@teleporthq/teleport-plugin-next-workflows 0.44.4 → 0.44.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teleporthq/teleport-plugin-next-workflows",
-  "version": "0.44.4",
+  "version": "0.44.5",
   "description": "A plugin for workflow code generation in Next.js projects.",
   "author": "teleportHQ",
   "license": "MIT",
@@ -66,8 +66,8 @@
   },
   "dependencies": {
     "@babel/types": "^7.5.5",
-    "@teleporthq/teleport-shared": "^0.44.4",
+    "@teleporthq/teleport-shared": "^0.44.5",
     "@teleporthq/teleport-types": "^0.44.0"
   },
-  "gitHead": "cacf0be69ff0d4b04635161e5d9e880bd5a2ec92"
+  "gitHead": "f58fa8b4c3e69d550a3fc13f85245f61789d7d92"
 }

package/src/account-delete-route-generator.ts

@@ -6,17 +6,21 @@
  *   1. resolves the current user from the NextAuth session (never trusting a
  *      client-supplied id),
  *   2. runs a single DB transaction that detaches + anonymises business/legal
- *      records (orders, withdrawal requests) so tracking survives, deletes the
- *      user's personal data (reviews, cart, favourites, chat history) and the
- *      user row, and
+ *      records (orders, withdrawal requests, bookings) so tracking survives,
+ *      deletes the user's personal data (reviews, cart, favourites, chat
+ *      history), deletes the rows the user owns in the project's own tables —
+ *      the ones the AI made for the site, each through the one column the
+ *      site's "My …" pages read it by (teleport-shared's resolveOwnerColumn,
+ *      shipped into the route as text) — and then the user row, and
  *   3. best-effort sends the farewell email (a failed send never fails the
  *      deletion).
  *
- * Every table statement is guarded by a runtime `information_schema` column
- * check, so the route is a no-op for feature tables a given project never
- * provisioned.
+ * Every platform-table statement is guarded by a runtime `information_schema`
+ * column check, so the route is a no-op for feature tables a given project
+ * never provisioned.
  */
 import { UIDLLocalizedEmailTemplates } from '@teleporthq/teleport-types'
+import { OwnerColumns } from '@teleporthq/teleport-shared'
 import { generatePgClientCode } from './pg-client-code'
 import { generateCommonJsSessionTokenResolverCode } from './session-cookie-resolver'
 import {
@@ -84,11 +88,22 @@ const DELETE_TABLES = [
   'teleport_cart',
   'teleport_ai_chat_messages',
   'teleport_ai_chat_conversations',
+  // A push subscription is the capability to notify the user's device.
+  'teleport_push_subscriptions',
 ];
 // Business / legal records that must survive: the user link is nulled and any
 // stored personal email is replaced with a synthetic, self-describing address.
-const ANONYMIZE_TABLES = ['teleport_orders', 'teleport_withdrawal_requests'];
+const ANONYMIZE_TABLES = [
+  'teleport_orders',
+  'teleport_withdrawal_requests',
+  'teleport_bookings',
+  'teleport_subscriptions',
+  'teleport_abandoned_carts',
+  'teleport_voucher_redemptions',
+];
 const EMAIL_COLUMNS = ['billing_email', 'shipping_email', 'customer_email', 'email'];
+// A booking also names the customer and carries their phone; both are cleared.
+const CLEARED_COLUMNS = { teleport_bookings: ['customer_name', 'customer_phone'] };
 
 async function tableColumns(client, table) {
   var r = await client.query(
@@ -111,6 +126,10 @@ async function anonymizeUserRows(client, table, userId, syntheticEmail) {
       sets.push(EMAIL_COLUMNS[i] + ' = $' + params.length);
     }
   }
+  var cleared = CLEARED_COLUMNS[table] || [];
+  for (var c = 0; c < cleared.length; c++) {
+    if (cols.indexOf(cleared[c]) !== -1) { sets.push(cleared[c] + ' = NULL'); }
+  }
   await client.query('UPDATE ' + table + ' SET ' + sets.join(', ') + ' WHERE user_id = $1', params);
 }
 
@@ -127,6 +146,119 @@ async function deleteRowsByEmail(client, table, column, email) {
   await client.query('DELETE FROM ' + table + ' WHERE ' + column + ' = $1', [email]);
 }
 
+// Rows the user owns in the project's OWN tables — the ones the AI made for
+// this site (saved items, requests, reviews …). Their link to the user is
+// ON DELETE SET NULL, so they outlived the account with a blank owner, and the
+// "My …" pages read "owner = me OR owner IS NULL": every other signed-in
+// visitor saw them. Platform tables keep the explicit handling above —
+// deleted, anonymised, or kept as the business's records.
+//
+// Each table is attributed through exactly ONE column, the one its "My …"
+// pages read it by: resolveOwnerColumn below is the AI pipeline's own
+// decision, shipped here as text, so the two sides cannot disagree. Rows go
+// only through an "owner" column (whose the row is: author, submitter,
+// sender); an "actor" column (who approved, reviewed, was assigned or
+// addressed) names somebody else's row and leaves the table alone.
+${OwnerColumns.generateOwnerColumnResolverCode()}
+
+const PLATFORM_TABLE_PREFIX = 'teleport_';
+const PLATFORM_TABLES = [AUTH_USERS_TABLE, 'password_reset_tokens'];
+
+function isPlatformTable(table) {
+  return PLATFORM_TABLES.indexOf(table) !== -1 || table.indexOf(PLATFORM_TABLE_PREFIX) === 0;
+}
+
+function quoteIdentifier(name) {
+  return '"' + String(name).split('"').join('""') + '"';
+}
+
+// The (table, column) pairs through which the project's own tables name their
+// owner: the resolved owner column when it references the users table — or
+// references nothing, in older projects whose link was dropped. One that
+// references another table (account_id -> accounts) is a domain link and the
+// table is left alone. Links are read from pg_constraint rather than
+// information_schema: constraint names are only unique per table, so a join
+// by name can pair the wrong tables.
+async function ownedRowLinks(client) {
+  var columns = await client.query(
+    "SELECT c.table_name, c.column_name, c.ordinal_position FROM information_schema.columns c" +
+      " JOIN information_schema.tables t ON t.table_schema = c.table_schema AND t.table_name = c.table_name" +
+      " WHERE c.table_schema = 'public' AND t.table_type = 'BASE TABLE'" +
+      " ORDER BY c.table_name, c.ordinal_position"
+  );
+  var links = await client.query(
+    "SELECT cl.relname AS table_name, a.attname AS column_name," +
+      " rcl.relname AS referenced_table, ra.attname AS referenced_column" +
+      " FROM pg_constraint k" +
+      " JOIN pg_class cl ON cl.oid = k.conrelid" +
+      " JOIN pg_namespace n ON n.oid = cl.relnamespace" +
+      " JOIN pg_attribute a ON a.attrelid = k.conrelid AND a.attnum = k.conkey[1]" +
+      " JOIN pg_class rcl ON rcl.oid = k.confrelid" +
+      " JOIN pg_attribute ra ON ra.attrelid = k.confrelid AND ra.attnum = k.confkey[1]" +
+      " WHERE k.contype = 'f' AND n.nspname = 'public' AND array_length(k.conkey, 1) = 1"
+  );
+  var referenced = {};
+  for (var i = 0; i < links.rows.length; i++) {
+    var link = links.rows[i];
+    referenced[link.table_name + '.' + link.column_name] = link.referenced_table + '.' + link.referenced_column;
+  }
+  var tables = [];
+  var columnsOf = {};
+  for (var j = 0; j < columns.rows.length; j++) {
+    var row = columns.rows[j];
+    if (!columnsOf[row.table_name]) {
+      columnsOf[row.table_name] = [];
+      tables.push(row.table_name);
+    }
+    columnsOf[row.table_name].push({ name: row.column_name, ordinalPosition: Number(row.ordinal_position) });
+  }
+  var owned = [];
+  for (var t = 0; t < tables.length; t++) {
+    var table = tables[t];
+    if (isPlatformTable(table)) { continue; }
+    var resolved = resolveOwnerColumn(columnsOf[table]);
+    if (!resolved || resolved.kind !== 'owner') { continue; }
+    var target = referenced[table + '.' + resolved.column];
+    if (target && target !== AUTH_USERS_TABLE + '.id') { continue; }
+    owned.push({ table: table, column: resolved.column });
+  }
+  return owned;
+}
+
+// Each table is deleted from under its own savepoint, so one that refuses
+// (another user's row still points at this user's, through a link without
+// ON DELETE CASCADE) stops neither the other tables nor the account from being
+// deleted. A refused table is retried once the rest are done — the blocker may
+// have been this user's own row in another table; what is still refused stays
+// as it always did, and the log names it.
+async function deleteOwnedRows(client, userId) {
+  var pending = await ownedRowLinks(client);
+  while (pending.length > 0) {
+    var refused = [];
+    for (var i = 0; i < pending.length; i++) {
+      var link = pending[i];
+      await client.query('SAVEPOINT owned_rows');
+      try {
+        await client.query(
+          'DELETE FROM ' + quoteIdentifier(link.table) + ' WHERE ' + quoteIdentifier(link.column) + ' = $1',
+          [userId]
+        );
+        await client.query('RELEASE SAVEPOINT owned_rows');
+      } catch (err) {
+        await client.query('ROLLBACK TO SAVEPOINT owned_rows');
+        await client.query('RELEASE SAVEPOINT owned_rows');
+        link.error = err && err.message ? err.message : String(err);
+        refused.push(link);
+      }
+    }
+    if (refused.length === pending.length) { break; }
+    pending = refused;
+  }
+  for (var k = 0; k < pending.length; k++) {
+    console.error('[account-delete] rows kept in ' + pending[k].table + ' (' + pending[k].column + '): ' + pending[k].error);
+  }
+}
+
 // Invoices are a financial/tax record that must survive, but they store the
 // customer's PII denormalised and link to the user only through order_id (no
 // user_id). Scrub the PII in place, matching invoices whose order belongs to the
@@ -246,6 +378,7 @@ module.exports = async function handler(req, res) {
         for (var d = 0; d < DELETE_TABLES.length; d++) {
           await deleteUserRows(client, DELETE_TABLES[d], userId);
         }
+        await deleteOwnedRows(client, userId);
         // password_reset_tokens has no user_id — it is keyed by the email string.
         await deleteRowsByEmail(client, 'password_reset_tokens', 'email', userEmail);
         await client.query('DELETE FROM ' + AUTH_USERS_TABLE + ' WHERE id = $1', [userId]);