@teleporthq/teleport-plugin-next-workflows 0.44.7 → 0.44.9

package/src/account-delete-route-generator.ts

@@ -4,9 +4,14 @@
  *
  * The client node calls this route, which:
  *   1. resolves the current user from the NextAuth session (never trusting a
- *      client-supplied id),
+ *      client-supplied id) and, when the request carries a password, goes on
+ *      only if it is the account's own,
  *   2. runs a single DB transaction that detaches + anonymises business/legal
- *      records (orders, withdrawal requests, bookings) so tracking survives,
+ *      records (orders, withdrawal requests, bookings, downloads, gift cards
+ *      the user bought or received) so tracking survives, takes the user's
+ *      email out of the activity log and the sent-email ledger, leaves the
+ *      invoices already issued as they are (an invoice must keep naming its
+ *      buyer),
  *      deletes the user's personal data (reviews, cart, favourites, chat
  *      history), deletes the rows the user owns in the project's own tables —
  *      the ones the AI made for the site, each through the one column the
@@ -100,10 +105,29 @@ const ANONYMIZE_TABLES = [
   'teleport_subscriptions',
   'teleport_abandoned_carts',
   'teleport_voucher_redemptions',
+  'teleport_downloads',
 ];
 const EMAIL_COLUMNS = ['billing_email', 'shipping_email', 'customer_email', 'email'];
 // A booking also names the customer and carries their phone; both are cleared.
-const CLEARED_COLUMNS = { teleport_bookings: ['customer_name', 'customer_phone'] };
+// A download keeps its count against the order's limit, without who fetched it
+// from where.
+const CLEARED_COLUMNS = {
+  teleport_bookings: ['customer_name', 'customer_phone'],
+  teleport_downloads: ['ip_address'],
+};
+// Tables that name the user only by their email: each column holding it takes
+// the anonymised address (a gift card stays redeemable by its code) or a blank
+// (an activity-log line keeps what happened, not who did it).
+const EMAIL_REFERENCES = [
+  { table: 'teleport_gift_cards', column: 'purchaser_email', replacement: 'anonymised' },
+  { table: 'teleport_gift_cards', column: 'recipient_email', replacement: 'anonymised' },
+  { table: 'teleport_events', column: 'actor', replacement: 'blank' },
+];
+const SENT_EMAILS_TABLE = 'teleport_sent_emails';
+
+function anonymisedEmailOf(userId) {
+  return String(DELETED_EMAIL_PATTERN).split('{{userId}}').join(String(userId));
+}
 
 async function tableColumns(client, table) {
   var r = await client.query(
@@ -146,6 +170,36 @@ async function deleteRowsByEmail(client, table, column, email) {
   await client.query('DELETE FROM ' + table + ' WHERE ' + column + ' = $1', [email]);
 }
 
+async function replaceEmailReferences(client, email, anonymisedEmail) {
+  if (!email) { return; }
+  for (var i = 0; i < EMAIL_REFERENCES.length; i++) {
+    var ref = EMAIL_REFERENCES[i];
+    var cols = await tableColumns(client, ref.table);
+    if (cols.indexOf(ref.column) === -1) { continue; }
+    await client.query(
+      'UPDATE ' + ref.table + ' SET ' + ref.column + ' = $1 WHERE lower(' + ref.column + ') = lower($2)',
+      [ref.replacement === 'anonymised' ? anonymisedEmail : '', email]
+    );
+  }
+}
+
+// The emails the site sent the user stay on record (which email, when, through
+// which provider), without the address, the body or the values it was filled
+// with.
+async function blankSentEmailsTo(client, email) {
+  if (!email) { return; }
+  var cols = await tableColumns(client, SENT_EMAILS_TABLE);
+  if (cols.indexOf('recipient_email') === -1) { return; }
+  var sets = ["recipient_email = ''"];
+  if (cols.indexOf('recipients') !== -1) { sets.push('recipients = NULL'); }
+  if (cols.indexOf('body_html') !== -1) { sets.push("body_html = ''"); }
+  if (cols.indexOf('payload') !== -1) { sets.push('payload = NULL'); }
+  await client.query(
+    'UPDATE ' + SENT_EMAILS_TABLE + ' SET ' + sets.join(', ') + ' WHERE lower(recipient_email) = lower($1)',
+    [email]
+  );
+}
+
 // Rows the user owns in the project's OWN tables — the ones the AI made for
 // this site (saved items, requests, reviews …). Their link to the user is
 // ON DELETE SET NULL, so they outlived the account with a blank owner, and the
@@ -259,44 +313,34 @@ async function deleteOwnedRows(client, userId) {
   }
 }
 
-// Invoices are a financial/tax record that must survive, but they store the
-// customer's PII denormalised and link to the user only through order_id (no
-// user_id). Scrub the PII in place, matching invoices whose order belongs to the
-// user. MUST run BEFORE the orders row is anonymised (its user_id is still set).
-var INVOICE_PII_NULL_COLUMNS = [
-  'customer_name',
-  'customer_address',
-  'customer_city',
-  'customer_state',
-  'customer_zip',
-  'customer_country',
-  'customer_vat',
-  'customer_phone',
-];
-
-async function anonymizeInvoices(client, ordersTable, invoicesTable, userId, syntheticEmail) {
-  var invCols = await tableColumns(client, invoicesTable);
-  if (invCols.indexOf('order_id') === -1) { return; }
-  var orderCols = await tableColumns(client, ordersTable);
-  if (orderCols.indexOf('user_id') === -1) { return; }
-  var sets = [];
-  var params = [];
-  if (invCols.indexOf('customer_email') !== -1) {
-    params.push(syntheticEmail);
-    sets.push('customer_email = $' + params.length);
+// The password a request confirms the deletion with, or null when it names
+// none. A request without one deletes as before; one with a password deletes
+// only when it is the account's own (the editor's delete-account form asks for
+// it).
+function readRequestPassword(req) {
+  var body = req.body;
+  if (typeof body === 'string') {
+    try { body = JSON.parse(body); } catch (e) { body = null; }
   }
-  for (var i = 0; i < INVOICE_PII_NULL_COLUMNS.length; i++) {
-    if (invCols.indexOf(INVOICE_PII_NULL_COLUMNS[i]) !== -1) {
-      sets.push(INVOICE_PII_NULL_COLUMNS[i] + ' = NULL');
-    }
+  if (!body || typeof body !== 'object' || body.password === undefined || body.password === null) {
+    return null;
+  }
+  return String(body.password);
+}
+
+// The sign-in check (utils/auth/hash-password.js verifyPassword): bcrypt over
+// the SHA-256 of the password and AUTH_PEPPER. An account without a stored
+// password (a social sign-in) matches no password.
+function passwordMatches(password, storedHash) {
+  if (!storedHash || password.length > 1000) { return false; }
+  var bcrypt = require('bcryptjs');
+  var crypto = require('crypto');
+  var prepared = crypto.createHash('sha256').update(password + (process.env.AUTH_PEPPER || '')).digest('base64');
+  try {
+    return bcrypt.compareSync(prepared, String(storedHash));
+  } catch (e) {
+    return false;
   }
-  if (sets.length === 0) { return; }
-  params.push(userId);
-  await client.query(
-    'UPDATE ' + invoicesTable + ' SET ' + sets.join(', ') +
-      ' WHERE order_id IN (SELECT id FROM ' + ordersTable + ' WHERE user_id = $' + params.length + ')',
-    params
-  );
 }
 
 ${generateFillTemplateFn()}
@@ -313,6 +357,7 @@ ${generateProviderSendFunction(provider, {
   source: 'account-delete',
   sourceRef: 'api/account/delete-current',
   relativePrefix: '../../..',
+  withoutRecipientDetails: true,
 })}
 
 // \`locale\` is the language of the page the deletion was requested from
@@ -328,7 +373,7 @@ async function sendFarewellEmail(toEmail, tokenValues, userId, locale) {
   var copy = resolveFarewellEmailCopy(locale);
   var subject = fillTemplate(copy.subject, tokenValues);
   var html = fillTemplate(copy.body, tokenValues);
-  await __sendProviderEmail({ from: from, fromName: EMAIL_FROM_NAME, to: toEmail, subject: subject, html: html, apiKey: apiKey, tokenValues: tokenValues, userId: userId });
+  await __sendProviderEmail({ from: from, fromName: EMAIL_FROM_NAME, to: toEmail, recordedTo: anonymisedEmailOf(userId), subject: subject, html: html, apiKey: apiKey, tokenValues: tokenValues, userId: userId });
 }
 
 module.exports = async function handler(req, res) {
@@ -348,10 +393,12 @@ module.exports = async function handler(req, res) {
     return res.status(401).json({ error: 'Unauthenticated' });
   }
 
+  var requestPassword = readRequestPassword(req);
   var client = getClient();
   var userEmail = '';
   var userName = '';
   var userFound = false;
+  var passwordRefused = false;
   var failed = false;
   // try/finally so the pg connection is ALWAYS closed — every early exit
   // (not-found, error) leaves via the finally, never leaking a connection.
@@ -364,14 +411,14 @@ module.exports = async function handler(req, res) {
       userFound = true;
       userEmail = userRes.rows[0].email || '';
       userName = userRes.rows[0].name || '';
-
-      var syntheticEmail = String(DELETED_EMAIL_PATTERN).split('{{userId}}').join(String(userId));
+      passwordRefused =
+        requestPassword !== null && !passwordMatches(requestPassword, userRes.rows[0].password);
+    }
+    if (userFound && !passwordRefused) {
+      var syntheticEmail = anonymisedEmailOf(userId);
 
       await client.query('BEGIN');
       try {
-        // Scrub invoice PII FIRST — invoices link to the user only through
-        // order_id, so this must run while the orders row still carries user_id.
-        await anonymizeInvoices(client, 'teleport_orders', 'teleport_invoices', userId, syntheticEmail);
         for (var a = 0; a < ANONYMIZE_TABLES.length; a++) {
           await anonymizeUserRows(client, ANONYMIZE_TABLES[a], userId, syntheticEmail);
         }
@@ -379,6 +426,8 @@ module.exports = async function handler(req, res) {
           await deleteUserRows(client, DELETE_TABLES[d], userId);
         }
         await deleteOwnedRows(client, userId);
+        await replaceEmailReferences(client, userEmail, syntheticEmail);
+        await blankSentEmailsTo(client, userEmail);
         // password_reset_tokens has no user_id — it is keyed by the email string.
         await deleteRowsByEmail(client, 'password_reset_tokens', 'email', userEmail);
         await client.query('DELETE FROM ' + AUTH_USERS_TABLE + ' WHERE id = $1', [userId]);
@@ -401,6 +450,9 @@ module.exports = async function handler(req, res) {
   if (!userFound) {
     return res.status(404).json({ error: 'Account not found' });
   }
+  if (passwordRefused) {
+    return res.status(403).json({ error: 'Incorrect password' });
+  }
 
   // Best-effort farewell email AFTER the successful commit (connection closed).
   try {

package/src/api-route-generator.ts

@@ -442,7 +442,7 @@ module.exports = async function handler(req, res) {
         for (var h = 0; h < hKeys.length; h++) {
           res.setHeader(hKeys[h], earlyRes.headers[hKeys[h]]);
         }
-        await utils.settlePendingNodePromises(context);
+        await utils.handOffPendingNodePromises(context);
         res.status(earlyRes.status || 500).json(earlyRes.body || {});
         return;
       }
@@ -453,11 +453,11 @@ module.exports = async function handler(req, res) {
       if (result && result.__terminal) break;
     }
 
-    // Land every fire-and-forget query BEFORE replying: the platform may freeze
-    // this function the moment the response is sent, which would drop the write.
-    // The visitor does not pay for this — the client dispatched this segment
-    // without awaiting it (see seg.fireAndForget in the client runtime).
-    await utils.settlePendingNodePromises(context);
+    // Every not-awaited step must still land: the platform may freeze this
+    // function the moment the response is sent, which would drop the work. On
+    // Vercel it finishes after the reply (waitUntil); elsewhere the reply waits
+    // for it (see handOffPendingNodePromises in the server runtime).
+    await utils.handOffPendingNodePromises(context);
     delete context.__request;
     delete context.__pendingNodePromises;
     // MUST be stripped before replying: the results payload below IS this
@@ -469,7 +469,7 @@ module.exports = async function handler(req, res) {
     res.status(200).json({ success: true, results: utils.segmentReply(SEGMENT_CONFIG, context, __incomingSnapshot) });
   } catch (error) {
     console.error('Workflow segment error:', error);
-    if (__wfContext) { await utils.settlePendingNodePromises(__wfContext); }
+    if (__wfContext) { await utils.handOffPendingNodePromises(__wfContext); }
     res.status(500).json({ success: false, error: error.message || 'Internal server error' });
   }
 };
@@ -527,9 +527,12 @@ function __isStreamingAI(node, config) {
   return config && config.streaming && __streamingAITypes.indexOf(node.type) >= 0;
 }
 
-// One node's result to the browser — never one kept on the server, and a data
-// node's rows without the users table's credentials (see segmentReply).
+// One node's result to the browser — never one kept on the server nor a
+// credential (the closing reply carries that one sealed), and a data node's
+// rows without the users table's credentials (see segmentReply).
+const __credentialResultIds = utils.credentialResultNodeIds(SEGMENT_CONFIG);
 function __streamNodeResult(res, nodeId, result) {
+  if (__credentialResultIds[nodeId]) return;
   const kept = SEGMENT_CONFIG.nodes.find(function(nd) { return nd.id === nodeId; });
   if (kept && kept.config && kept.config.keepResultOnServer === true && !utils.isBranchingNodeType(kept.type)) return;
   res.write('data: ' + JSON.stringify({ type: 'node-result', nodeId: nodeId, result: utils.withoutCredentialColumns(kept, result) }) + '\\n\\n');
@@ -873,7 +876,7 @@ module.exports = async function handler(req, res) {
         }
         const result = await nodeHandler(resolved, context);
         if (result && result.__earlyResponse) {
-          await utils.settlePendingNodePromises(context);
+          await utils.handOffPendingNodePromises(context);
           if (streamStarted) {
             res.write('data: ' + JSON.stringify({ type: 'error', error: (result.__earlyResponse.body && result.__earlyResponse.body.message) || 'Request rejected' }) + '\\n\\n');
             res.end();
@@ -898,10 +901,9 @@ module.exports = async function handler(req, res) {
       }
     }
 
-    // See the non-streaming segment route: land every fire-and-forget query
-    // before the response completes, or the platform may freeze this function
-    // with the write still in flight.
-    await utils.settlePendingNodePromises(context);
+    // See the non-streaming segment route: every not-awaited step must still
+    // land, after the reply on Vercel, before it anywhere else.
+    await utils.handOffPendingNodePromises(context);
     delete context.__request;
     delete context.__pendingNodePromises;
     // MUST be stripped before replying: the results payload below IS this
@@ -919,7 +921,7 @@ module.exports = async function handler(req, res) {
     }
   } catch (error) {
     console.error('Streaming workflow segment error:', error);
-    if (__wfContext) { await utils.settlePendingNodePromises(__wfContext); }
+    if (__wfContext) { await utils.handOffPendingNodePromises(__wfContext); }
     if (streamStarted) {
       try {
         res.write('data: ' + JSON.stringify({ type: 'error', error: error.message || 'Internal server error' }) + '\\n\\n');

package/src/auth-generator.ts

@@ -673,7 +673,9 @@ const generateProvidersSetup = (auth: UIDLAuthentication): string => {
       if (!verifyPassword(String(credentials.password), user.password)) {
         throw new Error('InvalidCredentials');
       }
-      return sanitizeUser(user);
+      const signedIn = sanitizeUser(user);
+      signedIn[TOKEN_PASSWORD_FINGERPRINT] = passwordFingerprint(user.password);
+      return signedIn;
     } catch (err) {
       if (err && err.message === 'InvalidCredentials') throw err;
       // A hashing/serialisation fault is an infrastructure problem, not a
@@ -758,6 +760,22 @@ const USER_REFRESH_INTERVAL_MS = ${USER_REFRESH_INTERVAL_MS};
 // internal timestamp on every binding that enumerates the user object.
 const TOKEN_REFRESH_STAMP = '__userRefreshedAt';
 
+// A short fingerprint of the account's stored password hash, carried in the
+// token from sign-in (or from the first refresh of a token that has none). A
+// password change, a reset included, changes it, and the refresh then ends the
+// session: every session opened before the change is signed out at its next
+// refresh. Keyed with NEXTAUTH_SECRET; never the hash itself, and like the
+// stamp above never copied onto \`session.user\`.
+const TOKEN_PASSWORD_FINGERPRINT = '__passwordFingerprint';
+
+function passwordFingerprint(storedHash) {
+  return require('crypto')
+    .createHmac('sha256', String(process.env.NEXTAUTH_SECRET || ''))
+    .update('teleport-password-fingerprint:v1|' + (storedHash ? String(storedHash) : ''))
+    .digest('base64')
+    .slice(0, 16);
+}
+
 const authOptions = {
   providers: providers,
   pages: {
@@ -803,6 +821,7 @@ const authOptions = {
       if (params.trigger !== 'update' && isFresh) {
         return token;
       }
+      let passwordChanged = false;
       try {
         if (token && token.email && typeof findUserByEmail === 'function') {
           const fresh = await findUserByEmail(String(token.email));
@@ -813,10 +832,23 @@ const authOptions = {
               token[fk[i]] = safe[fk[i]];
             }
           }
+          if (fresh) {
+            const currentFingerprint = passwordFingerprint(fresh.password);
+            if (typeof token[TOKEN_PASSWORD_FINGERPRINT] !== 'string') {
+              token[TOKEN_PASSWORD_FINGERPRINT] = currentFingerprint;
+            } else if (token[TOKEN_PASSWORD_FINGERPRINT] !== currentFingerprint) {
+              passwordChanged = true;
+            }
+          }
         }
       } catch (e) {
         // Keep the existing token on any DB hiccup — never sign the user out.
       }
+      if (passwordChanged) {
+        // NextAuth answers a jwt callback that throws by clearing the session
+        // cookie and returning no session: the visitor is signed out.
+        throw new Error('The account password changed since this session signed in');
+      }
       // Stamped even when the read threw, so an unreachable database costs one
       // attempt per interval instead of one per request.
       if (token) {
@@ -830,6 +862,7 @@ const authOptions = {
       if (token && session.user) {
         const skip = { iat: 1, exp: 1, jti: 1, sub: 1 };
         skip[TOKEN_REFRESH_STAMP] = 1;
+        skip[TOKEN_PASSWORD_FINGERPRINT] = 1;
         const keys = Object.keys(token);
         for (let i = 0; i < keys.length; i++) {
           if (!skip[keys[i]]) {

package/src/await-result.ts

@@ -15,6 +15,15 @@ export const DATA_NODE_TYPES: ReadonlyArray<string> = [
   'data-delete-item',
 ]
 
+/**
+ * The other steps the author may choose not to wait for: server work whose
+ * result nothing downstream needs (a cash order's invoice, rendered, stored
+ * and mailed while the buyer is already on the confirmation page). The
+ * editor offers the choice on the same steps (`supportsAwaitResultOption` in
+ * teleport-gui's `@teleport/workflow-schema`) — a PAIRED EDIT.
+ */
+export const NOT_AWAITABLE_SERVER_NODE_TYPES: ReadonlyArray<string> = ['ecommerce-generate-invoice']
+
 /**
  * Config key carrying the author's await choice. Only `false` opts out —
  * `undefined` (never configured) and `true` both mean "await", so every
@@ -22,14 +31,17 @@ export const DATA_NODE_TYPES: ReadonlyArray<string> = [
  */
 export const AWAIT_RESULT_CONFIG_KEY = 'awaitResult'
 
-const DATA_NODE_TYPE_SET = new Set<string>(DATA_NODE_TYPES)
+const AWAIT_OPTIONAL_NODE_TYPE_SET = new Set<string>([
+  ...DATA_NODE_TYPES,
+  ...NOT_AWAITABLE_SERVER_NODE_TYPES,
+])
 
 /**
- * True when this node runs fire-and-forget: the runtime starts the query,
+ * True when this node runs fire-and-forget: the runtime starts the step,
  * publishes `null` under the node's id and moves straight on to the next node.
  */
 export const isFireAndForgetNode = (node: UIDLWorkflowNode | undefined | null): boolean => {
-  if (!node || !DATA_NODE_TYPE_SET.has(node.type)) {
+  if (!node || !AWAIT_OPTIONAL_NODE_TYPE_SET.has(node.type)) {
     return false
   }
   const config = node.config as Record<string, unknown> | undefined
@@ -41,10 +53,10 @@ export const isFireAndForgetNode = (node: UIDLWorkflowNode | undefined | null):
  * response — i.e. every node it holds is fire-and-forget, so nothing
  * downstream can read anything the segment produces.
  *
- * The API route itself still awaits each query before replying (a serverless
- * function may be frozen the moment it responds, which would drop an in-flight
- * write); what this flag removes is the CLIENT's wait on that round trip, which
- * is where the latency the visitor feels actually comes from.
+ * The API route itself still lands each step (a serverless function may be
+ * frozen the moment it responds, which would drop an in-flight write: on
+ * Vercel the step finishes after the reply, elsewhere the reply waits); what
+ * this flag removes is the CLIENT's wait on that round trip.
  */
 export const isFireAndForgetSegment = (segment: WorkflowSegment): boolean =>
   segment.env === 'server' &&

package/src/credential-results.ts

@@ -0,0 +1,71 @@
+import { nodeRegistry } from './nodes'
+
+/**
+ * The node types whose result is a credential, read off the node registry
+ * (`resultIsCredential`): today the password-hashing node. Its result stays on
+ * the server. A server segment replies it to the browser only sealed —
+ * encrypted with a key derived from the app secret, signed like every other
+ * result — and a later server segment opens it again, so a workflow that
+ * hashes in one segment and writes in another still works (see the server
+ * runtime: `sealResult`, `openSealedResults`).
+ */
+export const CREDENTIAL_RESULT_NODE_TYPES: string[] = Object.keys(nodeRegistry).filter(
+  (nodeType) => nodeRegistry[nodeType].resultIsCredential === true
+)
+
+/**
+ * `credentialResultNodeIds(segmentConfig)`: the nodes of a segment whose
+ * result is a credential — every node of a credential type, and every map
+ * loop whose results are such a node's results (the loop's last body step, as
+ * the route runs it; a loop of loops follows its inner loop).
+ */
+export const generateCredentialResultsCode = (): string => `
+var __CREDENTIAL_RESULT_NODE_TYPES = ${JSON.stringify(CREDENTIAL_RESULT_NODE_TYPES)};
+
+function lastLoopBodyNodeId(loopId, sortedNodes, edges) {
+  var start = edges.find(function(e) { return e.source === loopId && e.sourceHandle === 'loop'; });
+  if (!start) return null;
+  var body = {};
+  var queue = [start.target];
+  while (queue.length > 0) {
+    var current = queue.shift();
+    if (body[current] || current === loopId) continue;
+    body[current] = true;
+    edges.forEach(function(e) {
+      if (e.source === current && (e.sourceHandle === 'loop-body-out' || !e.sourceHandle) && e.target !== loopId) {
+        queue.push(e.target);
+      }
+    });
+  }
+  var last = null;
+  sortedNodes.forEach(function(n) { if (body[n.id]) last = n.id; });
+  return last;
+}
+
+function credentialResultNodeIds(segmentConfig) {
+  var nodes = (segmentConfig && segmentConfig.nodes) || [];
+  var edges = (segmentConfig && segmentConfig.edges) || [];
+  var ids = {};
+  nodes.forEach(function(n) {
+    if (__CREDENTIAL_RESULT_NODE_TYPES.indexOf(n.type) !== -1) ids[n.id] = true;
+  });
+  var sortedNodes = nodes.slice().sort(function(a, b) { return (a.stepNumber || 0) - (b.stepNumber || 0); });
+  var mapLoops = nodes.filter(function(n) {
+    var loopType = n.config && n.config.loopType;
+    return n.type === 'general-loop' && !!loopType && loopType !== 'forEach';
+  });
+  var grew = true;
+  while (grew) {
+    grew = false;
+    mapLoops.forEach(function(loop) {
+      if (ids[loop.id]) return;
+      var last = lastLoopBodyNodeId(loop.id, sortedNodes, edges);
+      if (last && ids[last]) {
+        ids[loop.id] = true;
+        grew = true;
+      }
+    });
+  }
+  return ids;
+}
+`

package/src/data-api-route-generator.ts

@@ -1219,7 +1219,15 @@ module.exports = async function handler(req, res) {
   }
 
   var operation = params[params.length - 1];
-  var body = typeof req.body === 'string' ? JSON.parse(req.body) : req.body;
+  var body;
+  try {
+    body = typeof req.body === 'string' ? JSON.parse(req.body) : req.body;
+  } catch (e) {
+    body = null;
+  }
+  if (!body || typeof body !== 'object' || Array.isArray(body)) {
+    return res.status(400).json({ error: 'Invalid request body. Expected a JSON object.' });
+  }
   var client = getClient();
 
   try {

package/src/executor-generator.ts

@@ -5,6 +5,7 @@ import {
 } from './email-locale'
 import { generateSignedInDestinationCode } from './auth-return/signed-in-destination-code'
 import { generateCredentialColumnsCode } from './credential-columns-code'
+import { generateCredentialResultsCode } from './credential-results'
 
 export interface SharedRuntimeUtilsOptions {
   /**
@@ -654,9 +655,15 @@ function normalizeComparisonOperator(op) {
     .toLowerCase();
 }
 
+// The editor's templates write a comparison's sides as leftOperand /
+// rightOperand; everything else writes leftValue / rightValue.
+function comparisonSide(config, valueKey, operandKey) {
+  return config[valueKey] !== undefined ? config[valueKey] : config[operandKey];
+}
+
 function evaluateSingleComparison(config, context) {
-  var rawLeft = resolveValue(config.leftValue, context);
-  var rawRight = resolveValue(config.rightValue, context);
+  var rawLeft = resolveValue(comparisonSide(config, 'leftValue', 'leftOperand'), context);
+  var rawRight = resolveValue(comparisonSide(config, 'rightValue', 'rightOperand'), context);
   const op = normalizeComparisonOperator(config.operator || 'equals');
   var isUnary = op === 'is-empty' || op === 'is-not-empty' || op === 'is-truthy' || op === 'is-falsy' ||
     op === 'is-null' || op === 'is-not-null' || op === 'is-true' || op === 'is-false';
@@ -666,7 +673,7 @@ function evaluateSingleComparison(config, context) {
   switch (op) {
     case '===': return left === right;
     case '!==': return left !== right;
-    case '==': case 'equals': return left == right;
+    case '=': case '==': case 'equals': return left == right;
     case '!=': case 'not-equals': return left != right;
     case '>': case 'greater-than': return left > right;
     case '<': case 'less-than': return left < right;
@@ -808,10 +815,16 @@ var __DATA_NODE_TYPES = {
   'data-delete-item': true
 };
 
-// A data node the author opted out of awaiting. Only an explicit \`false\` opts
-// out, so a config written before the option existed keeps awaiting.
+// Mirrors NOT_AWAITABLE_SERVER_NODE_TYPES in await-result.ts — PAIRED EDIT.
+var __NOT_AWAITABLE_SERVER_NODE_TYPES = {
+  'ecommerce-generate-invoice': true
+};
+
+// A data node (or a step listed above) the author opted out of awaiting. Only
+// an explicit \`false\` opts out, so a config written before the option existed
+// keeps awaiting.
 function isFireAndForgetNode(node) {
-  if (!node || !__DATA_NODE_TYPES[node.type]) return false;
+  if (!node || !(__DATA_NODE_TYPES[node.type] || __NOT_AWAITABLE_SERVER_NODE_TYPES[node.type])) return false;
   return !!node.config && node.config.awaitResult === false;
 }
 
@@ -1418,7 +1431,12 @@ var SEGMENT_REPLY_PRIVATE_KEYS = {
 //
 // A data node's rows are replied without the auth users table's credentials
 // (see credential-columns-code.ts).
+//
+// A node whose result is a credential (a password hash) is left out here too,
+// whatever its config says: the server runtime replies it sealed, readable by
+// a later server segment only (see credential-results.ts).
 ${generateCredentialColumnsCode()}
+${generateCredentialResultsCode()}
 // The nodes whose result the client branches on: never kept on the server.
 function isBranchingNodeType(type) {
   return type === 'general-if-statement' || type === 'general-switch';
@@ -1427,7 +1445,7 @@ function isBranchingNodeType(type) {
 function segmentReply(segmentConfig, context, snapshot) {
   var reply = {};
   var own = {};
-  var kept = {};
+  var kept = credentialResultNodeIds(segmentConfig);
   var nodes = (segmentConfig && segmentConfig.nodes) || [];
   for (var ni = 0; ni < nodes.length; ni++) {
     own[nodes[ni].id] = nodes[ni];
@@ -1514,6 +1532,7 @@ module.exports = {
   snapshotIncomingContext,
   segmentReply,
   withoutCredentialColumns,
+  credentialResultNodeIds,
   evaluateCondition,
   evaluateSingleComparison,
   normalizeComparisonOperator,