@teleporthq/teleport-plugin-next-workflows 0.44.7 → 0.44.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teleporthq/teleport-plugin-next-workflows",
-  "version": "0.44.7",
+  "version": "0.44.8",
   "description": "A plugin for workflow code generation in Next.js projects.",
   "author": "teleportHQ",
   "license": "MIT",
@@ -69,5 +69,5 @@
     "@teleporthq/teleport-shared": "^0.44.7",
     "@teleporthq/teleport-types": "^0.44.0"
   },
-  "gitHead": "a279c1bd1e268a8b7302e2c4fafd45748a1d242a"
+  "gitHead": "81bb230e4f5c7b6c339850a8589fa29c78602d66"
 }

package/src/api-route-generator.ts

@@ -527,9 +527,12 @@ function __isStreamingAI(node, config) {
   return config && config.streaming && __streamingAITypes.indexOf(node.type) >= 0;
 }
 
-// One node's result to the browser — never one kept on the server, and a data
-// node's rows without the users table's credentials (see segmentReply).
+// One node's result to the browser — never one kept on the server nor a
+// credential (the closing reply carries that one sealed), and a data node's
+// rows without the users table's credentials (see segmentReply).
+const __credentialResultIds = utils.credentialResultNodeIds(SEGMENT_CONFIG);
 function __streamNodeResult(res, nodeId, result) {
+  if (__credentialResultIds[nodeId]) return;
   const kept = SEGMENT_CONFIG.nodes.find(function(nd) { return nd.id === nodeId; });
   if (kept && kept.config && kept.config.keepResultOnServer === true && !utils.isBranchingNodeType(kept.type)) return;
   res.write('data: ' + JSON.stringify({ type: 'node-result', nodeId: nodeId, result: utils.withoutCredentialColumns(kept, result) }) + '\\n\\n');

package/src/credential-results.ts

@@ -0,0 +1,71 @@
+import { nodeRegistry } from './nodes'
+
+/**
+ * The node types whose result is a credential, read off the node registry
+ * (`resultIsCredential`): today the password-hashing node. Its result stays on
+ * the server. A server segment replies it to the browser only sealed —
+ * encrypted with a key derived from the app secret, signed like every other
+ * result — and a later server segment opens it again, so a workflow that
+ * hashes in one segment and writes in another still works (see the server
+ * runtime: `sealResult`, `openSealedResults`).
+ */
+export const CREDENTIAL_RESULT_NODE_TYPES: string[] = Object.keys(nodeRegistry).filter(
+  (nodeType) => nodeRegistry[nodeType].resultIsCredential === true
+)
+
+/**
+ * `credentialResultNodeIds(segmentConfig)`: the nodes of a segment whose
+ * result is a credential — every node of a credential type, and every map
+ * loop whose results are such a node's results (the loop's last body step, as
+ * the route runs it; a loop of loops follows its inner loop).
+ */
+export const generateCredentialResultsCode = (): string => `
+var __CREDENTIAL_RESULT_NODE_TYPES = ${JSON.stringify(CREDENTIAL_RESULT_NODE_TYPES)};
+
+function lastLoopBodyNodeId(loopId, sortedNodes, edges) {
+  var start = edges.find(function(e) { return e.source === loopId && e.sourceHandle === 'loop'; });
+  if (!start) return null;
+  var body = {};
+  var queue = [start.target];
+  while (queue.length > 0) {
+    var current = queue.shift();
+    if (body[current] || current === loopId) continue;
+    body[current] = true;
+    edges.forEach(function(e) {
+      if (e.source === current && (e.sourceHandle === 'loop-body-out' || !e.sourceHandle) && e.target !== loopId) {
+        queue.push(e.target);
+      }
+    });
+  }
+  var last = null;
+  sortedNodes.forEach(function(n) { if (body[n.id]) last = n.id; });
+  return last;
+}
+
+function credentialResultNodeIds(segmentConfig) {
+  var nodes = (segmentConfig && segmentConfig.nodes) || [];
+  var edges = (segmentConfig && segmentConfig.edges) || [];
+  var ids = {};
+  nodes.forEach(function(n) {
+    if (__CREDENTIAL_RESULT_NODE_TYPES.indexOf(n.type) !== -1) ids[n.id] = true;
+  });
+  var sortedNodes = nodes.slice().sort(function(a, b) { return (a.stepNumber || 0) - (b.stepNumber || 0); });
+  var mapLoops = nodes.filter(function(n) {
+    var loopType = n.config && n.config.loopType;
+    return n.type === 'general-loop' && !!loopType && loopType !== 'forEach';
+  });
+  var grew = true;
+  while (grew) {
+    grew = false;
+    mapLoops.forEach(function(loop) {
+      if (ids[loop.id]) return;
+      var last = lastLoopBodyNodeId(loop.id, sortedNodes, edges);
+      if (last && ids[last]) {
+        ids[loop.id] = true;
+        grew = true;
+      }
+    });
+  }
+  return ids;
+}
+`

package/src/executor-generator.ts

@@ -5,6 +5,7 @@ import {
 } from './email-locale'
 import { generateSignedInDestinationCode } from './auth-return/signed-in-destination-code'
 import { generateCredentialColumnsCode } from './credential-columns-code'
+import { generateCredentialResultsCode } from './credential-results'
 
 export interface SharedRuntimeUtilsOptions {
   /**
@@ -1418,7 +1419,12 @@ var SEGMENT_REPLY_PRIVATE_KEYS = {
 //
 // A data node's rows are replied without the auth users table's credentials
 // (see credential-columns-code.ts).
+//
+// A node whose result is a credential (a password hash) is left out here too,
+// whatever its config says: the server runtime replies it sealed, readable by
+// a later server segment only (see credential-results.ts).
 ${generateCredentialColumnsCode()}
+${generateCredentialResultsCode()}
 // The nodes whose result the client branches on: never kept on the server.
 function isBranchingNodeType(type) {
   return type === 'general-if-statement' || type === 'general-switch';
@@ -1427,7 +1433,7 @@ function isBranchingNodeType(type) {
 function segmentReply(segmentConfig, context, snapshot) {
   var reply = {};
   var own = {};
-  var kept = {};
+  var kept = credentialResultNodeIds(segmentConfig);
   var nodes = (segmentConfig && segmentConfig.nodes) || [];
   for (var ni = 0; ni < nodes.length; ni++) {
     own[nodes[ni].id] = nodes[ni];
@@ -1514,6 +1520,7 @@ module.exports = {
   snapshotIncomingContext,
   segmentReply,
   withoutCredentialColumns,
+  credentialResultNodeIds,
   evaluateCondition,
   evaluateSingleComparison,
   normalizeComparisonOperator,

package/src/nodes/account/account-hash-password.ts

@@ -47,6 +47,7 @@ async function account_hash_password(config: any, context: Record<string, unknow
 export const accountHashPassword: NodeHandlerGenerator = {
   nodeType: 'account-hash-password',
   executionEnv: 'server',
+  resultIsCredential: true,
   dependencies: {
     bcryptjs: '^2.4.3',
   },

package/src/nodes/types.ts

@@ -114,6 +114,12 @@ export interface NodeHandlerGenerator {
   nodeType: string
   executionEnv: 'client' | 'server' | 'universal'
   isTerminal?: boolean
+  /**
+   * The node's result is a credential (a password hash). A server segment
+   * never replies it as it is: the browser receives it sealed, and only the
+   * app's own later server segments can open it (see credential-results.ts).
+   */
+  resultIsCredential?: boolean
   dependencies?: Record<string, string>
   generateHandler(): string
   generateServerHandler?(): string

package/src/server-runtime-code.ts

@@ -27,6 +27,14 @@
  * that needs a trustworthy figure (a price, an owner) reads it from the
  * database itself.
  *
+ * A result that is a credential (a password hash, see credential-results.ts)
+ * makes the same trip SEALED: `segmentReply` replies it encrypted with a key
+ * derived from NEXTAUTH_SECRET (AES-256-GCM) and signs the sealed form, and
+ * `claimSegmentContext` opens every sealed value a request hands it (a
+ * relayed result once its signature holds). The browser relays it without
+ * ever reading it, and a later segment's reply hands back the sealed form,
+ * never the opened one.
+ *
  * The facts about the graph each route needs are baked into its
  * SEGMENT_CONFIG at generation time (see segment-trust.ts).
  */
@@ -51,6 +59,59 @@ function mac(text) {
   return crypto.createHmac('sha256', stepKey()).update(text).digest('hex');
 }
 
+var __sealKeyCache = { secret: null, key: null };
+
+function sealKey() {
+  var secret = process.env.NEXTAUTH_SECRET || '';
+  if (__sealKeyCache.secret !== secret) {
+    __sealKeyCache = {
+      secret: secret,
+      key: crypto.createHmac('sha256', secret).update('teleport-workflow-seal:v1').digest()
+    };
+  }
+  return __sealKeyCache.key;
+}
+
+var SEAL_IV_BYTES = 12;
+var SEAL_TAG_BYTES = 16;
+
+var SEAL_AAD = Buffer.from('teleport-workflow-sealed-result:v1', 'utf8');
+
+// The sealed form of a credential result; undefined (the result is then not
+// replied at all) without an app secret, whose key anyone could derive.
+function sealResult(value) {
+  if (!process.env.NEXTAUTH_SECRET) return undefined;
+  var serialized;
+  try { serialized = JSON.stringify(value); } catch (e) { return undefined; }
+  if (serialized === undefined) return undefined;
+  var iv = crypto.randomBytes(SEAL_IV_BYTES);
+  var cipher = crypto.createCipheriv('aes-256-gcm', sealKey(), iv);
+  cipher.setAAD(SEAL_AAD);
+  var data = Buffer.concat([cipher.update(serialized, 'utf8'), cipher.final()]);
+  return { __sealed: Buffer.concat([iv, cipher.getAuthTag(), data]).toString('base64') };
+}
+
+function isSealedResult(value) {
+  return !!value && typeof value === 'object' && !Array.isArray(value) &&
+    typeof value.__sealed === 'string' && Object.keys(value).length === 1;
+}
+
+// { value } when the sealed form opens under this app's key, else null.
+function openSealedResult(sealed) {
+  if (!process.env.NEXTAUTH_SECRET) return null;
+  try {
+    var raw = Buffer.from(sealed.__sealed, 'base64');
+    if (raw.length <= SEAL_IV_BYTES + SEAL_TAG_BYTES) return null;
+    var decipher = crypto.createDecipheriv('aes-256-gcm', sealKey(), raw.subarray(0, SEAL_IV_BYTES));
+    decipher.setAAD(SEAL_AAD);
+    decipher.setAuthTag(raw.subarray(SEAL_IV_BYTES, SEAL_IV_BYTES + SEAL_TAG_BYTES));
+    var data = Buffer.concat([decipher.update(raw.subarray(SEAL_IV_BYTES + SEAL_TAG_BYTES)), decipher.final()]);
+    return { value: JSON.parse(data.toString('utf8')) };
+  } catch (e) {
+    return null;
+  }
+}
+
 // Without an app secret every key here would derive from '' — a value anyone
 // can compute — so nothing verifies: relayed server results are dropped and no
 // request passes as an internal call. (The generator gives every app with
@@ -206,10 +267,48 @@ function resetPreviousResult(segmentConfig, context) {
 // merge will.
 var __incomingOrders = new WeakMap();
 
+// The sealed results this segment opened, so its reply hands the caller back
+// the sealed form it relayed (see resealRelayedResults).
+var __openedResults = new WeakMap();
+
+// Opens every sealed value the request hands this segment, so its nodes read
+// the credential itself: a relayed server result (whose signature
+// dropUnsignedResults checked first), or a value the browser holds from one
+// (a custom node's output, the previous result). Only this app's server
+// seals, so what opens is what it sealed.
+function openSealedResults(context) {
+  var opened = [];
+  Object.keys(context).forEach(function(key) {
+    if (isControlKey(key) && key !== '__previousNodeResult') return;
+    if (!isSealedResult(context[key])) return;
+    var result = openSealedResult(context[key]);
+    if (!result) return;
+    opened.push({ sealed: context[key], value: result.value });
+    context[key] = result.value;
+  });
+  __openedResults.set(context, opened);
+}
+
+// Every reply entry that is an opened value (the value itself, or the previous
+// result taken from it) goes back sealed.
+function resealRelayedResults(context, reply) {
+  var opened = __openedResults.get(context) || [];
+  if (opened.length === 0) return;
+  Object.keys(reply).forEach(function(key) {
+    for (var i = 0; i < opened.length; i++) {
+      if (reply[key] === opened[i].value) {
+        reply[key] = opened[i].sealed;
+        return;
+      }
+    }
+  });
+}
+
 function claimSegmentContext(segmentConfig, context) {
   var orderKeys = readSignedOrder(context);
   if (orderKeys) restoreOrder(context, orderKeys);
   dropUnsignedResults(segmentConfig, context, orderKeys);
+  openSealedResults(context);
   stripForeignControlKeys(segmentConfig, context);
   __incomingOrders.set(context, Object.keys(context).filter(function(k) { return !isControlKey(k); }));
   utils.claimSegmentContext(segmentConfig, context);
@@ -219,6 +318,13 @@ function claimSegmentContext(segmentConfig, context) {
 
 function segmentReply(segmentConfig, context, snapshot) {
   var reply = utils.segmentReply(segmentConfig, context, snapshot);
+  resealRelayedResults(context, reply);
+  var credentialIds = utils.credentialResultNodeIds(segmentConfig);
+  Object.keys(credentialIds).forEach(function(id) {
+    if (context[id] === undefined) return;
+    var sealed = sealResult(context[id]);
+    if (sealed) reply[id] = sealed;
+  });
   var sigs = {};
   var incoming = context.__sig && typeof context.__sig === 'object' && !Array.isArray(context.__sig) ? context.__sig : {};
   Object.keys(incoming).forEach(function(id) {