@teleporthq/teleport-plugin-next-workflows 0.44.6 → 0.44.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teleporthq/teleport-plugin-next-workflows",
-  "version": "0.44.6",
+  "version": "0.44.8",
   "description": "A plugin for workflow code generation in Next.js projects.",
   "author": "teleportHQ",
   "license": "MIT",
@@ -66,8 +66,8 @@
   },
   "dependencies": {
     "@babel/types": "^7.5.5",
-    "@teleporthq/teleport-shared": "^0.44.5",
+    "@teleporthq/teleport-shared": "^0.44.7",
     "@teleporthq/teleport-types": "^0.44.0"
   },
-  "gitHead": "c763dc9d1d966d36811d04cd422e948a5cd7e841"
+  "gitHead": "81bb230e4f5c7b6c339850a8589fa29c78602d66"
 }

package/src/api-route-generator.ts

@@ -527,11 +527,15 @@ function __isStreamingAI(node, config) {
   return config && config.streaming && __streamingAITypes.indexOf(node.type) >= 0;
 }
 
-// One node's result to the browser — never one kept on the server (see segmentReply).
+// One node's result to the browser — never one kept on the server nor a
+// credential (the closing reply carries that one sealed), and a data node's
+// rows without the users table's credentials (see segmentReply).
+const __credentialResultIds = utils.credentialResultNodeIds(SEGMENT_CONFIG);
 function __streamNodeResult(res, nodeId, result) {
+  if (__credentialResultIds[nodeId]) return;
   const kept = SEGMENT_CONFIG.nodes.find(function(nd) { return nd.id === nodeId; });
   if (kept && kept.config && kept.config.keepResultOnServer === true && !utils.isBranchingNodeType(kept.type)) return;
-  res.write('data: ' + JSON.stringify({ type: 'node-result', nodeId: nodeId, result: result }) + '\\n\\n');
+  res.write('data: ' + JSON.stringify({ type: 'node-result', nodeId: nodeId, result: utils.withoutCredentialColumns(kept, result) }) + '\\n\\n');
 }
 
 function __collectSegBranchNodes(startId, excludeId) {

package/src/credential-columns-code.ts

@@ -0,0 +1,59 @@
+import { TableAccess } from '@teleporthq/teleport-shared'
+import { DATA_NODE_TYPES } from './data-api-route-generator'
+
+/**
+ * Runtime helpers that leave the auth users table's credential columns out of
+ * the rows a server segment answers the browser with — the columns
+ * `TableAccess.AUTH_CREDENTIAL_COLUMNS` names, the ones every browser read of
+ * the data route is already served without. A data node of a server segment
+ * reads through the data route as the app's own server code, so its rows come
+ * back whole, and the segment's reply (or a streamed node result) is the
+ * browser's copy of them.
+ *
+ * Only the results of the nodes that read rows (`DATA_NODE_TYPES`) are
+ * touched: all the credentials of a row of the users table, the unambiguous
+ * ones of a raw statement's row, whose table is not known. A row is the
+ * result itself (a create or update spreads its row into it), an object it
+ * holds, or an element of an array it holds; column values are not walked.
+ */
+export const generateCredentialColumnsCode = (): string => `
+var __CREDENTIAL_COLUMNS = ${JSON.stringify(TableAccess.AUTH_CREDENTIAL_COLUMNS)};
+var __UNAMBIGUOUS_CREDENTIAL_COLUMNS = ${JSON.stringify(
+  TableAccess.UNAMBIGUOUS_CREDENTIAL_COLUMNS
+)};
+var __CREDENTIAL_TABLES = ${JSON.stringify(TableAccess.AUTH_CREDENTIAL_TABLES)};
+var __ROW_NODE_TYPES = ${JSON.stringify(Array.from(DATA_NODE_TYPES))};
+
+function credentialColumnsOf(node) {
+  if (!node || __ROW_NODE_TYPES.indexOf(node.type) === -1) return [];
+  var tableName = node.config && typeof node.config.tableName === 'string' ? node.config.tableName : '';
+  if (!tableName) return __UNAMBIGUOUS_CREDENTIAL_COLUMNS;
+  var parts = tableName.trim().toLowerCase().replace(/"/g, '').split('.');
+  return __CREDENTIAL_TABLES.indexOf(parts[parts.length - 1]) !== -1 ? __CREDENTIAL_COLUMNS : [];
+}
+
+function withoutColumns(row, columns) {
+  if (!row || typeof row !== 'object' || Array.isArray(row)) return row;
+  var kept = {};
+  Object.keys(row).forEach(function(key) {
+    if (columns.indexOf(String(key).toLowerCase()) === -1) kept[key] = row[key];
+  });
+  return kept;
+}
+
+function withoutRowsColumns(value, columns) {
+  if (Array.isArray(value)) return value.map(function(row) { return withoutColumns(row, columns); });
+  return withoutColumns(value, columns);
+}
+
+function withoutCredentialColumns(node, result) {
+  var columns = credentialColumnsOf(node);
+  if (columns.length === 0 || !result || typeof result !== 'object') return result;
+  if (Array.isArray(result)) return withoutRowsColumns(result, columns);
+  var kept = withoutColumns(result, columns);
+  Object.keys(kept).forEach(function(key) {
+    if (kept[key] && typeof kept[key] === 'object') kept[key] = withoutRowsColumns(kept[key], columns);
+  });
+  return kept;
+}
+`

package/src/credential-results.ts

@@ -0,0 +1,71 @@
+import { nodeRegistry } from './nodes'
+
+/**
+ * The node types whose result is a credential, read off the node registry
+ * (`resultIsCredential`): today the password-hashing node. Its result stays on
+ * the server. A server segment replies it to the browser only sealed —
+ * encrypted with a key derived from the app secret, signed like every other
+ * result — and a later server segment opens it again, so a workflow that
+ * hashes in one segment and writes in another still works (see the server
+ * runtime: `sealResult`, `openSealedResults`).
+ */
+export const CREDENTIAL_RESULT_NODE_TYPES: string[] = Object.keys(nodeRegistry).filter(
+  (nodeType) => nodeRegistry[nodeType].resultIsCredential === true
+)
+
+/**
+ * `credentialResultNodeIds(segmentConfig)`: the nodes of a segment whose
+ * result is a credential — every node of a credential type, and every map
+ * loop whose results are such a node's results (the loop's last body step, as
+ * the route runs it; a loop of loops follows its inner loop).
+ */
+export const generateCredentialResultsCode = (): string => `
+var __CREDENTIAL_RESULT_NODE_TYPES = ${JSON.stringify(CREDENTIAL_RESULT_NODE_TYPES)};
+
+function lastLoopBodyNodeId(loopId, sortedNodes, edges) {
+  var start = edges.find(function(e) { return e.source === loopId && e.sourceHandle === 'loop'; });
+  if (!start) return null;
+  var body = {};
+  var queue = [start.target];
+  while (queue.length > 0) {
+    var current = queue.shift();
+    if (body[current] || current === loopId) continue;
+    body[current] = true;
+    edges.forEach(function(e) {
+      if (e.source === current && (e.sourceHandle === 'loop-body-out' || !e.sourceHandle) && e.target !== loopId) {
+        queue.push(e.target);
+      }
+    });
+  }
+  var last = null;
+  sortedNodes.forEach(function(n) { if (body[n.id]) last = n.id; });
+  return last;
+}
+
+function credentialResultNodeIds(segmentConfig) {
+  var nodes = (segmentConfig && segmentConfig.nodes) || [];
+  var edges = (segmentConfig && segmentConfig.edges) || [];
+  var ids = {};
+  nodes.forEach(function(n) {
+    if (__CREDENTIAL_RESULT_NODE_TYPES.indexOf(n.type) !== -1) ids[n.id] = true;
+  });
+  var sortedNodes = nodes.slice().sort(function(a, b) { return (a.stepNumber || 0) - (b.stepNumber || 0); });
+  var mapLoops = nodes.filter(function(n) {
+    var loopType = n.config && n.config.loopType;
+    return n.type === 'general-loop' && !!loopType && loopType !== 'forEach';
+  });
+  var grew = true;
+  while (grew) {
+    grew = false;
+    mapLoops.forEach(function(loop) {
+      if (ids[loop.id]) return;
+      var last = lastLoopBodyNodeId(loop.id, sortedNodes, edges);
+      if (last && ids[last]) {
+        ids[loop.id] = true;
+        grew = true;
+      }
+    });
+  }
+  return ids;
+}
+`

package/src/data-api-route-generator.ts

@@ -15,7 +15,7 @@ import { generateSqlValidatorCode } from './sql-validator'
 import { generateCommonJsSessionTokenResolverCode } from './session-cookie-resolver'
 import { ContentTables, TableAccess } from '@teleporthq/teleport-shared'
 
-const DATA_NODE_TYPES = new Set([
+export const DATA_NODE_TYPES: ReadonlySet<string> = new Set([
   'data-select',
   'data-create-item',
   'data-update-item',
@@ -677,6 +677,13 @@ function dropMissingOptionalColumns(tableName, entries, colTypes) {
   return kept;
 }
 
+// The row a create or update answers with, whoever asked, without the auth
+// users table's credentials (the columns a browser read is served without):
+// a server-side caller hands that answer on to the browser as its result.
+function withoutCredentialColumns(row, tableName) {
+  return row ? __taWithoutCredentials([row], tableName)[0] : row;
+}
+
 async function handleCreate(client, body) {
   var tableName = body.tableName;
   var columnMappings = body.columnMappings || {};
@@ -751,7 +758,7 @@ async function handleCreate(client, body) {
   var item = result.rows && result.rows[0] ? result.rows[0] : null;
   var idIdx = columns.indexOf('id');
   var resolvedId = item ? (item.id || null) : (idIdx >= 0 ? values[idIdx] : null);
-  return { item: item, id: resolvedId };
+  return { item: withoutCredentialColumns(item, tableName), id: resolvedId };
 }
 
 async function handleUpdate(client, body) {
@@ -803,7 +810,8 @@ async function handleUpdate(client, body) {
   sql += ' RETURNING *';
 
   var result = await safeQuery(client, sql, queryParams, 'update');
-  return { updatedCount: result.rowCount || 0, item: result.rows[0] || null, id: (result.rows[0] && result.rows[0].id) || null };
+  var updated = result.rows[0] || null;
+  return { updatedCount: result.rowCount || 0, item: withoutCredentialColumns(updated, tableName), id: (updated && updated.id) || null };
 }
 
 async function handleDelete(client, body) {

package/src/executor-generator.ts

@@ -4,6 +4,8 @@ import {
   generateWorkflowLocaleHelpersCode,
 } from './email-locale'
 import { generateSignedInDestinationCode } from './auth-return/signed-in-destination-code'
+import { generateCredentialColumnsCode } from './credential-columns-code'
+import { generateCredentialResultsCode } from './credential-results'
 
 export interface SharedRuntimeUtilsOptions {
   /**
@@ -1414,6 +1416,15 @@ var SEGMENT_REPLY_PRIVATE_KEYS = {
 // nodes after it in the same segment and never leaves the server (a statement's
 // rows read only to build what the browser may see, a sender's recipients).
 // Nothing in a later segment can read it.
+//
+// A data node's rows are replied without the auth users table's credentials
+// (see credential-columns-code.ts).
+//
+// A node whose result is a credential (a password hash) is left out here too,
+// whatever its config says: the server runtime replies it sealed, readable by
+// a later server segment only (see credential-results.ts).
+${generateCredentialColumnsCode()}
+${generateCredentialResultsCode()}
 // The nodes whose result the client branches on: never kept on the server.
 function isBranchingNodeType(type) {
   return type === 'general-if-statement' || type === 'general-switch';
@@ -1422,10 +1433,10 @@ function isBranchingNodeType(type) {
 function segmentReply(segmentConfig, context, snapshot) {
   var reply = {};
   var own = {};
-  var kept = {};
+  var kept = credentialResultNodeIds(segmentConfig);
   var nodes = (segmentConfig && segmentConfig.nodes) || [];
   for (var ni = 0; ni < nodes.length; ni++) {
-    own[nodes[ni].id] = true;
+    own[nodes[ni].id] = nodes[ni];
     if (nodes[ni].config && nodes[ni].config.keepResultOnServer === true && !isBranchingNodeType(nodes[ni].type)) {
       kept[nodes[ni].id] = true;
     }
@@ -1436,7 +1447,11 @@ function segmentReply(segmentConfig, context, snapshot) {
     if (SEGMENT_REPLY_PRIVATE_KEYS[key] || kept[key]) continue;
     var value = context[key];
     if (value === undefined) continue;
-    if (own[key] || !snapshot || !Object.prototype.hasOwnProperty.call(snapshot, key)) {
+    if (own[key]) {
+      reply[key] = withoutCredentialColumns(own[key], value);
+      continue;
+    }
+    if (!snapshot || !Object.prototype.hasOwnProperty.call(snapshot, key)) {
       reply[key] = value;
       continue;
     }
@@ -1504,6 +1519,8 @@ module.exports = {
   loopIterationContext,
   snapshotIncomingContext,
   segmentReply,
+  withoutCredentialColumns,
+  credentialResultNodeIds,
   evaluateCondition,
   evaluateSingleComparison,
   normalizeComparisonOperator,

package/src/nodes/account/account-hash-password.ts

@@ -47,6 +47,7 @@ async function account_hash_password(config: any, context: Record<string, unknow
 export const accountHashPassword: NodeHandlerGenerator = {
   nodeType: 'account-hash-password',
   executionEnv: 'server',
+  resultIsCredential: true,
   dependencies: {
     bcryptjs: '^2.4.3',
   },

package/src/nodes/types.ts

@@ -114,6 +114,12 @@ export interface NodeHandlerGenerator {
   nodeType: string
   executionEnv: 'client' | 'server' | 'universal'
   isTerminal?: boolean
+  /**
+   * The node's result is a credential (a password hash). A server segment
+   * never replies it as it is: the browser receives it sealed, and only the
+   * app's own later server segments can open it (see credential-results.ts).
+   */
+  resultIsCredential?: boolean
   dependencies?: Record<string, string>
   generateHandler(): string
   generateServerHandler?(): string

package/src/server-runtime-code.ts

@@ -27,6 +27,14 @@
  * that needs a trustworthy figure (a price, an owner) reads it from the
  * database itself.
  *
+ * A result that is a credential (a password hash, see credential-results.ts)
+ * makes the same trip SEALED: `segmentReply` replies it encrypted with a key
+ * derived from NEXTAUTH_SECRET (AES-256-GCM) and signs the sealed form, and
+ * `claimSegmentContext` opens every sealed value a request hands it (a
+ * relayed result once its signature holds). The browser relays it without
+ * ever reading it, and a later segment's reply hands back the sealed form,
+ * never the opened one.
+ *
  * The facts about the graph each route needs are baked into its
  * SEGMENT_CONFIG at generation time (see segment-trust.ts).
  */
@@ -51,6 +59,59 @@ function mac(text) {
   return crypto.createHmac('sha256', stepKey()).update(text).digest('hex');
 }
 
+var __sealKeyCache = { secret: null, key: null };
+
+function sealKey() {
+  var secret = process.env.NEXTAUTH_SECRET || '';
+  if (__sealKeyCache.secret !== secret) {
+    __sealKeyCache = {
+      secret: secret,
+      key: crypto.createHmac('sha256', secret).update('teleport-workflow-seal:v1').digest()
+    };
+  }
+  return __sealKeyCache.key;
+}
+
+var SEAL_IV_BYTES = 12;
+var SEAL_TAG_BYTES = 16;
+
+var SEAL_AAD = Buffer.from('teleport-workflow-sealed-result:v1', 'utf8');
+
+// The sealed form of a credential result; undefined (the result is then not
+// replied at all) without an app secret, whose key anyone could derive.
+function sealResult(value) {
+  if (!process.env.NEXTAUTH_SECRET) return undefined;
+  var serialized;
+  try { serialized = JSON.stringify(value); } catch (e) { return undefined; }
+  if (serialized === undefined) return undefined;
+  var iv = crypto.randomBytes(SEAL_IV_BYTES);
+  var cipher = crypto.createCipheriv('aes-256-gcm', sealKey(), iv);
+  cipher.setAAD(SEAL_AAD);
+  var data = Buffer.concat([cipher.update(serialized, 'utf8'), cipher.final()]);
+  return { __sealed: Buffer.concat([iv, cipher.getAuthTag(), data]).toString('base64') };
+}
+
+function isSealedResult(value) {
+  return !!value && typeof value === 'object' && !Array.isArray(value) &&
+    typeof value.__sealed === 'string' && Object.keys(value).length === 1;
+}
+
+// { value } when the sealed form opens under this app's key, else null.
+function openSealedResult(sealed) {
+  if (!process.env.NEXTAUTH_SECRET) return null;
+  try {
+    var raw = Buffer.from(sealed.__sealed, 'base64');
+    if (raw.length <= SEAL_IV_BYTES + SEAL_TAG_BYTES) return null;
+    var decipher = crypto.createDecipheriv('aes-256-gcm', sealKey(), raw.subarray(0, SEAL_IV_BYTES));
+    decipher.setAAD(SEAL_AAD);
+    decipher.setAuthTag(raw.subarray(SEAL_IV_BYTES, SEAL_IV_BYTES + SEAL_TAG_BYTES));
+    var data = Buffer.concat([decipher.update(raw.subarray(SEAL_IV_BYTES + SEAL_TAG_BYTES)), decipher.final()]);
+    return { value: JSON.parse(data.toString('utf8')) };
+  } catch (e) {
+    return null;
+  }
+}
+
 // Without an app secret every key here would derive from '' — a value anyone
 // can compute — so nothing verifies: relayed server results are dropped and no
 // request passes as an internal call. (The generator gives every app with
@@ -206,10 +267,48 @@ function resetPreviousResult(segmentConfig, context) {
 // merge will.
 var __incomingOrders = new WeakMap();
 
+// The sealed results this segment opened, so its reply hands the caller back
+// the sealed form it relayed (see resealRelayedResults).
+var __openedResults = new WeakMap();
+
+// Opens every sealed value the request hands this segment, so its nodes read
+// the credential itself: a relayed server result (whose signature
+// dropUnsignedResults checked first), or a value the browser holds from one
+// (a custom node's output, the previous result). Only this app's server
+// seals, so what opens is what it sealed.
+function openSealedResults(context) {
+  var opened = [];
+  Object.keys(context).forEach(function(key) {
+    if (isControlKey(key) && key !== '__previousNodeResult') return;
+    if (!isSealedResult(context[key])) return;
+    var result = openSealedResult(context[key]);
+    if (!result) return;
+    opened.push({ sealed: context[key], value: result.value });
+    context[key] = result.value;
+  });
+  __openedResults.set(context, opened);
+}
+
+// Every reply entry that is an opened value (the value itself, or the previous
+// result taken from it) goes back sealed.
+function resealRelayedResults(context, reply) {
+  var opened = __openedResults.get(context) || [];
+  if (opened.length === 0) return;
+  Object.keys(reply).forEach(function(key) {
+    for (var i = 0; i < opened.length; i++) {
+      if (reply[key] === opened[i].value) {
+        reply[key] = opened[i].sealed;
+        return;
+      }
+    }
+  });
+}
+
 function claimSegmentContext(segmentConfig, context) {
   var orderKeys = readSignedOrder(context);
   if (orderKeys) restoreOrder(context, orderKeys);
   dropUnsignedResults(segmentConfig, context, orderKeys);
+  openSealedResults(context);
   stripForeignControlKeys(segmentConfig, context);
   __incomingOrders.set(context, Object.keys(context).filter(function(k) { return !isControlKey(k); }));
   utils.claimSegmentContext(segmentConfig, context);
@@ -219,6 +318,13 @@ function claimSegmentContext(segmentConfig, context) {
 
 function segmentReply(segmentConfig, context, snapshot) {
   var reply = utils.segmentReply(segmentConfig, context, snapshot);
+  resealRelayedResults(context, reply);
+  var credentialIds = utils.credentialResultNodeIds(segmentConfig);
+  Object.keys(credentialIds).forEach(function(id) {
+    if (context[id] === undefined) return;
+    var sealed = sealResult(context[id]);
+    if (sealed) reply[id] = sealed;
+  });
   var sigs = {};
   var incoming = context.__sig && typeof context.__sig === 'object' && !Array.isArray(context.__sig) ? context.__sig : {};
   Object.keys(incoming).forEach(function(id) {