@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/dist/esm/invoice/pdf-service-client-code.js

@@ -24,11 +24,15 @@ export const generatePdfServiceClientCode = () => {
 // reservation for the next request for the order to finish.
 //
 // Contract:
-//   - Config via \`process.env.PDF_SERVICE_URL\` and
-//     \`process.env.PDF_SERVICE_API_KEY\` (read at call time, not module
+//   - Config via \`process.env.PDF_SERVICE_URL\`,
+//     \`process.env.PDF_SERVICE_API_KEY\` and
+//     \`process.env.PDF_SERVICE_PROJECT_ID\` (read at call time, not module
 //     load, so dev misconfiguration fails loud at render rather than
 //     at \`require()\`).
-//   - Auth header: \`X-Pdf-Service-Key: <key>\` (shared static key).
+//   - Auth headers: \`X-Pdf-Service-Key: <key>\` (this project's own key,
+//     derived by the platform at deploy time) and
+//     \`X-Pdf-Service-Project: <project id>\`, which the service checks the
+//     key against. A deploy without a project id sends the key alone.
 //   - 60 s client-side abort. The service's default per-attempt timeout
 //     is 45 s; operators who tune the service down to ~15 s/attempt can
 //     fit 3 full retries inside this window.
@@ -49,6 +53,7 @@ function sanitizePdfFilename(raw) {
 async function callPdfService(html, invoiceData) {
   var pdfServiceUrl = process.env.PDF_SERVICE_URL;
   var pdfServiceKey = process.env.PDF_SERVICE_API_KEY;
+  var pdfServiceProjectId = process.env.PDF_SERVICE_PROJECT_ID;
 
   if (!pdfServiceUrl) {
     throw new Error('PDF_SERVICE_URL is not configured. Set it in the project env vars (the Vercel controller injects it at deploy time from the services-worker env).');
@@ -78,15 +83,18 @@ async function callPdfService(html, invoiceData) {
   var abortCtrl = new AbortController();
   var timer = setTimeout(function () { abortCtrl.abort(); }, timeoutMs);
 
+  var requestHeaders = {
+    'Content-Type': 'application/json',
+    'X-Pdf-Service-Key': pdfServiceKey,
+  };
+  if (pdfServiceProjectId) requestHeaders['X-Pdf-Service-Project'] = pdfServiceProjectId;
+
   var response;
   try {
     console.info('[invoice-pdf] POST ' + endpoint + ' htmlBytes=' + (html ? html.length : 0) + ' filename=' + filename + ' timeoutMs=' + timeoutMs);
     response = await fetch(endpoint, {
       method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'X-Pdf-Service-Key': pdfServiceKey,
-      },
+      headers: requestHeaders,
       body: JSON.stringify(requestBody),
       signal: abortCtrl.signal,
     });

package/dist/esm/invoice/pdf-service-client-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"pdf-service-client-code.js","sourceRoot":"","sources":["../../../src/invoice/pdf-service-client-code.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,wEAAwE;AACxE,qEAAqE;AACrE,0EAA0E;AAC1E,qEAAqE;AACrE,yEAAyE;AACzE,qEAAqE;AACrE,kCAAkC;AAClC,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,kEAAkE;AAClE,wBAAwB;AAExB,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAW,EAAE;IACvD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsHR,CAAA;AACD,CAAC,CAAA"}
+{"version":3,"file":"pdf-service-client-code.js","sourceRoot":"","sources":["../../../src/invoice/pdf-service-client-code.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,wEAAwE;AACxE,qEAAqE;AACrE,0EAA0E;AAC1E,qEAAqE;AACrE,yEAAyE;AACzE,qEAAqE;AACrE,kCAAkC;AAClC,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,kEAAkE;AAClE,wBAAwB;AAExB,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAW,EAAE;IACvD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8HR,CAAA;AACD,CAAC,CAAA"}

package/dist/esm/newsletter/admin-route-code.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Not emitted. `NextNewsletterProjectPlugin` no longer writes this route or a
+ * site token. The published admin panel schedules by editing the issue row.
+ * Send now and send-a-test stay in the editor.
+ *
+ * Kept so the old route's checks stay readable. Do not wire it back into the
+ * plugin: that would put a service token on the published site again.
+ */
+import type { ProjectUIDL } from '@teleporthq/teleport-types';
+export declare const NEWSLETTER_ADMIN_ROUTE_FILE_KEY = "newsletter-admin-route";
+export declare const NEWSLETTER_ADMIN_ROUTE_PATH: string[];
+export declare const NEWSLETTER_ADMIN_ROUTE_FILE_NAME = "[action]";
+/** What the admin panel may ask for (R-N1: schedule and cancel are row edits). */
+export declare const NEWSLETTER_ADMIN_ACTIONS: readonly ["send", "test"];
+/**
+ * The `.env` lines the production deploy fills (the worker's
+ * `injectNewsletterServiceEnv`): the worker's public URL, the site's token and
+ * its project id.
+ */
+export declare const NEWSLETTER_SERVICE_ENV_NAMES: readonly ["NEWSLETTER_SERVICE_URL", "NEWSLETTER_SERVICE_TOKEN", "NEWSLETTER_SERVICE_PROJECT_ID"];
+/** How long the route waits for the worker. */
+export declare const NEWSLETTER_SERVICE_TIMEOUT_MS = 15000;
+/** The one statement the route runs: does this site hold the issue. */
+export declare const NEWSLETTER_ADMIN_ISSUE_SQL: string;
+/** Every answer the route writes itself (the worker's are relayed). */
+export declare const NEWSLETTER_ADMIN_MESSAGES: {
+    method: string;
+    crossOrigin: string;
+    jsonOnly: string;
+    signIn: string;
+    staffOnly: string;
+    unknownAction: string;
+    notProduction: string;
+    missingIssue: string;
+    noTestAddress: string;
+    testAddressUnsupported: string;
+    notFound: string;
+    readFailed: string;
+    keyRefused: string;
+    unreachable: string;
+    timeout: string;
+    badAnswer: string;
+    refused: string;
+    serviceFailed: string;
+};
+/**
+ * The route's source. Staff = the admin panel's roles and `admin`
+ * (`TableAccess.resolveStaffRoles`), baked at build time; `withRevocation`
+ * checks a stamped session against its account (a project with authentication).
+ */
+export declare const generateNewsletterAdminRouteCode: (uidl: Pick<ProjectUIDL, 'authentication'>, options: {
+    withRevocation: boolean;
+}) => string;
+/**
+ * Declares the newsletter service's `.env` lines, empty: the worker fills them
+ * on a production deploy only (`injectNewsletterServiceEnv` acts on a declared
+ * `NEWSLETTER_SERVICE_URL=` line).
+ */
+export declare const declareNewsletterServiceEnv: (uidl: ProjectUIDL) => void;
+//# sourceMappingURL=admin-route-code.d.ts.map

package/dist/esm/newsletter/admin-route-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-route-code.d.ts","sourceRoot":"","sources":["../../../src/newsletter/admin-route-code.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAM7D,eAAO,MAAM,+BAA+B,2BAA2B,CAAA;AACvE,eAAO,MAAM,2BAA2B,UAA0C,CAAA;AAClF,eAAO,MAAM,gCAAgC,aAAa,CAAA;AAE1D,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,2BAA4B,CAAA;AAEjE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,kGAI/B,CAAA;AAEV,+CAA+C;AAC/C,eAAO,MAAM,6BAA6B,QAAQ,CAAA;AAKlD,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,QAAoE,CAAA;AAE3G,uEAAuE;AACvE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;CAuBrC,CAAA;AAKD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,SACrC,KAAK,WAAW,EAAE,gBAAgB,CAAC,WAChC;IAAE,cAAc,EAAE,OAAO,CAAA;CAAE,KACnC,MA6NF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,SAAU,WAAW,KAAG,IAY/D,CAAA"}

package/dist/esm/newsletter/admin-route-code.js

@@ -0,0 +1,295 @@
+import { TableAccess } from '@teleporthq/teleport-shared';
+import { generateCommonJsSessionTokenResolverCode } from '../session-cookie-resolver';
+import { ROLE_OF_TOKEN_CODE } from '../workflow-auth-generator';
+import { newsletterHelperSpecifier } from './newsletter-scope';
+export const NEWSLETTER_ADMIN_ROUTE_FILE_KEY = 'newsletter-admin-route';
+export const NEWSLETTER_ADMIN_ROUTE_PATH = ['pages', 'api', 'newsletter', 'admin'];
+export const NEWSLETTER_ADMIN_ROUTE_FILE_NAME = '[action]';
+/** What the admin panel may ask for (R-N1: schedule and cancel are row edits). */
+export const NEWSLETTER_ADMIN_ACTIONS = ['send', 'test'];
+/**
+ * The `.env` lines the production deploy fills (the worker's
+ * `injectNewsletterServiceEnv`): the worker's public URL, the site's token and
+ * its project id.
+ */
+export const NEWSLETTER_SERVICE_ENV_NAMES = [
+    'NEWSLETTER_SERVICE_URL',
+    'NEWSLETTER_SERVICE_TOKEN',
+    'NEWSLETTER_SERVICE_PROJECT_ID',
+];
+/** How long the route waits for the worker. */
+export const NEWSLETTER_SERVICE_TIMEOUT_MS = 15000;
+/** The issues table (teleport-gui `NEWSLETTER_ISSUES_TABLE`, Task 1). */
+const NEWSLETTER_ISSUES_TABLE = 'teleport_newsletter_issues';
+/** The one statement the route runs: does this site hold the issue. */
+export const NEWSLETTER_ADMIN_ISSUE_SQL = `SELECT id FROM ${NEWSLETTER_ISSUES_TABLE} WHERE id = $1 LIMIT 1`;
+/** Every answer the route writes itself (the worker's are relayed). */
+export const NEWSLETTER_ADMIN_MESSAGES = {
+    method: 'Method not allowed',
+    crossOrigin: 'This request must come from your site.',
+    jsonOnly: 'This request must be sent as JSON.',
+    signIn: 'Sign in again.',
+    staffOnly: 'Staff only.',
+    unknownAction: 'Unknown newsletter action.',
+    notProduction: 'Newsletter sending from the admin panel works on the published production site.',
+    missingIssue: 'Newsletter id is required.',
+    noTestAddress: 'Your account has no email address to send the test to.',
+    testAddressUnsupported: "Your account's email address cannot receive the test from the admin panel; send the test from the editor.",
+    notFound: 'This newsletter no longer exists.',
+    readFailed: 'The newsletter could not be read right now. Try again in a moment.',
+    keyRefused: "The newsletter service did not accept this site's key. Publish the site again, then try again.",
+    unreachable: 'The newsletter service could not be reached. Try again in a moment.',
+    timeout: "The newsletter service did not answer in time. Check the newsletter's status before you try again.",
+    badAnswer: "The newsletter service gave an answer that could not be read. Check the newsletter's status before you try again.",
+    refused: 'The newsletter service could not do this.',
+    serviceFailed: 'The newsletter could not be sent right now. Try again in a moment.',
+};
+/** From `pages/api/newsletter/admin/` to the project root. */
+const RELATIVE_PREFIX = '../../../..';
+/**
+ * The route's source. Staff = the admin panel's roles and `admin`
+ * (`TableAccess.resolveStaffRoles`), baked at build time; `withRevocation`
+ * checks a stamped session against its account (a project with authentication).
+ */
+export const generateNewsletterAdminRouteCode = (uidl, options) => `/**
+ * POST /api/newsletter/admin/[action]   JSON body { issueId }
+ * The admin panel's "Send now" (send) and "Send a test" (test). Staff only,
+ * from a page of this site only.
+ * Asks the newsletter service to act on one issue of this site and relays its
+ * answer: { success: true, status, message } or { success: false, error }.
+ * A test goes to the signed-in staff member's own address.
+ */
+
+var __newsletter = require('${newsletterHelperSpecifier(RELATIVE_PREFIX)}');
+
+${generateCommonJsSessionTokenResolverCode(RELATIVE_PREFIX, {
+    withRevocation: options.withRevocation,
+})}
+${ROLE_OF_TOKEN_CODE}
+
+var STAFF_ROLES = ${JSON.stringify(TableAccess.resolveStaffRoles(uidl.authentication))};
+var NEWSLETTER_ADMIN_ACTIONS = ${JSON.stringify(NEWSLETTER_ADMIN_ACTIONS)};
+var SERVICE_TIMEOUT_MS = ${NEWSLETTER_SERVICE_TIMEOUT_MS};
+var ISSUE_SQL = ${JSON.stringify(NEWSLETTER_ADMIN_ISSUE_SQL)};
+var MESSAGES = ${JSON.stringify(NEWSLETTER_ADMIN_MESSAGES, null, 2)};
+
+function readBody(req) {
+  var body = req.body;
+  if (typeof body === 'string') {
+    try { body = JSON.parse(body); } catch (e) { body = null; }
+  }
+  return body && typeof body === 'object' ? body : {};
+}
+
+function fail(res, status, error) {
+  return res.status(status).json({ success: false, error: error });
+}
+
+// A page of this site sent the request (R-N25). Sibling sites on the shared
+// hosting domain count as same-site, so the session cookie alone proves
+// nothing: the browser's Sec-Fetch-Site, when sent, must say same-origin, and
+// the Origin (or, without one, the Referer) must name this host. Browsers send
+// Origin on every POST; a request that names no page is refused.
+function isSameOrigin(req) {
+  var headers = req.headers || {};
+  var site = headers['sec-fetch-site'];
+  if (site && site !== 'same-origin') {
+    return false;
+  }
+  var source = headers.origin || headers.referer;
+  if (typeof source !== 'string' || !source || !headers.host) {
+    return false;
+  }
+  try {
+    return new URL(source).host === String(headers.host).toLowerCase();
+  } catch (error) {
+    return false;
+  }
+}
+
+// The admin panel posts JSON; a cross-origin form cannot.
+function isJsonRequest(req) {
+  var type = String((req.headers && req.headers['content-type']) || '');
+  return type.split(';')[0].trim().toLowerCase() === 'application/json';
+}
+
+// This deployment's newsletter service, or null: only the production deploy
+// of the site is given one.
+function newsletterService() {
+  var url = String(process.env.NEWSLETTER_SERVICE_URL || '').trim().replace(/\\/+$/, '');
+  var token = String(process.env.NEWSLETTER_SERVICE_TOKEN || '').trim();
+  var project = String(process.env.NEWSLETTER_SERVICE_PROJECT_ID || '').trim();
+  return url && token && project ? { url: url, token: token, project: project } : null;
+}
+
+// The signed-in staff member's address (a test's recipient), or ''.
+function staffAddress(token) {
+  return __newsletter.normalizeEmail(token.email);
+}
+
+// The address as a request header can carry it (printable ASCII), or ''.
+function headerSafe(email) {
+  return /^[ -~]+$/.test(email) ? email : '';
+}
+
+// Who the newsletter service records as acting: the address, else the account id.
+function staffName(token, email) {
+  if (email) return email;
+  var id = token.id != null ? token.id : token.sub;
+  return id == null ? '' : String(id).replace(/[^ -~]/g, '').slice(0, 255);
+}
+
+// Whether this site's database holds the issue. Another project's issue is
+// never in it.
+async function issueExists(issueId) {
+  return __newsletter.withNewsletterDb(async function (db) {
+    var found = await db.query(ISSUE_SQL, [issueId]);
+    return !!(found && found.rows && found.rows[0]);
+  });
+}
+
+// The service's answer as the admin panel reads it: the contract's fields only.
+// A server failure's own text stays on the server.
+function relayedAnswer(response, answer) {
+  if (response.ok && answer.success === true) {
+    return {
+      success: true,
+      status: typeof answer.status === 'string' ? answer.status : '',
+      message: typeof answer.message === 'string' ? answer.message : '',
+    };
+  }
+  if (response.status >= 500) {
+    return { success: false, error: MESSAGES.serviceFailed };
+  }
+  return {
+    success: false,
+    error: typeof answer.error === 'string' && answer.error ? answer.error : MESSAGES.refused,
+  };
+}
+
+module.exports = async function handler(req, res) {
+  if (req.method !== 'POST') {
+    res.setHeader('Allow', 'POST');
+    return res.status(405).json({ success: false, error: MESSAGES.method });
+  }
+  if (!isSameOrigin(req)) {
+    return fail(res, 403, MESSAGES.crossOrigin);
+  }
+  if (!isJsonRequest(req)) {
+    return fail(res, 415, MESSAGES.jsonOnly);
+  }
+
+  var token = null;
+  try {
+    token = await __tqSessionToken(req);
+  } catch (err) {
+    console.warn('[newsletter] admin: could not read the session — ' + (err && err.message));
+    token = null;
+  }
+  if (!token) {
+    return fail(res, 401, MESSAGES.signIn);
+  }
+  var role = roleOf(token);
+  if (!role || STAFF_ROLES.indexOf(role) < 0) {
+    return fail(res, 403, MESSAGES.staffOnly);
+  }
+
+  var action = req.query && typeof req.query.action === 'string' ? req.query.action : '';
+  if (NEWSLETTER_ADMIN_ACTIONS.indexOf(action) < 0) {
+    return fail(res, 404, MESSAGES.unknownAction);
+  }
+
+  var service = newsletterService();
+  if (!service) {
+    return fail(res, 503, MESSAGES.notProduction);
+  }
+
+  var body = readBody(req);
+  var issueId = typeof body.issueId === 'string' ? body.issueId.trim() : '';
+  if (!issueId || issueId.length > 255) {
+    return fail(res, 400, MESSAGES.missingIssue);
+  }
+  var address = staffAddress(token);
+  var email = headerSafe(address);
+  if (action === 'test' && !address) {
+    return fail(res, 422, MESSAGES.noTestAddress);
+  }
+  if (action === 'test' && !email) {
+    return fail(res, 422, MESSAGES.testAddressUnsupported);
+  }
+  var staff = staffName(token, email);
+
+  try {
+    if (!(await issueExists(issueId))) {
+      return fail(res, 404, MESSAGES.notFound);
+    }
+  } catch (err) {
+    console.error('[newsletter] admin ' + action + ': could not read the newsletter — ' + ((err && (err.code || err.message)) || 'error'));
+    return fail(res, 503, MESSAGES.readFailed);
+  }
+
+  var controller = new AbortController();
+  var timer = setTimeout(function () { controller.abort(); }, SERVICE_TIMEOUT_MS);
+  var response = null;
+  var answer = null;
+  try {
+    response = await fetch(service.url + '/newsletter/site/' + action, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Teleport-Service-Token': service.token,
+        'X-Teleport-Service-Project': service.project,
+        'X-Teleport-Staff': staff,
+      },
+      body: JSON.stringify({ issueId: issueId }),
+      signal: controller.signal,
+      // A redirect would carry the token to another host: refused (502).
+      redirect: 'error',
+    });
+    try {
+      answer = await response.json();
+    } catch (readErr) {
+      if (controller.signal.aborted) throw readErr;
+      answer = null;
+    }
+  } catch (err) {
+    var timedOut = controller.signal.aborted || (err && err.name === 'AbortError');
+    // The failure's code only: a message can quote the request.
+    console.error('[newsletter] admin ' + action + ': the newsletter service ' + (timedOut ? 'did not answer within ' + SERVICE_TIMEOUT_MS + ' ms' : 'could not be reached (' + ((err && err.cause && err.cause.code) || (err && err.name) || 'error') + ')'));
+    return fail(res, timedOut ? 504 : 502, timedOut ? MESSAGES.timeout : MESSAGES.unreachable);
+  } finally {
+    clearTimeout(timer);
+  }
+
+  if (response.status === 401) {
+    // The site's key is not the current one (reset since this deploy).
+    console.error('[newsletter] admin ' + action + ': the newsletter service refused the site key; publish the site again');
+    return fail(res, 503, MESSAGES.keyRefused);
+  }
+  if (!answer || typeof answer !== 'object' || Array.isArray(answer)) {
+    console.error('[newsletter] admin ' + action + ': the newsletter service answered ' + response.status + ' without its JSON answer');
+    return fail(res, 502, MESSAGES.badAnswer);
+  }
+  return res.status(response.status).json(relayedAnswer(response, answer));
+};
+`;
+/**
+ * Declares the newsletter service's `.env` lines, empty: the worker fills them
+ * on a production deploy only (`injectNewsletterServiceEnv` acts on a declared
+ * `NEWSLETTER_SERVICE_URL=` line).
+ */
+export const declareNewsletterServiceEnv = (uidl) => {
+    if (!uidl.globals) {
+        ;
+        uidl.globals = { settings: { language: 'en' }, assets: [], env: {} };
+    }
+    if (!uidl.globals.env) {
+        uidl.globals.env = {};
+    }
+    for (const name of NEWSLETTER_SERVICE_ENV_NAMES) {
+        if (!uidl.globals.env[name]) {
+            uidl.globals.env[name] = '';
+        }
+    }
+};
+//# sourceMappingURL=admin-route-code.js.map

package/dist/esm/newsletter/admin-route-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-route-code.js","sourceRoot":"","sources":["../../../src/newsletter/admin-route-code.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACzD,OAAO,EAAE,wCAAwC,EAAE,MAAM,4BAA4B,CAAA;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAE9D,MAAM,CAAC,MAAM,+BAA+B,GAAG,wBAAwB,CAAA;AACvE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAA;AAClF,MAAM,CAAC,MAAM,gCAAgC,GAAG,UAAU,CAAA;AAE1D,kFAAkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAA;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,wBAAwB;IACxB,0BAA0B;IAC1B,+BAA+B;CACvB,CAAA;AAEV,+CAA+C;AAC/C,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,CAAA;AAElD,yEAAyE;AACzE,MAAM,uBAAuB,GAAG,4BAA4B,CAAA;AAE5D,uEAAuE;AACvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,uBAAuB,wBAAwB,CAAA;AAE3G,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,MAAM,EAAE,oBAAoB;IAC5B,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,oCAAoC;IAC9C,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,aAAa;IACxB,aAAa,EAAE,4BAA4B;IAC3C,aAAa,EAAE,iFAAiF;IAChG,YAAY,EAAE,4BAA4B;IAC1C,aAAa,EAAE,wDAAwD;IACvE,sBAAsB,EACpB,2GAA2G;IAC7G,QAAQ,EAAE,mCAAmC;IAC7C,UAAU,EAAE,oEAAoE;IAChF,UAAU,EACR,gGAAgG;IAClG,WAAW,EAAE,qEAAqE;IAClF,OAAO,EACL,oGAAoG;IACtG,SAAS,EACP,mHAAmH;IACrH,OAAO,EAAE,2CAA2C;IACpD,aAAa,EAAE,oEAAoE;CACpF,CAAA;AAED,8DAA8D;AAC9D,MAAM,eAAe,GAAG,aAAa,CAAA;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,IAAyC,EACzC,OAAoC,EAC5B,EAAE,CAAC;;;;;;;;;8BASiB,yBAAyB,CAAC,eAAe,CAAC;;EAEtE,wCAAwC,CAAC,eAAe,EAAE;IAC1D,cAAc,EAAE,OAAO,CAAC,cAAc;CACvC,CAAC;EACA,kBAAkB;;oBAEA,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;iCACrD,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC;2BAC9C,6BAA6B;kBACtC,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC;iBAC3C,IAAI,CAAC,SAAS,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyMlE,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,IAAiB,EAAQ,EAAE;IACrE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;QACjB,CAAC;QAAC,IAA6B,CAAC,OAAO,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAA;KAChG;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;QACrB,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,EAAE,CAAA;KACtB;IACD,KAAK,MAAM,IAAI,IAAI,4BAA4B,EAAE;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;SAC5B;KACF;AACH,CAAC,CAAA"}

package/dist/esm/newsletter/helper-code.d.ts

@@ -0,0 +1,109 @@
+/**
+ * `utils/newsletter/newsletter.js`: the one place the generated app changes a
+ * person's newsletter state. The public sign-up route, the `newsletter-subscribe`
+ * node, the sign-up route's consent box and the confirm / unsubscribe routes all
+ * go through it, so the policy is written once:
+ *
+ * - nobody is subscribed without their own action: a submit (single opt-in),
+ *   or the emailed confirmation link (double opt-in);
+ * - a form never undoes an opt-out: anyone can type anyone's address, so an
+ *   unsubscribed address is only ever sent a confirmation link;
+ * - every sign-up answers the same (`{ ok: true, pending }`, `pending` decided
+ *   by the settings alone), so the answer never tells whether an address is
+ *   known;
+ * - the links are stateless HMAC tokens keyed by the app secret
+ *   (`newsletterTokenSpec`), which the services worker reproduces for the
+ *   unsubscribe links of the newsletters it sends.
+ *
+ * CommonJS, server-only. The TeleportHQ database (`TELEPORT_DB_*`), through the
+ * same Postgres client the account routes open.
+ */
+import type { UIDLNewsletterSettings } from '@teleporthq/teleport-types';
+/**
+ * The confirmation and unsubscribe links' token, exactly, so the services
+ * worker (the unsubscribe links in the newsletters it sends, R-N7) mints the
+ * same bytes as the site:
+ *
+ *   key     = HMAC-SHA256(key: NEXTAUTH_SECRET (UTF-8), message: 'teleport-newsletter:v1')  → 32 bytes
+ *   payload = UTF-8 of `${email}|${purpose}|${issuedAt}`
+ *             email: trimmed, lower-cased; purpose: 'confirm' | 'unsubscribe';
+ *             issuedAt: whole seconds since the Unix epoch, in decimal
+ *   token   = base64url(payload) + '.' + base64url(HMAC-SHA256(key, payload))
+ *             base64url = RFC 4648 §5, no '=' padding
+ *
+ * Verification: exactly one '.'; both parts base64url; a 32-byte MAC compared
+ * in constant time; the payload split at its LAST two '|'; the purpose the
+ * caller expects; issuedAt at most `futureSkewSeconds` ahead of now; a
+ * `confirm` token at most `confirmMaxAgeSeconds` old; an `unsubscribe` token
+ * never expires. No app secret: nothing is signed and nothing verifies. The
+ * links carry the token in the `t` query parameter of the site's confirm and
+ * unsubscribe pages.
+ */
+export declare const newsletterTokenSpec: {
+    keyLabel: string;
+    keySecretEnv: string;
+    separator: string;
+    purposes: readonly ["confirm", "unsubscribe"];
+    confirmMaxAgeSeconds: number;
+    futureSkewSeconds: number;
+    unsubscribeExpires: boolean;
+    maxTokenLength: number;
+    queryParameter: string;
+    /** One token, for a byte-for-byte check of any other implementation. */
+    testVector: {
+        secret: string;
+        email: string;
+        purpose: "unsubscribe";
+        issuedAt: number;
+        token: string;
+    };
+};
+/**
+ * Every statement the helper runs. Each change of state is guarded in its own
+ * WHERE, so two requests at once can never take a row anywhere the policy
+ * does not allow (an unsubscribed person subscribed by a form, an event
+ * recorded twice). Consent is always written explicitly: a `users` table made
+ * before 2026-10-26 still defaults `marketing_consent` to TRUE.
+ */
+export declare const NEWSLETTER_SQL: {
+    /** `$1`: the address, lower-cased. The exact spelling first, else any case. */
+    findPerson: string;
+    /** `$1` address, `$2` `users.source`, `$3` `newsletter_source`. */
+    insertPending: string;
+    insertSubscribed: string;
+    /**
+     * `$1` id, `$2` `newsletter_source`: only a person never on the list, or
+     * still pending, and not opted out of email (an opt-out is undone only by
+     * the person's own confirmation click).
+     */
+    markPending: string;
+    markSubscribed: string;
+    /** `$1` id: the confirmation link, the person's own click. */
+    confirm: string;
+    unsubscribe: string;
+};
+/** What the confirmation email says when the project's template has no body. */
+export declare const DEFAULT_NEWSLETTER_CONFIRMATION_EMAIL: {
+    subject: string;
+    body: string;
+};
+export interface NewsletterHelperOptions {
+    settings: UIDLNewsletterSettings;
+    /** The `{{site_name}}` of the emails; the request's host when empty. */
+    siteName?: string;
+    /** The project has the in-app event bus (`hasAutomationsBus`). */
+    withAutomations?: boolean;
+    /**
+     * The sign-up route sends the account's own welcome email: a person who
+     * joins through the sign-up form's box is not sent the newsletter's too.
+     */
+    signupSendsAccountWelcome?: boolean;
+}
+/** A same-site path without a query or fragment, else `fallback`. */
+export declare const resolveNewsletterPagePath: (value: unknown, fallback: string) => string;
+/** What a welcome email whose body has no `{{unsubscribe_url}}` gets, before `</body>`. */
+export declare const NEWSLETTER_UNSUBSCRIBE_FOOTER = "<p style=\"font-size:12px;color:#6b7280;margin-top:24px\">You receive this email because you subscribed to the {{site_name}} newsletter. <a href=\"{{unsubscribe_url}}\">Unsubscribe</a></p>";
+/** A newsletter email body that always carries its unsubscribe link. */
+export declare const withUnsubscribeLink: (body: string) => string;
+export declare const generateNewsletterHelperCode: (options: NewsletterHelperOptions) => string;
+//# sourceMappingURL=helper-code.d.ts.map

package/dist/esm/newsletter/helper-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper-code.d.ts","sourceRoot":"","sources":["../../../src/newsletter/helper-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AA2BxE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;IAU9B,wEAAwE;;;;;;;;CASzE,CAAA;AAOD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;IACzB,+EAA+E;;IAE/E,mEAAmE;;;IAGnE;;;;OAIG;;;IAGH,8DAA8D;;;CAG/D,CAAA;AAED,gFAAgF;AAChF,eAAO,MAAM,qCAAqC;;;CAMjD,CAAA;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,sBAAsB,CAAA;IAChC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAA;CACpC;AAED,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,UAAW,OAAO,YAAY,MAAM,KAAG,MAW5E,CAAA;AAkCD,2FAA2F;AAC3F,eAAO,MAAM,6BAA6B,iMACkJ,CAAA;AAE5L,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAQlD,CAAA;AAuFD,eAAO,MAAM,4BAA4B,YAAa,uBAAuB,KAAG,MA6c/E,CAAA"}