] : ''"
+          )
+        )
+      )
+    ).toEqual([])
+  })
+
+  it('generates the expressions and mapping functions the editor writes', () => {
+    expect(
+      findProjectCodeViolations(
+        pageWith(
+          {
+            type: 'element',
+            content: { elementType: 'text', children: [text('product?.[\'name\'] || "Product"')] },
+          },
+          {
+            items: {
+              type: 'array',
+              defaultValue: [],
+              mappingFunction: 'function mapData(items) { return items.slice(0, 3) }',
+            },
+          }
+        )
+      )
+    ).toEqual([])
+  })
+})

package/__tests__/custom-node-custom-code-gate.test.ts

@@ -0,0 +1,136 @@
+import { assertWorkflowsAreSecure, CodegenSecurityError } from '../src/security-scanner'
+import { collectWorkflowPublishRefusals } from '../src/publish-refusals'
+import { NextWorkflowProjectPlugin } from '../src/workflow-project-plugin'
+
+/**
+ * A custom node's custom JS runs on the server as a workflow's does: in the
+ * custom node's own server segment routes, and in process inside a cron,
+ * webhook or automation route that calls it (they require
+ * `utils/workflows/custom-nodes.js`). The generator's custom-code gate reads
+ * it too, so a custom node cannot carry what a workflow step may not.
+ */
+
+const customNodeWith = (code: string, name = 'Email me') => ({
+  'cn-1': {
+    id: 'cn-1',
+    name,
+    parameters: [{ key: 'message' }],
+    nodes: [
+      { id: 'c-js', type: 'general-custom-js', config: { code, context: 'server' }, stepNumber: 1 },
+    ],
+    edges: [] as unknown[],
+  },
+})
+
+const LEAKS: Array<[string, string]> = [
+  [
+    'reads TELEPORT_DB_CONNECTION_STRING',
+    'function customHandler(previousContext, params) { return { v: process.env.TELEPORT_DB_CONNECTION_STRING }; }',
+  ],
+  [
+    'reads NEXTAUTH_SECRET',
+    'function customHandler(previousContext, params) { return { v: process.env.NEXTAUTH_SECRET }; }',
+  ],
+  [
+    'reaches the real process through .constructor',
+    "function customHandler(previousContext, params) { return (function(){}).constructor('return process')().env; }",
+  ],
+]
+
+// Custom nodes the editor's builders write, verbatim: the shared Record Event
+// writer's "is it new" step (features/shared/builders/record-event-node.ts) and
+// the anonymous-visitor key of the resolve-user node
+// (templates/builders/shared/resolve-user-custom-node-builder.ts).
+const BUILDER_SCRIPTS = [
+  [
+    'function customHandler(previousContext, params) {',
+    '  var selectResult = (params && params[1]) || {};',
+    '  var rows = selectResult && selectResult.rows',
+    '    ? selectResult.rows',
+    '    : (Array.isArray(selectResult) ? selectResult : []);',
+    '  return { isNew: rows.length === 0 };',
+    '}',
+  ].join('\n'),
+  [
+    'function customHandler(previousContext, params) {',
+    '  var host = "";',
+    '  try {',
+    '    host = (typeof window !== "undefined" && window.location && window.location.host) || "";',
+    '  } catch (e) { host = ""; }',
+    '  return { key: "teleportAnonymousUser:" + (host || "default") };',
+    '}',
+  ].join('\n'),
+]
+
+const generate = (customNodes: Record<string, unknown>) => {
+  const structure = {
+    uidl: {
+      name: 'Store',
+      globals: { settings: { title: 'Store', language: 'en' }, env: {} },
+      root: {
+        name: 'Root',
+        stateDefinitions: {
+          route: { type: 'string', defaultValue: 'Home', values: [{ value: 'Home' }] },
+        },
+        node: { type: 'element', content: { elementType: 'container', children: [] as unknown[] } },
+      },
+      components: {},
+      workflows: { workflows: {}, customNodes: JSON.parse(JSON.stringify(customNodes)) },
+    },
+    strategy: { pages: { options: {} } },
+    files: new Map(),
+    dependencies: {},
+    devDependencies: {},
+  }
+  return new NextWorkflowProjectPlugin().runBefore(structure as never)
+}
+
+describe('the codegen custom-code gate reads custom nodes', () => {
+  it.each(LEAKS)(
+    'refuses a custom node whose custom JS %s, naming the custom node',
+    (_leak, code) => {
+      let error: unknown
+      try {
+        assertWorkflowsAreSecure({ workflows: {}, customNodes: customNodeWith(code) })
+      } catch (caught) {
+        error = caught
+      }
+      expect(error).toBeInstanceOf(CodegenSecurityError)
+      expect((error as CodegenSecurityError).violations[0]).toMatchObject({
+        workflowId: 'cn-1',
+        workflowName: 'Email me',
+        nodeId: 'c-js',
+      })
+    }
+  )
+
+  it.each(LEAKS)('refuses generation of a project whose custom node %s', async (_leak, code) => {
+    await expect(generate(customNodeWith(code))).rejects.toBeInstanceOf(CodegenSecurityError)
+  })
+
+  it('reports the refusal against the custom node to the editor', () => {
+    const refusals = collectWorkflowPublishRefusals({
+      workflows: {},
+      customNodes: customNodeWith(LEAKS[0][1]),
+    } as never)
+    expect(refusals).toContainEqual(
+      expect.objectContaining({
+        kind: 'refused',
+        check: 'custom-code',
+        ownerId: 'cn-1',
+        ownerKind: 'custom-node',
+        nodeId: 'c-js',
+      })
+    )
+  })
+
+  it.each(BUILDER_SCRIPTS.map((code) => [code]))(
+    'publishes a builder custom node: %s',
+    async (code) => {
+      expect(() =>
+        assertWorkflowsAreSecure({ workflows: {}, customNodes: customNodeWith(code) })
+      ).not.toThrow()
+      await expect(generate(customNodeWith(code))).resolves.toBeDefined()
+    }
+  )
+})